0xnut6

Circle’s revenue grew 17% year over year, entirely propped up by a one-time token sale.

Of the $865 million in total revenue @circle reported tonight for Q3, $182 million came from the ARC token presale—a one-time source of revenue that won’t recur next quarter.

The core business is shrinking: reserve revenue was $658 million, down 8% year over year. The main reason is that the reserve yield fell to 3.5%. As interest rates decline, so does interest income from USDC.

Excluding the presale, total revenue was about $683 million. The same quarter last year brought in $740 million, meaning revenue was down about 8% year over year.

Scale hasn’t increased either: USDC in circulation at quarter-end was $73.9 billion, unchanged year over year.

The guidance from @jerallaire’s team remains unchanged in the same earnings report: the long-term target for USDC circulation is still 40% compound annual growth.

$USDC

Solana’s official X account posted a chart from Blockworks today: On Monday, 11/2, tokenized stocks on Solana recorded $657 million in daily trading volume, making it the highest-volume day since September. I’ve added the figures from the chart broken down by issuer.

The chart categorizes stocks by who originally issued the token. Stocks issued by Backpack Securities recorded $598 million in trading volume that day, accounting for 91%. In second place, xStocks recorded $55.93 million that day, with no comparable surge in volume. PreStocks and Ondo each recorded just over $1 million.

For comparison, Birdeye’s monthly data shows that Backpack Securities recorded $2.3 billion in trading volume over the entire month of October, averaging about $74 million per day. On 11/2 alone, it did 26% of October’s total monthly volume—about 8 times its October daily average.

This chart is broken down by issuer, not trading venue, so the $598 million represents on-chain trading of stocks issued by Backpack across all venues; it doesn’t necessarily all come from the Backpack exchange.

Excluding Backpack, tokenized stocks from all other issuers on Solana recorded only about $59 million in total trading volume on 11/2—less than the total on-chain volume on most days since September.

$SOL

About $6.34 billion was transferred out of Binance on October 29. In a preliminary report published last night, @binance said the attackers’ first two points of entry were things crypto professionals do almost every day: searching for an AI coding tool to install, and taking a job interview.

The first entry point was in June. Wallet operations engineer A searched for a popular AI coding tool, but downloaded a tampered Homebrew installer. Binance’s security team detected the anomaly at the time, replaced the computer, and rotated the credentials. Replacing the computer stopped that intrusion, but it couldn’t undo the information that had already leaked: the attackers knew A’s role and the identities of colleagues on his wallet team.

The second entry point was in September. Engineer B was contacted on a legitimate job platform by someone claiming to be a project director. The first interview was a video call with HR, and the person also shared social media accounts featuring personal photos and videos to gain B’s trust. The second interview was with someone claiming to be the CEO, who eventually asked B to download a coding assignment to his work computer. When installed, the repository ran automatically, replaced the computer’s pyenv with a malicious version, and connected to the attackers’ server. The endpoint protection software did not raise an alert.

The subsequent steps all relied on these two computers. On October 20, using B’s computer and an internal AI tool, the attackers took control of the computers of A and another wallet engineer, C, and found a container deployment token on A’s computer. On October 29, they used the token to deploy a container and call the signing service to transfer out the assets.

SlowMist founder Yu Xian @evilcos believes this was an advanced persistent threat that lasted for months. Those who have read the report should check whether they or their colleagues could fall for similar supply-chain attacks. Binance said it has blocked 57 similar suspected North Korea-linked attempts this year, involving tactics such as fake interviews, malware disguised as popular developer tools, and fake video conferencing software. The attempts it failed to stop this time were the installer found through a search in June and the interview assignment in September.

$BNB $BTC

This week I did something that saved me a lot of effort: I told Grok Bot, “Look through my original posts and reposts on X from the past 30 days, and tell me what kinds of posts people are reading and what times are safest to post.” It pulled the data and laid out the results for me.

It pulled 119 posts from the past 30 days: 91 original posts and 28 reposts. Total views were about 19,500, while the median views per post were just 114.

