🚨 Binance outflow suspected at ~$5.57B, both majors red, market in Fear
Morning, sheep. BTC and ETH are bleeding, and the reason isn't a meme. On-chain trackers put about $5.57B leaving Binance across three blockchains, and Binance says it's investigating a potential security breach.
▪️ Winners: PARTI +45.5% on $42M volume, HYPE +17.4% on $196M after ICE signed with Trade[XYZ] to bring Hyperliquid-based perps to US regulated markets
▪️ Losers: INTCB -23.4% on $36M and SOXLB -13.8%, with FET and WLD sliding too. Thin tapes are where the forced sellers live
▪️ Binance: Tether and Circle froze about $1.8B in stablecoins, Aave froze Avalanche lending markets, BitGo froze USD1 tied to the suspected hacker
▪️ BNB dropped as much as 9% after reports of $2.77B leaving Binance wallets. Ethena says its collateral sits off-exchange, which is the line everyone will be reading
▪️ Axis Robotics: ZachXBT says suspected insiders sold 42M AXIS while price fell about 40%, pointing at weak token lock-up agreements
▪️ US restrained over $1B in crypto tied to overseas scam networks. The alleged Madagascar dating scam got Americans to connect wallets to fake investment sites
📊 BTC:
📊 ETH:
📊 Fear & Greed:
🔮Fear at 30 on a $5.57B question mark. Who's buying this dip, and who already left the room?
@hivenetwork
Morning, sheep. BTC and ETH are bleeding, and the reason isn't a meme. On-chain trackers put about $5.57B leaving Binance across three blockchains, and Binance says it's investigating a potential security breach.
▪️ Winners: PARTI +45.5% on $42M volume, HYPE +17.4% on $196M after ICE signed with Trade[XYZ] to bring Hyperliquid-based perps to US regulated markets
▪️ Losers: INTCB -23.4% on $36M and SOXLB -13.8%, with FET and WLD sliding too. Thin tapes are where the forced sellers live
▪️ Binance: Tether and Circle froze about $1.8B in stablecoins, Aave froze Avalanche lending markets, BitGo froze USD1 tied to the suspected hacker
▪️ BNB dropped as much as 9% after reports of $2.77B leaving Binance wallets. Ethena says its collateral sits off-exchange, which is the line everyone will be reading
▪️ Axis Robotics: ZachXBT says suspected insiders sold 42M AXIS while price fell about 40%, pointing at weak token lock-up agreements
▪️ US restrained over $1B in crypto tied to overseas scam networks. The alleged Madagascar dating scam got Americans to connect wallets to fake investment sites
📊 BTC:
$78,629.82 (-2.29% 24h)📊 ETH:
$2,250.01 (-3.65% 24h)📊 Fear & Greed:
30 (Fear), yesterday 51Fear dropped from 51 to 30 in a day, so the crowd panicked on a Binance headline before anyone knew the full number. Anyone with funds parked on Binance or holding BNB is the exposed group right now. If Binance confirms the breach and the freezes hold, the bounce will be the first thing to fade; if the outflow tally keeps climbing, expect more freezes and BNB to break next.
🔮
@hivenetwork
🧊 US froze $1B+ in crypto tied to scam compounds, and the grift is going global
US authorities have restrained more than $1 billion in crypto linked to overseas scam networks, and the new Madagascar case is a masterclass in robbing retail with a smile. Six defendants are charged over a fake-dating operation that allegedly hit about 800 American victims. FBI investigators traced roughly 74 wallets, and the stolen money allegedly ended up in accounts tied to China-based actors.
▪️ The hook: alleged 'women' looking for a relationship chat up Americans, then pitch crypto investing and push them to fraudulent investment websites.
▪️ The trap: victims connect their wallets to those sites and fund them. Then the wallets are secretly drained. Free money for the bosses, zero for the hamsters.
▪️ Infrastructure: the Justice Department's Scam Center Strike Force seized 700 fraudulent crypto investment websites and Telegram channels that supported the schemes.
▪️ Madagascar: compounds allegedly opened in early 2025. In August the FBI backed local police raids on 13 of them and seized more than 3,200 electronic devices.
