News linked to both this project and an event.
Cantor highlighted Coinbase, Robinhood, and Strategy, expecting share prices to rebound once the panic subsides; TD Cowen believes this incident exposes Binance's own security vulnerabilities, while Compass Point stated that its liquidity is sufficient to cover the losses.
21Shares has released an analysis report on the Binance hack, stating that on October 29, Binance suffered an attack of approximately $6.3 billion, of which about $3 billion in stolen assets have now been frozen, and Binance has committed to bearing all losses. Within 24 hours after the incident, Bitcoin fell slightly more than 2%, significantly lower than the roughly 26% decline Bitcoin experienced after the FTX incident in November 2022. 221Shares emphasized that this incident was a security breach affecting Binance as a single company, and that the Bitcoin network itself was not attacked. Binance stated that it will cover all losses through the SAFU fund and corporate funds. Calculated at a Bitcoin price of approximately $78,509, the 15,000 BTC held by the SAFU fund is worth about $1.18 billion, which can cover about 36% of the losses on unfrozen assets, with the remaining portion to be borne by corporate funds. The report also mentioned that Chainalysis has high confidence that the attack is linked to North Korea, but Binance and government agencies have not yet officially confirmed the attribution.In addition, 21Shares stated that the assets of its physically backed ETPs and ETFs are held in cold storage by third-party custodians such as BitGo, Coinbase Custody, Anchorage Digital, and Zodia Custody, and are not kept in exchange accounts. Therefore, they were not affected by this incident, and all of the company's products are trading normally.
Odaily report: Analysts from three Wall Street firms—Cantor Fitzgerald, TD Cowen, and Compass Point—all believe that despite Binance suffering an approximately $6.3 billion hack, there is currently insufficient evidence to suggest the incident will threaten the broader crypto market, and the market's prior recovery trend is unlikely to be interrupted as a result.Cantor Fitzgerald analyst Ramsey El-Assal noted that Tether has frozen over $1.5 billion in stolen assets, Circle has frozen approximately $800 million, and Ripple has frozen about $200 million, with Binance stating that the total frozen stolen funds currently amount to roughly $3 billion. He believes the crypto industry is gradually improving its ability to respond to such security incidents and expects crypto-related stocks such as Coinbase, Robinhood, and Strategy to rebound once market panic subsides, recommending that investors buy on the dip.TD Cowen analyst Lance Vitanza believes the attack exposed security weaknesses in Binance's own transaction signing infrastructure rather than flaws in the underlying technology of cryptocurrencies like Bitcoin, and that the market sell-off may present an opportunity to accumulate Bitcoin and shares of listed companies holding Bitcoin.Compass Point analysts believe Binance has sufficient liquidity to cover the funding gap, and expect its excess USDT reserves, BTC reserves, and USDC funds to be adequate to absorb the losses. However, the firm also warned that Binance compensating customers could put pressure on stablecoin supply and may drive users to migrate from centralized exchanges to competing platforms such as Coinbase, Bullish, and Hyperliquid. (CoinDesk)
OneKey founder Yishi issued a warning that as Bitcoin ETF holdings increase, the security risks faced by custodians are also rising, and noted that BlackRock's spot Bitcoin ETF (IBIT) could become a potential target for North Korean hacking groups. The post states that TRM Labs is highly confident the recent Binance security breach is linked to the North Korean hacking group TraderTraitor, which has previously been implicated in the Bybit hack and the DMM Bitcoin theft.
Odaily reports: Binance founder CZ posted on the X platform that four data breach incidents were reported today, involving Coinbase third-party service provider Amplitude, South Korean crypto exchange Bithumb, and South Korean traditional financial institutions Mirae Asset and Daishin Securities. Among them, the Amplitude security incident affected the contact information of some Coinbase users, but user funds were not affected.CZ noted that information such as names, emails, phone numbers, addresses, identity documents, and transaction records leaked from trading platforms may be used for phishing, SIM-swapping, and social engineering attacks.In response, CZ recommends that users set up separate email addresses and strong passwords for different trading platforms, prioritize the use of hardware security keys, Passkeys, or authenticator apps, avoid relying on SMS two-factor authentication, and enable security features such as withdrawal address whitelists and anti-phishing codes. At the same time, users should regularly check account login sessions and API key permissions, and be vigilant against scams impersonating customer service.CZ also reminded users that if a platform suffers a data breach, they should promptly change passwords, revoke unnecessary API keys, check withdrawal records, and be alert to phishing attacks carried out using leaked information. In addition, leaked home addresses and asset holdings information may give rise to real-world extortion or robbery risks, and users should avoid publicly disclosing their personal asset situation.