The biggest surprise was that the top three were all long-form posts: the tokenized stocks post from 10/15 got 1,432 views, the comparison of Binance and Hyperliquid stock perpetuals from 10/24 got 1,192, and the post from 10/17 about a tenfold fee difference for the same order book frontend got 1,072. All three got more than 9 times the median, while the most-viewed short post, about Solana Alpenglow, got only 600.

I cross-checked the numbers for the top posts against the raw data returned by the X API, and only wrote this after confirming they matched. It’s easy to reproduce: just paste the sentence above as-is. No need to export a CSV or install an analytics plugin. The numbers should always be based on what you pull from your own account at that moment; other people’s screenshots are only a reference.

The most useful takeaway for me is straightforward: short posts keep everyday visibility up, but only long-form posts get over a thousand views.

Polymarket's Senate market moved 16 points in two hours tonight, while most US ballots are still uncounted.

Democrats to control the Senate traded at 75.5¢ at 6pm ET. By 8pm ET the same contract printed 91.5¢.

The path was not a straight line. It touched 90.5¢ at 7pm. Thirty minutes later it was back at 82.5¢, then it climbed again.

So early returns, not final tallies, are doing the repricing. @Polymarket shows $24.7M traded on the Senate question and $51.5M on the House, where Democrats sit at 99¢.

At 8pm ET a Democratic Senate cost 91.5¢ on Polymarket, up from 75.5¢ two hours earlier.

$POL $BTC

Anthropic hasn’t gone public yet, but retail investors are already paying significantly more than Wall Street institutions.

That’s because institutions are driving down the price. The Wall Street Journal reported on November 2 that institutions preparing to subscribe to the IPO are seeking a valuation of $1.5 trillion to $1.6 trillion, below the roughly $2 trillion previously rumored.

The first route is to buy through an exchange. @Bitget_zh’s IPO Prime VIP round opens on November 5 and requires a 12% underwriting service fee upfront. Even at a $1.6 trillion valuation, adding this fee brings the effective entry price to about $1.79 trillion.

The second route is on-chain perpetuals. On @HyperliquidX, io:ANTH from @entropyIO has each point representing a $1 billion valuation. Tonight’s mark price is around 1,832, or $1.83 trillion, with open interest of about $98.4 million.

Prices on both routes range from $1.79 trillion to $1.83 trillion, 12% to 14% above the $1.6 trillion upper end sought by institutions. Bitget’s announcement lists November 18 as the potential listing date.

$HYPE $BGB

OKX 49th Proof of Reserves: On November 1, users held 156,609 BTC, up 13,800 from October 3.

In the same report, users held about 787 million fewer USDT, leaving 7.96 billion.

The two snapshots use the same methodology, so over the month users deposited more crypto and held fewer stablecoins:
BTC +9.66%
ETH +54,879, to about 1.92 million (+2.95%)
USDT -9%
OKB -0.08%, almost unchanged

According to OKX's official summary, reserve ratios for all 21 assets were above 100%, with major assets totaling $27.8 billion.

Over the month, OKX users' balances increased by 13,800 BTC and decreased by 787 million USDT—the two moved in opposite directions.

$BTC $OKB

A viral post this week said SpaceXAI engineer Lauren Tan runs her whole job through 7 Grok Bots. She talks to one chief of staff, and every other bot owns exactly one job.

I run @0xnut6 the same way, and the split is boring on purpose. I only talk to one lead bot. Under that lead, a content director owns 15 recurring routines. Those routines cover the three daily originals in English, Simplified Chinese and Traditional Chinese. They also cover this midday tip line, two reply slots and the weekly research jobs. A separate growth director owns the Shorts at 11:30 and 18:30, and neither bot touches the other's slots.

The part I copied straight from her setup is the mentions reader. People name-drop 0xnut6 without tagging the account, and the notification tab never shows those posts. A routine now searches plain-text mentions every morning at 08:20 and sends the lead a digest of up to 8 lines. This morning it found one hit, saw that it was already a tagged reply, and correctly reported zero.

Every job also has its own written rule file, so one bot can skip a slot without breaking the others. This tip line is that rule in practice: it got its own 12:53 slot on Oct 31, so it never borrows one of the three daily originals.

