Blockchain & Digital Assets Briefing — October 31, 2026

Top stories

Remediation, forensics and the freeze debate after the largest theft in crypto history.

Binance says it has replenished about 90% of stolen assets and fully backed its ten largest tokens
Binance's Oct. 31 incident update raised coverage of the roughly $6.3 billion taken from its hot wallets to about 90%, up from the 80% it disclosed a day earlier. Bitcoin, ether, BNB, SOL, XRP, USDT, USDC, USD1, RLUSD and ZEC are now fully reserve-backed 1:1; the remaining tenth sits in smaller, less liquid tokens that the exchange is still buying on-exchange and over the counter. Funding came from part of the Secure Asset Fund for Users, a futures insurance fund and company capital, with SAFU to be topped back to about $1 billion within a day. A fresh proof-of-reserves snapshot was taken at 00:00 UTC on Oct. 31, the full zero-knowledge proof is expected Nov. 3, and withdrawals are still targeted to resume in phases on Nov. 1.
Why it matters: "Fully backed" is currently a company statement, not a verifiable balance: the proof that settles it arrives two days after users regain the ability to withdraw. What matters for Nov. 1 is the composition — the ten assets that are whole are the ones most users actually hold — while holders of low-liquidity tokens are the ones still exposed. A second detail deserves attention: CoinDesk reported that the compromised wallets had previously appeared in Binance's own list of assets backing customer balances, which is why the reserve disclosure, not the reimbursement pledge, is the number to read.

Binance's investigation finds more breach points, and attackers who erased their tracks
Co-CEO Richard Teng said in a video statement on Oct. 30 that investigators found additional points of breach beyond an initially suspected compromised employee laptop, and that the attackers used a self-destruct mechanism to erase evidence. The intrusion abused Ethereum's EIP-7702 account-delegation feature to take control of a hot wallet without passing Binance's normal approval procedures. Binance is reviewing cloud systems, employee devices, private-key management and transaction-signing procedures while it rebuilds the withdrawal service, and says the FBI is aware of the incident. Analytics firm TRM attributes the theft to TraderTraitor, a North Korean unit, and Elliptic put verified freezes at $2.84 billion.
Why it matters: The lesson is about the signing path, not the key: no private key leaked, yet an approved authorization was enough to move billions in minutes. EIP-7702 is a general-purpose feature that every wallet and custodian with smart-account support now inherits, so the practical control is allowlisting delegations to audited contracts and treating delegation as a standing permission that must expire. Expect counterparties and regulators to start asking exchanges for evidence of exactly that control rather than for proof-of-reserves screenshots.

Issuers froze about $2.7 billion within hours — and legal experts are asking who else gets that speed
Tether froze more than 1.56 billion USDT, Circle blocked about 823 million USDC, and Ripple and World Liberty Financial froze smaller amounts of RLUSD and USD1, taking the total immobilized to roughly $2.7 billion according to TRM Labs. Tether's first freeze landed 37 minutes after the theft. Legal and industry experts told CoinDesk the response was justified but uneven: smaller hack victims rarely see the same speed, and the issuers' published policies say they freeze when law enforcement or a court directs them, which is not what the public statements described. Freezing is also not recovery — issuers can burn and reissue, but establishing who is owed the tokens can require a legal process.
Why it matters: Issuer discretion is now de facto market infrastructure, operating without a published standard, and it cuts both ways: Circle's terms allow it to freeze USDC sent to or from a blocked address, so an innocent counterparty can lose access through association. Roughly $2.4 billion of the haul, mostly bitcoin and ether, sits beyond any issuer's reach — the attacker was traced splitting about $1.4 billion of bitcoin across 19 wallets. For anyone building settlement rails, the design implication is to treat stablecoins as revocable instruments with counterparty risk, not as bearer cash.

Markets & institutional adoption

ETF flows, price action and the charter route into federal supervision.

US spot bitcoin ETFs shed $643 million in a day, their largest outflow since June
The twelve US spot bitcoin ETFs recorded $643.33 million of net outflows on Oct. 30, per SoSoValue, ending a four-session inflow streak. BlackRock's IBIT lost $233.70 million, Fidelity's FBTC $201.04 million, ARK 21Shares' ARKB $129.55 million, Grayscale's GBTC $53.32 million and Bitwise's BITB $25.72 million; the other seven funds were flat. Total net assets stand at $98.14 billion, about 6.34% of bitcoin's market value. Ether funds lost another $156 million, a fifth straight day of outflows. Bitcoin traded near $77,200, down about 1.7% in 24 hours and roughly 7% over October, with the month closing tonight.
Why it matters: Context beats the headline: $643 million is about 0.7% of ETF assets and smaller than the $635 million exit on Oct. 22, so this is de-risking, not capitulation. The comparison that matters is Bybit in February 2025, when a $1.5 billion hack was followed by a then-record $1 billion single-day outflow and close to $3 billion over the week — ETF holders reprice exchange risk faster than spot traders do, because redeeming a share is a one-click decision. Monday's print, after the Nov. 1 withdrawal restart, is the cleaner signal on whether allocators treat this as an exchange problem or an asset-class problem.

