Tether Q3 Profit Hits $1.5B While USDT Reserve Buffer Nearly Doubles to $8B

Key Takeaways:

In Q3, Tether achieved an operating profit of $1.5 billion.Reserve assets rose to almost $8 billion.U.S. Treasury exposure reached $132.4 billion.User Score

8.7

Follow us on Google NewsTether also added another $1.5 billion in operating profits during the quarter, and considerably boosted the buffer for USDT. As of the end of September, the stablecoin issuer’s most recent BDO attestation reports $191.5 billion in assets against $183.5 billion in liabilities within total reserves.

Read More: Tether Backs Peso to Expand USDT Payments Across 4 Major Latin American Markets

🧨 Thorchain's bug froze swaps just as the FBI asks nodes to block Binance hack money

The Binance loot, the one North Korea's Tradertraitor lifted on Oct. 29, was supposed to get washed through Thorchain. Then one reorged Ethereum block conjured 10 ETH out of thin air, and Thorchain hit the emergency brake on most of its routes. The launderers got locked out along with everyone else. Poetic, honestly. Somebody up there has a sense of humor, and it's not us.

▪️ Ethereum reorganized a single block and erased a 10 ETH deposit meant for a Thorchain vault. That deposit never made it back onto the canonical chain. Ghost money: it exists right up until it doesn't.
▪️ Thorchain's observers had already seen the deposit and credited the vault. The linked swap failed its price conditions, so the protocol refunded 10 ETH the vault never actually received.
▪️ Another deposit from the same wallet was refunded too, leaving the vault about 10 ETH short. Solvency protections kicked in and halted Ethereum processing.
▪️ Trading and new swaps stopped on 12 of 13 supported external networks. Some previously initiated outbound payments kept running.
▪️ No malicious intent was found. The cause was a collision between Ethereum's reorg and Thorchain's deposit verification procedures. Nobody did it on purpose, and that's the scary part.
▪️ On Oct. 31 the FBI, with the U.S. Secret Service and IRS Criminal Investigation, asked infrastructure providers to block wallets tied to the Binance theft.

The FBI request is voluntary, not a court order, but it drops a permissionless protocol right in the crosshairs, and Thorchain operators have pushed back on selective transaction blocking before. The pause was an accounting fix, not a targeted freeze on Binance money, and developers are still digging into the malfunction. For anyone trading cross-chain routes, the takeaway is blunt: one reorged block on Ethereum can take a bridge offline across most of its networks overnight. Your 'instant swap' is only as instant as the weakest reorg.

💬 «No subpoenas required, a best-case scenario for investigations.» — Chad Barraford

🔮 Launderers got stuck behind a bug, not a sanction. Next time the bug might come with a federal request attached. Enjoy the ride, hamsters.

@rmpltg

🚨 SEC sues BG Wealth and DSJ Exchange: $130M from retail on paperwork that looked official

The SEC filed a civil complaint against BG Wealth Sharing and DSJ Exchange. Allegedly they raised more than $130 million from tens of thousands of retail investors. The pitch: crypto trading signals and risk-free returns, backed by filings that looked like government approval. The complaint was filed October 29, detailed in an October 30 litigation release.

▪️ The product was an investment program built on purported crypto trading signals, sold with promises of extraordinary, risk-free returns. Sound familiar? It's the oldest trick in the book.
▪️ The sales tool was false Form ADV and Form D filings, presented as proof of legitimacy. A link to an SEC database makes a pitch look official. It doesn't mean anyone approved it.
▪️ The SEC says neither entity was registered with it. The disputed filings have since been removed from the Commission's website. Nice try, but the screenshots are still floating around the chats.
▪️ The SEC is seeking injunctions, disgorgement and civil penalties.
▪️ Heads up: these are allegations in civil proceedings. No final court finding, criminal conviction or confirmed investor recovery amount exists yet. Nobody's getting paid today.

📊 Complaint filed: October 29

If you or someone you know bought into this program, the money is not back yet and nothing is confirmed. Disgorgement only matters if the SEC can find and freeze the assets, and that takes time most victims don't have. Next up: asset tracing and the court calendar, not a payout. The lesson is cheap and old: a logo, a filing number or a 'verified' badge tells you nothing about who holds your cash. Stop buying the badge.

🔮 Tens of thousands of people saw a government database link and wired money anyway. Who sold them the 'verified' part?

@rmpltg

🎰 $1.07B in Crypto Walked Into Sihanoukville Casinos Right Under OFAC's Nose

Thirty-four casinos in Sihanoukville, Cambodia pulled in about $1.07 billion in crypto between January 1 and September 7, 2026, according to blockchain firm TRM Labs. Casinos tied to OFAC-designated networks got $687 million of it, 64% of the total. Sanctions, huh. Nice speed bump.

