BitHub

This cartoon makes me feel both proud and under tremendous pressure. I will never claim that OKX is absolutely safe or immune to attacks. No company can honestly make that promise. What I can say is that OKX has always treated security and the protection of customer assets as our highest priority. Our 13-year track record reflects more than a decade of continuous investment, engineering, operational discipline, and hard-earned experience. We take security threats seriously and professionally—not as a marketing opportunity. Behind the scenes, we have built extensive layers of proprietary technology, internal security systems, strategies, frameworks, penetration testing, and independent audits. Much of this infrastructure cannot be disclosed publicly for security reasons. But these capabilities are constantly being tested, challenged, and improved. Here’s something I can share: since the recent Binance security incident, the entire OKX team has been working just as hard and staying just as busy as the teams directly responding to the attack. Not because OKX was compromised. But because an attack on one major exchange is a warning to the entire industry. While some may see such moments as opportunities to launch promotional campaigns, generate traffic, or compete for market share, our priority has been different. Our teams have been working around the clock on four critical areas: 1. Tracking stolen funds in real time. Monitoring the movement of funds associated with the incident with second-level latency, identifying suspicious addresses and transactions, and taking available measures to prevent stolen funds from being laundered through OKX Exchange or our Web3 DEX aggregator. 2. Strengthening market risk controls. Assessing the potential market impact of the incident, tightening risk controls where necessary, and preparing for liquidity shocks or cascading liquidations that could threaten users and the broader market. 3. Analyzing emerging attack techniques. Studying the attack patterns, potential vulnerabilities, and methodologies involved, including threats to software development supply chains and the rapidly evolving security risks introduced by AI coding agents and their dependencies. 4. Challenging our own security assumptions. Using the lessons from this incident to conduct a fundamental review of our internal controls, access management, wallet infrastructure, and security architecture. We don’t assume that what protected us yesterday will necessarily protect us tomorrow. Security is never a finished project. It is a continuous responsibility that requires humility, vigilance, investment, and execution. We don’t choose to be the loudest when another company is under attack. We choose to work harder to protect our customers and strengthen the resilience of the entire industry. Competition should drive better products and services. Security should bring the industry together. Protecting customer assets is our first responsibility. And we will never take your trust for granted.

Comunicado oficial: Identificamos e contivemos com rapidez um incidente de segurança em um de nossos sistemas nesta madrugada. Reforçamos que: • Não houve nenhum prejuízo aos clientes; • Não houve vazamento de dados. Como medida preventiva de proteção, depósitos e saques estão temporariamente suspensos. Nossas equipes estão mobilizadas investigando o caso, rastreando os ativos e coordenando as medidas junto às autoridades competentes. Manteremos atualizações regulares por aqui.

