Everything-dashboard for tokenized stocks + $6.3 B Binance hack
The company that catches crypto hackers got hacked.
Chainalysis now says password hashes and live tokens for all its users were exposed.
Funny, but it shows the real problem. Every company that hoards user data is building a honeypot.
The goal for this industry should be simple: no company stores your data. You prove what they need with ZK, and they never keep the file.
Here’s what we got today:
- $6.3 B Binance hack. Everything you need to know about it.
- Tokenizedstonks.io 101. The website for all your tokenized stocks info.
- Around the web. FBI's request to ThorChain, Rabby dropping support for MegaETH, Ambire launched Ice, and more.
Here's your Edge 🗡️!
News
The Biggest Hack in History, and the Market Didn't Blink
$6.3B stolen from Binance. The biggest crypto theft in history.
In 2022, an ~$8B hole at FTX took the whole market down with it. This time BTC dipped about 6% and was back within a week.
Why's that?
What happened?
At 20:05 UTC on Oct 29, Binance hot wallets started sending money to an attacker. XRP first, then SOL, OP, 18,270 BTC, and a pile of ETH. By the time the last transfer cleared at 23:56 UTC, $6.3B was gone.
That's more than 4x Bybit's $1.46B, the previous record.
Two days later, the FBI pinned it on North Korea's TraderTraitor group. Binance says it'll absorb the full loss. Users don't lose a cent.
The how matters here, because it explains why nobody could stop the money at the door.
How'd they pull it off?
With a job interview.
In September, someone posing as a project director approached a Binance engineer on a real job platform. Two rounds of interviews followed, one on live video, with a fake recruiter whose social media looked lived-in. Round two ended with a take-home "assignment." The repo carried 0-day malware.
Back in June, a tampered Homebrew install on another engineer's laptop had already shown the attackers who ran Binance's wallets.
From there, an internal AI tool let them hop from one engineer's machine to the next until they found a deploy token. That got them into the wallet signing service.
Then came the nasty part. The attacker used EIP-7702 to hand its own contract execution rights over a Binance hot wallet. Those rights lived onchain, so even with withdrawals paused, the money kept walking out for hours.
Binance blocked 57 North Korea-linked attacks this year. Number 58 got through.
Three reasons BTC shrugged (as of Nov 5)
1. Binance ate it.
This is the real difference from FTX. FTX lost its customers' money. Binance lost its own.
By Oct 31, Binance had replenished 98% of the stolen assets from its SAFU fund and company cash. When withdrawals reopened, users pulled a net $3.64B in the first 9.5 hours. That's 2.1% of the exchange's $171B in assets.
(DefiLlama's tracker showed more, a number Binance disputes.)
FTX's collapse set off bank runs and bankruptcies across crypto lenders. This time, users pulled 2.1% and kept trading.
2. Almost half the loot got frozen.
Elliptic counts $2.85B frozen or seized, 44% of the theft. Almost all of it stablecoins.
Tether froze 1.567B USDT the same night. Arbitrum's Security Council went further. It moved 8,425 ETH and 74.56M ARB out of the hacker's address without the private key, by briefly rewriting a system contract and then changing it back.
The hacker saw the freezes coming. On Aave, it deposited 60M USDT and borrowed 19,762 WETH. Swap money that can be frozen for money that can't. Aave answered by freezing 292 reserves across its markets within hours.
3. The market was already braced.
DefiLlama logs 322 hacks in 2026 alone. And BTC was already deep in a pullback. We've been bracing for these hacks for several months now.
Hard to panic-sell a market that's already sold.
This issue
Everything-dashboard for tokenized stocks + $6.3 B Binance hack
Tokenizedstonks.io is a must-know tool if you do anything with tokenized stocks. Here are the top features from it that I really like.
- $6.3 B Binance hack. Everything you need to know about it.
- Tokenizedstonks.io 101. The website for all your tokenized stocks info.
Next issue:
Free · every Thursday
Enjoying this issue? Get the next one by email.
Each Thursday Edgy explains what happened in DeFi and what it means for you. About 7 minutes. No shilling.
“No BS, solid analysis, not pressing me to buy.”
Reader survey
Written by Edgy · 15,000+ readers
Tools
The Everything-Dashboard for Tokenized Stocks
You bought tokenized TSLA. But what exactly does that give you?
Can you vote? Redeem for a real share? Withdraw to your own wallet? Who can freeze it? Most holders have no idea.
