The Off Switch

Week in 60 Seconds

• Binance: its preliminary investigation traces the theft to a malicious interview assignment and says an on-chain delegation kept working after withdrawals were suspended. It puts the assets involved at about $6.34B; the FBI attributed the theft to North Korea.
• Recovery: Binance reported about 98 per cent replenished in its 4 November update, completed a reserve proof for ten tokens and reopened withdrawals in phases.
• Arbitrum: the Security Council moved about 8,426 ETH and 74.56 million ARB without the holder's signature. Binance has asked ArbitrumDAO to release them.
• Polygon: block producers stopped about 70.5M POL moving. A proposed hard fork would reassign it; it has not been approved.
• Aave: in a separate incident, guardians froze the tBTC reserve on Aave's main Ethereum market after Threshold paused minting and redemption.
• Chainalysis: the tracing firm said password hashes and live tokens were exposed for all users, then began restoring KYT under new conditions.
• Mercado Bitcoin: estimates of the theft ranged from about $46.3M to about $49M; the exchange said it had blocked more than $15M.
• Regulators: Nigeria's transfer information rules took effect, South Korea told firms to switch off vulnerable services, Canada proposed widening its Stablecoin Act, and SEC staff described Canton Coin as a digital commodity.
• Freeze Ledger: 28 freezes worth $76.48M, against 33 worth $2.42B in the previous edition. Four Ethereum freezes early on Friday made up most of the week's value.

What the Suspension Could Not Reach

Binance's preliminary investigation, published on 3 November, traces the theft to a malicious interview assignment that one of its engineers installed. From there, Binance says, the attackers reached other engineers' devices and obtained the credentials used to deploy the containers that run its internal services. Binance says the attackers used its signing service to give code they controlled permission to act on behalf of a hot wallet, through what is known as an EIP-7702 delegation. Our previous report set out how that delegation was used.

The delegation explains why the suspension was not enough. Stopping customer withdrawals halted Binance's own outbound process. The delegation sat on Ethereum, outside that process, and remained valid until Binance revoked it on-chain. Binance says the final unauthorised transfer, of 2,961.9 ETH, was confirmed at 23:56 UTC on 29 October. At 00:10 UTC on 30 October, Binance cleared the delegation from its Binance 14 wallet.

On 31 October the FBI attributed the theft of more than $6B to North Korea, naming the activity TraderTraitor. Binance's report puts the value of the assets involved at about $6.34B.

Recovery came in stages, and each stage needs its own evidence.

• Replacement: Binance reported about 95 per cent covered in its 1 November update and about 98 per cent replenished in its 4 November update. Those figures describe Binance buying replacement assets, not stolen funds coming back.
• Proof: a reserve snapshot taken at 00:00 UTC on 31 October covered ten tokens, and Binance said on 2 November that its proof was complete. A second snapshot, at 00:00 UTC on 4 November, covered 44 tokens; its proof was still being generated when Binance announced it. A proof covers the balances in those tokens at that moment, not every later withdrawal.
• Access: Binance's 3 November update confirmed that withdrawals had reopened for selected networks and assets on 1 November. Further rounds were scheduled from 04:00 UTC on 3 November and, in a later update, on 5 November.

Restoring backing and restoring access are different operations. Binance has done both in parts, and neither shows that stolen funds have been returned.

Switching off withdrawals closed one route out. It did not cancel permissions already granted.

Three Kinds of Emergency Power

Arbitrum's Security Council acted without the holder's signature. At 00:08 UTC on 30 October, the council moved about 8,426 ETH and 74.56 million ARB from an address linked to the Binance theft into a holding address, according to its notice. A technical walkthrough, published on 2 November, describes how: the council's multisig wallet, which needs nine of its twelve members to sign, temporarily changed the contract that carries messages from Ethereum to Arbitrum, submitted messages in the address's name, then restored the original code. Releasing the funds requires an ArbitrumDAO vote. On 5 November, Binance asked the DAO to return them. The proposal was still at the forum stage, and Binance said the governance process could take about seven weeks or longer.