▪️ Boss math: Chui Kok Wa, the alleged leader, is charged with conspiracy to commit wire fraud. His phones held overnight work schedules matched to US hours and bonuses tied to stolen funds.
▪️ Staff: a material witness warrant targets 15 employees who accused Wa of trafficking and abuse. They're believed to still be jailed in Madagascar.
📊 Strike Force freezes, seizures and forfeitures in first 3…:
📊 Cumulative restraints after the Xinbi Guarantee operation:
📊 Scam accounts Meta reportedly removed:
📊 Wallets tied to the Madagascar scheme:
💬 «My Strike Force will expand and grow, and follow the scammers to Africa, India, Europe, and wherever they try to plant their operations.» — Jeanine Ferris Pirro
🔮Frozen is not returned. Who actually gets the money back, and how long will that take?
@hivenetwork
US authorities have restrained more than $1 billion in crypto linked to overseas scam networks, and the new Madagascar case is a masterclass in robbing retail with a smile. Six defendants are charged over a fake-dating operation that allegedly hit about 800 American victims. FBI investigators traced roughly 74 wallets, and the stolen money allegedly ended up in accounts tied to China-based actors.
▪️ The hook: alleged 'women' looking for a relationship chat up Americans, then pitch crypto investing and push them to fraudulent investment websites.
▪️ The trap: victims connect their wallets to those sites and fund them. Then the wallets are secretly drained. Free money for the bosses, zero for the hamsters.
▪️ Infrastructure: the Justice Department's Scam Center Strike Force seized 700 fraudulent crypto investment websites and Telegram channels that supported the schemes.
▪️ Madagascar: compounds allegedly opened in early 2025. In August the FBI backed local police raids on 13 of them and seized more than 3,200 electronic devices.
▪️ Boss math: Chui Kok Wa, the alleged leader, is charged with conspiracy to commit wire fraud. His phones held overnight work schedules matched to US hours and bonuses tied to stolen funds.
▪️ Staff: a material witness warrant targets 15 employees who accused Wa of trafficking and abuse. They're believed to still be jailed in Madagascar.
📊 Strike Force freezes, seizures and forfeitures in first 3…:
$580M+📊 Cumulative restraints after the Xinbi Guarantee operation:
$938M📊 Scam accounts Meta reportedly removed:
17.3M📊 Wallets tied to the Madagascar scheme:
74If you ever connected a wallet to a site promising 10x in a week, you're the exact hamster this case is built around. A restraint is not a refund: the assets are frozen pending legal proceedings and possible victim compensation, so the people who got drained are waiting in line. Pirro is also announcing the Strike Force will chase these operations into Africa, India and Europe, which means more clones, more fresh websites and more Telegram channels. The old rule still holds: a site that asks you to sign a transaction to 'invest' is a drain, not a yield.
💬 «My Strike Force will expand and grow, and follow the scammers to Africa, India, Europe, and wherever they try to plant their operations.» — Jeanine Ferris Pirro
🔮
@hivenetwork
📉 BTC at $77K, ETH at $2.2K, and the leverage crowd is bleeding
254,045 crypto traders got liquidated in 24 hours, with $1.67B in leveraged positions wiped out while BTC sits at $77,232.64 (-1.78%). ETH is at $2,240.51 (-0.42%), so the bleed is concentrated in leverage, not spread across the whole market.
▪️ BEAMX +39.0% on $29M volume is the standout green move. A 39% candle on that volume is where you check who's holding the bag before you chase it.
▪️ SNDKB -11.7% on $55M is the heaviest volume on the red side. That's where the selling is actually sitting, not in the quiet dips.
▪️ SOXLB -11.1% on $23M and INTCB -9.2% on $34M: the red is broad, not one name bleeding out alone.
▪️ LINK +2.6% on $38M and AAVE +2.1% on $20M: the grind-up kind of green that moves on volume, not hype.
▪️ HYPE -4.9% on $43M: real volume on a mid-size drop. Watch whether it holds or becomes the next liquidation magnet.
▪️ Recap: the liquidation wave is tied by our newsroom to high leverage in volatile markets, with forced closures doing the damage, not a single news trigger.