▪️ Entities linked to Xihu Resort Hotel took in $184M from April 23 to September 7, months after the US designations.
▪️ Entities attributed to Huan Hai Bo Lai International Investment pulled another $129M over the same stretch.
▪️ A casino tied to Jin Bei Group still got $9M after the October 2025 designation of Prince Group and related entities.
▪️ Monthly inflows look smaller: about $148M a month from January to May, then roughly $95M in July and August. Designated casinos dropped from $100M to about $48M a month.
▪️ TRM isn't buying the dip. Operators keep rotating wallet addresses, so some money may be moving through wallets investigators haven't identified yet.
▪️ Almost all of it is USDT on TRON. TRM credits low fees, deep liquidity and wide adoption across Southeast Asia. Of course it does. Cheap, fast, and nobody checks your ID at the door.

📊 Total crypto received, Jan 1 to Sep 7, 2026: $1.07B
📊 Tied to OFAC-designated networks: $687M (64%)
📊 Xihu Resort Hotel-linked, Apr 23 to Sep 7: $184M
📊 Huan Hai Bo Lai-linked, same period: $129M

Sanctions on paper aren't sanctions on the money. If you trade USDT or follow TRON flows, this is the rail still carrying scam-compound cash, and the enforcement headlines aren't cutting it off. Kok An, a Cambodian senator, plus 28 related people and entities, got sanctioned in April 2026 over scam centers that defrauded Americans. The casinos kept taking crypto anyway. September's license purge is the newest move, but the wallet-rotation problem TRM flagged means that monthly drop could be a mirage. Pretty picture on the chart, dirty money underneath.

🔮 Sanctions pulled the menu off the wall, the kitchen's still cooking. Which wallet cluster is TRM not naming yet?

@rmpltg

📊 Morning digest: BTC +0.61%, ETH +1.01%, and the crowd is still pissing itself

BTC at $78,326.18 (+0.61% in 24h), ETH at $2,291.27 (+1.01%). The grind is green, sure, but nobody's popping champagne. The market's still in fear, which is exactly the mood where retail gets handed the exit liquidity like a free sample.

▪️ Green list: ZEC +2.0% on $105M volume, the loudest mover up. TRX +1.5% on $36M and UNI +1.1% on $43M follow, with BNB +0.8% and ETH +1.0% on heavier flows.
▪️ Red list: NEAR -3.2% on $44M, the worst of the day. LINK -2.7% and AVAX -2.7% dropped on only $22M and $20M. The dips are moving on thin money, so this is a ghost town, not a capitulation.
▪️ Liquidations hit $12.5B in October 2026, and longs took most of the damage. Leverage is why your 'safe' long got wiped.
▪️ Thorchain: a one-block Ethereum reorg caused a double refund of 10 ETH, which triggered an emergency pause on cross-chain swaps. Plumbing breaks, and you find out from a pause notice.
▪️ SEC sued BG Wealth Sharing and DSJ Exchange over an alleged $130M+ scheme selling a 'crypto trading signals' program. Official-looking filings, false trading claims. Same old playbook, new logo.
▪️ TRM Labs: 34 Sihanoukville casinos got about $1.07B in crypto from January 1 to September 7, 2026. $687M (64%) went to casinos linked to OFAC-designated networks, despite the Cambodian crackdown.

📊 Fear & Greed today: 37 (Fear)
📊 Fear & Greed yesterday: 34

Fear at 37, up from 34: the crowd is nervous, not capitulated, so this is no bottom party. ZEC and TRX went green on modest volume, and NEAR, LINK and AVAX bled on even less. Don't read that tape as conviction. Watch whether the bounce survives once the big money shows up.

🔮 Longs ate $12.5B in liquidations last month. Who's buying these green candles, and who's selling them to you?

@rmpltg

🚨 Mystery EU victim drained for $106M, and the laundry is already running

An unnamed EU entity lost more than $106 million from several centralized exchange accounts on Sunday, Nov 1, according to onchain sleuth ZachXBT. No victim name, no exchange names. Days after the Binance hack, and the stolen money is already being laundered like it's a side hustle.

