CryptoForge
97 Posts
CryptoForge
Report
Block User
Crypto analyst| passionate Blockchain technology
Frequent Trader
5 Years
415 Following
219 Followers
170 Liked
Posts
All
Quotes
·
--
Binance hacked, $5.6 billion gone.
This is the crypto heist of the century. The numbers are staggering:
• $1.45B in BTC
• $875M in ETH
• $1.57B in USDT
• $823M in USDC
• + hundreds of millions in TRX, XAUT, WBETH…
But the craziest part? Tether and Circle managed to freeze nearly $1.8 billion mid-flight. CZ confirmed a hack and assured that user funds will be covered.
The market is panicking. BTC dropped below $79,000.
This is officially the largest hack in crypto history. The previous record (Bybit, $1.5B) has been obliterated.
#Binance #cryptouniverseofficial #Hack #bitcoin #Urgent
Binance hacked, $5.6 billion gone.
This is the crypto heist of the century. The numbers are staggering:
• $1.45B in BTC
• $875M in ETH
• $1.57B in USDT
• $823M in USDC
• + hundreds of millions in TRX, XAUT, WBETH…
But the craziest part? Tether and Circle managed to freeze nearly $1.8 billion mid-flight. CZ confirmed a hack and assured that user funds will be covered.
The market is panicking. BTC dropped below $79,000.
This is officially the largest hack in crypto history. The previous record (Bybit, $1.5B) has been obliterated.
#Binance #cryptouniverseofficial #Hack #bitcoin #Urgent
This is the crypto heist of the century. The numbers are staggering:
• $1.45B in BTC
• $875M in ETH
• $1.57B in USDT
• $823M in USDC
• + hundreds of millions in TRX, XAUT, WBETH…
But the craziest part? Tether and Circle managed to freeze nearly $1.8 billion mid-flight. CZ confirmed a hack and assured that user funds will be covered.
The market is panicking. BTC dropped below $79,000.
This is officially the largest hack in crypto history. The previous record (Bybit, $1.5B) has been obliterated.
#Binance #cryptouniverseofficial #Hack #bitcoin #Urgent
138
·
--
Keystone is destroying 18,835 crypto wallets. A hacker stole the key that certifies they're authentic. As a result, fake wallets could pass official verification and steal your funds.
On top of that, 25,964 customer records exposed… even though the company had long promised to delete them. The deletion tool was broken.
Your seed phrases? Not affected, according to Keystone. But if you received a wallet after October 20: verify it before using it.
Keystone is destroying 18,835 crypto wallets. A hacker stole the key that certifies they're authentic. As a result, fake wallets could pass official verification and steal your funds.
On top of that, 25,964 customer records exposed… even though the company had long promised to delete them. The deletion tool was broken.
Your seed phrases? Not affected, according to Keystone. But if you received a wallet after October 20: verify it before using it.
On top of that, 25,964 customer records exposed… even though the company had long promised to delete them. The deletion tool was broken.
Your seed phrases? Not affected, according to Keystone. But if you received a wallet after October 20: verify it before using it.
123
·
--
🚨 10/10/2025
One year ago today, crypto experienced the biggest wave of liquidations in its history.
$19 billion wiped out. 1.6 million traders wiped out.
🚨 10/10/2025
One year ago today, crypto experienced the biggest wave of liquidations in its history.
$19 billion wiped out. 1.6 million traders wiped out.
One year ago today, crypto experienced the biggest wave of liquidations in its history.
$19 billion wiped out. 1.6 million traders wiped out.
113
·
--
4.3 Possible Chain Reactions
Some speculate that Karpelès's public warning (approximately 90,000 views) may have alerted the attacker, prompting them to accelerate the transfer of funds from multiple wallets. However, this link has not been confirmed.
5. Recommendations for Users
For users who purchased a device from CryptoBilis within the last 90 days:
1. Not yet configured: do not proceed with initialization
2. Already configured: consider transferring assets to a new device, using an entirely new recovery phrase
3. Suspected tampering: avoid entering an existing recovery phrase into any unverified software or website
General advice: purchase hardware wallets through authorized official channels, and verify the authenticity of the device according to official procedures upon receipt.
6. Scope of the Incident
If the $86 million estimate is confirmed, this would be one of the most serious incidents ever linked to a hardware wallet's distribution chain. The essential difference, however, lies in the fact that this is an attack at the reseller level, and not a flaw affecting Ledger's entire systems or product line.
Ledger states that the investigation is ongoing and that it will publish updates as it progresses.
4.3 Possible Chain Reactions
Some speculate that Karpelès's public warning (approximately 90,000 views) may have alerted the attacker, prompting them to accelerate the transfer of funds from multiple wallets. However, this link has not been confirmed.
5. Recommendations for Users
For users who purchased a device from CryptoBilis within the last 90 days:
1. Not yet configured: do not proceed with initialization
2. Already configured: consider transferring assets to a new device, using an entirely new recovery phrase
3. Suspected tampering: avoid entering an existing recovery phrase into any unverified software or website
General advice: purchase hardware wallets through authorized official channels, and verify the authenticity of the device according to official procedures upon receipt.
6. Scope of the Incident
If the $86 million estimate is confirmed, this would be one of the most serious incidents ever linked to a hardware wallet's distribution chain. The essential difference, however, lies in the fact that this is an attack at the reseller level, and not a flaw affecting Ledger's entire systems or product line.
Ledger states that the investigation is ongoing and that it will publish updates as it progresses.
Some speculate that Karpelès's public warning (approximately 90,000 views) may have alerted the attacker, prompting them to accelerate the transfer of funds from multiple wallets. However, this link has not been confirmed.
5. Recommendations for Users
For users who purchased a device from CryptoBilis within the last 90 days:
1. Not yet configured: do not proceed with initialization
2. Already configured: consider transferring assets to a new device, using an entirely new recovery phrase
3. Suspected tampering: avoid entering an existing recovery phrase into any unverified software or website
General advice: purchase hardware wallets through authorized official channels, and verify the authenticity of the device according to official procedures upon receipt.
6. Scope of the Incident
If the $86 million estimate is confirmed, this would be one of the most serious incidents ever linked to a hardware wallet's distribution chain. The essential difference, however, lies in the fact that this is an attack at the reseller level, and not a flaw affecting Ledger's entire systems or product line.