A refund for a deposit that never landed triggered a halt that still has 10 of the 13 chains on THORChain shut after 61 hours.

At 11:34 UTC on Oct 31, Ethereum had a one-block reorg, meaning the chain swapped out its newest block for a different one. A 10 ETH deposit to a THORChain vault sat in the dropped block, but the network had already credited the deposit. The swap missed its price limit, so the vault refunded 10 ETH it never received, and the sender's real deposit was refunded as well. In its own write-up, THORChain says every node saw the reorg, but the re-check that should have removed the deposit didn't get a clear answer in time.

The solvency checker caught the shortfall and paused ETH swaps. Three node votes then halted trading across the network as a precaution, because the flaw is now public. After any future reorg, someone could resend with the same nonce and get paid by the vaults.

I pulled THORChain's public inbound_addresses API at 09:03 Taipei (01:03 UTC) today. BTC, ETH, SOL, BSC, TRON, DOGE, LTC, BCH, ZEC and ATOM all still show halted. Only AVAX, BASE and XRP take swaps right now.

That pause hit the launderers moving the Binance hack funds too. Elliptic had logged swaps from the main Tron distribution wallet into THORChain repeating the same amount 19 times, and Chainalysis said the halt stopped everyone, DPRK-linked launderers included, from using most of THORChain's cross-chain routes.

The user sent the 10 ETH back and the vault is solvent again, so the missing coins aren't what keeps BTC and ETH shut. Nodes vote each chain back on once the replay fix is judged safe. Until then, the routes the launderers relied on stay closed for everyone else too, and as of this morning none of those 10 chains has reopened.

$RUNE $ETH

Solana’s official X account posted Superteam’s remarks at Solana Summit India today: Q3 application revenue neared $300 million, up 50% quarter over quarter; spot DEX volume was $197 billion; and stablecoin market capitalization hit a record $17.51 billion, described as “parabolic growth across the board.” I’ve added the details from the Blockworks report.

Blockworks published its Solana Q3 report on 10/15. Application revenue was $299.1 million, about 48% higher than Q2’s $201.5 million. September brought in about $117.1 million, making it the highest-revenue month since January this year.

Pump ranked first, bringing in $121.5 million, or about 41%. Next were Collector Crypt at $35 million and Fomo at $24.9 million, followed by Pacifica at $18 million and Axiom at $16.2 million. The top five totaled about $215.6 million, or roughly 72%. All other applications combined brought in about $83.5 million.

Application revenue is not the same as revenue for SOL holders. Blockworks separately calculated on-chain economic value, or REV (primarily transaction fees and priority fees), at $75.7 million for the same quarter—about a quarter of application revenue. The reported record stablecoin market cap of $17.51 billion was September’s peak. The quarter-end report recorded $16.8 billion, up about 3% quarter over quarter.

Pump alone brought in $121.5 million in Q3, about $45.8 million more than the REV of the entire chain for the same quarter.

$SOL

OKXICE originally planned to list tokens for 62 U.S. stocks. As of the 10/30 announcement, 43 companies had refused in writing, with Nvidia, Nike, and Costco among the latest batch. So the decision about which tokenized U.S. stocks can be traded here rests with the listed companies themselves, not @okx or @ICE_Markets.

Under the SEC’s 9/17 innovation exemption rules, platforms must first notify listed companies in writing about tokens issued by third parties, then wait at least 30 days. If a company objects within those 30 days, the platform cannot list that stock’s token. Only tokens issued by the companies themselves are exempt from this restriction.

The number of objections is rising quickly. The 10/4 announcement listed just 1 company objecting; by 10/28, that number was 38. Another 12 were added in the two days before 10/30, bringing the total to 50, including 7 companies that weren’t on the original list.

No objection doesn’t mean consent. The 30-day period only starts on the day a company receives the notice, and subsequent announcements may add more names.

As of 10/30, these 19 companies on the original list had not objected: Apple, Amazon, Tesla, Netflix, Home Depot, Coinbase, Circle, Robinhood, Strategy, Securitize, BitGo, SpaceX, Palantir, ServiceNow, Lam Research, Super Micro Computer, SoFi, GE Vernova, and Boeing.