▪️ The funds left the exchanges as USDC and USDT, the two stablecoins whose issuers can freeze them. Somebody did their homework.
▪️ Within 24 hours the attacker swapped USDC into ETH to shake off the stablecoin trail. Classic: if the issuer can freeze it, turn it into something they can't.
▪️ Funds went through instant exchanges WellWallet and Kyrrex, which barely check who you are. KYC? Never heard of her.
▪️ Part was converted into Monero through the Wagyu swap service. Monero hides senders, receivers and amounts. Nothing to see here, just a quarter-million-dollar magic trick.
▪️ Assets were bridged across several blockchains. ZachXBT has tied 11 wallet addresses to the funds, so the trail exists, it's just messy.
▪️ ZachXBT says with 'a high degree of confidence' it isn't North Korea's Lazarus Group, citing multiple laundering indicators. Relax, nobody's getting a sanctions-era fairy tale today.

📊 Wallet addresses tied to EU theft: 11
📊 Solana arbitrage bot drain: $786K

If your stables sit on a centralized exchange, this is the reminder that the exchange is the weak link, not your conviction. Hodling is great until the platform holding your coins turns out to be a sieve. The Binance precedent shows issuers can freeze fast: Tether froze stolen USDT in 37 minutes and Circle froze $823M in USDC, per Elliptic. Nobody has confirmed whether any EU funds got frozen, and the attacker is already fleeing USDC and USDT, so don't hold your breath for a happy ending. Meanwhile Brazil's Mercado Bitcoin halted withdrawals after a $40M hack of its own, and BTCPay Server told merchants to switch off their servers amid hot wallet attacks. Translation: the hot wallets are getting picked like a pocket on payday.

💬 «This pattern strongly suggests a potential wallet compromise.» — Onchain Lens

🔮 Who parks $106M on EU exchanges, then needs it washed through Monero in a day? Open question. I'd bet the answer isn't a Sunday hobbyist.

@rmpltg

Binance got gutted for $6.3B, 95% 'refilled', and now fake support clowns are sliding into your DMs

Binance lost about $6.3 billion in crypto after an Oct 29 attack on its hot wallets. The exchange says 95% of the hit is already replaced with company money. Cool story. Now it's warning that the real second wave isn't a hacker. It's a fake Binance support agent in the DMs of people waiting on their withdrawals.

▪️ Withdrawals reopen in phases from Nov 1. Next phase is Nov 3, and Binance hasn't said which coins and networks come back. Sit tight, boys.
▪️ The script: fake Binance staff in emails, DMs and group chats offer to speed up your pending withdrawal or sell you 'priority queue' access. Yeah, a VIP line to get robbed faster.
▪️ More bait: fake compensation claims, fake proof-of-reserves sites, and 'move your coins to a secure wallet' instructions. Classic hamster feeding.
▪️ The killer move: you approve a malicious wallet permission, and the attacker moves your assets without asking you again. No undo button. Your coins are gone, and so is your sense of humor.
▪️ Binance says it doesn't charge fees to unlock withdrawals and never asks you to authorize wallet transactions to regain access. So anyone asking you to do that is the thief. No grey zone here.
▪️ Refill split: 95% from company resources, the last 5% in less-liquid coins bought on the market and OTC. Tracing the stolen funds is a separate track, so don't hold your breath on that one.

📊 Replaced from company resources: 95%
📊 Assets in Oct 31 reserve proof: 10
📊 Time to generate next proof (Nov 4 snapshot): 40-50 hours

Got a pending withdrawal? The only real channels are the app and Binance's official verification service. Anyone in your DMs offering to unlock your funds for a fee works for the thieves, full stop. The proof covers balances at 00:00 UTC on Oct 31 and shows at least 1:1 backing for that snapshot. It doesn't show current solvency and it doesn't audit the exchange. A PR tool is not a balance sheet, so don't let it pass for one.

🔮 Full refill or a pretty shop window? The proof is an Oct 31 snapshot, not today's books.

@rmpltg

📉 BTC at $76,844, ZEC bleeds 10.9% on $182M, Fear at 26. The chat is sulking

Bitcoin is down 1.93% to $76,844.01 and Ether is down 1.65% to $2,253.98. The whole board is red and the crowd is sulking. Zcash took the biggest hit among the high-volume names, while everything else just slid down with it.

▪️ ZEC -10.9% on $182M, the heaviest volume on the loser list. Somebody is getting shaken out with size, and it's not you, unless it is.
▪️ NEAR -10.6% on $104M. SOXLB -15.4% on $35M is the deepest drop on the board, with INTCB -9.2% and SNDKB -9.1% right behind it. Nobody's catching these knives for free.
▪️ TRX is the only real green: +2.1% on $40M. USDC printed $1,656M in volume and went nowhere. Stablecoins doing their boring job, as always.
▪️ An unidentified European entity pulled more than $106M out of centralized exchange accounts on Sunday, days after the Binance hack. That's not a coincidence you're supposed to shrug off.
▪️ Binance's November 2 update says full proof for its $6.3B hack recovery is complete and replenishment stands at about 95%, with broader token coverage planned.
▪️ A Polymarket account bought the Arizona Cardinals at 1.4 cents when Arizona trailed Dallas by 10 with under four minutes left. Either someone knew something or got very lucky.

