比特白

On the morning of October 26, Binance’s BTC spot price was around $79,895, down 0.98% over 24 hours, while the on-chain fee rate was just 1 sat/vB, indicating an uncongested network.
Prices are moving lower, but no one on-chain is paying extra to rush transactions through. At least in this snapshot, the decline hasn’t turned into pressure to move funds on-chain.
This is just background context and doesn’t point to a definite rise or fall ahead. Next, watch whether fees climb above 1 sat/vB—and whether that happens alongside large transfers.

The strangest thing in today’s market wasn’t SanDisk falling 7.07%, but gold dropping alongside the Nasdaq. The Nasdaq 100 fell 1.19% over 24 hours, while gold tokens dropped 1.41%. Risk assets and safe havens weakening in tandem is unusual.

Looking closer, Apple bucked the trend, rising 1.62% and closing near its intraday high of 345.63. Meanwhile, memory stocks were broadly lower: SanDisk fell 7.07%, Intel 6.34%, SK Hynix 5.71%, and Micron 4.75%. It looks as if money is rotating quickly within tech—moving out of semiconductors and into cash-rich blue chips like Apple—while gold failed to attract safe-haven flows.

This suggests the current sell-off may be about more than just shrinking risk appetite; liquidity or the dollar may also be at play. If so, the key thing to watch next isn’t whether a particular stock rebounds, but whether stablecoins and dollar liquidity send a confirming signal. Whether gold tokens can climb back above 4,140 and the semiconductor sector can stabilize are both measurable checkpoints. For now, remember this anomaly: gold falling alongside the Nasdaq is more worth watching than SanDisk leading the declines.

On October 20, U.S. spot Bitcoin ETFs saw net inflows of $526.7 million. IBIT recorded net inflows of $665.2 million for the day, while FBTC saw net outflows of $83.6 million.

On the same day, spot Ethereum ETFs saw net outflows of $103.3 million. ETHA alone accounted for $95.4 million in outflows, more than 90% of the total.

As of 18:03 on October 21, BTC was trading at $83,340 and ETH at $2,451.39. Looking at the fund flows on October 20, Bitcoin saw net inflows while Ethereum saw net outflows—a pattern that did not fully align with both prices rising at the time of verification.

Going forward, watch just three verifiable indicators: whether IBIT’s $665.2 million in inflows continues, whether FBTC records consecutive outflows, and whether ETHA’s $95.4 million in outflows grow further.

On October 13, U.S. spot Bitcoin ETFs saw total net outflows of $65.4 million. The entire $65.4 million came from a single ticker, IBIT, while all other tickers saw zero inflows or outflows.

Spot Ethereum ETFs saw total net outflows of $85.4 million. ETHA had net outflows of $75.1 million, and ticker ETH had net outflows of $10.3 million.

In both cases, outflows were led by individual tickers, while the rest saw no activity. Next, we’ll see whether the net flows for IBIT, ETHA, and ETH continue.

The narrative around this story is loud; the numbers are what we can verify.

Oil moved first: Brent is currently at $101.19, up 1.4% on the day, with an intraday high of $101.28. Bonds followed: the 30-year Treasury yield is sitting at its highest level since 2002. Risk assets moved the other way: BTC is around $82,717, down 1.75% over 24 hours.

There’s really only one layer of firsthand information: Axios reported that days ago, the Pentagon instructed CENTCOM to prepare to resume large-scale military operations against Iran. The directive set no timeline, and Trump hasn’t made a decision. So what we can say for sure right now is that “preparations are underway”—not that “a strike will happen.”

A decision lies between those two things. The first wave of reaction to this kind of news is usually driven by emotion; facts only come into play in the second wave.

I’m watching three things: whether long-term Treasury yields keep climbing, whether oil can hold near its recent highs, and the actual volume of traffic through the Strait of Hormuz (Kpler counted 7 vessels on Tuesday, the lowest since July 23). The numbers tell you before the headlines do whether escalation is real or just posturing.

The U.S. government address made one move early this morning, then another fifteen minutes ago.

The second transfer was 750.2 WBTC, worth about $62.34 million, and like the previous batch of assets, it went to Coinbase Prime. In total, the address transferred out $165 million within 24 hours, including 1,583.8 BTC on the Bitcoin network, worth about $134 million at the time.

What’s interesting is the change in form: the earlier transfer was BTC, while this one was WBTC. The same address, the same destination, but the assets shifted from native to wrapped—suggesting the holdings aren’t limited to coins on a single chain.

These movements alone don’t tell us whether anything has been sold. A transfer to Coinbase Prime simply means the assets have reached a trading venue; whether any trades were executed or the assets were moved out afterward can still be tracked on-chain.

Two things to watch next: whether this address continues moving smaller amounts to Coinbase Prime, and whether the WBTC is unwrapped or split up on Ethereum. Sending coins to an exchange could signal preparations to sell, or it could be for custody or market-making. At this point, there’s no evidence to support any one explanation.