Under pressure from Israeli prime minister Benjamin Netanyahu, the Trump administration may be within days of launching a nuclear strike on Iran. The target would be Pickax Mountain in central Iran, where Israeli intelligence claims the Iranian government has restarted its nuclear enrichment program. No conventional weapon in the American arsenal can penetrate 300 feet of solid granite to destroy the tunnels where enrichment is supposedly taking place. The only military option is a nuclear strike. Netanyahu has been pushing hard for one. “Bibi calls Trump about it every day,” says an informed observer. Netanyahu is cornered and desperate. After last week’s election results, he can’t form a government unless Trump intervenes directly in Israeli politics and brokers a deal with other parties that gives Netanyahu 61 seats in the Knesset. Otherwise, he is out as prime minister and on his way to ignominy, investigations and possibly jail. Netanyahu must stay close to Trump. He needs this war. To that end, he’s applied maximum pressure to his closest allies in the administration, including Secretary of Defense Pete Hegseth and CENTCOM commander Brad Cooper. Both oppose a negotiated settlement to the war they’ve so grievously mismanaged; both are pushing to restart major combat operations. Secretary of State Marco Rubio and CIA director John Ratcliffe are also following Netanyahu’s lead, as are leaders of the Democratic Party. In a recent meeting on the subject, former president Barack Obama said he opposes the current Iran peace deal being drafted in Doha. The rest of America’s longtime allies in the Middle East are terrified by the prospect of more war. On September 27th, Netanyahu flew secretly to Abu Dhabi to enlist the UAE in his lobbying effort for a final attack on Iran. The Emiratis refused. After eight months of conflict, Gulf economies are teetering. So are global energy and fertilizer markets. They won’t recover soon. Globally, there are a total of about 850 supertankers used to transport oil from producers to the rest of the world. In October alone, 11 of them were badly damaged in Hormuz. At this pace, a global depression is imminent. A nuclear strike would radically accelerate the destruction. Fallout from a ground explosion at Pickax Mountain would contaminate the Persian Gulf, poisoning the water supply for 100 million people. And those are just some of the immediate consequences for the region. The rest of the world is every bit as exposed. No country other than the United States has ever used a nuclear weapon in war. Some would like to. An American nuclear attack on Iran would set a new precedent. The Russians have already told at least two other governments that an American nuclear strike on Iran would free them to use nuclear weapons against Ukraine. Pakistan and India would be tempted to do the same against each other, as would North Korea against Seoul. After the first nuclear strike, World War Three is inevitable. That war would be short and final. We’ve been sleepwalking toward this moment for months. Since February, the administration has quietly rewritten America’s nuclear doctrine to make first use of so-called “battlefield nukes” easier and therefore more likely. No one in Washington in either party seems bothered by this. Now we’re on the brink of it. Close observers say Trump is likely to decide by next weekend whether or not to use nuclear weapons. That would be November 7, six days from now. To his credit, he’s hesitating. At the moment, Trump is listening to his vice president, JD Vance, and to his envoy and friend Steve Witkoff, both of whom argue a deal with Iran can be made. They’re right, though it won’t be simple. The Iranians are famously frustrating to negotiate with under any circumstances, and elements of that government have become more radical since Ayatollah Ali Khamenei and his family were killed in February. After decades of isolation, even relatively moderate Iranian leaders seem confused by how decisions are made in the West. (There is a widespread belief in Tehran, for example, that the United States government controls Israel.) But overall, people who have spoken to decision-makers in Iran say there is consensus there that more war is bad for everyone and a deal is worth making. One group that hasn’t been consulted so far is the global population — the hundreds of millions of people who will be killed along with their children if Trump is pushed by Netanyahu into launching a nuclear strike next week. Now would be the time for them to speak up.

12 hours after withdrawals resumed: 2.1% net outflow, with most occurring in the first couple of hours. Over $1 billion in flow, too. 98% choose to stay! Trust isn’t earned by what you say in good times. It’s earned by what you do in hard times. Thank you for your trust! 🙏🙏🙏🙏

Withdrawals re-enabled for: ✅ BTC: BTC ✅ ETH: ETH, USDT, USDC ✅ BSC: BNB, USDT, USDC ✅ XRP: XRP ✅ Base: ETH, USDC

Withdrawal Update Withdrawals have now been restored for the following assets and networks: - Ethereum Network: USDC, USDT, ETH - BNB Smart Chain (BSC): USDC, USDT, BNB We will continue to restore additional assets and networks in phases following the completion of our security checks. Further updates will be shared through official Binance channels.

The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor." The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages. How You Can Help: FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets. A list of addresses associated with this activity is available here: fbi.gov/investigate/cyber/al…