Fear & Greed is at 26, Fear, down from 37 yesterday. The room is scared and the sellers have the mic. Binance's second-wave warning is the thing to keep an eye on, because affected users are still waiting to see how the rest of the recovery gets handled, and that's where the next leg of panic usually comes from.

🔮 Fear at 26 and falling. Who's buying this panic, and who's left holding the bag?

@rmpltg

🏈 Polymarket degen buys Cardinals at 1.4¢ and walks off with $118K

Somebody bought Arizona at 1.4 cents when the whole room had already buried them, then hedged like a pro. Polymarket account CutJalenHurts put in about $2,475 on Sunday's Cardinals–Cowboys game and finished about $118,500 ahead after Arizona won 33–30 in overtime. Everyone else was writing the Cardinals off. This account wasn't. Funny how that works.

▪️ Entry: about a minute after Dallas kicker Brandon Aubrey's 35-yard field goal made it 27–17 with 3:54 left, the account bought 171,703 Cardinals shares at 1.4¢.
▪️ Not a typo. After the kick, Polymarket's moneyline traded near 1.5¢, and Kalshi's Cardinals contract touched 1¢. That's 1–2% implied odds, and the room was too busy crying to notice.
▪️ The account started on Dallas: about 51,000 Cowboys shares at 76–77¢ right after kickoff. Then it added Cardinals at 1.4¢, and 4,616 more at about 13¢ after Aubrey's second field goal.
▪️ Tied game, and it bought about 24,000 more Cowboys at 57–70¢. In overtime it merged 74,948 Cardinals–Cowboys pairs back into $74,948 in cash, locking in roughly $17,000 whichever team won.
▪️ Leftover Cardinals shares paid $1 each, $101,370 total. Money in was about $57,800, money out about $176,300.
▪️ Polymarket splits the merge proceeds between the sides: +$135,754 on Cardinals, −$17,219 on Cowboys. Net is the same either way. The house doesn't care who wins, only that you keep trading.

📊 Entry price, Cardinals: 1.4¢
📊 Overtime merge profit lock: ~$17,000

Even the sharks bleed. BreakTheBank, one of Polymarket's biggest sports traders, made about $215,000 on Arizona across moneyline and spread bets, buying moneyline shares at an average of 24¢. Across Sunday's NFL slate its settled positions showed about $1.82 million in gains against about $1.2 million in losses including fees, leaving it roughly $625,000 ahead. Late swings cut both ways too: last month another account was eight seconds from a $623,449 payout before a 57-yard field goal at time expiry wiped out its $147,000 Eagles bet. Eight seconds. Brutal.

🔮 A 1.4¢ share is a lottery ticket. Hedging the other side to lock in profit is how you stop being the donor.

@rmpltg

🔓 Mercado Bitcoin: $38M gone, and the exchange swears nobody lost a cent. Sure, buddy.

Brazilian exchange Mercado Bitcoin froze deposits and withdrawals on Monday after a security incident in one of its systems. The assets involved are now put at about $38M, and the exchange says customers won't lose funds. Its own blockchain security partner Hypernative had already flagged the outflow overnight, so somebody saw this coming before the exchange did.

▪️ First suspicious transfer hit at 2:15 UTC. The big exodus came between 6:19 and 6:53 UTC, so about half an hour of ugly.
▪️ Wallets tied to the exchange pushed funds into newly created addresses. The money was moved, not sold. Nobody's dumping, they're relocating.
▪️ The transfers spread across at least 10 blockchains, including Bitcoin, Ethereum, Solana and Tron. Spreading it around like that is not a hobby, it's a plan.
▪️ The transactions looked like ordinary signed transfers, as if the source wallets had authorized them themselves. Nice. The keys did the job, the owners just got told later.
▪️ Hypernative says it's still unclear how the attacker got the ability to sign those transactions. Translation: nobody knows how the front door opened.
▪️ The exchange says no customer data leaked. Access was cut as a precaution, and services come back only once full security conditions are in place.