Ledger states that the investigation is ongoing and that it will publish updates as it progresses.
CryptoForge
·
--
Binance founder CZ commented that the evidence points toward a localized supply chain attack targeting a single vendor, rather than a flaw affecting Ledger's entire product line.
3. Unusual Changes at CryptoBilis
3.1 Change of Ownership
Company records indicate that as of August 3, an individual named Jiaming, whose registered address is in Heilongjiang Province, China, held 100% of CryptoBilis's shares.
The former co-founder confirmed that the acquisition was finalized in March, and that the former owner had withdrawn from all operational, managerial, and administrative roles. This founder, who no longer has access to operations since the sale, stated, "we are no longer part of the company," and called on the current management to be transparent.
3.2 Link to the Attack Not Established
At this stage, no conclusive evidence establishes a direct link between the change of ownership at CryptoBilis and the wallet intrusions.
4. Mark Karpelès's Discovery of an Implanted Module
Former Mt. Gox CEO Mark Karpelès revealed that a Ledger device originating from Malaysia that he examined contained a suspected spy module.
4.1 Technical Details
The module was concealed in the location of the screen's original padding, and included the following components:
· An LTE communication component
· An antenna
· An eSIM
· A microcontroller, connected to the Ledger's SPI bus
4.2 Attack Principle
According to Karpelès, the implanted module analyzes the content displayed on the screen, records the recovery phrase at the moment it is presented to the user, and then transmits it to a third party via the LTE network. The attacker can then monitor the victim's wallet addresses and choose the opportune moment to transfer the assets.
Major issue: since the original secure element remains intact, Ledger's official authenticity verification may fail to detect this type of physical modification.
3. Unusual Changes at CryptoBilis
3.1 Change of Ownership
Company records indicate that as of August 3, an individual named Jiaming, whose registered address is in Heilongjiang Province, China, held 100% of CryptoBilis's shares.
The former co-founder confirmed that the acquisition was finalized in March, and that the former owner had withdrawn from all operational, managerial, and administrative roles. This founder, who no longer has access to operations since the sale, stated, "we are no longer part of the company," and called on the current management to be transparent.
3.2 Link to the Attack Not Established
At this stage, no conclusive evidence establishes a direct link between the change of ownership at CryptoBilis and the wallet intrusions.
4. Mark Karpelès's Discovery of an Implanted Module
Former Mt. Gox CEO Mark Karpelès revealed that a Ledger device originating from Malaysia that he examined contained a suspected spy module.
4.1 Technical Details
The module was concealed in the location of the screen's original padding, and included the following components:
· An LTE communication component
· An antenna
· An eSIM
· A microcontroller, connected to the Ledger's SPI bus
4.2 Attack Principle
According to Karpelès, the implanted module analyzes the content displayed on the screen, records the recovery phrase at the moment it is presented to the user, and then transmits it to a third party via the LTE network. The attacker can then monitor the victim's wallet addresses and choose the opportune moment to transfer the assets.
Major issue: since the original secure element remains intact, Ledger's official authenticity verification may fail to detect this type of physical modification.
34
·
--
Binance founder CZ commented that the evidence points toward a localized supply chain attack targeting a single vendor, rather than a flaw affecting Ledger's entire product line.
3. Unusual Changes at CryptoBilis
3.1 Change of Ownership
Company records indicate that as of August 3, an individual named Jiaming, whose registered address is in Heilongjiang Province, China, held 100% of CryptoBilis's shares.
The former co-founder confirmed that the acquisition was finalized in March, and that the former owner had withdrawn from all operational, managerial, and administrative roles. This founder, who no longer has access to operations since the sale, stated, "we are no longer part of the company," and called on the current management to be transparent.
3.2 Link to the Attack Not Established
At this stage, no conclusive evidence establishes a direct link between the change of ownership at CryptoBilis and the wallet intrusions.
4. Mark Karpelès's Discovery of an Implanted Module
Former Mt. Gox CEO Mark Karpelès revealed that a Ledger device originating from Malaysia that he examined contained a suspected spy module.
4.1 Technical Details
The module was concealed in the location of the screen's original padding, and included the following components:
· An LTE communication component
· An antenna
· An eSIM
· A microcontroller, connected to the Ledger's SPI bus
4.2 Attack Principle
According to Karpelès, the implanted module analyzes the content displayed on the screen, records the recovery phrase at the moment it is presented to the user, and then transmits it to a third party via the LTE network. The attacker can then monitor the victim's wallet addresses and choose the opportune moment to transfer the assets.
Major issue: since the original secure element remains intact, Ledger's official authenticity verification may fail to detect this type of physical modification.
Binance founder CZ commented that the evidence points toward a localized supply chain attack targeting a single vendor, rather than a flaw affecting Ledger's entire product line.
3. Unusual Changes at CryptoBilis
3.1 Change of Ownership
Company records indicate that as of August 3, an individual named Jiaming, whose registered address is in Heilongjiang Province, China, held 100% of CryptoBilis's shares.
The former co-founder confirmed that the acquisition was finalized in March, and that the former owner had withdrawn from all operational, managerial, and administrative roles. This founder, who no longer has access to operations since the sale, stated, "we are no longer part of the company," and called on the current management to be transparent.
3.2 Link to the Attack Not Established
At this stage, no conclusive evidence establishes a direct link between the change of ownership at CryptoBilis and the wallet intrusions.
4. Mark Karpelès's Discovery of an Implanted Module
Former Mt. Gox CEO Mark Karpelès revealed that a Ledger device originating from Malaysia that he examined contained a suspected spy module.
4.1 Technical Details
The module was concealed in the location of the screen's original padding, and included the following components:
· An LTE communication component
· An antenna
· An eSIM
· A microcontroller, connected to the Ledger's SPI bus
4.2 Attack Principle
According to Karpelès, the implanted module analyzes the content displayed on the screen, records the recovery phrase at the moment it is presented to the user, and then transmits it to a third party via the LTE network. The attacker can then monitor the victim's wallet addresses and choose the opportune moment to transfer the assets.