🔮Fear at 30, same as yesterday: calm or the pause before the next flush?
@hivenetwork
254,045 crypto traders got liquidated in 24 hours, with $1.67B in leveraged positions wiped out while BTC sits at $77,232.64 (-1.78%). ETH is at $2,240.51 (-0.42%), so the bleed is concentrated in leverage, not spread across the whole market.
▪️ BEAMX +39.0% on $29M volume is the standout green move. A 39% candle on that volume is where you check who's holding the bag before you chase it.
▪️ SNDKB -11.7% on $55M is the heaviest volume on the red side. That's where the selling is actually sitting, not in the quiet dips.
▪️ SOXLB -11.1% on $23M and INTCB -9.2% on $34M: the red is broad, not one name bleeding out alone.
▪️ LINK +2.6% on $38M and AAVE +2.1% on $20M: the grind-up kind of green that moves on volume, not hype.
▪️ HYPE -4.9% on $43M: real volume on a mid-size drop. Watch whether it holds or becomes the next liquidation magnet.
▪️ Recap: the liquidation wave is tied by our newsroom to high leverage in volatile markets, with forced closures doing the damage, not a single news trigger.
Fear & Greed sits at 30 (Fear), unchanged from yesterday. A flat fear reading after a leverage flush means the market is still pricing in pain, not finished capitulating. If you're running leveraged longs, you're the group that gets picked off on every dip, and the bounce that follows goes to whoever kept their margin.
🔮
@hivenetwork
📊 Green tape, scared crowd: LSK pumps, TRX bleeds, drainers keep working
BTC sits at $77,851 (+0.81% in 24h) and ETH at $2,268 (+1.23%), so the majors are green. Fear & Greed is 34 (Fear), up from 30 yesterday: the price is drifting up while the crowd stays scared.
▪️ LSK +13.9% on just $24M volume, the biggest green candle of the day. Our data gives no catalyst. A 14% pop on thin liquidity is exactly where exit liquidity comes from.
▪️ TRX -4.3% on $87M, the heaviest volume among the losers. That is real selling, not noise, and it's the one loser worth watching.
▪️ PEPE +2.9% on $45M, second-largest volume among the gainers behind NEAR's $69M. Memecoin money is still moving.
▪️ StepDrainer hit 10 more websites, and LaunchOnSF is back online after being hit. The attack works through user interactions on web platforms, so front ends are the target.
▪️ North Korea-linked hackers moved $38M through Relay Protocol's cross-chain system in seven hours. Expect this to feed stricter regulation and compliance scrutiny across crypto.
🔮Green majors, scared crowd, and TRX bleeding on size. Who is selling into this?
@hivenetwork
BTC sits at $77,851 (+0.81% in 24h) and ETH at $2,268 (+1.23%), so the majors are green. Fear & Greed is 34 (Fear), up from 30 yesterday: the price is drifting up while the crowd stays scared.
▪️ LSK +13.9% on just $24M volume, the biggest green candle of the day. Our data gives no catalyst. A 14% pop on thin liquidity is exactly where exit liquidity comes from.
▪️ TRX -4.3% on $87M, the heaviest volume among the losers. That is real selling, not noise, and it's the one loser worth watching.
▪️ PEPE +2.9% on $45M, second-largest volume among the gainers behind NEAR's $69M. Memecoin money is still moving.
▪️ StepDrainer hit 10 more websites, and LaunchOnSF is back online after being hit. The attack works through user interactions on web platforms, so front ends are the target.
▪️ North Korea-linked hackers moved $38M through Relay Protocol's cross-chain system in seven hours. Expect this to feed stricter regulation and compliance scrutiny across crypto.
A green tape with Fear at 34 means nobody is buying the rally with conviction. Drainers hitting front ends means the risk today sits in the signing screen, so read every approval before you click. Cross-chain bridges are the lane North Korean hackers just used, and that's where the compliance hammer lands next.