In response to reports about a data breach, Coinbase stated that no data breach occurred at the company itself. The incident actually involved a security event at third-party analytics provider Amplitude, which affected the contact information of some Coinbase customers as well as data of other Amplitude clients.Coinbase said it has found no evidence of any unauthorized access to its internal systems, and customer funds were not affected. The company will notify affected customers and relevant regulators as required by law.
SlowMist CISO 23pds stated that the Coinbase data breach has been confirmed, with hackers obtaining contact information for over 70,000 users, although it has not yet been confirmed whether user passwords or funds were stolen.
According to Cointelegraph, the PHP Foundation admitted that a critical security vulnerability discovered as early as 2024 has yet to be patched due to flawed decision-making processes and understaffing within the security team, calling the delay a structural failure. The vulnerability could allow unauthenticated attackers to remotely execute code on affected servers. On August 11, security firm Calif and OpenAI independently reported the same issue, with Calif also demonstrating unconditional remote code execution, prompting the matter to be elevated to the highest security priority. PHP released emergency patches for two related critical vulnerabilities on Wednesday. Around the time of the patch release, government websites or services in the Netherlands, Finland, France, Germany, and Australia were temporarily taken offline, with the Netherlands shutting down its digital identity service. The Wikimedia Foundation also took some supporting services offline, causing disruptions to certain Wikipedia features. Japanese Prime Minister Sanae Takaichi called on website operators to install the patches as soon as possible. In the crypto sector, monitoring by SlowMist's MistEye service found that out of 1,488 evaluated domains, 793 showed direct PHP fingerprints. Cardano governance organization Intersect temporarily took its member portal offline. Both Coinbase and BitGo stated that their platforms were unaffected. Binance co-founder Changpeng Zhao advised users to exercise extreme caution when visiting websites over the next few days. PHP security team
Odaily reports: The PHP Foundation has stated that due to hesitant decision-making and insufficient resources, remediation work for a critical security vulnerability first discovered in 2024 stalled and restarted multiple times, and it characterized the delay as a "structural failure." PHP is a programming language widely used for websites and web applications.PHP has released emergency patches for two related critical vulnerabilities. Unauthenticated attackers could exploit the flaws to execute code on affected servers without logging in. Some government websites or online services in the Netherlands, Finland, France, Germany, and Australia were temporarily taken offline to prepare for patch installation.Security firm Calif and OpenAI separately reported the same underlying issue on August 11, and Calif also demonstrated unconditional remote code execution. Blockchain security firm SlowMist investigated PHP usage in the crypto industry and found direct PHP fingerprints on 793 of the 1,488 domains it assessed.Intersect has temporarily closed its Members Area, Coinbase said it has not found any affected PHP instances, and digital asset infrastructure company BitGo said its platform was not affected. Binance co-founder Changpeng Zhao reminded users to exercise heightened caution when visiting websites recently, and OpenAI has released a Codex skill for checking for vulnerable PHP versions. (Cointelegraph)
According to Cointelegraph, Ethereum researcher Justin Drake warned that the rapid advancement of AI could accelerate mathematical attacks against the Elliptic Curve Digital Signature Algorithm (ECDSA), potentially breaking existing cryptographic systems within months under the worst-case scenario, and called on the industry to initiate "bunker mode"—transferring assets to new addresses with previously unexposed public keys to mitigate risk. Several industry insiders, however, expressed reservations. Coinbase Chief Cryptographer Yehuda Lindell stated there is currently "no evidence" that the mathematical assumptions underpinning ECDSA have been weakened; Trezor Bitcoin analyst Lucien Bourdon similarly noted that migrating assets could backfire and inadvertently create opportunities for scams. MetaMask founder Taylor Monahan was even more direct, asserting that if elliptic curve cryptography were truly compromised, "the entire world would go to zero," rendering bunker mode ineffective. Meanwhile, Ethereum has laid out a post-quantum roadmap based on hash-based signatures and ZK proofs, while public blockchains such as Solana and NEAR are also exploring their own quantum-safe alternatives, though concrete deployment timelines remain unset.
