Blockchain & Digital Assets Briefing — November 1, 2026

Top stories

The largest theft in crypto history moves into remediation, and a forensics vendor discloses its own breach.

Binance resumes bitcoin and ether withdrawals after covering 95% of the $6.3 billion theft
Binance restored bitcoin withdrawals shortly after 06:00 GMT on Sunday and brought back ether, BNB and some USDT and USDC withdrawals, with the first phase covering 15 assets including XRP and dogecoin; remaining assets follow in stages. The exchange said it spent company money to buy $6 billion of replacement tokens, or about 95% of what was taken, and that the outstanding 5% consists of less liquid assets it is still sourcing. Roughly $3 billion had been located with industry partners as of Friday, Binance said, and about $6.34 billion of corporate funds was set aside to absorb the loss, drawn from a $1 billion Secure Asset Fund for Users, part of the futures insurance fund and the corporate treasury. Co-CEO Yi He said half of SAFU was used, with the fund to be replenished toward $1 billion. Separately, the FBI attributed the attack to the North Korean state unit known as TraderTraitor and said it observed the group converting stolen assets into ether.
Why it matters: The distinction that matters is between a promise and a balance sheet. Binance has now converted "we will cover all losses" into actual purchases, which is why spot bitcoin did not break down on the news. Three things remain unverified: whether the Nov. 3 proof of reserves reconciles with the 95% figure, whether the illiquid 5% gets sourced at all, and how much of the frozen $3 billion is recoverable versus merely located. For readers holding exchange balances, the practical read is that counterparty risk at the largest venue was absorbed by corporate capital rather than socialised across users — a better outcome than Mt. Gox or FTX, but one that consumed half of a fund designed for exactly one such event.

Chainalysis discloses a breach of customer names and emails, says investigation data was not accessed
Chainalysis said an external actor gained unauthorized access to its internal systems and tools using what it described as "offensive agentic techniques." Some customer information was accessed — names, email addresses, user IDs and organizational role labels — while the company said it found no evidence of access to investigation content such as graphs, notes or cases, transaction or query results, plaintext passwords, MFA secrets or session tokens. It has notified customers, engaged outside security firms and explicitly stated the incident is unrelated to the Binance theft. The company is still determining which records belong to which affected organization and advised users to watch for unexpected password-reset requests or authentication prompts.
Why it matters: Blockchain analytics firms sit in the trust path for exchanges, stablecoin issuers, banks and law enforcement, so a breach there is both a targeting list and a reputational problem — even when the sensitive casework stays sealed. The customer roster of a forensics vendor is effectively a directory of every compliance team in the industry, which makes credential phishing the realistic follow-on risk. Two practical implications: compliance and investigations staff should treat unsolicited authentication prompts as hostile for the next several weeks, and institutions doing vendor due diligence should now ask analytics providers the same questions they ask custodians — breach history, data minimisation and whether customer identity data is separable from investigation data in the first place.

Markets & institutional adoption

Record ETF outflows, a mark-to-market earnings beat, and tokenized collateral going live in U.S. clearing.

U.S. spot bitcoin ETFs post their largest single-day outflow in 90 sessions, closing October negative
Friday's session took $643.3 million out of U.S. spot bitcoin ETFs, the largest single-day outflow of the month and the biggest in 90 trading days. That one print flipped October from a small net inflow on Oct. 29 to a month-to-date outflow of $515.0 million across 22 trading sessions, with 13 inflow days and 9 outflow days. BlackRock's IBIT lost $233.7 million after four straight inflow days. Spot ether funds went the other way for the fifth consecutive session, shedding $155.7 million, which pushed October's ether ETF outflows to roughly $1.35 billion. Bitcoin traded near $77,700 on Sunday, down about 3.5% over five sessions, with ether around $2,260.
Why it matters: The composition is more informative than the headline. Bitcoin funds are roughly flat for the month on a cumulative basis and lost a single session's worth of demand in one afternoon, which says the marginal buyer is small and reactive rather than structural. Ether is the genuinely weak leg: five straight outflow days plus a staking yield that has compressed to 2.63% removes two of the three reasons to hold ether inside a wrapper. Watch whether Monday's session makes Friday an outlier or the start of a trend — a second $500 million-plus exit would confirm that allocators are trimming crypto beta specifically after the Binance incident, not rotating within it.