Major issue: since the original secure element remains intact, Ledger's official authenticity verification may fail to detect this type of physical modification.
3. Unusual Changes at CryptoBilis
3.1 Change of Ownership
Company records indicate that as of August 3, an individual named Jiaming, whose registered address is in Heilongjiang Province, China, held 100% of CryptoBilis's shares.
The former co-founder confirmed that the acquisition was finalized in March, and that the former owner had withdrawn from all operational, managerial, and administrative roles. This founder, who no longer has access to operations since the sale, stated, "we are no longer part of the company," and called on the current management to be transparent.
3.2 Link to the Attack Not Established
At this stage, no conclusive evidence establishes a direct link between the change of ownership at CryptoBilis and the wallet intrusions.
4. Mark Karpelès's Discovery of an Implanted Module
Former Mt. Gox CEO Mark Karpelès revealed that a Ledger device originating from Malaysia that he examined contained a suspected spy module.
4.1 Technical Details
The module was concealed in the location of the screen's original padding, and included the following components:
· An LTE communication component
· An antenna
· An eSIM
· A microcontroller, connected to the Ledger's SPI bus
4.2 Attack Principle
According to Karpelès, the implanted module analyzes the content displayed on the screen, records the recovery phrase at the moment it is presented to the user, and then transmits it to a third party via the LTE network. The attacker can then monitor the victim's wallet addresses and choose the opportune moment to transfer the assets.
Major issue: since the original secure element remains intact, Ledger's official authenticity verification may fail to detect this type of physical modification.
CryptoForge
·
--
Ledger Affair: Over $86 Million Stolen, Reseller CryptoBilis Suspected at the Heart of a Supply Chain Attack
Key points: Ledger is investigating a possible supply chain attack involving the reseller CryptoBilis in Southeast Asia. An onchain investigator estimates losses at over $86 million. The reseller reportedly changed ownership in March to a Chinese national, and the former CEO of Mt. Gox claims to have discovered a tampered device containing an LTE spy module. So far, Ledger has confirmed neither the cause of the incident nor the exact amount of the losses.
1. Background of the Case
On October 9, Ledger issued a statement indicating it was investigating reports of lost funds from users in Southeast Asia, all of whom had purchased their device from the reseller CryptoBilis.
Official measures taken by Ledger:
· Requested that CryptoBilis immediately suspend all sales and shipments
· Recommended that users who purchased a device within the last 90 days not configure it if they have not yet done so
· Advised users who have already activated their device to consider transferring their assets to a new wallet using an entirely new recovery phrase
Ledger emphasizes that, based on available information, the incident is limited to this specific reseller and this particular market. No related reports have been observed for products purchased directly from Ledger, and Ledger's own infrastructure, systems, and services have not been compromised.
2. Onchain Loss Estimates
Onchain investigator Specter stated on X that they had traced the stolen funds across Bitcoin, Ethereum, and Tron, for a total amount exceeding $86 million, originating from hundreds of victim wallets.
Another investigator, tanuki42, estimates the losses at over $72 million. According to detailed data reported by KuCoin: approximately $42 million in ETH, $17.6 million in BTC, and $16.5 million in USDT.
These figures have not been confirmed by Ledger, and it is unclear whether the two investigators' estimates cover the same set of transactions.
Key points: Ledger is investigating a possible supply chain attack involving the reseller CryptoBilis in Southeast Asia. An onchain investigator estimates losses at over $86 million. The reseller reportedly changed ownership in March to a Chinese national, and the former CEO of Mt. Gox claims to have discovered a tampered device containing an LTE spy module. So far, Ledger has confirmed neither the cause of the incident nor the exact amount of the losses.
1. Background of the Case
On October 9, Ledger issued a statement indicating it was investigating reports of lost funds from users in Southeast Asia, all of whom had purchased their device from the reseller CryptoBilis.
Official measures taken by Ledger:
· Requested that CryptoBilis immediately suspend all sales and shipments
· Recommended that users who purchased a device within the last 90 days not configure it if they have not yet done so
· Advised users who have already activated their device to consider transferring their assets to a new wallet using an entirely new recovery phrase
Ledger emphasizes that, based on available information, the incident is limited to this specific reseller and this particular market. No related reports have been observed for products purchased directly from Ledger, and Ledger's own infrastructure, systems, and services have not been compromised.
2. Onchain Loss Estimates
Onchain investigator Specter stated on X that they had traced the stolen funds across Bitcoin, Ethereum, and Tron, for a total amount exceeding $86 million, originating from hundreds of victim wallets.
Another investigator, tanuki42, estimates the losses at over $72 million. According to detailed data reported by KuCoin: approximately $42 million in ETH, $17.6 million in BTC, and $16.5 million in USDT.
These figures have not been confirmed by Ledger, and it is unclear whether the two investigators' estimates cover the same set of transactions.
1
45
·
--
Ledger Affair: Over $86 Million Stolen, Reseller CryptoBilis Suspected at the Heart of a Supply Chain Attack
Key points: Ledger is investigating a possible supply chain attack involving the reseller CryptoBilis in Southeast Asia. An onchain investigator estimates losses at over $86 million. The reseller reportedly changed ownership in March to a Chinese national, and the former CEO of Mt. Gox claims to have discovered a tampered device containing an LTE spy module. So far, Ledger has confirmed neither the cause of the incident nor the exact amount of the losses.
1. Background of the Case
On October 9, Ledger issued a statement indicating it was investigating reports of lost funds from users in Southeast Asia, all of whom had purchased their device from the reseller CryptoBilis.
Official measures taken by Ledger:
· Requested that CryptoBilis immediately suspend all sales and shipments
· Recommended that users who purchased a device within the last 90 days not configure it if they have not yet done so
· Advised users who have already activated their device to consider transferring their assets to a new wallet using an entirely new recovery phrase
Ledger emphasizes that, based on available information, the incident is limited to this specific reseller and this particular market. No related reports have been observed for products purchased directly from Ledger, and Ledger's own infrastructure, systems, and services have not been compromised.
2. Onchain Loss Estimates
Onchain investigator Specter stated on X that they had traced the stolen funds across Bitcoin, Ethereum, and Tron, for a total amount exceeding $86 million, originating from hundreds of victim wallets.