Blockchain analytics firm Elliptic reported an apparent transfer of 44M OP from the attacker's address by Optimism. We have not found a statement from Optimism confirming the action or identifying who authorised it.

Polygon's block producers stopped the POL moving. A proposal would reassign it. The addresses holding the POL are on a block list that Polygon's block producers enforce. A proposal published on 4 November says the list has stopped the funds moving and "no bypass has been found". It identifies two limits. The list checks only "outer senders and EIP-7702 authorities", not every part of a transaction. And blocking transfers gives producers no way to return the funds. The proposal addresses the second limit with a coordinated hard fork: it would debit one Binance-linked address holding about 46.63M POL and four Polymarket-linked addresses holding about 23.86M POL, and credit the same amounts to designated recovery wallets. It still needs approval, a client release and an activation block.

In a separate incident, Aave's guardians stopped new borrowing against tBTC. Threshold, which issues tBTC, paused minting and redemption on 31 October. At 10:01 UTC that day, LlamaRisk reports, Aave's guardians froze the tBTC reserve on its main Ethereum market, a step that "stops tBTC from adding borrowing power to any position". Users could no longer deposit more tBTC or increase their borrowing power with it. Repayments, withdrawals, liquidations and borrowing against other collateral continued.

Arbitrum's council could move the funds. Only a DAO vote could release them.

Access Through Someone Else

Chainalysis. The company whose tools help investigators trace stolen funds disclosed an intrusion on 30 October. In an update at 04:00 UTC on 5 November, it said password hashes and live tokens had been exposed for all users. It took the interface and API of KYT, its transaction-monitoring service, offline and said it was notifying affected KYT customers. Chainalysis said it had found no evidence that anyone accessed investigation data or altered attribution data.

At 08:30 UTC on 6 November, Chainalysis said phased restoration of KYT and Address Screening had begun, under new conditions. Customers were asked to submit trusted IP addresses. Once granted access, users had to reset their passwords and, where applicable, rotate API keys before registering transactions. Work to restore Reactor and Data Solutions continued.

Crédit Mutuel Arkéa. The French bank said in a clarification on 4 November that the attackers entered through "la plateforme d'un de nos prestataires", the platform of one of its service providers, and moved money from the bank's own account. It said conversion into crypto was possible, not established. Asked about a reported €118M, it confirmed only the order of magnitude, and said some funds had been blocked.

Binance and SignalPlus. Binance's own theft began with a malicious interview assignment on an engineer's device, as set out above. On 5 November, Decrypt reported that Binance had removed all API keys linked to the trading platform SignalPlus as an "immediate precautionary measure". The report does not establish a loss or any link to the October theft.

BitMart. In a notice timestamped 04:45 UTC on 6 November, headed "Please Do Not Deposit", BitMart warned that deposit addresses could remain visible, and that deposits sent after the suspension might not be credited automatically. The notice says deposits were suspended progressively from 26 July and trading ceased on 26 August. A visible address is not proof that a service is still accepting funds.

Mercado Bitcoin's Three Numbers

Brazil's Mercado Bitcoin said only its hot wallets were affected, and temporarily took its platform offline. Three accounts of the theft circulated, and they measure different things.

• Total stolen: Chainalysis estimated about $49M across 17 blockchains. The Block, citing Arkham data, put it at about $46.3M.
• Frozen by issuers: Chainalysis said it identified the funds, contacted parties able to intervene, including Tether, and helped issuers freeze nearly $10M. The Block reported that Tether's chief executive, Paolo Ardoino, said Tether had frozen more than 4.5M USDT.
• Blocked, by the exchange's count: in an update labelled 21:00 on 2 November, Mercado Bitcoin said it had blocked about $11M with partners' help, with about $38M still unblocked. By its update labelled 18:40 on 4 November, its cumulative figure was more than $15M.

