A major CEX suffers a USD 6.3B hack, with USD 3B frozen as North Korean links are probed and Aave freezes 292 reserves. Today, BTC dropped to $78.1K amid Fear sentiment. Crypto markets came under pressure following a major security breach at a major CEX, the Binance platform. Both BTC and ETH declined as market sentiment rapidly shifted from Neutral to Fear. According to market data, BTC briefly fell below $77K before recovering to around $78,100. The cryptocurrency was down approximately 2.35% over 24 hours. The rebound suggested some short-term buying interest following the sharp decline, although prices remained below the previous trading day's main trading range. Order book data from a major CEX showed near-market BTC spot bids totaling approximately USD 11.6412 million against USD 5.7898 million in asks. Buy orders exceeded sell orders by USD 5.8514 million, indicating that some market participants were providing liquidity at current price levels. However, stronger bids on a single exchange do not necessarily indicate that broader market deleveraging has been completed. ETH briefly declined toward $2,200 earlier in the day before recovering to $2,250.07. Its 24-hour loss of 3.35% exceeded BTC's and reflected continued adjustments in leveraged positions and spot selling pressure. According to CoinGlass, total cryptocurrency derivatives liquidations reached approximately USD 1.112 billion over the past 24 hours. Long liquidations accounted for USD 930 million, compared with USD 175 million in short liquidations. BTC and ETH recorded approximately USD 350 million and USD 253 million in liquidations, respectively. These figures indicated that the latest market volatility was largely concentrated in the forced unwinding of leveraged long positions. Liquidation exposure in ETH derivatives markets also remained significant. If ETH rises above $2,345, estimated cumulative short liquidation exposure across major CEXs could reach USD 891 million. A decline below $2,124 would place approximately USD 440 million in long positions at risk of liquidation. These figures represent scenario-based estimates rather than actual liquidation amounts. Regarding ETF flows, RootData statistics published on October 30 showed that US spot Bitcoin ETFs recorded approximately USD 17.2 million in net inflows on October 29, US Eastern Time. Meanwhile, spot Ethereum ETFs saw approximately USD 106 million in net outflows. The divergence highlighted differences in institutional capital flows between the two assets. These figures may be updated as additional fund disclosures become available. Market sentiment indicators also showed a notable shift. The Fear and Greed Index stood at 30, indicating Fear, down sharply from 51 the previous day. This decline reflected growing investor concerns over exchange security, asset custody and short-term liquidity risks.

Source: Alternative

Key News Highlights:

Major CEX Security Breach Involves an Estimated USD 6.3 Billion in Assets, With Approximately USD 3 Billion Frozen

A major CEX, Binance, suffered a significant security breach after on-chain monitoring identified large-scale unauthorized asset transfers from wallets associated with the platform. The exchange subsequently launched a security investigation and temporarily suspended certain services. According to its official announcement, the incident involved an estimated USD 6.3 billion in assets. This figure represents a preliminary assessment of the total impact, while the final losses remain subject to further verification. Following the incident, the exchange coordinated with blockchain analytics firms, stablecoin issuers and law enforcement agencies to trace suspicious wallet addresses and fund movements. Based on the latest investigation updates, approximately USD 3 billion in affected assets had been frozen on-chain. The total amount frozen could change as investigators identify additional funds. Tether confirmed that it had frozen more than USD 1.567 billion in USDT linked to the incident, while Circle reported freezing over USD 800 million in USDC. Other stablecoin issuers and blockchain projects also introduced measures to restrict transfers of affected assets. The assets involved included USDT, USDC, RLUSD, USD1 and ARB across multiple blockchain networks. Their distribution across different chains added complexity to fund tracing and coordination efforts. During the initial investigation, the exchange suspended deposits and withdrawals and revoked certain authorizations associated with affected wallet addresses to prevent further unauthorized transfers. Subsequent updates indicated that deposit services had resumed normal operations. Withdrawals were expected to resume within 48 hours after the completion of security system adjustments, although the exact reopening time remained subject to official confirmation. The scale of the incident and the coordinated freezing of digital assets have brought renewed attention to exchange security, wallet authorization management and cross-chain fund tracking across the cryptocurrency industry.

Preliminary Investigation Points to Compromised Engineer's Laptop as Wallet Authorization Comes Under Scrutiny