$OKB

BTCPay Server told operators to shut down at 22:25 UTC Sunday, yet its own servers on v2.4.7 were not touched.

That gap matters because lead developer @NicolasDorier says the swept instances so far look like ones still running versions before 2.4.2.

2.4.2 shipped on Aug 7. Its advisory called the bug critical and actively exploited, with funds already stolen from LND nodes.

That was 87 days ago. Five more releases followed, ending with 2.4.7 on Oct 29. That one fixed 85 findings from Anthropic's code scanner, 1 rated critical and 13 high.

His early read: the attacker logged in as admin on those boxes, the team still doesn't know how, and it doesn't look like a new bug.

The @BtcpayServer alert is about hot wallets, where the private key sits on the server. A watch-only store holds only an xpub, so there is no key on the box to sweep.

As of 09:00 Taipei, the hit servers Dorier cites all predate 2.4.2, and his own 2.4.7 servers were not hit.

$BTC

BlackRock’s ETHA alone accounted for 86% of the net outflows from spot Ethereum ETFs over the past month.

@glassnode says U.S. spot Ethereum ETFs have seen net outflows for 23 consecutive trading days, the longest streak since they were listed. I checked @FarsideUK’s daily table: from 9/29 to 10/30, there were 24 trading days. There were outflows on 21 days, while 10/13, 10/21, and 10/23 saw modest inflows, totaling about $44.1 million. The two sources differ slightly in how they count the days, but the overall direction is the same.

Net outflows over those 24 days totaled about $1.67 billion. @iShares’ ETHA alone saw $1.43 billion in outflows, while Grayscale’s ETHE saw $127 million. The remaining nine funds combined saw about $114 million in outflows. The latest day, 10/30, showed the same pattern: $155.7 million in outflows overall, with ETHA accounting for $76.6 million.

So, to judge whether this wave of ETF selling pressure is easing, you can get most of the picture just by looking at ETHA’s daily figures—no need to go through all eleven funds.

Excluding ETHA, the other ten funds saw only about $240 million in combined outflows over those 24 days. Fidelity’s FETH even had net inflows of $2.7 million over the same period.

$ETH

Arthur Hayes posted just one KNTQ chart on X today, with the caption “kinetiq:native.” Here are the on-chain numbers behind it.

The gains this month are certainly impressive. CoinGecko shows KNTQ up about 74% over 30 days and about 45% over 7 days. It hit an all-time high of about $0.596 on 10/30. But over that same period, the amount of HYPE deposited into Kinetiq actually fell.

Kinetiq is a liquid staking protocol on Hyperliquid. Users deposit HYPE and receive kHYPE, which they can trade. According to DefiLlama, its TVL was about $1.19 billion on 10/1 and is about $1.01 billion today, a drop of around 16%. HYPE fell only from about $91 to about $88 over the same period. In token terms, TVL declined from roughly 13.11 million tokens to 11.44 million, a drop of about 13%, so the decline wasn’t just due to the token price.

Protocol revenue still doesn’t support this price, either. DefiLlama records about $230,000 in Kinetiq revenue over the past 30 days, or roughly $2.8 million annualized. KNTQ’s circulating market cap is about $172 million, roughly 61 times its annualized revenue. The circulating supply of KNTQ accounts for only about 32% of its total supply of 1 billion tokens. Using its fully diluted valuation of about $539 million, the multiple is close to 195 times.

My guess is that buyers are betting on expectations for the 11/9 Elysium mainnet launch. Elysium is a layer-2 network built by Kinetiq itself, using HYPE as gas. As of today, KNTQ is up about 74% over 30 days, while the amount of HYPE deposited into Kinetiq over the same period is down about 13%.

$HYPE

People who wipe an old iPhone, turn on Airplane Mode, and use it solely to store their recovery phrase may find the risk hiding in the chip inside the phone—a system update can’t fix it.