These figures overlap and should not be added together.

The same 4 November update said customers would get view-only web access from 9 November, to see balances and statements. Transfers, withdrawals and trading were to follow as each service passed its security checks. The 9 November date is not a withdrawal reopening.

Seeing a balance and being able to withdraw it are different services.

Regulation and Control

Nigeria made refusal a duty. The Central Bank of Nigeria's regulations for non-security virtual assets, which give 5 November as their effective date, set out what information must accompany a covered crypto transfer. Sections 26.14 and 26.15 require providers to collect identifying information about the sender and recipient for every covered transfer. More detailed information is required for transfers worth USD or EUR 1,000 or more, including the equivalent value in naira. At or above the threshold, the provider must take reasonable steps to verify that its customer owns or controls the unhosted wallet. An originating provider that cannot meet those duties must refuse the transfer. The time the regulations were first published has not been established.

South Korea told firms to switch off vulnerable services. The Financial Services Commission's 5 November release covers about 580 financial-sector firms, including crypto firms. When a firm finds a significant vulnerability that could cause financial harm to customers or the firm, or expose personal information, it must immediately suspend the affected service and block external access. Where an important service cannot be repaired at once, the release allows a narrowly conditioned restart, with alternative controls and the chief executive's approval. Reporting guidelines due this month and a bill planned for the first quarter of 2027 are still plans. An English listing of the release is available.

SEC staff tied their view of Canton Coin to who holds control. On 3 November the Division of Corporation Finance described Canton Coin as a "digital commodity", relying on representations from the applicant, including that no central party controls the network. The position covers the programmatic minting described in counsel's request, made on behalf of Digital Asset Holdings, and staff said different facts could lead to a different conclusion. Separately, staff FAQ entries added on 2 November focus on unilateral authority over participation, including access and changes to voting or upgrades.

Canada proposed widening its stablecoin rules. Budget 2026, released on 5 November, proposes requiring federally regulated financial institutions to issue stablecoins through non-financial institution subsidiaries governed by the Stablecoin Act. It also proposes extending the Act to foreign financial institutions that are not prudentially regulated in Canada. Both are budget proposals, not enacted changes.

The OCC gave examiners a resource, not banks a rule. Bulletin 2026-54, published on 4 November, sets out a framework for examiners assessing banks' use of AI. The bulletin says it "does not establish supervisory expectations for banks".

Korea's rule puts the off switch in the firm's hands, and makes using it mandatory.

Hong Kong Builds the Plumbing

Not every development this week was about stopping funds. Hong Kong's legislature passed a bill on 4 November that brings in the international crypto asset reporting framework. Relevant providers are to collect information under it in 2027, with exchanges of that information with partner jurisdictions intended to begin in 2028. The government gives a separate timetable for the amended Common Reporting Standard.

Two days earlier, the Hong Kong Monetary Authority said its Project Ensemble pilot now supports round-the-clock interbank settlement of tokenised deposit transactions in tokenised central bank money. Settlement stays in central bank money, and inside a pilot the HKMA runs.

Security Intelligence

b14g: blockchain analytics firm Bitquery reports that at 09:29 UTC on 31 October an attacker withdrew about 97.05M CORE, worth about $1.47M, from 91 staking orders at b14g, a Bitcoin staking app on the Core chain. By Bitquery's reconstruction, the contract was paused 66 minutes after the drain. The findings are Bitquery's; we have not reconstructed the transactions ourselves.

Base: on 5 November Base said it had recomputed a state root, confirmed it was correct, patched its block builders and issued a fix for node operators. Release v1.5.3 "prevents a state root mismatch" and recommends that operators upgrade. The Denim upgrade activated at 18:14 UTC that day, and Base said it was investigating periodic delays in transaction inclusion and more empty blocks than expected. Base has not reported an exploit or loss.

OpenSSH: Portable 10.6p2, released on 5 November, works around a password-authentication bypass on affected Linux systems that use musl libc with PAM disabled. The maintainers place the root cause outside sshd but say it is exploitable through it. No affected validator, signer or exchange has been identified.