🔮
@hivenetwork
🧨 Thorchain bug freezes swaps while FBI asks nodes to block Binance hack money
The money from Binance's theft, the one North Korea's Tradertraitor pulled off on Oct. 29, was supposed to be washed through Thorchain. Then a one-block Ethereum reorg created 10 ETH out of thin air, and Thorchain slammed the emergency brake on most of its routes. The launderers got locked out along with everyone else, which is the cruelest irony the market has served up this week.
▪️ Ethereum reorganized a single block, dropping a 10 ETH deposit meant for a Thorchain vault. That deposit never made it back onto the canonical chain.
▪️ Thorchain's observers had already seen the deposit and credited the vault. The linked swap failed its price conditions, so the protocol refunded 10 ETH the vault never actually received.
▪️ Another deposit from the same wallet was refunded too, leaving the vault about 10 ETH short. Solvency protections kicked in and halted Ethereum processing.
▪️ Trading and new swaps stopped on 12 of 13 supported external networks. Some previously initiated outbound payments kept running.
▪️ No malicious intent was found. The cause was a collision between Ethereum's reorg and Thorchain's deposit verification procedures.
▪️ On Oct. 31 the FBI, with the U.S. Secret Service and IRS Criminal Investigation, asked infrastructure providers to block wallets tied to the Binance theft.
💬 «No subpoenas required, a best-case scenario for investigations.» — Chad Barraford
🔮Launderers got stuck behind a bug, not a sanction. Next time the bug might come with a federal request attached.
@hivenetwork
The money from Binance's theft, the one North Korea's Tradertraitor pulled off on Oct. 29, was supposed to be washed through Thorchain. Then a one-block Ethereum reorg created 10 ETH out of thin air, and Thorchain slammed the emergency brake on most of its routes. The launderers got locked out along with everyone else, which is the cruelest irony the market has served up this week.
▪️ Ethereum reorganized a single block, dropping a 10 ETH deposit meant for a Thorchain vault. That deposit never made it back onto the canonical chain.
▪️ Thorchain's observers had already seen the deposit and credited the vault. The linked swap failed its price conditions, so the protocol refunded 10 ETH the vault never actually received.
▪️ Another deposit from the same wallet was refunded too, leaving the vault about 10 ETH short. Solvency protections kicked in and halted Ethereum processing.
▪️ Trading and new swaps stopped on 12 of 13 supported external networks. Some previously initiated outbound payments kept running.
▪️ No malicious intent was found. The cause was a collision between Ethereum's reorg and Thorchain's deposit verification procedures.
▪️ On Oct. 31 the FBI, with the U.S. Secret Service and IRS Criminal Investigation, asked infrastructure providers to block wallets tied to the Binance theft.
The FBI request is voluntary, not a court order, but it puts a permissionless protocol squarely in the crosshairs, and Thorchain operators have resisted selective transaction blocking before. The pause was an accounting fix, not a targeted freeze on Binance money, and developers are still investigating the malfunction. For anyone trading cross-chain routes, the lesson is blunt: one reorged block on Ethereum can take a bridge offline across most of its networks overnight.
💬 «No subpoenas required, a best-case scenario for investigations.» — Chad Barraford
🔮
@hivenetwork
🚨 SEC sues BG Wealth and DSJ Exchange over $130M from retail on fake-looking paperwork
The SEC has filed a civil complaint against BG Wealth Sharing and DSJ Exchange, alleging they raised more than $130 million from tens of thousands of retail investors. The pitch was crypto trading signals and risk-free returns, backed by filings that looked like government approval. The complaint was filed October 29 and detailed in an October 30 litigation release.
▪️ The product was an investment program built on purported crypto trading signals, sold with promises of extraordinary, risk-free returns.
▪️ The sales tool was false Form ADV and Form D filings, presented as proof of legitimacy. A link to an SEC database makes a pitch look official. It doesn't mean anyone approved it.
▪️ The SEC says neither entity was registered with it. The disputed filings have since been removed from the Commission's website.
▪️ The SEC is seeking injunctions, disgorgement and civil penalties.
▪️ These are allegations in civil proceedings. No final court finding, criminal conviction or confirmed investor recovery amount exists yet.
📊 Complaint filed:
🔮Tens of thousands of people saw a government database link and wired money anyway. Who sold them the 'verified' part?