📊 Blocked so far with Tether, Circle, Paxos, BRL1, Chainalysis: $11M
📊 Moved out of exchange wallets overnight (Hypernative): $40M+

Translation: you can't withdraw, and 'funds are safe' is what you say while you're still counting. Containment is ongoing and the exchange admits more eligible amounts are still being identified, so the $38M figure is a floor, not a ceiling. Same week, ZachXBT flagged a separate suspected theft of more than $133M in withdrawals from centralized exchanges, tied to an unnamed EU entity. He thinks a large Western European financial institution got hit and that the incident is being covered up, with more than $30M already laundered through WellWallet, Kyrrex and Wagyu into XMR. He's highly confident it isn't Lazarus. So no, the industry isn't catching its breath. It's still underwater.

🔮 $11M blocked out of $38M and 'no funds lost'. Which number is your balance going to match?

@rmpltg

📊 Green board, scared crowd: BTC and ETH up, Fear still driving the bus

BTC at $77,450 (+0.85% in 24h), ETH at $2,283.42 (+1.32%). Both green, neither actually running. The tape is flat-to-up, nobody wants to commit, and the crowd is sitting on its hands waiting for a sign from the sky.

▪️ ZEC +8.2% on $183M volume: the only real mover with size behind it. The feed gives zero catalyst, so don't invent one. Watch whether the volume holds next session, or it's a pump with nobody home.
▪️ PEPE +3.8% ($47M) and UNI +3.0% ($42M) are next on the gainers list. Clean moves, no story attached. Enjoy them while the story doesn't exist yet.
▪️ BNB -0.2% on $87M of volume, the biggest turnover on the board for almost no net move. Somebody's churning there, and it isn't you getting paid.
▪️ LINK -1.4% ($22M) and SPCXB -1.7% ($23M) lead the losers. Small bleed, nothing screaming breakdown. Yet.
▪️ RLUSD and RWUSD at -0.0% on $41M and $25M. Parked and boring, exactly how they're supposed to behave. Nothing to see, move along.

Fear & Greed is at 34 (Fear), up from 26 yesterday. The mood's thawing, not flipped, so the crowd is still waiting for permission to buy. Mercado Bitcoin's withdrawal freeze is the wildcard: the exchange says customers won't lose funds and containment is ongoing. That's a promise, not a verdict. Until the recovery numbers move, it's a headline that can still grow teeth.

🔮 $87M of BNB volume for a -0.2% move: who's distributing, and who's left holding the bag?

@rmpltg

🧨 Binance's SAFU fund: 7,500 BTC just vanished into a mystery wallet, and nobody's talking

Half of Binance's SAFU emergency reserve, 7,500 BTC, got burned to cover the $6.3 billion hot-wallet hack. Now it's moving again. On Nov. 3 the coins went to an unlabeled, high-volume address. Nobody's claiming it. Binance isn't explaining the transfers. Classic.

▪️ Oct. 31, 14:45-14:51 UTC: SAFU's published address sent 1 BTC, then 7,499 BTC, to an intermediate address. The coins sat there for three days, like they were waiting for a ride.
▪️ Nov. 3, 05:56 UTC: that intermediate address sent all 7,500 BTC in one transaction to a wallet with 2,400+ transactions in its history. Not a fresh burner. A seasoned wallet.
▪️ Fifty minutes later that wallet chopped the stack into 150 outputs of about 50 BTC each. That's the textbook way to feed market makers or OTC desks.
▪️ 96 of those outputs (4,800 BTC) were bundled into a single 9,346 BTC transfer. The other 54 chunks went out separately the same day. Somebody's in a hurry, or somebody's very well organized.
▪️ SAFU held 15,000 BTC in February after converting its roughly $1B stablecoin reserve into bitcoin. Now it holds just over 7,500 BTC. Half the reserve evaporated while the marketing kept saying 'safe'.
▪️ Binance's Nov. 3 incident report blames a tainted developer install and an abused internal wallet service. It doesn't mention SAFU at all. Convenient.

📊 Hack size: $6.3B
📊 SAFU left, worth: ~$572M
📊 Net outflows, 7 days: $12.17B

The fund's own rule: Binance refills SAFU to $1B if it drops below $800M from BTC price moves. This drop came from spending, not price, so technically the rule never fires. Binance promised a ~$1B top-up with no date. Read that as: the refill is a promise, the wallet is a fact. If you bought the 'safety net' story, ask who's holding those coins right now, because the exchange isn't telling you.

💬 «committing to replenishing the SAFU to return the fund size to approximately US$1 billion» — Binance

🔮 Half the safety net is gone, the refill has no date, and the coins sit in a wallet nobody will name. Who's holding them?

@rmpltg

🩸 Miners cash out: Riot dumps 10,599 BTC while Hut 8 unloads $250M

Bitcoin miners Riot Platforms and Hut 8 coughed up big BTC sales in their Q3 earnings reports on Wednesday. Riot sold coins worth $751.5M in one quarter to fund its data center expansion. Hut 8 dumped about $250M across Q3 and October to buy back its own stock. So much for miners being the diamond hands of this market, huh.