Another investigator, tanuki42, estimates the losses at over $72 million. According to detailed data reported by KuCoin: approximately $42 million in ETH, $17.6 million in BTC, and $16.5 million in USDT.
These figures have not been confirmed by Ledger, and it is unclear whether the two investigators' estimates cover the same set of transactions.
Ledger Affair: Over $86 Million Stolen, Reseller CryptoBilis Suspected at the Heart of a Supply Chain Attack
Key points: Ledger is investigating a possible supply chain attack involving the reseller CryptoBilis in Southeast Asia. An onchain investigator estimates losses at over $86 million. The reseller reportedly changed ownership in March to a Chinese national, and the former CEO of Mt. Gox claims to have discovered a tampered device containing an LTE spy module. So far, Ledger has confirmed neither the cause of the incident nor the exact amount of the losses.
1. Background of the Case
On October 9, Ledger issued a statement indicating it was investigating reports of lost funds from users in Southeast Asia, all of whom had purchased their device from the reseller CryptoBilis.
Official measures taken by Ledger:
· Requested that CryptoBilis immediately suspend all sales and shipments
· Recommended that users who purchased a device within the last 90 days not configure it if they have not yet done so
· Advised users who have already activated their device to consider transferring their assets to a new wallet using an entirely new recovery phrase
Ledger emphasizes that, based on available information, the incident is limited to this specific reseller and this particular market. No related reports have been observed for products purchased directly from Ledger, and Ledger's own infrastructure, systems, and services have not been compromised.
2. Onchain Loss Estimates
Onchain investigator Specter stated on X that they had traced the stolen funds across Bitcoin, Ethereum, and Tron, for a total amount exceeding $86 million, originating from hundreds of victim wallets.
Another investigator, tanuki42, estimates the losses at over $72 million. According to detailed data reported by KuCoin: approximately $42 million in ETH, $17.6 million in BTC, and $16.5 million in USDT.
These figures have not been confirmed by Ledger, and it is unclear whether the two investigators' estimates cover the same set of transactions.
Key points: Ledger is investigating a possible supply chain attack involving the reseller CryptoBilis in Southeast Asia. An onchain investigator estimates losses at over $86 million. The reseller reportedly changed ownership in March to a Chinese national, and the former CEO of Mt. Gox claims to have discovered a tampered device containing an LTE spy module. So far, Ledger has confirmed neither the cause of the incident nor the exact amount of the losses.
1. Background of the Case
On October 9, Ledger issued a statement indicating it was investigating reports of lost funds from users in Southeast Asia, all of whom had purchased their device from the reseller CryptoBilis.
Official measures taken by Ledger:
· Requested that CryptoBilis immediately suspend all sales and shipments
· Recommended that users who purchased a device within the last 90 days not configure it if they have not yet done so
· Advised users who have already activated their device to consider transferring their assets to a new wallet using an entirely new recovery phrase
Ledger emphasizes that, based on available information, the incident is limited to this specific reseller and this particular market. No related reports have been observed for products purchased directly from Ledger, and Ledger's own infrastructure, systems, and services have not been compromised.
2. Onchain Loss Estimates
Onchain investigator Specter stated on X that they had traced the stolen funds across Bitcoin, Ethereum, and Tron, for a total amount exceeding $86 million, originating from hundreds of victim wallets.
Another investigator, tanuki42, estimates the losses at over $72 million. According to detailed data reported by KuCoin: approximately $42 million in ETH, $17.6 million in BTC, and $16.5 million in USDT.
These figures have not been confirmed by Ledger, and it is unclear whether the two investigators' estimates cover the same set of transactions.
1
108
·
--
It’s not a partnership exclusive to Solana; that’s just marketing.
It’s not a partnership exclusive to Solana; that’s just marketing.
134
·
--
Bitget Hack: What We Actually Know Hours After the Hack
🔹 ≈$351.6M left Bitget's hot wallets after its security system flagged the first unauthorized transfer at 18:31 UTC on September 24. Cold wallets were not affected.
🔹 Surprising method: no private keys were stolen. According to CEO Gracy Chen, the attacker breached a backend system and falsified transaction data, so Bitget's own infrastructure approved the withdrawals.
🔹 Main losses:
· XRP: 102.9M XRP (≈$157.5M)** — largest single loss
· ETH: **31,890 ETH (≈$85.8M)
· Stablecoins: ≈$75.5M**
· Most EVM funds have already been swapped into **67,982 ETH (≈$183M)
🔹 Attribution: Chen points to IP addresses linked to VPNs used by a DPRK group. On-chain investigators connect the XRP trail to the July AFX hack, attributed to TraderTraitor (linked to Lazarus). No technical proof has been published yet.
🔹 Coverage: the 5,500 BTC (≈$464M) User Protection Fund absorbs the loss and is expected to be replenished later. Deposits and trading remain open, balances are intact, and Mandiant and SlowMist are investigating.
🔹 Withdrawals frozen with no reopening date. When Bybit lost $1.5B in February 2025, it never suspended withdrawals, partly because Bitget had lent it 40,000 ETH. This time, the roles are reversed.
🔹 Context: September is already 2026's worst month for hacks, with over $700M** lost, including Liquid's **$320M on September 7.
Key Takeaway
This doesn't mean cold storage failed. It means the weak point has shifted to the centralized system that decides what a hot wallet is allowed to send.
What to Watch
To assess the real scope of the impact:
· ⏳ How quickly withdrawals reopen
· 📄 Whether the incident report actually explains the backend breach
Bitget Hack: What We Actually Know Hours After the Hack
🔹 ≈$351.6M left Bitget's hot wallets after its security system flagged the first unauthorized transfer at 18:31 UTC on September 24. Cold wallets were not affected.
🔹 Surprising method: no private keys were stolen. According to CEO Gracy Chen, the attacker breached a backend system and falsified transaction data, so Bitget's own infrastructure approved the withdrawals.
🔹 Main losses:
· XRP: 102.9M XRP (≈$157.5M)** — largest single loss
· ETH: **31,890 ETH (≈$85.8M)
· Stablecoins: ≈$75.5M**
· Most EVM funds have already been swapped into **67,982 ETH (≈$183M)
🔹 Attribution: Chen points to IP addresses linked to VPNs used by a DPRK group. On-chain investigators connect the XRP trail to the July AFX hack, attributed to TraderTraitor (linked to Lazarus). No technical proof has been published yet.
