hot

The cybersecurity company CertiK recommends that cryptocurrency exchanges set a hard dollar limit on hot wallet holdings, rather than relying solely on cold storage ratios to measure security. This recommendation comes at a time when several exchanges have recently disclosed their cold wallet holdings ratios to reassure customers, following a record hack of Binance's hot wallet. Gate reports that 88.26% of its total assets are stored in cold storage, while Coinbase states that over 99% of customer assets are kept offline.The CertiK research team told Cointelegraph that cold storage is an effective indicator of online risk exposure, but it is not an independent security rating. Currently, South Korea requires crypto service providers to store at least 80% of the value of customer crypto assets in cold storage, Singapore's guidelines require at least 90%, Japan's framework requires at least 95%, and the benchmark for licensed crypto trading platforms in Hong Kong is 98%. CertiK points out that higher levels of cold storage generally reduce online risk exposure, but at extremely high levels, the returns diminish, and a rigid storage ratio may slow down withdrawals, force hasty transfers, and concentrate risks in the key management system.CertiK suggests that exchanges set hot wallet limits for each asset and blockchain based on the most stringent of three restrictions: the percentage of customer liabilities, estimated withdrawal demand, and an absolute loss limit based on the exchange's financial resources and recovery capabilities. Additionally, Binance stated last week that it has replenished about 98% of the affected tokens after the hack and absorbed the losses itself, with the remaining tokens having lower liquidity and longer acquisition times. Elliptic reported that hackers linked to North Korea laundered money by issuing memecoins, transferring about $430,000 through six newly issued tokens on NEAR.

PhotonPay today announced that its Canadian operating entity, Photon Dance CA Inc., is now registered with the Bank of Canada as a payment service provider (PSP) under Canada's Retail Payment Activities Act (RPAA). The registration brings its in-scope retail payment activities within Canada's federal supervisory framework, which establishes requirements for operational risk management, incident response, regulatory reporting and the safeguarding of end-user funds. The registration adds to PhotonPay's growing regulatory presence in North America, alongside its Canadian FINTRAC MSB registration, U.S. FinCEN MSB registration and money transmitter licenses across multiple U.S. states. With 35 payment licenses, regulatory authorizations and registrations across the Americas, Europe and Asia, PhotonPay continues to build the local foundations for its next-generation Financial OS. By bringing together multi-asset wallets, global collections and payouts, foreign exchange, card issuing and embedded finance, the platform connects traditional fiat payment infrastructure with stablecoin capabilities to support businesses managing financial operations across markets.

The open-source Bitcoin payment processing tool BTCPay Server has received multiple reports of unauthorized fund theft from its Bitcoin and Litecoin hot wallets on the platform. The project team released an investigation update confirming that the attack targeted servers running BTCPay Server version 2.4.1 or earlier. The attackers exploited a vulnerability that was fixed in version 2.4.2 on August 7, gaining administrative access to the servers through various methods and draining the hot wallet funds.BTCPay Server founder Nicolas Dorier confirmed that only servers running versions prior to 2.4.2, particularly version 2.4.1, were affected; users running the latest version 2.4.7 have not reported any credible losses. Some affected service providers, including LunaNode, have automatically shut down at-risk older instances. The official recommendation for users still using version 2.4.1 or earlier is to immediately transfer any remaining funds in old hot wallets to a new wallet created with a completely new mnemonic, take the old server offline while retaining relevant logs, and then install the latest version on a new virtual machine and connect the new wallet, ensuring not to restore the old server entirely to the new machine.Simply updating the software version is not enough to eliminate the risk, as attackers may have gained persistent access to the old server. Funds stored outside the server, such as those in hardware wallets, were not affected by this incident. The vulnerability is related to a flaw fixed in August of this year, when attackers had manipulated nodes by obtaining LND administrative credentials. As of now, this vulnerability has not been assigned a CVE number and is not listed in CISA's known exploited vulnerabilities catalog.

Binance released an update on the progress of the security incident recovery, stating that approximately 98% of the affected assets have been replenished. Binance will continue to purchase the remaining token assets through market and over-the-counter trading channels. Due to the low liquidity of the remaining 2% of tokens, the purchase is expected to take some time.Binance stated that it will bear the full loss of the stolen funds from this incident and has reserved more than 100% of the total required assets from its own funds.Additionally, Binance completed a new round of reserve proof snapshots on November 4 at 8:00, expanding the number of tokens covered from 10 in the previous round to 44. The complete zero-knowledge proof is expected to take about 50 to 60 hours to generate, at which point users holding tokens within the coverage range can independently verify whether their account balances have at least 1:1 sufficient reserve support.

According to security company Salus, approximately 3,600 stolen Binance SOL flowed into the HitBTC hot wallet on November 3 at 16:51 Beijing time after being transferred through automated scripts and a peeling chain model via multiple paths.Salus stated that HitBTC had previously appeared in the fund transfer paths of major cryptocurrency theft cases; hackers often use nested services such as instant exchange services, small exchanges, and over-the-counter trading desks to transfer stolen funds.

Renowned trader Killa posted that in the cryptocurrency industry, those who frequently showcase so-called huge profits should be approached with caution. Such individuals may have poor trading performance and attempt to prove their abilities by displaying screenshots of simulated trading profits.He believes that those who truly trade with large amounts of capital usually do not need to constantly prove themselves to the outside world, and he reminds the community not to be easily deceived by the trading results presented on the surface, but to pay attention to the details.