▪️ Riot: 10,599 BTC sold in Q3, more than half of the 20,264 BTC it has dumped in 2026 (nearly $1.5B total). Not a typo.
▪️ The pace is accelerating: 3,778 BTC in Q1 ($289.5M), 5,887 BTC in Q2 (~$443M), then 10,599 BTC in Q3. Somebody's in a hurry.
▪️ Riot ended September with 2,418 BTC, down from 18,005 at the start of the year, and expects to sell substantially all newly mined coins. So the miner is basically a sell order with a power bill.
▪️ Hut 8: 954 BTC sold in Q3 to fund buybacks, then 2,148 BTC in October. Combined 3,102 BTC, about $250.2M. Buying its own stock with coins. Bold move.
▪️ Hut 8 still holds 16,787 BTC (~$1.4B), including its majority-owned American Bitcoin subsidiary, which is backed by the Trump family. Keep an eye on that one.
▪️ Riot's AI pivot: a 15-year lease for 910 MW at Corsicana, Texas, worth ~$28B over the initial term, pushing contracted data center revenue to ~$38B. Pitch deck says AI.

📊 Riot Q3 BTC sold: 10,599 BTC
📊 Riot cash and bitcoin, end of Q3: $950.2M
📊 Hut 8 combined sales: $250.2M
📊 Riot contracted data center revenue: ~$38B

Riot's Q3 net income fell to about $4M from $104.5M, so those coin sales are paying for the AI build-out, not padding a profit cushion. Hut 8's $131.1M net income came from a noncash gain on rising digital asset prices, not from operations. That's paper profit dressed up as earnings. Riot says it will keep selling new mining output, so the supply keeps hitting the market every day. The market reactions to the two reports were wildly different, and if you're the one holding the bags, you already know why.

🔮 When the miners sell BTC to build AI data centers, who's left holding the bag?

@rmpltg

📊 BTC $80.4K, ETH +6.3%: fear sobers up to neutral, and the leverage crowd gets shaken out

Bitcoin is at $80,438 (+4.06% in 24h), Ether at $2,423 (+6.31%). Fear & Greed jumped from 34 yesterday to 50 (Neutral). The crowd got brave again right when the leverage started getting shaken out. Classic.

▪️ Green board: ZEC +7.6% on $239M volume, ETH +6.3% on $765M, UNI +5.9%, LINK +5.2%, ADA +4.8%. ETH is where the real money is. ZEC is the only other name with serious volume.
▪️ Red board: TRUMP -17.2% on $42M, the worst drop on the board. SOXLB -13.5% on $47M and SNDKB -8.0% on $60M are next in line.
▪️ Top story: BTC's run to $80,000 liquidated roughly $415M of leveraged positions. That's how fast a green candle turns into a cascade. Somebody was very sure of themselves at the top.
▪️ Second story: BTC then dropped below $76,000 and $250M in leveraged positions got liquidated. The digest's version: institutional outflows and waning confidence in Bitcoin.
▪️ Binance's SAFU fund: about 7,500 BTC (~$570M), pulled to cover the $6.3B hack, then moved again to an unlabeled high-volume address. Nobody has said where it's going.
▪️ Polymarket trader 0xA2 booked $917K on bets tied to the Democratic sweep of the midterms. Somebody read the map before the rest of us got our coffee.

📊 Fear & Greed (yesterday 34): 50 (Neutral)

Sentiment just flipped from fear to neutral, and the liquidation list from both directions is still warm. Whoever chased the $80K breakout with leverage is the one who got wiped on the way down. Before you touch anything today, watch the BTC-to-$76K zone and the Binance SAFU wallet. Don't be the exit liquidity for someone who already left.

🔮 Neutral at 50 and a fresh liquidation list. Who's holding the bag this time?

@rmpltg

🧨 Binance and Polymarket want Polygon to rewrite history and claw back $6.8M in stolen POL

Binance and Polymarket are asking Polygon for a hard fork to pull back roughly 70.49M POL, worth about $6.8M, lost in two separate hacks on their platforms. Block producers already froze the stolen tokens, but a freeze only keeps them still. The fork would actually send them back to the owners.

