Blockchain & Digital Assets Briefing — November 3, 2026

Top stories

Another exchange breach, a nine-figure institutional theft, and a rollup council that froze the proceeds.

Mercado Bitcoin's hot wallets drained as transfers continued after the platform went offline
Mercado Bitcoin confirmed early Monday that an incident in one of its systems had exposed its hot wallets, the online float it uses for day-to-day deposits and withdrawals, and suspended both as a precaution. The exchange says customer assets and data were unaffected. Loss estimates vary by source and method: Arkham puts the total near $46.3 million, Chainalysis about $49 million across 17 blockchains, and CoinDesk more than $40 million across at least 10. The transfers were ordinary transactions rather than a smart-contract exploit, with the largest outflows between 06:19 and 06:53 UTC. In its 21:00 local update the exchange said roughly $11 million had been blocked with help from Tether, Circle, BRL1, Paxos and Chainalysis, leaving about $38 million still unblocked. CertiK's Dickson Wu reported that addresses tied to the breach kept receiving funds for hours after the platform went offline and that the attacker moved dust out of 27,160 deposit addresses, which he argued implies control over customer deposit keys rather than only the corporate hot wallet.
Why it matters: A hot wallet is a float, not a vault, and this is what happens when the float is drained: the loss lands on the operator's balance sheet, so the question shifts from cryptography to solvency and recovery. The freeze numbers are the tell. Roughly $11 million blocked out of a $46 million-plus loss means issuer-level freezes work exactly where the asset is a stablecoin and nowhere else; the 106 BTC and the ether balances are gone unless the attacker gets careless. For anyone holding balances at a mid-sized venue, the practical read is that 'customers will not lose assets' is a promise backed by a company balance sheet rather than by the chain, and that an exchange deposit address is a custodial address whose key you do not control.

Kraken, Crypto.com and OKX restrict accounts tied to a suspected $133 million EU theft
Blockchain investigator ZachXBT said Tuesday that he had identified another $27 million of withdrawals from centralized exchanges tied to a suspected theft from an unidentified European Union entity, raising the total he has traced to more than $133 million from the $106 million he reported on Monday; some of the withdrawals happened after his first disclosure. Bitquery attributed withdrawals to accounts at Kraken, Crypto.com and OKX, and found that $62.98 million of stablecoins was converted into 27,553 ether in roughly four hours. Kraken said the incident did not originate on its platform, that it had restricted the accounts in question and that it was working with law enforcement. Crypto.com said it had taken steps to prevent associated funds moving through its venue, and OKX said it was looking into the matter. No victim, issuer or attacker has been publicly identified.
Why it matters: A nine-figure theft from an institution is a different failure mode from an exchange hack: the keys were presumably compromised inside the victim, and the exchanges are only the exits. The conversion into ether matters more than the headline. Swapping $63 million of stablecoins for ETH in four hours is what laundering looks like when issuers can freeze dollars but cannot touch the native asset, and it explains why investigators keep pressing for faster issuer-level blacklisting. It also marks the limit of that defence: once funds reach an unfreezable asset and leave a KYC venue, recovery depends on cooperation that has no legal force offshore. For exchanges, the control that worked here was account-level restriction after public disclosure, which is reactive by construction.

Arbitrum's Security Council froze 8,425 ETH and 74.6 million ARB by impersonating the exploiter
At 08:08 HKT on Oct. 30 (00:08 UTC), Arbitrum's Security Council executed an emergency action freezing 8,425 ETH and 74,559,805.2 ARB held on Arbitrum One by an address identified with the Binance exploit, moving the funds to 0x0000000000000000000000000000000000000DA0. Per the project's own forum post, the mechanism was an atomic upgrade of the bridge's Inbox contract on Ethereum that added a function called sendUnsignedTransactionOverride, letting the council impersonate the exploiter's address and push two cross-chain transactions that swept the funds; the implementation was then reverted. The frozen assets can now only be moved by an ArbitrumDAO governance vote. Arbitrum says no other user funds or applications were affected, and the action appears as a quick update on today's governance call agenda.
Why it matters: This is the clearest look yet at who holds the ring on a major rollup. A multisig edited the bridge's inbox contract so the chain would accept transactions signed as someone else, which is censorship in the technical sense and was also the only thing that recovered the money. The trade-off is explicit: Arbitrum's upgradeability made the freeze possible, and the same key set could in principle do it to any address. That does not make the action wrong, since the alternative was watching about $19 million of ether walk through bridges, but it does mean the trust assumption for an L2 is now documented as council plus governance vote rather than proof alone. Projects advertising 'decentralized' settlement should expect this question from institutional counterparties, and answer it with the actual key threshold and the actual veto path.