Coinbase's 66% profit jump was a crypto mark, not an operating turnaround
Coinbase reported third-quarter net income of $718.7 million, up 66% year over year, but $715.0 million of that was a gain on crypto assets held for investment. Adjusted net income was $77.7 million — positive for the first time since the fourth quarter of 2025 and about $0.27 a share. Total revenue of $1.22 billion was flat quarter over quarter and down roughly 35% year over year, with subscription and services at $570.2 million, or 49% of net revenue. Spot volume fell 8% quarter over quarter to $135 billion even as market share rose to 10.7%, the fourth consecutive quarter of gains. Prediction markets passed $200 million of annualized revenue with daily traders up more than 60% sequentially. Shares fell 10.8% to $143.29 on the print, touching a 52-week intraday low, as the Binance theft hit the whole sector.
Why it matters: Read the earnings release for the mix, not the EPS. Half of net revenue now comes from subscriptions and services and about a quarter of transaction revenue from predictions and derivatives, which is what allows flat revenue while spot trading falls — that is the actual thesis for owning a listed crypto venue instead of the token. The offsetting fact is that the operating business is still small: $77.7 million of adjusted net income against a $1.22 billion revenue base is a thin margin, and the mark that produced the headline can reverse just as easily. For the sector, the lesson is that equity investors now price crypto venues on revenue durability, and sold on exchange risk rather than on the quarter itself.

DTCC's tokenization service goes live with 20 institutions signed, against $114 trillion in custody
The Depository Trust Company launched the DTCC Tokenization Service, which mints tokenized representations of securities already held in DTC custody. Eligible users can convert between traditional and tokenized form and deliver tokens to a wallet of choice, with the tokens retaining the ownership rights, investor protections and economic entitlements of the underlying security. Twenty DTC participants have signed agreements to use the service, including Bank of America, Barclays, BNP Paribas, Citadel Securities, Citi, Fidelity, J.P. Morgan, Morgan Stanley, State Street and UBS, with further onboarding on a rolling basis. DTC holds more than $114 trillion in assets under custody.
Why it matters: This is the first time tokenized securities sit inside the actual U.S. clearing utility rather than on a parallel chain bolted onto a broker. The economic prize is collateral mobility — moving margin in minutes instead of a settlement cycle — and the roster matters more than the technology, because these are the institutions that decide whether a token is financeable. The design constraint is equally important: these are entitlements inside DTC's ledger, not bearer assets, so legal finality stays with the depository by construction. That limits DeFi composability and should temper claims that Wall Street assets are about to become freely composable onchain — the plumbing is being tokenized, the custody model is not.

Uber tests round-the-clock treasury with HSBC, Franklin Templeton and Fireblocks on Canton
Uber completed a pilot with HSBC, Franklin Templeton, Tradeweb and Fireblocks that let it keep corporate cash invested in a tokenized money market fund while retaining the ability to pay from it. In the test, Uber used HSBC's tokenized bank deposits to buy shares of Franklin Templeton's tokenized money market fund through Tradeweb, with Fireblocks providing wallet infrastructure, and redeemed part of the position over a weekend. Fund tokens and payment moved together in delivery-versus-payment settlement on the Canton Network. The companies described it as a pilot; no volumes or fees were disclosed.
Why it matters: Corporate treasury is the use case that actually pays for 24/7 settlement, because the money is already there and the pain — cash sitting idle to cover weekend payments — is measurable in basis points. It is also the cleanest test of whether banks or blockchains capture the value: HSBC supplied the deposit token, Franklin the fund, Tradeweb the venue and Fireblocks the keys, which means the bank keeps the customer relationship while the network takes the settlement layer. With no disclosed volume, treat this as proof of technical feasibility, not adoption — the number to watch is whether any participant converts a completed pilot into recurring balances.