Galaxy applies for a national trust bank charter to put custody, trading and staking under one regulator
Galaxy Digital's brokerage subsidiary filed on Oct. 29 with the Office of the Comptroller of the Currency to establish Galaxy National Bank, a New York-based national trust bank that would house its digital-asset custody, trading and staking businesses along with fiduciary investment advisory services under a single federal framework. The application is pending and would not permit deposit-taking or commercial lending. It follows a New York BitLicense and money transmission license for a Galaxy subsidiary, and lands in a queue that this week also produced unconditional OCC approval for Ripple's trust bank.
Why it matters: Charter conversion is the quiet institutional land-grab of this cycle: a national trust charter replaces state-by-state licensing friction with one supervisor, and it puts crypto custody inside bank examination — the box pension and endowment mandates need ticked. It is an application, not an approval, and the Independent Community Bankers of America has sued the OCC this month arguing the trust-charter surge creates a regulatory gap, so the pipeline can slow. Watch whether the OCC attaches conditions on staking and on the segregation of client assets.

Protocols, products & regulation

Enforcement built on fake filings, and stablecoins asking to be treated as cash.

SEC charges two firms over a $130 million crypto scheme built on fake SEC filings
The SEC charged BG Wealth Sharing Ltd and DSJ Exchange Pty Ltd on Oct. 29 in the Northern District of California, alleging a scheme that raised more than $130 million from tens of thousands of retail investors across 40-plus states between October 2025 and June 2026. The pitch promised extraordinary, risk-free returns from "SI-generated" crypto trading signals — Bloomberg Law reported guaranteed monthly returns of at least 60% — and the defendants submitted false Form ADV and Form D filings, then showed them to investors as proof the SEC had licensed the program. Neither entity was registered; the filings have been removed from the SEC's website. The agency seeks injunctions, disgorgement and penalties.
Why it matters: The fraud vector was metadata, not technology: public filings were repurposed as a trust signal, which is cheap to fake and hard for a non-expert to disprove. The practical control is procedural — verify registration through Investor.gov or the adviser database rather than a screenshot, and treat "SEC-registered" claims as a claim to be checked. It also fits the year's enforcement pattern: retail-facing fraud, not token classification, is where SEC crypto cases are concentrated.

Circle asks the SEC to treat GENIUS-compliant stablecoins as cash and zero out the broker-dealer haircut
In a comment letter filed Oct. 20 on the SEC's proposed Regulation Crypto Assets and publicized on Oct. 28, Circle argued that payment stablecoins meeting the GENIUS Act's requirements should be recognised as cash: usable at par in the registration-exempt offerings the proposal creates (up to $5 million over four years, $75 million annually), and free of securities obligations imposed on the token or issuer merely because it was accepted as payment. It also asked the SEC to drop the 2% net-capital haircut that broker-dealers apply to qualifying stablecoin inventory, and to align accounting and customer-reserve treatment.
Why it matters: This is the unglamorous plumbing that decides whether tokenized settlement actually saves money. At the current 2% haircut, a dealer holding $1 billion of stablecoin inventory must deduct $20 million from net capital; zeroing it makes market-making and same-day settlement in dollars far cheaper to run. Two caveats keep this in the "request" column: the 2% is non-binding SEC staff guidance rather than a Commission rule, and recognising a stablecoin as cash for one purpose says nothing about redemption risk or reserve quality.

Bottom line

Treat this as a credibility test rather than a solvency event. Three dates decide the narrative: phased withdrawals on Nov. 1, the checkable proof of reserves on Nov. 3, and Monday's ETF flow print. A $643 million ETF exit is about 0.7% of fund assets — a trim, not an exodus — but it shows allocators reprice exchange risk faster than spot markets do. The structural change outlasts the hack: stablecoin issuers can now immobilize billions at their own discretion with no published standard, and custody is steadily migrating into federal bank charters, where the OCC's approval queue is becoming the real gatekeeper for institutional crypto.

As of

October 31, 2026, 15:00 UTC. Prices are spot snapshots. This briefing was researched and generated for NPDev News subscribers; it is a news summary, not investment advice.