Markets & institutional adoption

ETF redemptions continue into the midterm vote while the largest corporate holder keeps buying.

Bitcoin holds near $76,900 as ETF outflows run a second day into the U.S. midterms
Bitcoin edged up 0.2% to about $76,900 since midnight UTC after dipping near $76,300 in European hours, holding close to a one-month low. U.S. spot bitcoin ETFs lost $399 million on Monday, a second straight day of outflows, with BlackRock's IBIT shedding $405 million for its largest daily outflow since June. Binance customers have pulled a net $4.72 billion since the exchange reopened withdrawals on Sunday, against $3.64 billion in the first session. Futures volume rose 51% to $168.1 billion while open interest fell 1.63% to $134.9 billion, and liquidations jumped 171% to $382.6 million, the signature of trading rather than new positioning. U.S. voters go to the polls in the midterms today, with Nasdaq futures up 0.3% and Brent crude around $106 a barrel.
Why it matters: The flows say the market is repricing counterparty risk rather than bitcoin's thesis. ETF redemptions are an institutional risk-off reaction to a single exchange's breach, and Binance's $4.7 billion of net withdrawals is about 2.8% of the $171 billion it reported holding, large enough to matter for the venue and small enough to look like migration rather than a run. What is missing is the buyer: with open interest flat to lower and funding still positive, leverage is not rebuilding, so the marginal price-setter is spot flow and spot flow is leaving. The midterms add a second variable, but the near-term path probably depends on whether ETF outflows stop once the Binance shock is a week old. Watch the flows, not the headlines about them.

Strategy adds 811 bitcoin at $80,846 as its holdings reach 849,327 BTC
Strategy bought another 811 bitcoin for about $65.5 million between Oct. 26 and Nov. 1, resuming purchases after a one-week pause at an average price of $80,846. Holdings now total 849,327 BTC, acquired for roughly $64.1 billion at an average of $75,451 per coin, more than 4% of the 21 million supply cap. The purchase was funded with about $164 million of MSTR common stock sold during the week. The company also repurchased about $208.2 million of STRC preferred shares and paid $43.4 million of preferred dividends from cash reserves.
Why it matters: The average is the interesting number. Strategy paid $80,846 while spot drifted toward $76,900, so the latest tranche is underwater by roughly $3.2 million, small against a $64 billion position but revealing about the machine: issuing equity to buy an asset that is falling only works while the equity clears above net asset value. Note the direction of the other two transactions in the same week, a $208 million preferred buyback and $43 million of dividends paid from cash, which is what balance-sheet management looks like when the funding channel is a stock rather than an operating business. Corporate treasury demand of this kind is price-insensitive at the margin but premium-dependent in a way that ETF flow is not, so a compression in MSTR's premium is the variable that would slow the bid.

Protocols, products & regulation

Crypto's perpetual-futures structure reaches U.S. equities, a sidechain peg is made whole, and USDT moves chains.

Perpetual futures on single U.S. stocks begin trading after CFTC deems them approved
Perpetual futures on individual U.S. equity securities began trading on CFTC-registered exchanges today for the first time, after the Commission deemed the contracts approved under Regulation 40.3 as security futures products under the Commodity Futures Modernization Act of 2000. CFTC Chairman Michael Selig announced the step in a statement that named no exchange, listed no contracts and set no launch date; the details are expected from designated contract markets, which must also hold an SEC notice registration as a national securities exchange for security futures. The agency approved the first U.S.-listed bitcoin perpetual, Kalshi's BTCPERP, on May 29, and gold and silver perpetuals followed in September.
Why it matters: This is crypto's product architecture migrating into the regulated equity market, not the reverse. Perpetuals, with no expiry and periodic funding payments that pin the contract to spot, dominate offshore crypto derivatives volume because they are capital-efficient, and that structure is now available on single stocks inside a joint CFTC-SEC framework. The consequences cut both ways: U.S. venues gain a product they could not previously list, while offshore perp desks lose a structural advantage that came mostly from being the only place the instrument existed. It also imports the failure modes, since funding-rate spikes and cascade liquidations are features of the design rather than bugs, and equity market participants are about to learn them. The contract specs the DCMs publish will determine how much leverage actually reaches retail.