@hivenetwork
The SEC has filed a civil complaint against BG Wealth Sharing and DSJ Exchange, alleging they raised more than $130 million from tens of thousands of retail investors. The pitch was crypto trading signals and risk-free returns, backed by filings that looked like government approval. The complaint was filed October 29 and detailed in an October 30 litigation release.
▪️ The product was an investment program built on purported crypto trading signals, sold with promises of extraordinary, risk-free returns.
▪️ The sales tool was false Form ADV and Form D filings, presented as proof of legitimacy. A link to an SEC database makes a pitch look official. It doesn't mean anyone approved it.
▪️ The SEC says neither entity was registered with it. The disputed filings have since been removed from the Commission's website.
▪️ The SEC is seeking injunctions, disgorgement and civil penalties.
▪️ These are allegations in civil proceedings. No final court finding, criminal conviction or confirmed investor recovery amount exists yet.
📊 Complaint filed:
October 29If you or someone you know bought into this program, the money is not back yet and nothing is confirmed. Disgorgement only matters if the SEC can find and freeze the assets, and that takes time most victims don't have. Next comes the asset tracing and the court calendar, not a payout. The lesson is cheap and old: a logo, a filing number or a 'verified' badge tells you nothing about who holds your cash.
🔮
@hivenetwork
🎰 $1.07B in Crypto Hit Sihanoukville Casinos Right Under the Sanctions Nose
Thirty-four casinos in Sihanoukville, Cambodia took in about $1.07 billion in crypto between January 1 and September 7, 2026, according to blockchain firm TRM Labs. Casinos tied to OFAC-designated networks got $687 million of it, 64% of the total. So much for the crackdown.
▪️ Entities linked to Xihu Resort Hotel received $184M from April 23 to September 7, months after the US designations.
▪️ Entities attributed to Huan Hai Bo Lai International Investment took another $129M over the same stretch.
▪️ A casino tied to Jin Bei Group still got $9M after the October 2025 designation of Prince Group and related entities.
▪️ Monthly inflows look smaller: about $148M a month in January to May, then roughly $95M in July and August. Designated casinos fell from $100M to about $48M a month.
▪️ TRM doesn't buy the dip. Operators keep changing wallet addresses, so some money may be moving through wallets investigators haven't identified yet.
▪️ Almost all of it is USDT on TRON. TRM credits low fees, deep liquidity and wide adoption across Southeast Asia.
📊 Total crypto received, Jan 1 to Sep 7, 2026:
📊 Tied to OFAC-designated networks:
📊 Xihu Resort Hotel-linked, Apr 23 to Sep 7:
📊 Huan Hai Bo Lai-linked, same period:
🔮Sanctions took the menu off the wall, not the kitchen out of business. Which wallet cluster is TRM not naming yet?
@hivenetwork
Thirty-four casinos in Sihanoukville, Cambodia took in about $1.07 billion in crypto between January 1 and September 7, 2026, according to blockchain firm TRM Labs. Casinos tied to OFAC-designated networks got $687 million of it, 64% of the total. So much for the crackdown.
▪️ Entities linked to Xihu Resort Hotel received $184M from April 23 to September 7, months after the US designations.
▪️ Entities attributed to Huan Hai Bo Lai International Investment took another $129M over the same stretch.
▪️ A casino tied to Jin Bei Group still got $9M after the October 2025 designation of Prince Group and related entities.
▪️ Monthly inflows look smaller: about $148M a month in January to May, then roughly $95M in July and August. Designated casinos fell from $100M to about $48M a month.
▪️ TRM doesn't buy the dip. Operators keep changing wallet addresses, so some money may be moving through wallets investigators haven't identified yet.
▪️ Almost all of it is USDT on TRON. TRM credits low fees, deep liquidity and wide adoption across Southeast Asia.