OpenAI: in a 5 November announcement, OpenAI said its systems had found 81 previously unknown high-severity vulnerabilities in Firefox and produced 948 Linux privilege-escalation exploits, drawing on Linux research published the day before. OpenAI says Mozilla classified the 81 Firefox findings as high severity. By the end of the Linux scan and analysis, OpenAI says 61 privilege-escalation flaws had upstream fixes and another 43 had patches in staging.

Weekly Freeze Ledger

28 freezes • $76.48M frozen

The ledger covers Saturday 31 October through Friday 6 November 2026, counting issuer-enforced freezes of $200K or more across Ethereum, Tron and XRPL. Each row covers the 24 hours ending at 21:00 UTC on that date.

The ledger recorded 28 freezes worth $76.48M, compared with 33 worth $2.42B in the previous edition, when seven late-Thursday freezes accounted for about $2.38B. Friday's six freezes, worth $48.91M, made up about 64 per cent of this week's value. Four of them came at 02:44 UTC on Friday, all USDT on Ethereum: two of $13.91M and two of $9.94M, together about $47.70M. By Thursday's close, the ledger had recorded 22 freezes worth $27.57M. Tuesday had the week's highest count, with seven freezes worth $10.43M. Tether accounted for 27 of the week's freezes and Circle for one; 19 were on Tron, nine on Ethereum and none on XRPL. No qualifying freezes were logged for Sunday. The digests do not establish what any of these freezes relate to.

Daily amounts are rounded as published in the digests; the weekly total sums those rounded figures.

These figures count freeze actions. They do not show how much remains frozen or how much was later recovered.

Source: The Cipher Index Stablecoin Freeze Tracker

What to Watch

• Binance: Confirmation of which routes reopened in the latest withdrawal round, completion of the proof for the 44-token snapshot, and the final investigation report.
• ArbitrumDAO: A Snapshot temperature check on Binance's release request, the first vote in a process Binance says could take about seven weeks or longer.
• Polygon: A governance decision on the recovery fork, followed by a client release and an activation block if it is approved.
• Optimism: A first-party notice explaining the reported movement of 44M OP, and who authorised it.
• Chainalysis: Restoration of Reactor and Data Solutions, and confirmation that previously exposed tokens have been invalidated.
• Mercado Bitcoin: View-only access from 9 November, then a timetable for transfers, withdrawals and trading.
• Nigeria: How providers apply the ownership and control checks for self-hosted wallets, and how often transfers are refused.
• South Korea: The reporting guidelines due this month and the security bill planned for early 2027.
• Canada: Legislation to carry out the budget's stablecoin proposals, and how it treats foreign issuers.

Corrections and Continuing Investigations

Binance replenishment dates: Binance's updates reported about 95 per cent covered on 1 and 2 November and about 98 per cent replenished on 4 November. Its 3 November investigation report puts 98 per cent at 31 October. We date each figure by the update that published it, not by when Binance says the level was reached.

Arbitrum figures: the Security Council's notice gives 8,425 ETH; the Ethereum Magicians walkthrough puts the transfer at 8,425.998 ETH, and Binance's release request at 8,425.997 ETH. This edition rounds to about 8,426 ETH.

Optimism: the reported transfer of 44M OP still rests on Elliptic's account. We are continuing to look for a statement from Optimism.

Previous edition's freezes: CipherIndex has still not established that every one of the seven late-Thursday freezes recorded in the previous edition's Friday row relates to Binance.

Further Reading

• Signed by the Right Key, the previous Nexus Report
• Binance's preliminary investigation
• How Arbitrum's freezes send transactions from an address without its key, Ethereum Magicians
• Polygon's recovery proposal
• Chainalysis on Mercado Bitcoin
• Elliptic on the Binance theft

Published by the Zero Trust Network. Research supported by CipherBot and CipherIndex.