The affected major CEX released preliminary technical findings from its investigation into the security breach. The findings indicated that a DevOps engineer's laptop may have been compromised and used as an entry point into the exchange's internal systems. According to the platform, attackers may have exploited the compromised device to gain access to an internal service container and submit unauthorized withdrawal transactions. This potentially enabled digital assets to be transferred from the exchange's wallets to external addresses. The exchange stated that it had found no evidence of a direct wallet private key leak. As a result, investigators were examining internal access permissions and transaction-signing procedures alongside device security. On-chain analysis by blockchain security firm Blockaid suggested that the attackers may have exploited Ethereum's EIP-7702 account authorization mechanism to gain control over token transfers from the targeted wallet. EIP-7702 is part of an Ethereum account upgrade that allows accounts to delegate transaction execution to designated smart contract code. In this incident, investigators identified signs that the delegation mechanism may have been maliciously exploited. Blockaid found that the attackers submitted 50 authorization entries in a single transaction. One entry contained an authorization nonce that matched the target account's requirements and allowed the malicious contract delegation to take effect. Further analysis indicated that the delegated contract could transfer tokens and ETH from the account to designated addresses. These findings provided investigators with technical evidence for tracing the unauthorized asset movements. Security researchers also noted that such attacks could involve the manipulation of transaction-signing infrastructure without directly obtaining wallet private keys. Further investigation is therefore required to determine how the attackers secured valid authorization. The exchange has revoked the affected wallet authorizations and continues to work with external security teams and law enforcement agencies to examine the relevant systems. The investigation remains ongoing, and the complete technical connection between the compromised engineer's device and the malicious wallet authorization has not been formally established. The exchange plans to publish a detailed incident report after completing its forensic investigation.

Blockchain Security Firms Suspect North Korean Hackers as Cross-Chain Fund Transfers Remain Under Investigation

Several blockchain security research firms released on-chain findings related to the major CEX security breach. Their investigations suggested that the attack may be linked to TraderTraitor, a North Korea-associated hacking group. According to Reuters, blockchain analytics firm TRM Labs assessed the likelihood of TraderTraitor's involvement by examining on-chain transaction records alongside off-chain intelligence. The firm expressed high confidence in its preliminary attribution. TRM Labs reported that the attackers transferred approximately USD 6.36 billion in assets across 10 different blockchain networks within roughly 20 minutes. This activity involved coordinated movements across multiple blockchain wallets and a large volume of transactions. The firm identified TraderTraitor as a North Korea-linked hacking group that security researchers had previously associated with other major cryptocurrency thefts. Jonathan Levin, co-founder and CEO of blockchain analytics firm Chainalysis, also indicated that the incident may have been carried out by the same group based on on-chain connections to earlier attacks. Onchain investigator ZachXBT identified another potential link after discovering that some funds associated with the latest breach had reached the same wallet address as assets involved in a previous exchange exploit. The funds had been transferred through THORChain, providing another lead for investigators examining the identity of the attackers. Security firm Blockaid also observed similarities between the attackers' on-chain preparations, authorization arrangements and asset transfers and techniques previously associated with North Korean hacking operations. However, these assessments remain preliminary. Connections between wallet addresses and similarities in transaction patterns do not constitute definitive legal attribution of the attack. The affected exchange has not officially identified the attackers and continues to cooperate with law enforcement and blockchain intelligence firms. As investigators identify additional wallet addresses, cross-chain transactions and fund transfer records, further evidence will be needed to establish the attackers' identities and determine the final destination of the affected assets.

Aave Freezes Cross-Chain Lending Markets Following Major Security Breach, Restricting 292 Reserves Across V3 and V4

Decentralized lending protocol Aave implemented precautionary freezes across lending markets on multiple blockchain networks following the major security breach at a centralized cryptocurrency exchange. The measures were designed to prevent funds linked to the incident from being used to establish additional positions within the protocol. According to information published by Aave risk service provider LlamaRisk on its governance forum, a wallet associated with the attacker deposited approximately 60 million USDT into the Aave V3 Ethereum market. The wallet subsequently borrowed 19,762 WETH worth approximately USD 44.6 million at the time. These transactions occurred between 20:58 and 21:01 UTC on October 29, before Aave began implementing the market freezes. LlamaRisk reported that the borrowing position remained backed by approximately USD 59.9 million in USDT collateral against roughly USD 43.8 million in outstanding debt. The collateral value continued to exceed the borrowed amount, and the position had not directly resulted in losses for Aave depositors. To prevent the affected funds from being used to establish additional lending positions through other tokens or blockchain networks, Aave decided to implement cross-network restrictions rather than freeze only a single affected asset. The measures covered 175 reserves across 16 blockchain networks on Aave V3 and another 117 reserves across four networks on Aave V4. A total of 292 reserves were subject to restrictions. During the freeze, the affected markets stopped accepting new deposits and borrowing transactions. Existing users could still withdraw funds and repay loans, while normal liquidation procedures remained operational. Aave clarified that the restrictions were precautionary risk management measures and were not the result of a vulnerability or security breach in the protocol's smart contracts. LlamaRisk, Aave Labs and other risk management teams continued monitoring wallets associated with the attacker, fund movements and oracle price data to assess further developments. According to the governance forum update, the affected markets could be reopened gradually once suspicious fund movements had stopped and the containment of the incident became clearer. Separately, stablecoin issuer Tether confirmed that it had frozen more than USD 1.567 billion in USDT associated with the major CEX security breach to prevent further transfers of the affected assets. Tether CEO Paolo Ardoino stated that the measures were intended to protect the cryptocurrency industry and its partners. The freeze restricts transfers of the affected tokens but does not mean the funds have been successfully recovered.

Disclaimer: The information provided in this section is for informational purposes only and doesn't represent any investment advice or FameEX's official view.