ZCAT is up 76.33% in 24 hours, with a market cap of $68.17 million. The price gain alone isn't unusual; what I'm interested in is where its roughly 3% transaction tax goes.

According to the project description, the tax is used to buy bridged Zcash (ZEC) on Solana and then airdrop it to holders. If this is actually happening, every ZCAT trade would convert a small portion of its value into bridged ZEC. These on-chain flows are transparent: the addresses for the revenue, swaps, and distributions can each be checked.

So far, the only public information is the price gain and market cap; the airdrop frequency and swap ratio haven't been disclosed. Going forward, I'll watch just two things: whether the tax collection address consistently swaps SOL for bridged ZEC, and whether the airdrop address distributes it regularly. If those two don't line up, this mechanism is just words in the project description.

Huang Licheng’s address is still reducing its BTC and ETH long positions, with total unrealized profits of $948,000. The figure looks large, but it’s not much for a leveraged portfolio like this.

TradingBeats snapshot on October 7: a 25x long of 35,700 ETH, with an average entry price of $2,689.86 and $420,000 in unrealized profit; a 40x long of 455 BTC, with an average entry price of $84,908.7 and $357,000 in unrealized profit; and a 10x long of 145,500 HYPE. ETH’s current price is only a little over $6 above its entry price, while BTC is up by only about $535, leaving very little room for profit.

The position reductions came before unrealized profits had grown much. No specific amounts or timings for the reductions are available; all we can see is that the address is reducing leverage, with no corresponding opposite positions appearing.

For now, keep an eye on the address itself: whether the BTC and ETH long positions continue to shrink, whether the HYPE position is reduced as well, and whether any new margin is transferred in.

The golden cross feels more like background noise in today’s report. What I care about more is money finally moving back into positive territory: spot Bitcoin ETFs saw net inflows of $3.49 billion in September, bringing 2026 net flows back above zero for the first time on September 23. That same month, the total crypto market cap rose 11% to $2.99 trillion, despite the Fed’s first rate hike since 2023 and the failure of the CLARITY Act.

Bitcoin’s 50-day moving average crossed above its 200-day moving average on September 8, and the gap has since widened to about 750. This indicator only shows that the average price over the past 50 days has caught up with the 200-day average; it is not a guarantee of future prices.

For what comes next, I’m watching only what can be verified: whether ETFs continue to see net inflows in October, and in particular whether there are any large single-day outflows after the September 23 return to positive territory. The direction of money is more worth watching than the shape of a moving-average chart.

After 170,000 USDT was stolen, the perpetrators asked him to transfer money again to unlock it.
A video dated October 5 claimed that on June 10, he downloaded a fake wallet from Huawei’s official store, exposing his recovery phrase, and 177,473 USDT was stolen. The address permissions were subsequently changed to multisig.
The next step deserves closer attention: in a second scam, they asked him to transfer money under the pretext of “paying to unlock” the funds. After he transferred it, all the USDT in the address was moved out.
No specific address or transaction hash is available at present, so it is impossible to verify which transaction involved the multisig change or whether the recipient of the second transfer was part of the same group that stole the funds.
If the address is identified later, check these three things: the time of the permissions-change transaction, the amount received in the unlock transfer, and the interval between the final USDT outflow and the previous one.
This involved an additional layer beyond simply losing a recovery phrase: a second contact in which the perpetrators posed as helpers.

The leveraged positions at Huang Licheng’s address have been updated again: three longs in BTC, ETH, and HYPE are open at the same time, with leverage ranging from 10x to 40x.

He is long 34,100 ETH at 25x, with an average entry price of $2,689.86 and $986,000 in unrealized profit; long 455 BTC at 40x, with an average entry price of $84,908.70 and $430,000 in unrealized profit; and long 159,500 HYPE at 10x. The disclosure does not give HYPE’s average entry price. Subtracting the unrealized profits on the first two positions from the total of $1.894 million puts HYPE’s profit at about $478,000.

The BTC entry price is about $1,086 below the current price, so its unrealized profit is relatively slim. The three positions have different leverage levels, which also means margin pressure will build at different price levels as prices move.

Going forward, the address itself is worth watching: whether more margin is transferred into the trading account or new positions are added, whether either the ETH or BTC position is reduced, and whether the average entry price and unrealized profit reported for HYPE later line up with the $478,000 estimate inferred from the current figures.

Ali Charts’ data: in the past week, the market has been moving sideways. Whale holdings have decreased by about 30,000 BTC, valued at the time at $252 million. This amount and the pressure that appeared around 87,000 occurred within the same stretch of行情.

Now BTC’s latest price is 86,714, up 2.33% in 24 hours. It has already moved back close to 87,000; there’s about 5% left before the 82,500 support. So 82.5万 is not a level being tested right now—it’s merely the lower consolidation zone he drew.

