News linked to both this project and an event.
According to Decrypt, Binance co-CEO He Yi stated that Ripple has frozen approximately $200 million in RLUSD; suspected hackers are converting freezeable stablecoins into ETH via Uniswap and Aave, while Kamino has suspended SOL/BTC market lending.
Odaily Report: According to monitoring by Bitcoin News, on-chain analysis shows that after attackers exploited a malicious EIP-7702 authorization to take control of a Binance wallet, the wallet's key remained usable. Binance reportedly used the signing key to execute transactions through the compromised wallet, recovering $823 million in USDC. The attackers reportedly obtained 50 valid authorizations signed by the wallet's key, one of which successfully activated malicious code and moved 65 types of assets. Even after Tether and Circle blacklisted the attackers' addresses, the asset transfers reportedly continued; a $200 million USDT deposit was moved out just 100 seconds after it arrived.
Odaily Report: According to monitoring by Bitcoin News, Binance is reportedly still operating its automatic deposit sweeping function, routing newly deposited user funds into a compromised hot wallet. Attackers are reportedly continuing to move funds out of the wallet as new deposits arrive, putting user deposits at potential risk. Related advisories recommend that users avoid depositing funds until the incident is resolved.
according to Bitcoin News monitoring, attackers allegedly used EIP-7702 delegation to point the Binance Wallet to malicious code, thereby transferring funds. How the attacker obtained authorization is still under investigation, with two possibilities currently: the private key was stolen, or the attacker obtained a malicious authorization signature through a compromised signing process. Neither scenario has been confirmed. If the private key was not stolen, this attack may expose a significant vulnerability in the exchange's transaction authorization mechanism, rather than a private key security issue.
Odaily reports: According to monitoring by Bitcoin News, the attacker allegedly exploited users' still-active sessions to directly sell users' positions and withdraw funds through the Polymarket system. The attack reportedly originated from the compromise of a DebugBear website performance monitoring script, which was replaced with malicious code that users' browsers treated as trusted code. Polymarket resumed trading after about an hour and said it would compensate affected users. The incident has been referred to UK law enforcement.
According to monitoring by Bitcoin News, a Bitcoin address labeled as a hot wallet in Binance's own transparency disclosures reportedly had approximately 17,500 BTC transferred out. The transfer occurred amid reports of a major security incident involving a Binance-linked Ethereum wallet. It is currently unclear whether this Bitcoin transfer was unauthorized or a movement made for security reasons.
Odaily reports: According to Bitcoin News monitoring, on-chain analysis shows that attackers appear to have exploited the Ethereum EIP-7702 mechanism to obtain signature authorization, installing malicious code without directly accessing the private keys of Binance-associated wallets. The attackers then called a function named "sweep" to transfer ETH and dozens of tokens into wallets under their control; the same delegation permission was reportedly also used to transfer $780 million USDC out of another Binance hot wallet. The attackers' transaction relayer received funding through Tornado Cash, and nearly 195,460 ETH was subsequently transferred to a newly created wallet. How the attackers obtained the relevant authorization remains unclear. Binance stated that user funds are safe and that an investigation is currently underway.
According to on-chain statistics cited by Decrypt, at least $5.57 billion in assets have been transferred from wallets associated with Binance, involving Ethereum, Bitcoin, and TRON; if confirmed as a hack, it would become the largest cryptocurrency heist in history. Binance stated that it is still investigating.
Odaily reports: On-chain monitoring shows that the total assets flowing out of Binance-labeled wallets amounted to approximately $5.643 billion. The breakdown includes: $3.528 billion on Ethereum, $1.449 billion on Bitcoin, $628 million on Tron, and $38 million combined across Arbitrum, Optimism, and Base networks. The tally excludes change outputs and avoids double-counting subsequent transfers and swaps. Tether and USDC issuer Circle have frozen at least $2.316 billion in stablecoins, including approximately $1.493 billion in USDT and $823 million in USDC.
Odaily reports: Research from quantum computing company Alice & Bob estimates that a fault-tolerant quantum computer with approximately 29,588 physical qubits could solve the 256-bit elliptic curve cryptography problem used by Bitcoin in about 61.8 minutes. This problem underpins the digital signatures used to authorize Bitcoin transactions. The findings are theoretical resource estimates and do not mean that existing quantum computers already have the capability to crack it.The research also estimates that 22,593 physical qubits could crack RSA-2048 encryption in about 3.14 days. The calculations use cat qubits technology designed to reduce quantum errors, combined with more efficient error-correcting codes and improvements to Shor's algorithm.If a sufficiently powerful quantum computer could derive private keys from publicly exposed public keys, the relevant Bitcoin could face risks of unauthorized signatures and asset theft. The estimated cracking time is still longer than Bitcoin's average block interval of about 10 minutes; approximately 6.9 million Bitcoin may be at risk because their corresponding public keys have already been exposed. (Bitcoin.com News)
Trader Killa posted that despite the market facing multiple bearish factors—including the Fed's hawkish decision, rising oil prices, hotter-than-expected CPI data, surging global bond yields, a stronger dollar, the Ledger wallet hack, and market concerns over Strategy (MSTR)'s delisting risk and its pivot to AI—Bitcoin has still maintained range-bound trading. Given the current macroeconomic pressures and negative news, Bitcoin should have fallen below $70,000, but its resilience is noteworthy. The market may be gradually forming a significant interim bottom, and its ability to hold the price range amid bearish shocks indicates that it is absorbing negative news, which is also a typical characteristic of a bull market.