Protocols, products & regulation

What actually failed at Binance, and the two-day window before the midterms reset crypto policy.

EIP-7702 did not cause the Binance hack, but security researchers say it may have widened the blast radius
Blockaid co-founder Ido Ben-Natan told Cointelegraph that attackers could have drained Binance's wallets without Ethereum's EIP-7702 upgrade, but that the smart-account feature may have helped them do it in a single sweep and bypass some withdrawal checks that would otherwise have required multiple transactions. Ambire co-founder Ivo Georgiev disagreed on impact, saying the attackers already had the ability to authorize transactions. Binance CEO Richard Teng said investigators found no evidence that wallet private keys leaked, and the company separately linked the theft to a compromised DevOps engineer's laptop. EIP-7702 shipped in the May 2025 Pectra upgrade, and malicious delegations were flagged within weeks by Wintermute, then again in September 2025 by World Liberty Financial token holders reporting losses.
Why it matters: This is expert interpretation, not a confirmed cause — the incident disclosure points at signing infrastructure, and two of the three researchers quoted say 7702 changed efficiency rather than capability. The durable lesson is about control design: a signer that will approve a transaction it should not approve is the failure, and batching features simply compress the window in which a bad approval can be exploited. For wallet teams the practical agenda is delegation allowlists and visible, one-click revocation of EIP-7702 delegations; for exchanges it is transaction simulation and spend limits at the signer, because that is the layer that actually failed here.

Crypto's $63 million Ohio bet is the last big play before Tuesday's midterms decide CLARITY's fate
Fairshake, the industry's leading super PAC, has put roughly $56 million into defeating former Senate Banking Committee chairman Sherrod Brown's comeback bid in Ohio, and a Winklevoss-funded PAC has added $7.2 million, putting the industry's stake in Tuesday's vote at about $63 million and more than $100 million spent against one candidate over two years. Brown, who blocked crypto legislation while chairing the committee, holds a lead within the margin of error in most polls; Kalshi puts his comeback at 68% and gives Democrats a 68% chance of taking the Senate. The CLARITY Act passed the House in July 2025 and failed a Senate cloture vote 49-50 on Sept. 15, 2026.
Why it matters: The practical consequence is not who wins Ohio but which branch writes the rules. With CLARITY stalled, the SEC's proposed Regulation Crypto Assets and the CFTC's October advance notice of proposed rulemaking — comments due Dec. 14 — become the operative framework, which means agency discretion and litigation risk rather than a statutory safe harbour. A Democratic chamber would shift the four committees with crypto jurisdiction toward oversight hearings, and The Block's reporting suggests even a scaled-back CLARITY is unlikely under a Democratic chair. For builders, that argues for designing to the strictest plausible reading of existing securities and commodities law rather than waiting for a bill.

Bottom line

Binance absorbed this one on its own balance sheet, which is both the good outcome for users and the concentration risk to note: roughly $6.34 billion of corporate funds set aside and half the SAFU spent leaves a thinner buffer for the next event. The attack path was signing infrastructure, not a broken chain — and the same week the industry's main blockchain-forensics vendor disclosed its own breach, so "the analytics layer will catch it" is now a vendor-risk line item, not a control. Meanwhile the build continued on schedule: DTC is minting tokenized entitlements for 20 major institutions against $114 trillion of custody, and Uber ran a weekend-redeemable treasury pilot with HSBC and Franklin Templeton. Price and flows moved the other way — bitcoin around $77,700, down roughly 3.5% over five sessions, with October ETF flows negative — but plumbing and price are now clearly separate stories. Tuesday's U.S. midterms decide which one gets the next rulebook: CLARITY has two days of political oxygen left before the odds of legislation give way to agency rulemaking.

As of

November 1, 2026, 15:00 UTC. Prices are spot snapshots. This briefing was researched and generated for NPDev News subscribers; it is a news summary, not investment advice.