According to Binance's announcement, the complete zero-knowledge proof for the reserve proof (PoR) snapshot on October 31 has been completed. Users holding BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC can use their verification tools to independently verify whether their account balances have at least 1:1 reserve support.Binance stated that it plans to take another snapshot on November 4, covering more tokens, and then generate a complete zero-knowledge proof, which is expected to take about 40 to 50 hours. The company previously mentioned that it has replenished approximately 95% of the affected assets, with the remaining approximately 5% of tokens having low liquidity and still being procured.Binance also plans to gradually resume withdrawals for more networks and assets tomorrow, with specific details to be announced once ready.

Meme token and AI Agent issuance platform Bullshot announced the completion of a $7.7 million financing round, co-led by P2 Ventures and Animoca Brands, with participation from B1 Ventures, Poolz Ventures, Genesis Capital, and other institutions.

BTCPay Server reported receiving reports of funds from hot wallets being transferred by unauthorized attackers and recommends that instance operators shut down their servers until the investigation is complete.

Binance responded to community users on platform X, stating that the information regarding the $150 compensation for the suspension of withdrawals posted by the user is false, and the related screenshots have been digitally altered.The user had previously posted that Binance was offering a $150 compensation for the suspension of withdrawals, along with a screenshot showing the relevant compensation details.

The crypto KOL DeFi small miner posted, inquiring about Grok Bot, feeling that the current net outflow from Binance is around 2 billion dollars.Binance co-founder He Yi responded, stating that it seems Grok Bot has counted some of Binance's new hot wallet addresses as outflows, which can be cross-verified using multiple tools.

Binance co-founder He Yi stated that most large transfers are from the Binance cold wallet to the new hot wallet of Binance.He Yi was responding to X user yurihanachan98's inquiry about several large transfers. This user asked in a post discussing large transfers on Binance, which whales are involved in these transfers amounting to hundreds of millions of dollars.

Binance co-founder Zhao Changpeng stated that a circulating chat screenshot showing him attempting to contact Pauly is fake, and he cannot verify other related claims.Zhao Changpeng referenced a post by X user TuanX regarding whether the Binance theft incident had been predicted in advance. The post mentioned several unverified prediction claims, as well as a screenshot allegedly showing Zhao Changpeng asking about and trying to contact Pauly.Zhao Changpeng stated that screenshots and videos are easy to forge and expressed skepticism about the claims regarding predictive abilities.

Binance released the second progress announcement regarding the security incident, disclosing two key timelines. The announcement was made at 3:33 AM on October 31 (UTC+8).Binance stated that it plans to conduct the first proof of reserves snapshot within 12 hours after the announcement and will publish the results before November 2; at the same time, the technical team's goal is to gradually restore withdrawal services within approximately 34 hours, depending on the progress of security checks.Based on the announcement time, Binance plans to complete the first proof of reserves snapshot by 3:33 PM on October 31, with the goal of starting a phased restoration of withdrawal services by 1:33 PM on November 1.Binance previously stated that it has prepared over $6.34 billion in company funds, of which approximately $5 billion worth of affected token assets are in place, covering about 80% of the stolen assets, with the remaining portion being purchased through on-chain and off-chain channels. Additionally, approximately $3 billion of affected assets have been frozen on-chain.

Crypto journalist Eleanor Terrett posted that in response to questions about why Binance still claims user funds are safe after a $6 billion hack, a Binance spokesperson stated that customer funds were unaffected and that the funds that were transferred out came from one of the exchange's own hot wallets. Binance claims that most customer funds are stored in cold wallets and are only transferred to hot wallets when users withdraw.The spokesperson stated that most of Binance's daily operating income is held in the form of crypto assets, and the company retains a significant portion of this, reinvesting it into business and security development, as they believe in the long-term value of crypto assets and the industry.He stated, "This is precisely why we are able to immediately absorb such a large loss with our own funds."

The latest economic data from the United States is challenging Federal Reserve Chairman Waller's assessment that the economy is not yet overheating, as the market continues to bet on a rate hike in December, putting the Fed in a more complex position. Strong consumer spending and business investment have driven economic growth beyond expectations, while persistent inflation complicates the Fed's choices between sustaining growth and controlling prices.Data released by the U.S. Department of Commerce shows that the real Gross Domestic Product (GDP) grew at an annualized quarterly rate of 3.4% in the third quarter, exceeding market expectations. During the same period, consumer spending increased by 3.8%, and business equipment investment surged by 20.9%.Just a day before the data was released, Waller stated that he does not believe the U.S. economy is running hot and does not want to hinder economic expansion through excessive tightening of monetary policy. However, the latest data indicates that even as the market expects the Fed to continue raising rates, there has not been a noticeable slowdown in U.S. economic activity.

The founder of Slow Fog, Yu Xian, tweeted that the Binance hacker chose the EIP-7702 mechanism on Ethereum solely for the convenience of the cleanup work, which is to bulk steal tokens from Binance-related hot wallets.Yu Xian stated that, from an on-chain perspective, the hacker's operations were relatively crude, and they conducted several hours of rehearsal preparation before the actual theft. He emphasized that there is nothing wrong with the EIP-7702 mechanism itself; even without this protocol mechanism, there are other ways to achieve similar operations.

According to on-chain analyst Ai Yi's monitoring, hackers have sold all 77.7 trillion PEPE from Binance's hot wallet for 14,049 ETH, causing the PEPE price to drop by 12.33%, with the total amount sold exceeding 31.9 million USD, at an average price of about 0.0000041 USD.Since October 17, Sun Yuchen has transferred out 118 trillion PEPE, with unrealized gains shrinking to 4.45 million USD, at an average price of about 0.000004114 USD, and at one point last night, the unrealized gains were 18.55 million USD.