🔹 Coverage: the 5,500 BTC (≈$464M) User Protection Fund absorbs the loss and is expected to be replenished later. Deposits and trading remain open, balances are intact, and Mandiant and SlowMist are investigating.
🔹 Withdrawals frozen with no reopening date. When Bybit lost $1.5B in February 2025, it never suspended withdrawals, partly because Bitget had lent it 40,000 ETH. This time, the roles are reversed.
🔹 Context: September is already 2026's worst month for hacks, with over $700M** lost, including Liquid's **$320M on September 7.
Key Takeaway
This doesn't mean cold storage failed. It means the weak point has shifted to the centralized system that decides what a hot wallet is allowed to send.
What to Watch
To assess the real scope of the impact:
· ⏳ How quickly withdrawals reopen
· 📄 Whether the incident report actually explains the backend breach
🔹 ≈$351.6M left Bitget's hot wallets after its security system flagged the first unauthorized transfer at 18:31 UTC on September 24. Cold wallets were not affected.
🔹 Surprising method: no private keys were stolen. According to CEO Gracy Chen, the attacker breached a backend system and falsified transaction data, so Bitget's own infrastructure approved the withdrawals.
🔹 Main losses:
· XRP: 102.9M XRP (≈$157.5M)** — largest single loss
· ETH: **31,890 ETH (≈$85.8M)
· Stablecoins: ≈$75.5M**
· Most EVM funds have already been swapped into **67,982 ETH (≈$183M)
🔹 Attribution: Chen points to IP addresses linked to VPNs used by a DPRK group. On-chain investigators connect the XRP trail to the July AFX hack, attributed to TraderTraitor (linked to Lazarus). No technical proof has been published yet.
🔹 Coverage: the 5,500 BTC (≈$464M) User Protection Fund absorbs the loss and is expected to be replenished later. Deposits and trading remain open, balances are intact, and Mandiant and SlowMist are investigating.
🔹 Withdrawals frozen with no reopening date. When Bybit lost $1.5B in February 2025, it never suspended withdrawals, partly because Bitget had lent it 40,000 ETH. This time, the roles are reversed.
🔹 Context: September is already 2026's worst month for hacks, with over $700M** lost, including Liquid's **$320M on September 7.
Key Takeaway
This doesn't mean cold storage failed. It means the weak point has shifted to the centralized system that decides what a hot wallet is allowed to send.
What to Watch
To assess the real scope of the impact:
· ⏳ How quickly withdrawals reopen
· 📄 Whether the incident report actually explains the backend breach
153
·
--
🇺🇸❌ The U.S. Senate rejects the CLARITY Act.
The most-anticipated crypto market structure bill failed to reach the 60 votes needed to advance the cloture motion. The vote ended in defeat by 50 to 49, likely pushing the legislative process back to 2027.
🗣️ Warren’s fight.
Elizabeth Warren called the bill’s ethical provisions a “paltry fig leaf.” In her view, the current version weakens financial protections and could set the stage for another crisis like the one in 2008. Her main talking point: conflicts of interest tied to Trump’s crypto activities, estimated at more than $1 billion for the president and his family last year.
🔄 What it really means.
This isn’t a vote “for or against crypto.” It’s a disagreement over who sets the rules—and whose interests they serve. Supporters of the bill argue that a clear federal framework would reduce precisely those risks. But for now, the SEC and the CFTC will keep moving forward using their own powers—rules that can be reversed with every change of administration.
The fight for a lasting framework isn’t over. It’s just been postponed.
🇺🇸❌ The U.S. Senate rejects the CLARITY Act.
The most-anticipated crypto market structure bill failed to reach the 60 votes needed to advance the cloture motion. The vote ended in defeat by 50 to 49, likely pushing the legislative process back to 2027.
🗣️ Warren’s fight.
Elizabeth Warren called the bill’s ethical provisions a “paltry fig leaf.” In her view, the current version weakens financial protections and could set the stage for another crisis like the one in 2008. Her main talking point: conflicts of interest tied to Trump’s crypto activities, estimated at more than $1 billion for the president and his family last year.
🔄 What it really means.
This isn’t a vote “for or against crypto.” It’s a disagreement over who sets the rules—and whose interests they serve. Supporters of the bill argue that a clear federal framework would reduce precisely those risks. But for now, the SEC and the CFTC will keep moving forward using their own powers—rules that can be reversed with every change of administration.
The fight for a lasting framework isn’t over. It’s just been postponed.
The most-anticipated crypto market structure bill failed to reach the 60 votes needed to advance the cloture motion. The vote ended in defeat by 50 to 49, likely pushing the legislative process back to 2027.
🗣️ Warren’s fight.
Elizabeth Warren called the bill’s ethical provisions a “paltry fig leaf.” In her view, the current version weakens financial protections and could set the stage for another crisis like the one in 2008. Her main talking point: conflicts of interest tied to Trump’s crypto activities, estimated at more than $1 billion for the president and his family last year.
🔄 What it really means.
This isn’t a vote “for or against crypto.” It’s a disagreement over who sets the rules—and whose interests they serve. Supporters of the bill argue that a clear federal framework would reduce precisely those risks. But for now, the SEC and the CFTC will keep moving forward using their own powers—rules that can be reversed with every change of administration.
The fight for a lasting framework isn’t over. It’s just been postponed.
70
·
--
Strategy is selling Air Jordan sneakers in Bitcoin colors (black/orange) for $250, but it's impossible to pay for them with BTC: only credit card or Google Pay is accepted. This is utterly ironic for a company that holds hundreds of thousands of BTC and bases its entire identity on Bitcoin. The model is already exhausted, proof of its marketing success despite the absurdity of the payment method.
Strategy is selling Air Jordan sneakers in Bitcoin colors (black/orange) for $250, but it's impossible to pay for them with BTC: only credit card or Google Pay is accepted. This is utterly ironic for a company that holds hundreds of thousands of BTC and bases its entire identity on Bitcoin. The model is already exhausted, proof of its marketing success despite the absurdity of the payment method.