▪️ Polymarket's share sits in four wallets, Binance's in one. Both got robbed in separate security incidents, so this isn't one tidy hack with a neat bow on it.
▪️ The fork strips the tokens from five attacker-controlled addresses and routes them to recovery wallets verified by Polymarket and Binance. Verified by them. Remember that part.
▪️ It runs at a predetermined block and leaves POL's total supply untouched. Nobody mints anything. The ledger just gets edited, like a spreadsheet nobody was supposed to open.
▪️ Block producers have already blocked transactions from those addresses. The proposal itself calls that restriction temporary and admits it cannot return the funds.
▪️ Still needs governance approval and a test run on Polygon's Amoy testnet. Discussion is slated for Nov. 5, with no mainnet date confirmed. Translation: don't front-run a date that doesn't exist yet.
▪️ Backdrop: Binance's record $6.3B hack on Oct. 29, and Polymarket suspending trading after a third-party provider was compromised. Two platforms bleeding, and the fix is to bend the chain.

📊 Total POL stolen: 70.49M
📊 Polymarket wallets (4): 23.86M POL
📊 Binance wallet (1): 46.63M POL

If you hold POL, this is a governance vote on whether a chain rewrites its own state to undo a theft, and that precedent is the part that matters. The freeze is already live. The real question is whether the vote passes and the fork fires on schedule. Nothing is locked in yet: no mainnet date, no approval, just a proposal and a testnet to get through.

🔮 Rolling back a thief's wallet sounds clean on a slide. Who decides which addresses count as 'attacker-controlled' next time?

@rmpltg

BTC to $81K on gold's coattails, but the shorts are the ones paying the bill

Bitcoin ripped from about $75,600 to above $81,000 on Nov. 4, hitching a ride on gold's 3.4% jump to $4,061.10 while the crowd screamed debasement trade. Peel back the layers and this wasn't a fresh wave of believers. It was shorts getting shoved into buying back, and the dumb money is calling it a thesis.

▪️ Gold futures posted their biggest daily gain in three months after the dollar weakened on the Democrats' sweeping US midterm win
▪️ Stocks joined the party too: S&P 500 +1.6%, Dow +3%, and the 10-year Treasury yield slid from about 4.95% to 4.89%
▪️ Shorts were the fuel: about 81% of the bearish positions liquidated within one hour were shorts, and every forced buyback pushed price higher
▪️ Bitfinex's Nov. 4 analysis found the recovery was driven largely by short covering, with limited aggressive buying in the spot market
▪️ Spot ETFs bled about $1.16B over the three sessions before the bounce, their biggest outflow since late June
▪️ Nov. 4 brought $74.6M back, but Fidelity's FBTC took in $236.7M while BlackRock's IBIT lost another $201.2M

📊 Short-term holder BTC in profit, now: ~38%
📊 Short-term holder BTC in profit, early October: at least 97.5%
📊 CBO federal deficit projection, 2026: $1.9T

Long the debasement story? Then the data is telling you the bid is paper-thin. ETF money still hasn't clawed back what it bled, and most short-term holders are underwater. Lower yields and a stock relief rally explain this candle way better than some currency-doom sermon. The CBO's $1.9T deficit path is great ammo for the narrative, but it didn't pay for this move. Shorts run out, and the support walks out with them.

🔮 Gold and BTC holding hands in a short squeeze. Who's buying once the shorts are gone? Good luck finding them.

@rmpltg

🤖 AI-hacker CRAFTY FALCON is draining exchange wallets while India's CERT-In yells fire and nobody listens

India's CERT-In is warning that CRAFTY FALCON, an AI-assisted financial threat actor, is going after banks, fintechs, payment providers and crypto exchanges to steal wallet keys and siphon funds. NBFCs and fintech firms have already reported successful hits. It kept going after earlier warnings, because these guys keep coming back to whoever patched halfway. A half-done patch is just a welcome mat.

▪️ Targets get scanned by machine intelligence and hit at machine speed. Nobody's clicking through this by hand, so your 'we'll look into it Monday' plan is dead on arrival.
▪️ Timing is the trick: holidays, weekends, the low-monitoring windows when the SOC is asleep. Detection and response show up late, when the money's already gone.
▪️ Repeat customers: the actor deliberately re-hits entities that already got restricted advisories where remediation was incomplete. A loyalty program for hackers, basically.
▪️ Entry points are internet-exposed testing and staging environments. Reverse-engineered app codebases give tailored exploits, and modified app packages make unauthorized API calls.
▪️ Cloud abuse: AWS Systems Manager and Lambda run commands and deploy malicious files inside the victim's infrastructure. Your own cloud tools, working for the other side.
▪️ IP allow-listing gets bypassed through whitelisted third-party fetcher IP pools. The whitelist is the door.