Liquid restores 1:1 bitcoin backing for LBTC, with Blockstream named as the backstop
The Liquid Federation said Tuesday that the network's bitcoin reserves are fully restored, re-establishing 1:1 backing for every LBTC, after a final 250 BTC transfer on Nov. 2 closed the gap left by a Sept. 6 bug in Elements, the software Liquid runs on. The flaw, a failure in cached range-proof verification, let an attacker mint roughly 4,000 unbacked LBTC and redeem them for bitcoin through SideSwap, a federation member with peg-out authority; reserves fell from about 4,205 BTC to 197. The attacker returned about 3,400 BTC the next day, leaving roughly 600 BTC outstanding, which four deposits totalling about 602.5 BTC covered: 2.5 on Oct. 27, 50 on Oct. 28, then 300 and 250 on Nov. 2. Reserve and supply both stood near 4,270.54 BTC when the gap closed.
Why it matters: The peg is whole, but nobody has published a funding breakdown. Federation board member Samson Mow named Blockstream as the source, CoinDesk reported that the federation itself did not disclose it, and no loss allocation has been made public. Two things follow. A sidechain peg is a promise about a federation's willingness to absorb losses, and here that promise was honoured by the company that wrote the software, which is a good outcome and not a rule. And capability is still not restored even though backing is: direct federation peg-outs remain under what the federation calls enhanced operational controls with no reopening date, so LBTC is fully backed and not fully redeemable through the official route. Anyone treating parity on SideSwap as proof the peg works is trusting a provider rather than the federation.

TRON overtakes Ethereum in average USDT supply for the first time
Token Terminal's Q3 report, published Nov. 2 and promoted by TRON DAO, has TRON overtaking Ethereum in average native USDT supply for the first time: $90.75 billion against $87.73 billion, a $3.02 billion lead, with USDT at about 98.4% of TRON's average stablecoin supply of $92.25 billion. The crossover happened in July, and by Sept. 30 TRON held $92.35 billion of USDT to Ethereum's $86.69 billion. Across the 12 chains tracked, average native stablecoin supply fell 2.41% to $298.23 billion while TRON's share rose to 30.93%. The report also records $2.18 trillion of quarterly stablecoin transfer volume, 76.53 million holder addresses against Ethereum's 26.32 million, and $693.21 million of network revenue at an average fee of $0.64.
Why it matters: The dollar-token layer of crypto has been moving to the chain with the cheapest transfer economics, and this is the first full quarter in which the aggregate numbers say so. That matters most for businesses treating USDT settlement as infrastructure: payment corridors, remittance desks and offshore venues are already TRON-first, and Ethereum's role is shifting toward custody, large transfers and tokenized funds rather than retail dollar movement. Read the figures with their caveats, since this is a vendor report promoted by the chain it measures, holder counts are addresses rather than people, and a quarterly average hides a quarter-end gap that was wider than the average. The direction is still corroborated by independent supply and volume data, and it has a cost: the network earning 93% of tracked revenue at a $0.64 average fee is also the network where fee compression is steepest.

Bottom line

Three things happened in the last 48 hours and only one of them is about price. First, intermediation is being priced. Mercado Bitcoin lost part of a hot-wallet float and had frozen about $11 million of a $46 million-plus loss by Monday night; an unidentified European institution lost more than $133 million and watched $63 million of it convert into 27,553 ether in four hours; Binance has returned $6.3 billion to customers and still saw $4.72 billion leave. The common failure is not cryptography but key custody and blast radius, and the recovery rate tracks one variable, whether the stolen asset was a freezable stablecoin. Second, the industry's emergency layer is now visible and discretionary. Arbitrum's Security Council rewrote a bridge contract to impersonate an attacker and froze 8,425 ETH plus 74.6 million ARB; Blockstream funded the 600 BTC that closed Liquid's peg. Both outcomes were good and neither was automatic. Third, the U.S. is importing crypto's plumbing into traditional markets: equity perpetuals began trading today under a joint CFTC-SEC regime, while the dollar tokens those markets settle in keep migrating to TRON. The midterm vote decides who writes the next rule, but the structure underneath is being set by the entities that can freeze, fund and upgrade.

As of

November 3, 2026, 15:00 UTC. Prices are spot snapshots. This briefing was researched and generated for NPDev News subscribers; it is a news summary, not investment advice.