Bitcoin News posted on X that FoundationHQ stated attackers sent over 23,000 phishing emails after exploiting leaked API keys to access customer data, including addresses and phone numbers.
Bitcoin News posted on X that Bitcoin Core has discovered 3 new vulnerabilities, one of which could allow an attacker to remotely crash nodes. This vulnerability can affect nodes running Windows, macOS, or BSD by exhausting memory, while Linux nodes are not affected by this attack; another vulnerability can gradually exhaust node memory, and a third may corrupt blockchain undo data.
Michael Saylor posted that the idea that artificial intelligence (AI) can attack crypto applications, and therefore there is no reason to hold Bitcoin, is like arguing that because AI can attack communication apps, there is no reason to speak English. Saylor used this to rebut the view that directly links AI's ability to attack applications with Bitcoin's value as a store of value.
the cloud desktop service of Japanese internet giant GMO Group suffered unauthorized access, with up to 26,739 servers potentially affected. In the ransom letter, hackers demanded payment in BTC and ETH, initially asking for $50 million, then reducing the demand to $1 million, while threatening to continue conducting anomalous transactions in compromised accounts and publicly disclosing user data. GMO Group representative Masatoshi Kumagai stated that the company refused to compromise and did not pay any funds; its crypto exchange GMO Coin confirmed that no abnormal operations were found in customer accounts. The hackers subsequently published some data and threatened to update it daily. The website domain hosting the leaked information was shut down in the early morning of October 28.
Odaily reports: Bitcoin hardware wallet manufacturer Keystone has stated that attackers obtained the permanent factory keys used to verify device authenticity. The company will destroy 18,835 unsold devices in its inventory and suspend all unshipped orders on its official website. The incident was discovered on October 20. Devices delivered before October 20 are not affected, and mnemonic phrases and private keys were not involved.The incident also affected 25,964 buyer records from Keystone's Shopify online store, involving names, contact information, shipping addresses, and order information between 2024 and 2026. A total of 51,083 records were previously involved, and 25,119 pieces of personal information have been deleted; customers who purchased through channels such as Amazon are not affected.Keystone stated that some records were not deleted within the originally planned 180-day period. The company has shortened the data retention period to 90 days and on October 24 requested that Shopify delete overdue data, which is expected to be completed on November 3. Official website sales will switch to pre-orders until devices using the new keys are produced; the company has submitted reports to relevant authorities in the EU, the UK, and other regions. (Decrypt)
Odaily reports: According to Bitcoin News monitoring, Electrum released version 4.8.3 on October 24, 2026, fixing a security vulnerability that has already been exploited in real attacks. Malicious servers could display fabricated transactions to users and, when users attempt to speed up transactions via Replace-by-Fee (RBF), trick them into signing transactions that pay the attacker's address; the attacker does not need to obtain the user's private keys. Electrum stated it has received two related reports, in which one user lost bitcoin after increasing the fee, and recommends that users update to version 4.8.3.
Odaily reports: Cyber extortion group WhiteArmor claims to have obtained the complete user database of crypto casino Gamdom, involving approximately 15.42 million accounts and 146 columns of data, and is demanding a payment of $15 million in Bitcoin. The group claims to have breached the system through an internal machine account with administrator privileges, and has published approximately 100 account records as evidence.Previously, Gamdom suffered a hot wallet attack on October 13, with the platform officially confirming losses exceeding $3 million, while on-chain researchers estimated losses at approximately $4.2 million. Currently, there is no evidence linking the two incidents, and the scale of the data breach claimed by WhiteArmor has not yet been independently verified. (Dark Web Informer)
Previously, Gamdom suffered a hot wallet attack on October 13. Founder Felix Römer acknowledged losses exceeding $3 million, while blockchain researcher vxdb estimated the stolen amount across multiple networks at approximately $4.2 million.
According to SlowMist, its security personnel discovered during routine threat intelligence monitoring that the Udesk customer service system-related script udeskApi.2026-10-16.cached.js has been implanted with a malicious loader. The loader hides the address using hexadecimal encoding and asynchronously loads the remote script deeps.js (originating from udeskqlobal[.]com; note that the domain starts with the letter 'q'). This script reads page-accessible Cookie, localStorage, and sessionStorage data, intercepts form submissions and login/authentication requests, and sends the data to udeskqlobal[.]com/c.php, enabling attackers to hijack sessions or take over accounts. This data collection behavior is not restricted by target site policies, and unmatched pages may also be affected. According to SlowMist's analysis, the script also targets three categories of sites: mgbx[.]com, bikingex[.], and bitxex[.]io. It scans deposit pages every 200 milliseconds and replaces recognized deposit addresses with preset BTC, EVM, TRON, Solana, LTC, and DOGE addresses. Additionally, by wrapping the Clipboard API, replacing copy buttons, and intercepting copy events, the script ensures users only see and copy tampered addresses. If users transfer funds to these addresses, the assets will flow into the attacker's wallet.