#Binance WSZYSTKO CO WIEMY NA TEN MOMENT Z giełdy wyprowadzono 6,3 miliardów dolarów, najprawdopodobniej przez hakerów-weteranów z Korei Północnej. Proces przebiegał następująco (czas polski) 👇 Przygotowania 28.10: portfel operatora dostaje trzy drobne wypłaty z miksera Tornado Cash. 29.10: kod ataku zostaje przetestowany na dwóch portfelach i przećwiczony na trzecim. Cztery godziny później ląduje na gorącym portfelu Binance. Bezsenna noc (29.10) 21:05: pięć portfeli Binance na XRP Ledger traci 233,46 mln XRP. 21:10: dołączają portfele na Solanie i Optimism. 21:20: z gorącego portfela BTC wychodzi 18 270 BTC. Napastnik od razu dzieli je na paczki po 1000 i 100 BTC. 21:20:59: do portfela „Binance 14” trafia 50 wcześniej podpisanych autoryzacji EIP-7702. 49 nie działa, jedna pasuje. 21:22: portfel na Tronie wysyła 612,7 mln USDT i 46,4 mln TRX. 21:24: sweeper opróżnia Binance 14: 167 464 ETH, 1,615 mld USDT i około 60 innych tokenów. Około 2,5 mld USD w jednej transakcji. 21:24:47: „Binance 16” wysyła na ten sam adres 28 005 ETH, 55,7 mln USDT i 25,9 mln RLUSD. Dołączają portfele na Arbitrum i Avalanche. 21:41: napastnik wyciąga 780 mln USDC z konta smart Circle powiązanego z Binance 14. 21:58: 60 mln USDT trafia do Aave jako zabezpieczenie pożyczki na 19 762 WETH. 22:01: Tether zamraża 971 mln USDT. 22:04: Circle zamraża 823 mln USDC. 22:15: Binance potwierdza, że bada sprawę. CZ: „It does look like a hack”. 23:01: Ripple zamraża 40,5 mln RLUSD. 23:10: World Liberty Financial zamraża 27,8 mln USD1. 23:15: Binance wstrzymuje wypłaty. 23:32: Aave zamraża rynki V3 i V4. Po północy (30.10) 00:05: druga fala uderza w portfele na Avalanche i Polygonie. 00:06: Binance zawiesza handel w Binance Alpha. 00:35: Binance: zamrożono 2,54 mld USD. 00:56: ostatni zarejestrowany sweep z przejętego portfela. 01:07: Binance wstrzymuje też depozyty i zapowiada pokrycie wszystkich strat. 01:08: Arbitrum Security Council zamraża około 30 mln USD należących do napastnika. 01:26: Blockaid: przejęta infrastruktura podpisująca, a nie wyciek klucza. 01:52: Binance: zamrożono 3 mld USD. 02:19: BTC w okolicach 76 900 USD, BNB traci 8%. 03:21: First Digital zamraża skradzione FDUSD. 03:25: Binance wskazuje przejęty laptop inżyniera DevOps i potwierdza 6,3 mld USD strat. 05:17: Yi He: wypłaty wrócą w ciągu 48 godzin. 05:51: ZachXBT: środki z Binance i z hacku Bitget spotkały się na jednym adresie po przejściu przez THORChain. 06:00: Chainalysis wskazuje północnokoreańską grupę TraderTraitor. 08:37: Richard Teng: to nie był atak „jednym kliknięciem”. 09:37: Binance ujawnia kolejne punkty naruszenia. Gdzie jesteśmy teraz 👇 🧊 Zamrożono około 3 mld USD, prawie wyłącznie w stablecoinach. Najwięcej zablokował Tether (około 1,77 mld USDT), potem Circle (około 825 mln USDC). Resztę dołożyli Ripple, World Liberty Financial i Arbitrum. 💰 Napastnik wciąż kontroluje około 2,9 mld USD w ETH i BTC, czyli aktywach, których nikt nie może zamrozić. Samego ETH ma już około 495 tys., rozłożone na 10 adresów. ₿ 18 270 BTC leży w 19 portfelach i nie ruszyło się od nocy. To najbardziej obserwowana kupka bitcoinów w tej chwili. 🏃 Napastnik wygrał wyścig z blokadami, ale słono za to zapłacił. Około 325 mln USDT sprzedał market makerom z ponad 10-procentowym dyskontem. Altcoiny (UNI, ENA, PEPE, LINK, AAVE, ONDO, WLD) za 158 mln USD zamienił na 70 480 ETH. 🇰🇵 TRM Labs i Chainalysis przypisują atak grupie TraderTraitor z Korei Północnej. To ta sama grupa, którą FBI wskazało jako sprawcę hacku Bybit. Według ZachXBT środki z Binance spotkały się z pieniędzmi z hacku Bitget za 388 mln USD. 🔑 Binance twierdzi, że żaden klucz prywatny nie wyciekł. Blockaid naliczył jednak jedenaście kluczy, które podpisały przelewy. Najbardziej prawdopodobne wyjaśnienie: napastnik przejął system, który decyduje, co klucze podpisują. 💻 Laptop inżyniera DevOps miał być punktem wejścia, ale Binance przyznaje już, że punktów naruszenia było więcej. Pełny post-mortem i nowy Proof of Reserves mają zostać opublikowane po zakończeniu śledztwa. 🛡️ Binance pokryje straty z funduszu SAFU i środków własnych. Przed atakiem giełda trzymała około 144 mld USD aktywów, więc niezamrożona część to rząd 2% tej kwoty. ⏳ Depozyty działają, a wypłaty mają wrócić do niedzieli. 📉 Rynek: BTC spadł chwilowo do około 76 650 USD, najniżej od sześciu tygodni. Likwidacje sięgnęły około 1,5 mld USD, a indeks Fear & Greed spadł do 30. 🔒 Rynki Aave pozostają zamrożone do czasu, aż środki napastnika przestaną się ruszać. 👀 Teraz warto obserwować, czy ruszy 18 270 BTC. TRM spodziewa się, że kolejny etap prania przejdzie przez mosty cross-chain, usługi swapowe i brokerów OTC.