According to K33 Research, the US government transferred approximately 17,733 BTC to Coinbase Prime this week, including 12,267 BTC linked to the Bitfinex hack incident. Following the transfer, the government’s tagged holdings decreased from 324,527 BTC to 306,795 BTC. If untagged suspected government wallets are included, the total BTC transferred to Coinbase Prime reaches approximately 21,500. Analysts believe this transfer is highly likely a custody operation rather than a liquidation—Coinbase Prime has served as the custodian for the US Marshals Service since 2024. Coins associated with the Bitfinex case remain in the claims process, with the Department of Justice requiring restitution to victims in BTC; the no-sale order for the Strategic Bitcoin Reserve also only applies to fully confiscated assets. Additionally, roughly 1,200 BTC originating from FTX and HashFlare were transferred simultaneously and may be disbursed to victims in cash through compensation channels. Notably, the completion of the transfer of approximately 15,000 Bitfinex-claim-related BTC within two days suggests that a distribution plan or relevant rulings may be advancing.
Odaily News: According to Bitcoin News monitoring, a wallet tagged as the United States transferred 833.6 BTC, valued at $71.6 million, to a Coinbase Prime deposit address. Arkham data shows that 568.7 BTC of this is related to assets forfeited from HashFlare, and 264.9 BTC is related to funds from the Bitfinex hack. Transfers to a Prime deposit address do not necessarily indicate a confirmed sale; Coinbase also provides custody services for cryptocurrency held by the government, and a similar $288 million transfer occurred in July.
Odaily News: Galaxy Research on-chain tracking shows that the US government transferred approximately 9,261 BTC, worth about $770 million, to Coinbase Prime over two days. Since the deposit address was first activated in December 2025, it has cumulatively received 11,567 BTC, of which 6,406 came from wallets already labeled as belonging to the US government, and 5,160 came from previously unlabeled wallets.Of the 9,261 BTC transferred this time, nearly half can be traced back to Bitfinex hacker funds recovered by the US government, with some coming from previously known Binance-related seized assets; among them, 2,456 BTC previously had no clear government attribution label, but because they entered this address through the same path as government funds, they are currently regarded as US government seized assets. The US government currently holds approximately 319,100 BTC, of which about 71% comes from LuBian-related BTC and Bitfinex recovered funds.In January 2025, a US federal court approved the return in kind of seized Bitfinex hacker funds to Bitfinex, and the main address holding approximately 94,600 BTC has still not moved. In October 2025, the US Department of Justice filed a civil forfeiture lawsuit against Chen Zhi and related assets, involving approximately 127,300 BTC; this batch of LuBian BTC entered addresses attributed to the US government between June and July 2024. Since 2013, US government-related addresses have received a total of approximately 555,300 BTC, worth about $16.1 billion at prices at the time; during the same period, approximately 236,200 BTC flowed out, worth about $3.8 billion at prices at the time. After excluding internal transfers between the government's own addresses, this transfer, based on labeled government addresses, ranks 9th among the largest single-day BTC outflows in US government history, and is also the largest since December 2, 2024. BTC being transferred to Coinbase Prime does not mean the US government has already sold it, and on-chain transfers alone cannot confirm the specific purpose of the funds.
Odaily News: According to Bitcoin News monitoring, Arkham reports that US government-linked wallets transferred approximately 4,695 BTC, along with WBTC and USDT, through a series of transactions today, involving total assets worth approximately $470 million. On-chain analyst @TimechainIndex independently flagged the same batch of approximately 4,695 BTC, distributed across 4 transactions. The assets are related to seizures tied to the Bitfinex hack and FTX/Alameda, with some assets already sent to Coinbase Prime deposit addresses. This transfer follows the US government's additional transfer to Coinbase Prime yesterday.