125
·
--
No one's more stressed than the guy who's been in crypto since 2021 and still isn't rich.
He's been through the wringer.
He's watched his account get wiped out.
He's heard everyone tell him it's over.
And now he watches the newbies arrive, wondering why, after all these years, he still has nothing.
The hardest part isn't losing.
It's hanging in there for years…
and realizing the jackpot still hasn't arrived.
No one's more stressed than the guy who's been in crypto since 2021 and still isn't rich.
He's been through the wringer.
He's watched his account get wiped out.
He's heard everyone tell him it's over.
And now he watches the newbies arrive, wondering why, after all these years, he still has nothing.
The hardest part isn't losing.
It's hanging in there for years…
and realizing the jackpot still hasn't arrived.
He's been through the wringer.
He's watched his account get wiped out.
He's heard everyone tell him it's over.
And now he watches the newbies arrive, wondering why, after all these years, he still has nothing.
The hardest part isn't losing.
It's hanging in there for years…
and realizing the jackpot still hasn't arrived.
124
·
--
⚠️ A real TROJAN HORSE could be hiding in your illegally downloaded copy of the movie "The Odyssey"...
According to Bitdefender, fake copies of the film are circulating disguised as HD/WebRip/Blu-ray versions. However, instead of the movie, some .exe files install Lumma Stealer, malware specializing in data theft.
Once launched, it can retrieve your crypto wallets, passwords, saved data, and session cookies, potentially allowing the hijacking of accounts even those protected by two-factor authentication. It sometimes hides behind VLC-style icons.
⚠️ A real TROJAN HORSE could be hiding in your illegally downloaded copy of the movie "The Odyssey"...
According to Bitdefender, fake copies of the film are circulating disguised as HD/WebRip/Blu-ray versions. However, instead of the movie, some .exe files install Lumma Stealer, malware specializing in data theft.
Once launched, it can retrieve your crypto wallets, passwords, saved data, and session cookies, potentially allowing the hijacking of accounts even those protected by two-factor authentication. It sometimes hides behind VLC-style icons.
According to Bitdefender, fake copies of the film are circulating disguised as HD/WebRip/Blu-ray versions. However, instead of the movie, some .exe files install Lumma Stealer, malware specializing in data theft.
Once launched, it can retrieve your crypto wallets, passwords, saved data, and session cookies, potentially allowing the hijacking of accounts even those protected by two-factor authentication. It sometimes hides behind VLC-style icons.
56
·
--
🚨 GitHub is down worldwide.
GitHub and Copilot are experiencing issues: 20% of website and API errors, and 50% of archives and raw content errors. The issues affect the API, Actions, problems, merge requests, and webhooks. The team is investigating; the time to resolution is not yet known.
🚨 GitHub is down worldwide.
GitHub and Copilot are experiencing issues: 20% of website and API errors, and 50% of archives and raw content errors. The issues affect the API, Actions, problems, merge requests, and webhooks. The team is investigating; the time to resolution is not yet known.
GitHub and Copilot are experiencing issues: 20% of website and API errors, and 50% of archives and raw content errors. The issues affect the API, Actions, problems, merge requests, and webhooks. The team is investigating; the time to resolution is not yet known.
86
·
--
⚠️🔐 Nearly 14,000 @Trezor customers have had their personal data exposed after a shipping provider was hacked.
In total, 11,742 customers were affected by a complete data breach, including their name, email address, phone number, and, most importantly, their shipping address, while another 1,947 customers had some of their information exposed.
The incident affected new customers who received an order within 90 days prior to August 8, 2026, in the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal.
Trezor clarifies that its systems and hardware wallets were not compromised.
⚠️🔐 Nearly 14,000 @Trezor customers have had their personal data exposed after a shipping provider was hacked.
In total, 11,742 customers were affected by a complete data breach, including their name, email address, phone number, and, most importantly, their shipping address, while another 1,947 customers had some of their information exposed.
The incident affected new customers who received an order within 90 days prior to August 8, 2026, in the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal.
Trezor clarifies that its systems and hardware wallets were not compromised.
In total, 11,742 customers were affected by a complete data breach, including their name, email address, phone number, and, most importantly, their shipping address, while another 1,947 customers had some of their information exposed.
The incident affected new customers who received an order within 90 days prior to August 8, 2026, in the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal.
Trezor clarifies that its systems and hardware wallets were not compromised.
2
·
--
Verified
🧵 Telegram $GRAM - COMPLETE THESIS
The Billion User Bet 🌍
⚠️ FIRST, THE TRAP TO AVOID
$GRAM is NOT a new token. It's the former $TON (Toncoin), renamed on June 15, 2026, after a community vote (81.22% in favor). It reverts to the original name from the 2018 Telegram whitepaper.
1:1 conversion, no migration, balances unchanged 👉 Any site asking you to "claim GRAM" or "migrate" your TON is a SCAM. There is no legitimate migration.
The chain retains its name: The Open Network (TON).
Gram = the token. TON = the blockchain.
🧵 Telegram $GRAM - COMPLETE THESIS
The Billion User Bet 🌍
⚠️ FIRST, THE TRAP TO AVOID
$GRAM is NOT a new token. It's the former $TON (Toncoin), renamed on June 15, 2026, after a community vote (81.22% in favor). It reverts to the original name from the 2018 Telegram whitepaper.
1:1 conversion, no migration, balances unchanged 👉 Any site asking you to "claim GRAM" or "migrate" your TON is a SCAM. There is no legitimate migration.
The chain retains its name: The Open Network (TON).
Gram = the token. TON = the blockchain.
The Billion User Bet 🌍
⚠️ FIRST, THE TRAP TO AVOID
$GRAM is NOT a new token. It's the former $TON (Toncoin), renamed on June 15, 2026, after a community vote (81.22% in favor). It reverts to the original name from the 2018 Telegram whitepaper.
1:1 conversion, no migration, balances unchanged 👉 Any site asking you to "claim GRAM" or "migrate" your TON is a SCAM. There is no legitimate migration.
The chain retains its name: The Open Network (TON).
Gram = the token. TON = the blockchain.
3
250
·
--
Over 300 people came together around Web3 in Burkina Faso🇧🇫!