Going forward, I’ll only look at on-chain confirmation: whether the whale addresses stop net-decreasing, whether the exchange BTC balance can fall again, and whether large sell-side swap/turnover activity appears near 87,000. Without these, 82.5万 is still just a line.

The Utexo plan supported by Tether has been sending USDT over the Bitcoin network this month, but it plans to keep most transaction data off-chain. Utexo co-founder Viktor Ihnatiuk said it has obtained a commercial license and will provide API, SDK, and cloud infrastructure to exchanges, wallets, and payment service providers.

I’ll first watch how the off-chain data changes the visibility of these USDT. Following RGB’s usual design, only the commitment is left on-chain; transfer amounts and addresses aren’t fully recorded on-chain like Ethereum’s USDT. Later, if you want to track the paths of these USDT in the Bitcoin ecosystem, checking only an on-chain explorer may not be enough—you’d also need to combine the RGB client with asset state.

So far, the disclosure hasn’t provided specific contracts, asset identifiers, or the on-chain transaction formats. It also hasn’t said how the native BTC portion will be settled. Next, we’ll see whether Utexo or Tether will publish RGB asset identifiers, whether the Bitcoin mainnet will produce new types of commitment transactions, or whether an exchange wallet moves first.

The Bitcoin network is now at 3 sat/vB, nearly idle. The BTC price at $84,726 is still climbing, yet nobody is grabbing block space on-chain—this contrast is worth paying attention to.

Low fees usually mean there’s less transfer demand: no big incoming transactions to exchanges waiting to be sold, and no panic withdrawals. The divergence between price and on-chain activity suggests that this leg of the rally isn’t being driven by on-chain transfers.

Next, watch two verifiable things: whether large unconfirmed transactions suddenly appear in the mempool, and whether the fee rate can jump away from single digits within a few hours. If it keeps sitting there, the funds may not have truly started moving yet.

NEAR Intents (NEAR ecosystem cross-chain protocol) had the stolen funds first sent to KuCoin (KuCoin), and then bridged into BTC. The attacker’s address also interacted with an address marked as belonging to the Lazarus Group (North Korean hacking organization): 0x098B7...E2f96.

These are the only confirmed details. The amounts haven’t been disclosed, and it’s still unknown whether KuCoin blocked anything or where the BTC ended up.

A single interaction at most shows that two addresses had contact; you can’t directly conclude that Lazarus was the one carrying out the operation.

Next, monitor two things: whether that Lazarus-labeled address will continue to receive same-source funds, and whether the BTC corresponding to KuCoin’s deposit address will continue to be withdrawn.

Awesome~ even the air is clear

In this report, the most striking thing is a number that wasn’t provided.

It states that transactions processed by Iran’s shadow-banking network last year were estimated at $20 billion—but the specific amount involving USDT was not disclosed.

This isn’t quibbling over wording. USDT’s market capitalization is $183.8 billion; if truly large sums flowed into Iran, the amount frozen would be the hardest indicator. Tether itself provides the following: in 2026, it helped freeze about $550 million worth of USDT related to Iran.

On one hand, it talks about a “lifeline,” and on the other, reports $550 million. The missing gap in between is what should be watched next.

On-chain, you can’t see “national intent”—you can only see addresses and freeze records. The report calls for the Treasury and the Department of Justice to get involved. If they do investigate, the first batch to come out will be wallet transaction trails—not news headlines.

One trade netted them ETH for three years; over the past week, they began shifting funds in a concentrated way to Bitfinex (a crypto exchange).

The last transaction was 30,825 ETH, or about $83.03 million. Six days prior to that, they had already deposited 81,228 ETH, for a total of 112,053 ETH, or roughly $300 million. On-chain realized profit is $72.83 million.

By working backward from these two figures, their average cost is roughly just above $2,000. As ETH is currently still around $2,690, this batch still retains an approximately 30% profit buffer.

Getting funds into an exchange doesn’t necessarily mean they’ve dumped it yet, but it has turned the $300 million from long-term on-chain holdings into a balance that can be sold at any time. Going forward, I’ll focus on tracking Bitfinex’s ETH balance—if it drops quickly, it means taking profit is accelerating.

GoPlus Security Team discloses that on the Robinhood Chain (a chain under Robinhood, with a background in the U.S. internet brokerage), a high-risk fraud Meme factory has appeared. In the past 30 days, the transaction volume has exceeded $9 million, involving hundreds of fraudulent Meme tokens. The aggregation address is 0x8c3Bad30cc7563A2D0357F49509FFd063666bb00.

As of September 28, the address balance is approximately 56.0635 ETH, which is about $148,000 based on the current price. There is a large gap between transaction volume and balance, and most of the funds are no longer in this aggregation address.

Next verifiable points: whether this address continues to make small-scale aggregations and periodically transfers the ETH to new addresses, exchanges, or cross-chain bridges. As long as the loop hasn’t been broken, the factory is still operating.