Bitcoin Daily Briefing (November 4, 2026)
Today’s 4 most important stories
1. Binance releases preliminary investigation into $6.34 billion theft: began with a fake job interview and malware, then escalated privileges using internal AI tools
On November 3, Binance announced the preliminary findings of its investigation into the October 29 hot-wallet theft (approximately $6.34 billion). The attack was a months-long, multistage operation—not a single-point breach:
June: A wallet team engineer downloaded a tampered Homebrew installer while searching for AI tools, exposing team information. Binance detected the issue and replaced the device, but the information had already been leaked.
September: Another engineer was contacted by a “project director” through a legitimate job platform. After a fake HR video interview and a fake second-round interview with the “CEO,” the engineer was tricked into downloading a malicious “assignment” onto their work computer. It contained a zero-day trojan that replaced components of legitimate development tools and bypassed endpoint protection.
Around October 20: Using the infected computer and Binance’s internal AI tools, the attackers gained further control of two other wallet engineers’ devices and stole deployment credentials.
October 29: Using unauthorized access to the wallet-signing service, the attackers moved assets—including approximately 18,000 BTC—from multichain hot wallets within hours, and used Ethereum’s EIP-7702 authorization mechanism to bypass normal withdrawal procedures.
The FBI attributed the incident to the North Korea-linked group TraderTraitor. Approximately $2.85 billion has been frozen or intercepted so far. Binance said it would fully cover user losses using SAFU and company funds, and that approximately 98% of affected assets had been replenished.
2. Spot Bitcoin ETFs see more than $1 billion in large net outflows over two consecutive days; Bitcoin stabilizes near $77,000
On November 2 (Monday, U.S. time), U.S. spot Bitcoin ETFs saw net outflows of approximately $399 million. BlackRock’s IBIT alone saw approximately $405 million in outflows for the day, its largest since June. Combined with the $643 million in outflows on October 30, the total over the two days was approximately $1.04 billion. After briefly falling to around $76,300 in early European trading, the price rebounded to the $76,900–$77,800 range, with limited volatility.
3. Tether CEO publicly says the company holds approximately 150,000 Bitcoin, far more than reported in USDT reserve disclosures
Speaking at the Plan ₿ Forum in Lugano, Paolo Ardoino said that Tether “probably holds 150,000 Bitcoin, worth about $11.5 billion.” The company’s latest Q3 proof of reserves lists approximately 100,000 Bitcoin associated with USDT (valued at approximately $83,621 per coin as of September 30) $BTC
Today’s 4 most important stories
1. Binance releases preliminary investigation into $6.34 billion theft: began with a fake job interview and malware, then escalated privileges using internal AI tools
On November 3, Binance announced the preliminary findings of its investigation into the October 29 hot-wallet theft (approximately $6.34 billion). The attack was a months-long, multistage operation—not a single-point breach:
June: A wallet team engineer downloaded a tampered Homebrew installer while searching for AI tools, exposing team information. Binance detected the issue and replaced the device, but the information had already been leaked.
September: Another engineer was contacted by a “project director” through a legitimate job platform. After a fake HR video interview and a fake second-round interview with the “CEO,” the engineer was tricked into downloading a malicious “assignment” onto their work computer. It contained a zero-day trojan that replaced components of legitimate development tools and bypassed endpoint protection.
Around October 20: Using the infected computer and Binance’s internal AI tools, the attackers gained further control of two other wallet engineers’ devices and stole deployment credentials.
October 29: Using unauthorized access to the wallet-signing service, the attackers moved assets—including approximately 18,000 BTC—from multichain hot wallets within hours, and used Ethereum’s EIP-7702 authorization mechanism to bypass normal withdrawal procedures.
The FBI attributed the incident to the North Korea-linked group TraderTraitor. Approximately $2.85 billion has been frozen or intercepted so far. Binance said it would fully cover user losses using SAFU and company funds, and that approximately 98% of affected assets had been replenished.
2. Spot Bitcoin ETFs see more than $1 billion in large net outflows over two consecutive days; Bitcoin stabilizes near $77,000
On November 2 (Monday, U.S. time), U.S. spot Bitcoin ETFs saw net outflows of approximately $399 million. BlackRock’s IBIT alone saw approximately $405 million in outflows for the day, its largest since June. Combined with the $643 million in outflows on October 30, the total over the two days was approximately $1.04 billion. After briefly falling to around $76,300 in early European trading, the price rebounded to the $76,900–$77,800 range, with limited volatility.
3. Tether CEO publicly says the company holds approximately 150,000 Bitcoin, far more than reported in USDT reserve disclosures
Speaking at the Plan ₿ Forum in Lugano, Paolo Ardoino said that Tether “probably holds 150,000 Bitcoin, worth about $11.5 billion.” The company’s latest Q3 proof of reserves lists approximately 100,000 Bitcoin associated with USDT (valued at approximately $83,621 per coin as of September 30) $BTC