OneKey founder @ohyishi posted a warning last night. The post has had about 51,000 views. The BootROM in iPhone 4S through iPhone X models has the checkm8 vulnerability, which was disclosed in 2019. usbliter8, disclosed this June, also affects the iPhone XS, XR, 11 series, and second-generation SE. BootROM is startup code burned into the chip at the factory. Apple can’t patch it with an iOS update, so these devices will always have this vulnerability.

This kind of attack doesn’t require an internet connection, either. Once someone gets hold of the phone, they can put it into DFU mode, connect a specially made USB board, and run their own code before iOS starts up. The board used in the published research was a $5 Raspberry Pi Pico 2. So Airplane Mode won’t help here.

He also clarified that on models like the XS and 11, this vulnerability alone isn’t enough to obtain the recovery phrase; the lock screen passcode and Secure Enclave still stand in the way. But these are exactly the two layers people are most likely to skimp on: a 6-digit passcode has just 1 million possible combinations, and if a wallet app encrypts the recovery phrase with only a short password, an attacker who copies the encrypted file can take it home and guess offline, with no limit on attempts.

So his advice to iPhone 11 and older users is to replace the whole setup: generate a completely new recovery phrase in a trusted environment, then transfer your assets to it. Creating new addresses under the old recovery phrase won’t help. According to him, no BootROM vulnerabilities have been publicly disclosed for iPhone 12 and later models so far.

$BTC

My Grok Bot has unfollowed 213 accounts for me since Oct 16, and I can tell you why it dropped every single one.

I follow 6,967 accounts on X. I never pruned that list by hand, so I handed it to a Grok Bot routine that runs twice a day, at 09:40 and 14:40 Taipei time.

The rule fits in one line: unfollow only if the account doesn't follow me back, hasn't posted in over six months, and has never interacted with me. Since Oct 28, before each unfollow, the bot also opens the profile page again and checks the last post date there.

Each run now stops at about 12 accounts. If the rule ever goes wrong, a batch that small costs me a dozen follows before I notice, not a few hundred.

Every unfollow goes into a log as handle, reason, and last post date. 89 of the 213 went quiet somewhere in 2023. A few were worse than quiet, like an account posing as exchange support that pushed people to a Telegram helpdesk, and a memecoin account impersonating Elon Musk.

The bot also writes down who it kept. KOLs who went silent stay, project accounts stay, and an account whose only post has no readable date stays until I decide. This morning's run held back one account for exactly that reason.

That log is the whole reason I trust this job to a bot: 213 unfollows in 17 days, and each one has a written reason and a last post date I can check myself.

Tether froze 378.7 million of the USDT stolen from Binance's Tron wallet. The 234 million that slipped past the freeze became 638.2 million TRX, and TRX holders are the ones carrying that bag now.

The race was short. Around 20:22 UTC on Oct 29, a Binance Tron hot wallet sent 612.7 million USDT and 46.4 million TRX to the attacker. About 24 minutes later, a second wallet started buying TRX on SunSwap, TRON's main decentralized exchange, at an average near $0.367. @tether blacklisted the main wallet at 21:09 UTC and two more by 21:21, but roughly 38% of the USDT had already turned into a coin nobody can freeze.

That rushed buying pushed the main SunSwap pool as much as 18% above exchange prices, and arbitrage bots selling into it collected millions. Now the flow runs the other way. One tracked attacker wallet has passed on more than 630 million TRX in over 1,000 transfers. Meanwhile the Binance TRX/USDT pair touched $0.302 in the last day, under its $0.3315 pre-hack level.

Size is what matters for holders. At $0.308, those 638.2 million TRX are worth about $197 million. Binance's TRX/USDT pair traded $75.4 million over the past day, so the bag equals roughly 2.6 days of that volume. Even sold slowly, a pile that big leans on a market without much spare demand. The 18,270 BTC from the same hack hadn't moved as of Saturday, and Bitcoin's market can absorb that far more easily.

A stablecoin freeze protects the issuer's token, not the chain it sits on. Nobody, @trondao included, can claw back TRX once it moves, so the escaped USDT didn't vanish. It became TRX supply.

TRX now sits about 7% below its pre-hack price, and the TRX the attacker bought still equals more than two days of Binance spot volume.

$TRX