📊 Total crypto received, Jan 1 to Sep 7, 2026:
$1.07B📊 Tied to OFAC-designated networks:
$687M (64%)📊 Xihu Resort Hotel-linked, Apr 23 to Sep 7:
$184M📊 Huan Hai Bo Lai-linked, same period:
$129MSanctions on paper aren't sanctions on the money. If you trade USDT or follow TRON flows, this is the rail that keeps carrying scam-compound cash, and the enforcement headlines aren't cutting it off. Kok An, a Cambodian senator, and 28 related people and entities were sanctioned in April 2026 over scam centers that defrauded Americans, and the casinos kept receiving crypto anyway. The September license purge is the newest move, but the wallet-rotation problem TRM flagged means the monthly drop could be a mirage.
🔮
@hivenetwork
📊 Morning digest: BTC +0.61%, ETH +1.01%, and the crowd is still scared
BTC is at $78,326.18 (+0.61% in 24h) and ETH at $2,291.27 (+1.01%), so the grind is green but nobody's popping champagne. The market is still in the fear zone, which is exactly where retail gets fed the exit liquidity.
▪️ Green list: ZEC +2.0% on $105M volume, the loudest mover up. TRX +1.5% on $36M and UNI +1.1% on $43M follow, with BNB +0.8% and ETH +1.0% on heavier flows.
▪️ Red list: NEAR -3.2% on $44M is the worst of the day. LINK -2.7% and AVAX -2.7% dropped on only $22M and $20M, so the dips are moving on thin money.
▪️ Liquidations hit $12.5B in October 2026, with longs taking most of the damage. Leverage is the reason your 'safe' long got wiped.
▪️ Thorchain: a one-block Ethereum reorg caused a double refund of 10 ETH, triggering an emergency pause on cross-chain swaps.
▪️ SEC sued BG Wealth Sharing and DSJ Exchange over an alleged $130M+ scheme selling a 'crypto trading signals' program with official-looking filings and false trading claims.
▪️ TRM Labs: 34 Sihanoukville casinos got about $1.07B in crypto from January 1 to September 7, 2026. $687M (64%) went to casinos linked to OFAC-designated networks, despite the Cambodian crackdown.
📊 Fear & Greed today:
📊 Fear & Greed yesterday:
🔮Longs ate $12.5B in liquidations last month. Who is buying these green candles, and who is selling them to you?
@hivenetwork
BTC is at $78,326.18 (+0.61% in 24h) and ETH at $2,291.27 (+1.01%), so the grind is green but nobody's popping champagne. The market is still in the fear zone, which is exactly where retail gets fed the exit liquidity.
▪️ Green list: ZEC +2.0% on $105M volume, the loudest mover up. TRX +1.5% on $36M and UNI +1.1% on $43M follow, with BNB +0.8% and ETH +1.0% on heavier flows.
▪️ Red list: NEAR -3.2% on $44M is the worst of the day. LINK -2.7% and AVAX -2.7% dropped on only $22M and $20M, so the dips are moving on thin money.
▪️ Liquidations hit $12.5B in October 2026, with longs taking most of the damage. Leverage is the reason your 'safe' long got wiped.
▪️ Thorchain: a one-block Ethereum reorg caused a double refund of 10 ETH, triggering an emergency pause on cross-chain swaps.
▪️ SEC sued BG Wealth Sharing and DSJ Exchange over an alleged $130M+ scheme selling a 'crypto trading signals' program with official-looking filings and false trading claims.
▪️ TRM Labs: 34 Sihanoukville casinos got about $1.07B in crypto from January 1 to September 7, 2026. $687M (64%) went to casinos linked to OFAC-designated networks, despite the Cambodian crackdown.
📊 Fear & Greed today:
37 (Fear)📊 Fear & Greed yesterday:
34Fear at 37, up from 34, means the crowd is nervous but not capitulated, so this is not a bottom party. The green on ZEC and TRX came on modest volume, and the red on NEAR, LINK and AVAX came on even less, so don't read a tape like that as conviction. Watch whether the bounce holds once the bigger money shows up.
🔮
@hivenetwork
🚨 Mystery EU victim drained from exchange accounts days after Binance hack
An unnamed entity in the European Union lost more than $106 million from several centralized exchange accounts on Sunday, Nov 1, according to onchain sleuth ZachXBT. Neither the victim nor the exchanges have been named. Days after the Binance hack, the stolen money is already being laundered like it's a hobby.