📊 Test transaction: 1 INR (~$0.011)

If your coins sit on an exchange, a fintech wallet or a payment app, the weak spot isn't your password. It's the operator's forgotten staging box and its payout API. CERT-In already warned these firms once, and the campaign rolled on anyway. So those 'we fixed it' press releases are worth exactly as much as the patch levels behind them. Expect more re-hits on the ones that patched halfway.

💬 «AI tools can now find vulnerabilities faster than teams can patch them, which is why we've seen a string of major incidents in recent months.» — Bernardo Brites

🔮 Which exchange is still running a staging server nobody remembers to shut off?

@rmpltg

📉 BTC −6% to $75.6K, ETH −8%: the crowd is scared and only stablecoins are smiling

Bitcoin is down 5.97% to $75,648.87, Ether is down 8.07% to $2,227.81 over 24 hours. The gainers board is a parking lot of stablecoins sitting at 0.0–0.1%. The only real green is INJ, and that's it.

▪️ INJ +3.0% on $24M volume is the only green that actually moved. U, RLUSD, USDC and USD1 are flat stables. Their volume is money parked in the lot, not buyers. Don't mistake a parking lot for a rally.
▪️ The real bloodbath is in the losers: SOXLB −25.4% on $107M, KORUB −25.0% on $22M, SNDKB −14.0% on $98M. These look like tokenized wrappers, so before you average down, check what you actually own.
▪️ MUB −10.6% and MSTRB −10.3% close out the bottom five. Nothing in the sources explains either move, so I'd treat it as sell-side flow until someone proves otherwise.
▪️ Polygon: Binance and Polymarket are pushing a proposed hard fork to recover $6.8M in stolen crypto. Block producers have already frozen the tokens, so the fork is the whole game from here.
▪️ Tendril: a flaw in the sell hook of its custom token logic let attackers drain roughly $555K in USDT. Custom DeFi token code keeps getting people robbed, and it's never the flashy protocol that gets…
▪️ Loopscale: the DeFi lender paused operations after a sustained attack on its Genesis Vaults. Amount lost and outcome are not disclosed yet, which in this business usually means the number is ugly and…

📊 Short squeeze on the Nov. 4 rally: $378M

Fear means the crowd is spooked, not washed out. Yesterday it was neutral, so this is the zone where weak bounces get sold into and dips get bought by whoever still has nerves. BTC and ETH are both down 6–8%. Today is about protecting your size, not chasing green stablecoin lines like they're a signal.

🔮 The Nov. 4 short squeeze is already dead. So who's holding the bag now, the shorts or the longs?

@rmpltg

🚨 $6.3B walked out of Binance hot wallets. Record heist, North Korea is the suspect

Someone drained Binance's hot-wallet infrastructure for $6.3B, the biggest theft in crypto industry history. Per TRM Labs, most of it was gone in about 20 minutes. Reports link the job to North Korea, which reportedly rewards its top hackers with apartments in Pyongyang. Now that's a retention plan.

▪️ The target was hot-wallet infrastructure, the internet-connected layer exchanges use to process withdrawals. Nobody in the sources says how they got in. Convenient.
▪️ Attribution is still a report, not a verdict. Cryptobriefing calls the Binance heist 'alleged' and files the reward story under 'reports'. Read that twice before you repost it.
▪️ Binance CEO Richard Teng says the 'vast majority' of user assets sit in cold wallets. Binance has not published the exact cold/hot split. 'Vast majority' is a vibe, not a number.
▪️ Binance restored withdrawals and covered the damage through its SAFU fund and its own reserves. Prices sold off first, then rebounded more than expected.
▪️ Rivals went straight into PR mode. Gate launched a 'Proof of Security' framework claiming its cold storage could cover 104.58% of customer assets even if hot wallets were fully drained, pending…
▪️ Offline isn't a magic shield. Hong Kong's SFC warned in an August 2025 circular that compromised signing systems, weak access controls or staff approving fraudulent transactions can hit cold wallets…

📊 Coinbase cold storage: more than 99%
📊 Gate cold storage: 88.26%
📊 Upbit cold storage (Sept 2026): 99.17%
📊 Bithumb cold storage (end Sept): 94.76%

Binance says it covered the damage and the market bounced, so the panic phase is over. Now comes the real question: the biggest exchange still hasn't disclosed its cold/hot split, and everyone else is posting pie charts to look safe. US regulators are checking banks after the hack, so expect more heat on custody and hot-wallet exposure. Pie charts don't stop heists, and the fireworks aren't over.

💬 «the 'vast majority' of user assets are held in cold wallets» — Richard Teng

🔮 Everyone's flexing cold-storage pie charts this week. Nobody's showing who holds the signing keys.

@rmpltg