This crypto update for November 3, 2026 has one clear theme: within 48 hours of last week’s Binance hack, two more cases surfaced in which attackers pulled money from exchange wallets or exchange accounts. It is also becoming clear what the Binance payout has cost its emergency fund. Bitcoin trades at around $76,940 on Tuesday morning according to CoinGecko (10:59 CET), down 1.4 percent over 24 hours. The daily low came at around 8:00 CET at roughly $76,490. This article is not investment advice.
Key Takeaways
- Mercado Bitcoin, Brazil’s largest crypto exchange, was hacked overnight into Monday. Only its hot wallets were hit. About $11 million has been frozen, about $38 million has not. The exchange says customers will not lose any assets.
- Investigator ZachXBT reports the suspected theft of more than $106 million from exchange accounts of an unnamed EU entity, now more than $133 million. Part of it was swapped into Monero. Nobody has confirmed it so far.
- Binance’s SAFU wallet now holds about 7,500 instead of 15,000 bitcoin. Since 04:00 UTC today, Binance has been reopening withdrawals for more assets.
- North Korea rejects the FBI’s attribution of the Binance hack.
- Sentiment and fund flows are weak: Fear & Greed drops from 37 to 26, and US spot bitcoin ETFs lost $398.6 million on Monday.
- SEC staff clarify when governance participants of a network count as a “central party”.
Crypto update: prices, sentiment and on-chain data
Ether is also lower at about $2,265 (down 1.1 percent), according to CoinGecko. The total crypto market is worth about $2.58 trillion, with bitcoin holding a share of almost 60 percent. On Sunday bitcoin was still at around $78,000, as described in our crypto market update from November 1.
The swing in sentiment is sharper. The Alternative.me Fear & Greed Index fell from 37 on Monday to 26 on Tuesday. Both readings count as “fear”, but an eleven-point drop in one day is large.
In its weekly report from November 2, analytics firm Glassnode writes that sellers on the perpetual futures market drove the slide below $80,000, while spot buyers kept buying. On X, Glassnode added that last week brought the longest run of daily net realized losses since mid-August. According to Glassnode, a hold above $75,000 would fit the pattern of earlier local lows.
One detail often gets lost: according to Glassnode, leverage has not left the market. Futures open interest remains in the upper part of its range at about $37.4 billion. Long positions are paying even more in funding than a week ago, about $3.1 million per day. So the claim that leveraged traders are “getting out” is only partly supported.
Spot ETFs: $398.6 million in outflows on Monday
US spot bitcoin ETFs recorded net outflows of $398.6 million on Monday, November 2, according to daily data from Farside Investors. Almost all of it came from one fund: BlackRock’s IBIT lost $405.3 million, Fidelity’s FBTC took in $6.7 million, and all other funds reported no flows. On Friday, October 30, $643.2 million had already left the funds. Two large outflow days in a row suggest investors are cutting risk before the vote.
Mercado Bitcoin: hot wallets drained, platform offline
Brazilian exchange Mercado Bitcoin detected a security incident overnight into Monday. In its official update from November 2, 9 pm local time (in Portuguese), it says only the hot wallets were affected, the online wallets it uses for day-to-day transfers. Most customer funds sit in cold wallets, and the platform has been taken offline as a precaution.
Together with Tether, Circle, BRL1, Paxos and Chainalysis, about $11 million has been blocked so far. About $38 million has not yet been blocked. Mercado Bitcoin promises that customers will not lose any assets. It has not given a date for reopening. Security firms had flagged suspicious transfers of over $40 million on at least ten chains. How the attacker gained signing access is unknown; there is no evidence of a link to Binance.
Suspected $106 million pulled from an EU entity
On-chain investigator ZachXBT reported on Monday in his Telegram channel that an unnamed entity in the EU is suspected of losing more than $106 million on November 1 from accounts at several centralized exchanges. The funds were allegedly withdrawn as USDC and USDT, swapped into ether and partly converted into the privacy coin Monero via Wagyu. ZachXBT said with “a high degree of confidence” that it is not North Korea’s Lazarus Group.
On Tuesday, ZachXBT raised his estimate to more than $133 million after finding about $27 million in further withdrawals. His working theory is that a large financial institution in Western Europe was exploited and that the incident is being covered up. Neither a victim nor an exchange has confirmed it so far.
Binance: SAFU halved, withdrawals in phase two
There are two new points on the Binance hack from October 29. First, the exchange’s public SAFU address now holds only 7,500 bitcoin, according to blockchain data from mempool.space. In February it held 15,000 bitcoin, after Binance converted the roughly $1 billion fund into bitcoin. At the current price, the remaining coins are worth about $577 million, and the amount taken out is worth roughly the same. Binance announced the partial use of the fund on October 31 and pledged to refill it to about $1 billion. It has not given a timeline.
Second, according to Recovery Update #6, Binance has been reopening withdrawals for more assets on nine networks since 04:00 UTC, including BSC, Ethereum, Solana, XRP, Sui, Arbitrum, Optimism, Tron and Base. The rollout is gradual. Binance repeats that the exchange, not its users, bears the loss.
North Korea has responded to the accusations for the first time. In a statement carried by the state news agency KCNA, Kim Yo Jong, the sister of leader Kim Jong Un, called the FBI’s attribution “absurd rhetoric” and a political provocation by the US. The FBI had attributed the attack to the TraderTraitor group.
Exchanges get hacked, not bitcoin
All three cases have one thing in common: the targets were hot wallets and exchange accounts, places where keys and access are concentrated. The bitcoin protocol was not “cracked”. The risk sits with the custodian. Self-custody, for example on a hardware wallet, shifts that responsibility to the user.
SEC clarifies rules for governance tokens
The Division of Corporation Finance at the US Securities and Exchange Commission added three answers to its crypto asset FAQ on November 2. They refer to the SEC’s interpretive release from March 2026, under which “digital commodities” are not securities as long as their network is functional and has no “central party” with operational, economic or voting control.
What is new: participants in a broad-based governance system generally do not count as such a group, provided they are not affiliated and have no formal or informal agreement to act in concert, including through delegation. The same applies to token-based governance run through a foundation. According to the FAQ, a central party “oversees” participation when, for example, it can unilaterally block access, change voting rules or reverse transactions. For governance tokens this is a relief. The FAQ, however, are explicitly staff views with no legal force. We covered the wider framework in our article on SEC Regulation Crypto Assets.
Midterms and Iran: politics sets the pace
The US midterm elections take place today. According to the watchdog group Public Citizen, cited by CNBC, crypto-linked groups have contributed more than $200 million in this election cycle. The super PAC Fairshake and its affiliates back 33 House candidates from both parties. The industry mainly wants a market structure law after the Clarity Act stalled in the Senate in September.
Geopolitics adds to the mix. According to a Wall Street Journal report citing US officials, the United States struck targets on Iran’s Qeshm Island in the Strait of Hormuz. Brent crude rose 0.5 percent to $105.25 a barrel in early Asian trading after falling 7.6 percent on Monday on hopes of a deal.
Bottom line
The market is nervous but not in a sell-off. Bitcoin is holding above $76,000, while spot buyers keep buying, according to Glassnode. The real story this week is trust in custodians: three incidents in a few days, two with confirmed losses and one so far backed only by on-chain data. We will keep tracking whether Binance refills its SAFU fund and when Mercado Bitcoin reopens.