On Saturday, I had the chance to be part of the organizing team for the Binance Meetup, hosted by @BinanceAfrique que through the Binance Angels, right here in Burkina Faso.
The event brought together more than 300 participants, all driven by the same curiosity and belief: that Web3 has a real role to play in our region.
For me, this kind of gathering goes far beyond just a meetup. It's a genuine space for exchange, mutual learning, and above all, a concrete way to show people that real career opportunities exist in this space.
Our goal was straightforward: to help attendees understand how they can find their footing in an ecosystem that's evolving at lightning speed.
The discussions were lively, the questions were sharp, and the energy in the room was truly interactive.
A big thank you to @Binance for creating these spaces for connection and knowledge-sharing—they're essential for nurturing the Web3 momentum across Africa.
African Web3 is still being built. And it's together, on the ground, that we'll shape what comes next.
Over 300 people came together around Web3 in Burkina Faso🇧🇫!
On Saturday, I had the chance to be part of the organizing team for the Binance Meetup, hosted by @Binance Afrique que through the Binance Angels, right here in Burkina Faso.
The event brought together more than 300 participants, all driven by the same curiosity and belief: that Web3 has a real role to play in our region.
For me, this kind of gathering goes far beyond just a meetup. It's a genuine space for exchange, mutual learning, and above all, a concrete way to show people that real career opportunities exist in this space.
Our goal was straightforward: to help attendees understand how they can find their footing in an ecosystem that's evolving at lightning speed.
The discussions were lively, the questions were sharp, and the energy in the room was truly interactive.
A big thank you to @Binance for creating these spaces for connection and knowledge-sharing—they're essential for nurturing the Web3 momentum across Africa.
African Web3 is still being built. And it's together, on the ground, that we'll shape what comes next.
On Saturday, I had the chance to be part of the organizing team for the Binance Meetup, hosted by @Binance Afrique que through the Binance Angels, right here in Burkina Faso.
The event brought together more than 300 participants, all driven by the same curiosity and belief: that Web3 has a real role to play in our region.
For me, this kind of gathering goes far beyond just a meetup. It's a genuine space for exchange, mutual learning, and above all, a concrete way to show people that real career opportunities exist in this space.
Our goal was straightforward: to help attendees understand how they can find their footing in an ecosystem that's evolving at lightning speed.
The discussions were lively, the questions were sharp, and the energy in the room was truly interactive.
A big thank you to @Binance for creating these spaces for connection and knowledge-sharing—they're essential for nurturing the Web3 momentum across Africa.
African Web3 is still being built. And it's together, on the ground, that we'll shape what comes next.
67
·
--
The bear market is an incredible opportunity! NO, that is completely wrong for 99% of investors. ❌
Those who have been around since 2021 and have learned from the past know that this is not really an opportunity for 99% of holders.
If we are indeed in a bear market, I assure you that by 2027, 95% of the altcoins you are currently accumulating to make big gains will be obsolete.
I am convinced of that.
At the beginning of 2023, several cryptocurrencies that once dominated the market have been dethroned, either by a new cryptocurrency or by an older cryptocurrency that innovated. Some trends have faded, making way for others.
SAND, MANA, GALA, AXS, MATIC, FANTOM, BAKE, HARMONY ONE, ROSE, ENJ, QNT, ADA, BABYDOGE, CAKE, SUSHI… The list is long.
Swing traders can certainly take advantage of a bear market. But not long-term altcoin investors.
If you mismanage your bear market, you will have nothing left when it recovers.
Bitcoin is the best in a bear market.
I know you love compliments, even if that's how you lose money.
The bear market is an incredible opportunity! NO, that is completely wrong for 99% of investors. ❌
Those who have been around since 2021 and have learned from the past know that this is not really an opportunity for 99% of holders.
If we are indeed in a bear market, I assure you that by 2027, 95% of the altcoins you are currently accumulating to make big gains will be obsolete.
I am convinced of that.
At the beginning of 2023, several cryptocurrencies that once dominated the market have been dethroned, either by a new cryptocurrency or by an older cryptocurrency that innovated. Some trends have faded, making way for others.
SAND, MANA, GALA, AXS, MATIC, FANTOM, BAKE, HARMONY ONE, ROSE, ENJ, QNT, ADA, BABYDOGE, CAKE, SUSHI… The list is long.
Swing traders can certainly take advantage of a bear market. But not long-term altcoin investors.
If you mismanage your bear market, you will have nothing left when it recovers.
Bitcoin is the best in a bear market.
I know you love compliments, even if that's how you lose money.
Those who have been around since 2021 and have learned from the past know that this is not really an opportunity for 99% of holders.
If we are indeed in a bear market, I assure you that by 2027, 95% of the altcoins you are currently accumulating to make big gains will be obsolete.
I am convinced of that.
At the beginning of 2023, several cryptocurrencies that once dominated the market have been dethroned, either by a new cryptocurrency or by an older cryptocurrency that innovated. Some trends have faded, making way for others.
SAND, MANA, GALA, AXS, MATIC, FANTOM, BAKE, HARMONY ONE, ROSE, ENJ, QNT, ADA, BABYDOGE, CAKE, SUSHI… The list is long.
Swing traders can certainly take advantage of a bear market. But not long-term altcoin investors.
If you mismanage your bear market, you will have nothing left when it recovers.
Bitcoin is the best in a bear market.
I know you love compliments, even if that's how you lose money.
80
·
--
The altseason index is often misunderstood. Many believe it automatically indicates a bullish season for altcoins, whereas its calculation method is much more nuanced.
Specifically, this index measures the performance of the top 100 altcoins over a 90-day period, comparing them to the performance of Bitcoin over the same period.
When the index shows 17, it means that 17 altcoins from the top 100 have outperformed Bitcoin over the last 90 days.
Conversely, a high index (for example, 92) means that 92 altcoins have performed better than Bitcoin, but that does not necessarily mean the market is bullish.
A fundamental point to understand:
👉 Outperforming Bitcoin does not mean being in the green.
If Bitcoin drops sharply and some altcoins drop less than it, they are considered "more performing" in the index calculation.
Thus:
You can be overall at a loss,
While seeing the altseason index rise sharply.
