Plebum Dominium
News
Binance confirms $6.3 billion hack, the largest crypto theft on record
On October 30, 2026, Binance confirmed that attackers stole an estimated $6.3 billion from its hot wallets late on October 29, the largest cryptocurrency theft on record. The drain started around 4:24 PM ET: about 167,464 ETH plus 63 other tokens, including about 1.6 billion USDT, moved from the “Binance 14” wallet to a newly created address, followed by 780 million USDC from “Binance Hot Wallet 34.” TRM Labs traced about $6.36 billion in transfers across 10 blockchains in a burst that lasted roughly 20 minutes.
Binance said it set aside more than $6.34 billion in company resources to restore customer balances, with $5 billion already held in the exact token assets affected, and pointed to its SAFU emergency reserve as well. About $3 billion in stolen assets has been frozen with help from industry partners. TRM estimates the attacker still controls about $2.4 billion in ETH and BTC beyond any issuer’s reach. Withdrawals have been paused since the night of October 29 while Binance rebuilds its withdrawal service, with a target of resuming around Sunday, November 1. Deposits are operating normally. Binance.US said it was unaffected.
On the cause, Binance’s preliminary finding points to a compromised laptop belonging to a DevOps engineer, used to reach a service container and submit unauthorized withdrawals. The company says it found no evidence of wallet private key exposure. On October 30 it said the investigation had uncovered additional points of breach and called the incident a complex attack. TRM Labs, Chainalysis, and Elliptic link the theft to North Korea’s TraderTraitor group with high confidence, and the FBI is investigating. Binance itself has not named an attacker.
Binance confirmed the hack a day after the money moved. That is the reason the guide starts by withdrawing a test amount to an address only you control: your coins should never depend on a company’s statement.
The stablecoin freezes are the second lesson. Tether and Circle blocked the receiving addresses within the hour, because they can. That power exists regardless of how you feel about this use of it. Bitcoin has no such switch. Once the ETH left the wallet, there was no off button. Use stablecoins for transit. Keep savings in bitcoin, in your own wallet.
Sources: CoinDesk · Decrypt · Unchained · Crypto Times
Coinbase vendor breach exposes customer contact data
On October 27, 2026, Coinbase said a security incident at Amplitude, a third-party analytics vendor, exposed contact and limited transaction data for a small subset of its customers. Coinbase said its own systems were not breached and customer funds were not affected. The company did not say how many customers were affected or which fields were taken. A claim on X that more than 70,000 users were affected was called false by Coinbase. The company is notifying affected customers and regulators.
An exchange can keep your coins safe and still leak your contact details through a vendor you never chose. That data is what makes phishing convincing: a message that knows your name, your phone number, and your recent transactions. Treat any message claiming to be from an exchange as suspect until you verify it through a channel you opened yourself. Keep your seed material entirely off any system tied to an exchange account.
Sources: Unchained · CoinDesk · Cointelegraph
Keystone breach exposes customer shipping addresses
On October 24, 2026, Keystone disclosed a website breach that exposed customer shipping data, including home addresses tied to past hardware wallet orders. The company said private keys and funds on its devices were not affected, since that material never touches the internet. Keystone has not said how many customers were affected or how the breach happened.
A shipping address tied to a hardware wallet order tells a thief where a holder lives, which enables physical targeting and phishing that references your real order. This guide tells you to buy devices from the maker’s own shop. Ship those orders to an address that is not your home, and treat any message about your order as suspect.
Sources: AltcoinDaily
State Bank of India: 3,897 customer records on the dark web
On October 21, 2026, State Bank of India disclosed an incident involving customer data on the dark web. The bank said it was alerted on October 16 by its threat intelligence provider, the Defence Cyber Agency, and CERT-In. A preliminary analysis of about 375,000 records found 3,897 customer records containing personal information. Those records included names, mobile numbers, dates of birth, email addresses, residential addresses, branch and customer identifiers, and loan and lead metadata. The bank said customer balances were completely safe, that the incident had no material impact on core operations, and that it had engaged an independent CERT-In empanelled agency for a full assessment.