▪️ The funds left the exchanges as USDC and USDT, the two stablecoins whose issuers can freeze them.
▪️ Within 24 hours the attacker swapped USDC into ETH to shake off the stablecoin trail.
▪️ Funds went through instant exchanges WellWallet and Kyrrex, which barely check who you are.
▪️ Part was converted into Monero through the Wagyu swap service. Monero hides senders, receivers and amounts.
▪️ Assets were bridged across several blockchains. ZachXBT has tied 11 wallet addresses to the funds.
▪️ ZachXBT says with 'a high degree of confidence' it isn't North Korea's Lazarus Group, citing multiple laundering indicators.
📊 Wallet addresses tied to EU theft:
📊 Solana arbitrage bot drain:
💬 «This pattern strongly suggests a potential wallet compromise.» — Onchain Lens
🔮Who holds $106M, parks it on EU exchanges, and needs it washed through Monero in a day? Open question.
@hivenetwork
An unnamed entity in the European Union lost more than $106 million from several centralized exchange accounts on Sunday, Nov 1, according to onchain sleuth ZachXBT. Neither the victim nor the exchanges have been named. Days after the Binance hack, the stolen money is already being laundered like it's a hobby.
▪️ The funds left the exchanges as USDC and USDT, the two stablecoins whose issuers can freeze them.
▪️ Within 24 hours the attacker swapped USDC into ETH to shake off the stablecoin trail.
▪️ Funds went through instant exchanges WellWallet and Kyrrex, which barely check who you are.
▪️ Part was converted into Monero through the Wagyu swap service. Monero hides senders, receivers and amounts.
▪️ Assets were bridged across several blockchains. ZachXBT has tied 11 wallet addresses to the funds.
▪️ ZachXBT says with 'a high degree of confidence' it isn't North Korea's Lazarus Group, citing multiple laundering indicators.
📊 Wallet addresses tied to EU theft:
11📊 Solana arbitrage bot drain:
$786KIf your stables sit on a centralized exchange, this is the reminder that the exchange is the weak link, not your conviction. The Binance precedent shows issuers can freeze fast: Tether froze stolen USDT in 37 minutes and Circle froze $823M in USDC, per Elliptic. It's unclear whether any EU funds have been frozen, and the attacker is already getting out of USDC and USDT. Meanwhile Brazil's Mercado Bitcoin halted withdrawals after a $40M hack of its own, and BTCPay Server told merchants to switch off their servers amid hot wallet attacks. Bots running on Solana should check their wallets before someone else does.
💬 «This pattern strongly suggests a potential wallet compromise.» — Onchain Lens
🔮
@hivenetwork
🔥 Binance got emptied, refilled 95%, and now the scammers are lining up in your DMs
Binance lost about $6.3 billion in crypto after an Oct 29 attack on its hot wallets. The exchange says 95% of the hit assets are already replaced from company money. Now it's warning that the second wave isn't a hacker, it's a fake Binance support agent sliding into the DMs of people waiting for their withdrawals.
▪️ Withdrawals reopened in phases from Nov 1. The next phase is Nov 3, and Binance hasn't said which coins and networks come back.
▪️ The scam script: fake Binance staff in emails, DMs and group chats offer to speed up pending withdrawals or sell 'priority queue' access.
▪️ Other bait: fake compensation claims, fake proof-of-reserves sites, and 'move your coins to a secure wallet' instructions.
▪️ The killer move: you approve a malicious wallet permission, and the attacker moves your assets without asking you again. Nothing to reverse.
▪️ Binance says it doesn't charge fees to unlock withdrawals and never asks you to authorize wallet transactions to regain access. Anyone who does is the thief.
▪️ Refill split: 95% from company resources, the last 5% in less-liquid coins bought on the market and OTC. Tracing the stolen funds runs as a separate track.
📊 Replaced from company resources:
📊 Assets in Oct 31 reserve proof:
📊 Time to generate next proof (Nov 4 snapshot):
🔮Full refill or a nice shop window? The proof covers an Oct 31 snapshot, not today's books.