Odaily News: The U.S. Attorney's Office for the District of Massachusetts filed a civil forfeiture lawsuit on September 28, seeking the forfeiture of 110,300 USDT seized from a Binance account. The case involves phishing text messages impersonating Coinbase, which led to the theft of 33.7 bitcoins, worth approximately $900,000 at the time, from a beneficiary and their family trust held in the same Coinbase account.Investigators said that between June 5 and June 15, 2023, 11.2 of the stolen bitcoins were traced to the Binance account and were quickly converted into Monero. When the FBI requested the account be frozen, it held approximately 758.55 Monero; Binance transferred 110,300 USDT to a government-controlled wallet on August 3, 2026. (Bitcoin.com News)
Ari Paul, founder and chief investment officer of digital asset investment firm BlockTower Capital, stated on social media that Coinbase caused his firm to lose $25 million several years ago. Paul accused Coinbase of concealing large-scale, repeated security breaches and refusing to return the related funds.
据布鲁克林地区检察官 Eric Gonzalez 宣布，布鲁克林男子 Ronald Spektor（23 岁）因实施大规模 Coinbase 网络钓鱼诈骗，于 2026年 9月 23 日被布鲁克林最高法院判处 4至 12 年有期徒刑。 Spektor 冒充 Coinbase 客服代表，以"账户遭黑客攻击"为由，诱骗全美约 100 名用户将加密资产转入其控制的钱包，累计盗窃金额约 1594.4 万美元。被盗资产随后经多个加密交易所反复兑换洗钱，最终流向赌博平台、礼品卡及数字资产购买渠道。 Spektor 在 Telegram 频道"Blockchain enemies"中以 @lolimfeelingevil 为昵称公开炫耀犯罪所得，并招募他人协助实施社会工程攻击。调查人员通过区块链分析、数字取证及多项搜查令，将其家庭 IP 地址与多个被盗钱包关联，最终锁定其身份。 Spektor 已就全部 31 项指控认罪，包括一级洗钱罪、一级重大盗窃罪等，并被命令没收逾 50 万美元资产，同时赔偿受害者近 1600 万美元。
According to Decrypt, the UK National Economic Crime Centre (NECC) stated in its annual report that criminals are "innovatively" leveraging crypto asset products to evade detection and transfer illicit funds at scale, while also highlighting AI alongside cryptocurrencies as an emerging threat method. Crypto assets have been ranked third among the nine priority economic crime areas jointly designated by NECC, the FCA, and the Treasury. NECC stated it will build more proactive, intelligence-driven crypto capabilities to actively identify targets for enforcement action. Previously, the NCA, in collaboration with the US Secret Service, Coinbase, Binance, Kraken, and Tether, conducted "Operation Atlantic," which identified 20,000 phishing attack victims and resulted in the freezing of $12 million in assets this March.
Odaily News: Blockchain project Core DAO has announced a coordinated emergency hard fork, caused by validators receiving CORE rewards exceeding the blockchain's originally scheduled issuance. Core DAO stated that the incident is under control, malicious validators can no longer continue to obtain excess rewards, and the upgrade will not roll back the network or revoke confirmed transactions.Core DAO previously stated that a small number of validators had accumulated rewards significantly higher than the protocol's set issuance, and that the incident only involved reward distribution, with user assets remaining secure. Coinbase, Bithumb, Coinone, Bitget, and LBank had restricted CORE deposits, withdrawals, or transfers.Core DAO has not yet disclosed the amount of excess CORE issued, the duration of the related activity, whether the extra tokens entered circulation, or the cause of the vulnerability, and stated that it will publish a technical post-mortem report. (Cointelegraph)
Odaily News: Metaverse gaming platform The Sandbox has confirmed a vulnerability in its cross-chain bridge, allowing attackers to mint unbacked SAND on Base and BNB Smart Chain. Blockchain security firm PeckShield detected on August 21 that two addresses had collectively minted approximately 14.9 billion SAND. The Sandbox subsequently shut down bridging functionality on both networks.The Sandbox stated that the affected assets are bridged assets on Base and BNB Smart Chain, while SAND on Ethereum and Polygon, user wallet assets, and the Ethereum-locked assets backing the token remain unaffected. The proportion of genuinely collateralized assets involved in this incident is less than 0.01% of the total SAND supply.The Sandbox is developing a compensation plan for affected liquidity providers and advises users not to trade SAND on Base or BNB Smart Chain until bridging is restored. Coinbase plans to delist 10 perpetual futures contracts, including SAND, on August 26, with open positions to be automatically settled at that time. (Bitcoin.com News)