A bank can keep balances safe and still leak your home address, your phone number, and your loan history. That is the data used for targeted phishing and for physical targeting. Treat any message claiming to be from a bank or an exchange as suspect until you verify it through a separate channel you trust, and keep your plates, your map, and your passphrase paper in separate places, away from anything tied to that leaked identity data.
Sources: Reuters · The Hindu BusinessLine
South Korea: hacking incidents at seven banks linked to one attacker
On October 4, 2026, South Korean financial authorities said hacking incidents at seven financial institutions appeared to be linked to the same attacker. The institutions named were Shinhan, KB Kookmin, Hana, BNK Busan Bank, Yeogaram, Welcome Savings Bank, and Hyundai Capital. Authorities shared the attacker's internet addresses and security precautions with about 500 firms in the sector and started urgent inspections. At Shinhan, information leaked through a system used by employees and loan recruiters. Customer internet and mobile banking were not affected, and no financial losses were reported there. Authorities grouped the incidents into information inquiry services, employee support services, and website services.
The entry point was not the main customer banking system. It was employee and recruiter systems around it. That is a reason not to trust a large institution to protect every piece of your identity data, and a reason to keep seed material out of any system tied to a bank, a loan application, or an employer portal. Your plates and your map do not belong in the same place as your banking identity.
Sources: Aju Press · Tech Insider
Two hardware failures in one year
In July 2026, attackers drained about 1,816 bitcoin from more than 5,200 Coldcard wallets. The cause was a firmware flaw from March 2021 that left some seeds with as little as 40 bits of real randomness instead of 128. Updating the firmware did not fix seeds already made. Owners had to move their funds to new seeds.
In October 2026, Ledger confirmed an unauthorized hardware implant in at least one device sold by the Southeast Asian reseller CryptoBilis. Researchers estimate $86 million to $93 million was taken from hundreds of wallets. Ledger said its own systems and direct sales were not affected, and every confirmed case so far traces to that reseller.
Both failures break the same promise: that the device can be trusted on its own. The guide answers that three ways. Buy from the maker’s own shop, never a reseller and never a used device. Never let a device roll its own entropy: make the seed with dice on an offline boot, then import it. And for a single key, require a passphrase: researchers noted that seeds made with dice rolls or protected by a strong passphrase were not the ones drained. A device you trust less is a device you verify more.
Russia closes the exchange off-ramp
Russia’s new digital-asset law (No. 282-FZ, in force since September 1) routes all crypto buying through licensed brokers and state-approved banks. The central bank’s October guidance is explicit: moving crypto from a regulated account to your own wallet is not permitted, and peer-to-peer trades between individuals end entirely on July 1, 2027. Small buyers are capped at roughly $3,800 a year: bitcoin, ether, or tether only.
Nobody banned holding your own keys. They closed the door between the regulated system and self-custody. That door is the exact step this guide starts with, when you withdraw a test amount from an exchange to an address only you control.
Rules can close an off-ramp at any time, in any country. A wallet built before you need it never has to ask permission. Build it while the door is open.
Sources: Cointelegraph · TFTC
Coinbase: bribed support agents leak data on 69,461 customers
On May 15, 2025, Coinbase disclosed that criminals had bribed overseas customer support agents to steal customer data. The siphoning began on December 26, 2024 and was detected on May 11, 2025, when the attackers demanded a $20 million ransom. A later filing put the number at 69,461 customers, less than 1% of monthly transacting users. The stolen data included names, addresses, phone numbers, email addresses, the last four digits of Social Security numbers, masked bank details, government ID images, and account balances and transaction histories. Passwords, private keys, and customer funds were not taken. Coinbase refused the ransom, offered a $20 million reward for information leading to arrests, and estimated remediation and reimbursements at $180 million to $400 million.
This is the insider version of the same lesson. The attackers did not break the cryptography. They paid the people who answer the phones. An exchange holds your name, your home address, your ID, and your transaction history in systems its own contractors can read. That data enabled phishing that tricked some customers into sending coins to scammers. Self-custody removes the coins from that database. It does not remove your identity from it, which is why the guide keeps seed material off every system tied to an exchange account.