@hivenetwork
Binance lost about $6.3 billion in crypto after an Oct 29 attack on its hot wallets. The exchange says 95% of the hit assets are already replaced from company money. Now it's warning that the second wave isn't a hacker, it's a fake Binance support agent sliding into the DMs of people waiting for their withdrawals.
▪️ Withdrawals reopened in phases from Nov 1. The next phase is Nov 3, and Binance hasn't said which coins and networks come back.
▪️ The scam script: fake Binance staff in emails, DMs and group chats offer to speed up pending withdrawals or sell 'priority queue' access.
▪️ Other bait: fake compensation claims, fake proof-of-reserves sites, and 'move your coins to a secure wallet' instructions.
▪️ The killer move: you approve a malicious wallet permission, and the attacker moves your assets without asking you again. Nothing to reverse.
▪️ Binance says it doesn't charge fees to unlock withdrawals and never asks you to authorize wallet transactions to regain access. Anyone who does is the thief.
▪️ Refill split: 95% from company resources, the last 5% in less-liquid coins bought on the market and OTC. Tracing the stolen funds runs as a separate track.
📊 Replaced from company resources:
95%📊 Assets in Oct 31 reserve proof:
10📊 Time to generate next proof (Nov 4 snapshot):
40-50 hoursIf you have a pending withdrawal, the only real channels are the app and Binance's official verification service. Anyone in your DMs offering to unlock funds for a fee is working for the thieves. The proof covers balances at 00:00 UTC on Oct 31 and shows at least 1:1 backing for that snapshot. It does not show current solvency or audit the exchange, so don't let a PR tool stand in for a balance sheet.
🔮
@hivenetwork
📉 BTC at $76,844, ZEC bleeds 10.9% on $182M, and Fear sits at 26
Bitcoin is down 1.93% to $76,844.01 and Ether is down 1.65% to $2,253.98, so the whole board is red and the crowd is sulking. Zcash took the biggest drop among the high-volume names, while the rest of the tape just drifted lower with it.
▪️ ZEC -10.9% on $182M, the heaviest volume on the loser list. Somebody is getting shaken out with size.
▪️ NEAR -10.6% on $104M. SOXLB -15.4% on $35M is the deepest drop on the board, and INTCB -9.2% and SNDKB -9.1% are right behind it.
▪️ TRX is the only real green: +2.1% on $40M. USDC printed $1,656M in volume and went nowhere, which is just stablecoins doing their job.
▪️ An unidentified European entity lost more than $106M from centralized exchange accounts on Sunday, days after the Binance hack.
▪️ Binance's November 2 update says full proof for its $6.3B hack recovery is complete and replenishment stands at about 95%, with broader token coverage planned.
▪️ A Polymarket account bought the Arizona Cardinals at 1.4 cents when Arizona trailed Dallas by 10 with under four minutes left.
🔮Fear at 26 and falling. Who is buying this panic, and who is just holding the bag?
@hivenetwork
Bitcoin is down 1.93% to $76,844.01 and Ether is down 1.65% to $2,253.98, so the whole board is red and the crowd is sulking. Zcash took the biggest drop among the high-volume names, while the rest of the tape just drifted lower with it.
▪️ ZEC -10.9% on $182M, the heaviest volume on the loser list. Somebody is getting shaken out with size.
▪️ NEAR -10.6% on $104M. SOXLB -15.4% on $35M is the deepest drop on the board, and INTCB -9.2% and SNDKB -9.1% are right behind it.
▪️ TRX is the only real green: +2.1% on $40M. USDC printed $1,656M in volume and went nowhere, which is just stablecoins doing their job.
▪️ An unidentified European entity lost more than $106M from centralized exchange accounts on Sunday, days after the Binance hack.
▪️ Binance's November 2 update says full proof for its $6.3B hack recovery is complete and replenishment stands at about 95%, with broader token coverage planned.
▪️ A Polymarket account bought the Arizona Cardinals at 1.4 cents when Arizona trailed Dallas by 10 with under four minutes left.
Fear & Greed is at 26, Fear, down from 37 yesterday, so the room is scared and the sellers have the mic. Binance's second-wave warning is the thing to keep an eye on, because affected users are still waiting to see how the rest of the recovery gets handled.
🔮
@hivenetwork