In some extreme cases, the index can even approach 90 or more, simply because Bitcoin corrects more violently than the rest of the market — without there being a real altseason.
The altseason index is a statistical indicator, not a market signal sufficient on its own.
It can help read a relative trend, but it should never serve as the sole basis for making an investment or trading decision.
The altseason index is often misunderstood. Many believe it automatically indicates a bullish season for altcoins, whereas its calculation method is much more nuanced.
Specifically, this index measures the performance of the top 100 altcoins over a 90-day period, comparing them to the performance of Bitcoin over the same period.
When the index shows 17, it means that 17 altcoins from the top 100 have outperformed Bitcoin over the last 90 days.
Conversely, a high index (for example, 92) means that 92 altcoins have performed better than Bitcoin, but that does not necessarily mean the market is bullish.
A fundamental point to understand:
👉 Outperforming Bitcoin does not mean being in the green.
If Bitcoin drops sharply and some altcoins drop less than it, they are considered "more performing" in the index calculation.
Thus:
You can be overall at a loss,
While seeing the altseason index rise sharply.
In some extreme cases, the index can even approach 90 or more, simply because Bitcoin corrects more violently than the rest of the market — without there being a real altseason.
The altseason index is a statistical indicator, not a market signal sufficient on its own.
It can help read a relative trend, but it should never serve as the sole basis for making an investment or trading decision.
Specifically, this index measures the performance of the top 100 altcoins over a 90-day period, comparing them to the performance of Bitcoin over the same period.
When the index shows 17, it means that 17 altcoins from the top 100 have outperformed Bitcoin over the last 90 days.
Conversely, a high index (for example, 92) means that 92 altcoins have performed better than Bitcoin, but that does not necessarily mean the market is bullish.
A fundamental point to understand:
👉 Outperforming Bitcoin does not mean being in the green.
If Bitcoin drops sharply and some altcoins drop less than it, they are considered "more performing" in the index calculation.
Thus:
You can be overall at a loss,
While seeing the altseason index rise sharply.
In some extreme cases, the index can even approach 90 or more, simply because Bitcoin corrects more violently than the rest of the market — without there being a real altseason.
The altseason index is a statistical indicator, not a market signal sufficient on its own.
It can help read a relative trend, but it should never serve as the sole basis for making an investment or trading decision.
3
730
·
--
A cryptocurrency that loses 90% first experiences a drop of 80%, then another 50%, and then another 50%.
To simply return to its initial price, it then needs an increase of 1,900%. This is something that influencers never mention.
A cryptocurrency that loses 90% first experiences a drop of 80%, then another 50%, and then another 50%.
To simply return to its initial price, it then needs an increase of 1,900%. This is something that influencers never mention.
To simply return to its initial price, it then needs an increase of 1,900%. This is something that influencers never mention.
8
3
18
20.6k
·
--
A small important reminder:
To regain its initial price after a drop, an asset must achieve a percentage increase greater than that of the drop.
Here are some examples to illustrate this principle:
· ➡️ After a drop of 10%, an increase of 11% is necessary to return to breakeven.
· ➡️ After a drop of 30%, an increase of 43% is necessary.
· ➡️ After a drop of 50%, an increase of 100% (i.e., a doubling) is necessary.
· ➡️ After a drop of 70%, an increase of 233% is necessary.
· ➡️ After a drop of 90%, an increase of 900% is necessary.
In summary, the greater the fall, the longer the path to recovery. It is always easier to lose a percentage than to regain it.
A small important reminder:
To regain its initial price after a drop, an asset must achieve a percentage increase greater than that of the drop.
Here are some examples to illustrate this principle:
· ➡️ After a drop of 10%, an increase of 11% is necessary to return to breakeven.
· ➡️ After a drop of 30%, an increase of 43% is necessary.
· ➡️ After a drop of 50%, an increase of 100% (i.e., a doubling) is necessary.
· ➡️ After a drop of 70%, an increase of 233% is necessary.
· ➡️ After a drop of 90%, an increase of 900% is necessary.
In summary, the greater the fall, the longer the path to recovery. It is always easier to lose a percentage than to regain it.
To regain its initial price after a drop, an asset must achieve a percentage increase greater than that of the drop.
Here are some examples to illustrate this principle:
· ➡️ After a drop of 10%, an increase of 11% is necessary to return to breakeven.
· ➡️ After a drop of 30%, an increase of 43% is necessary.
· ➡️ After a drop of 50%, an increase of 100% (i.e., a doubling) is necessary.
· ➡️ After a drop of 70%, an increase of 233% is necessary.
· ➡️ After a drop of 90%, an increase of 900% is necessary.
In summary, the greater the fall, the longer the path to recovery. It is always easier to lose a percentage than to regain it.
1
5
2k
Log in to explore more content
Join global crypto users on Binance Square
⚡️ Get latest and useful information about crypto.
💬 Trusted by the world’s largest crypto exchange.
👍 Discover real insights from verified creators.
Email / Phone number
Trending Topics
FedWatch
16.4M views
39,810 Discussing
🚨 🇺🇸 PETER SCHIFF JUST THREW A BIG WARNING AT THE FED!
Peter Schiff is calling Kevin Warsh’s tough talk on inflation a “bluff,” and his prediction could have major implications for the markets.
Schiff believes the Fed could eventually return to money printing through quantitative easing (QE) and even cut interest rates next year, despite inflation continuing to rise.
Think about that for a moment.
🔥 Inflation could remain a problem. 🔥 The Fed could still move toward easier monetary policy. 🔥 More liquidity could flow into financial markets.
If this scenario plays out, it could create a very different market environment for stocks, gold, Bitcoin, and the wider crypto market.
But there’s a catch: if inflation stays high, the Fed could face a difficult choice between fighting rising prices and supporting the economy.
Will Warsh stick to a tough inflation policy, or will the Fed eventually change direction?
The next move could matter a lot for investors.
#FedWatch #EarningsSeason #USMidtermElections #BrazilCryptoExchangesMustApplyForLicensesByFriday #StanDruckenmillerBecomesInvestorInTradeXYZ
Jackson Liam
·4 Likes
·8.9k views
EarningsSeason
6.5M views
32,499 Discussing
USMidtermElections
65,570 views
821 Discussing