Sources: SecurityWeek · TechStory
FTX collapses, $8 billion in customer funds missing
FTX was one of the largest crypto exchanges in the world, valued at $32 billion in early 2022. On November 2, 2022, CoinDesk published the balance sheet of Alameda Research, the trading firm run by the same people, and it showed billions in FTT, a token FTX had printed itself. Customers rushed to withdraw. About $6 billion left in 72 hours, and the money was not there.
FTX halted withdrawals on November 8 and filed for bankruptcy on November 11, revealing a shortfall of roughly $8 billion in customer funds. Founder Sam Bankman-Fried was convicted on seven fraud and conspiracy counts in November 2023 and sentenced to 25 years in March 2024. The bankruptcy estate later repaid most customers in dollars, but priced at November 2022 values, so a customer who had held one bitcoin got back the dollar value of a bitcoin on the day the company failed, not the bitcoin.
An exchange balance is a claim on a company, not money in your pocket. The moment withdrawals stop, that distinction becomes the whole story. This guide keeps no balance anywhere: you buy, you withdraw a test amount to an address only you control, and you verify it before the rest follows. Even a bankruptcy that pays everyone back in dollars can still take your bitcoin.
Ledger breach exposes 272,000 customer addresses
Ledger makes hardware wallets, and in July 2020 it disclosed that an attacker had reached its e-commerce and marketing database through a third party API key. At first Ledger said about 9,500 customers had detailed records exposed, alongside more than one million email addresses. In December 2020 the full database appeared on a public forum, and the real count was about 272,000 detailed records: names, postal addresses, and phone numbers of people who had ordered a device.
No keys and no funds were touched. The damage was different: years of phishing emails and texts aimed at recovery phrases, SIM swaps, and extortion threats, all aimed at people whose home addresses were now in criminal hands. Ledger later confirmed that rogue members of its e-commerce provider’s support team had also exported customer records in April and June 2020.
Order data is physical security data. A home address tied to a hardware wallet order tells a criminal what you own and where you keep it, and that data stays dangerous for years after the breach. Order from the maker’s shop, ship to an address that is not your home, and treat any message about your order as suspect.
QuadrigaCX dies with its founder, $190 million locked away
QuadrigaCX was Canada’s largest crypto exchange when its founder, Gerald Cotten, died in India in December 2018 at age 30. He alone held the passwords to the company’s cold wallets. His widow had his encrypted laptop and no password, and no one else at the company could open the wallets. About 115,000 customers were owed roughly $190 million.
The exchange filed for bankruptcy in April 2019. In June 2020, Ontario’s securities regulator concluded the operation had been a fraud and a Ponzi scheme, with Cotten trading against customers under aliases. Whether the keys were truly lost or never existed, the result for customers was the same: the money was gone.
One person holding every key is the failure this guide is built to remove. A 2-of-3 spread across three keys and three places survives any single death, loss, or theft, and the inheritance sheet exists so the people you trust can still open the fund when you cannot.
Mt. Gox loses 850,000 bitcoin
Mt. Gox was the world’s largest bitcoin exchange, handling more than 70 percent of all bitcoin transactions in early 2014. On February 24, 2014, it suspended trading and went offline. Four days later it filed for bankruptcy in Tokyo, admitting about 850,000 bitcoin had gone missing, worth roughly $450 million at the time. About 200,000 were later recovered from an old wallet. The rest were never found.
Investigations later showed the exchange had been losing coins to attackers since 2011, slowly, through flaws in how it tracked withdrawals. Creditors waited a decade: repayments through Kraken and Bitstamp began in July 2024, and the deadline for the remaining distributions runs to October 31, 2026.
This is the original lesson of the site. Coins left on an exchange are the exchange’s coins until you withdraw them, and no reputation or size changes that. The practice spend exists so you prove the withdrawal step with a small amount before your savings ever move.
New entries land as events warrant.