Enter tokenizedstonks.io. It shows you all the facts (with sources) you need to know.
As of now, it tracks 4,637 tokenized securities across 31,412 tokens.
Divide those numbers and you get the first surprise: almost seven tokens per security. Tesla has 46.
46 versions of the same stock
Pick any stock and open its Structure tab. For TSLA, you get a map called "How TSLA is tokenized." It connects the real share to every issuer, network and venue.
That's 46 tokens from 13 issuers on 20 networks, trading in 298 markets.
So if there are 46 TSLAs, are there real differences between them?
Your TSLA isn't my TSLA
This is the site's best feature. The Structures page asks every issuer eight questions a holder should ask. Do you own the share? Can you vote? Can you redeem? Can you get real shares out? Can you hold it in your own wallet?
Hover any cell and you get the reasoning plus the source doc. This determines what your "tokenized stock" actually is.
Quick 80/20 for five TSLA issuers:
The reports also show what each issuer does on weekends. Robinhood and Coinbase freeze on a 24/5 oracle. bStocks uses the prior close. Ondo quotes its own price. Hold that thought.
Who can pull the plug
This is the part that feels most like L2BEAT. The site reads admin and upgrade powers straight from the contracts. Here's a list of trust assumptions you're taking on.
- Robinhood: the issuer can freeze, block, pause, seize and upgrade every Stock Token at once through one shared contract.
- Binance bStocks:a single regular wallet address can upgrade every bStock contract.
- Ondo: upgrades sit behind 2-hour timelocks, and Ankura holds a first-priority claim on the backing.
And the risk doesn't stop at the contract. Check what's actually backing your token. xStocks can lend out the shares behind TSLAx. Lent shares leave the pledge and get swapped for cash pooled across its lending products. So part of what backs your TSLAx might be a cash claim, not a Tesla share.
The real market is the perps
Remember those frozen weekend prices? Price discovery doesn't stop. It moves to the perps.
The Derivatives page tracks stock perps on trade.xyz (Hyperliquid HIP-3), Lighter and Pacifica. TSLA perps did $93.9M in 24h. All 46 TSLA tokens combined did $21.25M. That's 4.4x the volume of every TSLA token put together.
"Perps before the open" is one of my favorite views. It compares the last perp mark before the US open with the actual opening price.
On 4 Nov, TSLA closed the prior day at $398.50 and opened at $380.00, a 4.6% gap down. Three minutes before the bell, trade.xyz had it at $379.03. That's within 0.26% of the open.
The perps had already priced the drop.
Where to trade, and where to earn
The Liquidity page ranks every pool. The first lesson: liquidity isn't activity.
Ondo's TSLAon/USDC pool on Ethereum is the deepest TSLA pool at $4.81M. It does $0.32M a day. Coinbase's TSLAc/USDC on Aero (Base) holds $0.48M and does $7.26M a day. Depth tells you who can absorb size. Volume tells you where the traders are.
For LPs, every pool page estimates fee APR. The TSLAB/USDT pool on PancakeSwap shows roughly 106%, gross and before impermanent loss, with $157K of depth within 2% of the price.
Why you can trust it (mostly)
Every number on the site carries its source, its type (onchain read, provider, computed, issuer doc, modelled, disputed), and its age. Stale data drops out of totals.
Most dashboards hand you a number and expect you to believe it. This one shows its work.
That's just six features. There's a lot more I didn't cover: venue and network breakdowns, shareable filters, open JSON for anyone building on it. Go poke around.
Before you buy a tokenized stock, find out what you're actually holding. Now you can.
🚀 DeFi Catalysts
Scroll plans to turn its public L2 into a restricted network built for AI agents. SCR and USX would migrate to Ethereum mainnet, with SCR keeping its governance role.
Extended published its XTEN tokenomics. Points holders get 300M XTEN (30% of supply), fully unlocked at TGE, while team and investors stay locked for 12 months.
Kinetiq brought Banana Gun to Elysium, and the bot will route 40% of its net trading revenue into buying and burning KNTQ.
Collector Crypt (CARD), the tokenized trading-card project, just landed on Coinbase's listing roadmap.
FBI is asking THORChain node operators, RPC providers and DeFi services to block transactions from the Binance hackers' wallets. It's a voluntary request, not a court order.
Hyperliquid's HLP vault ate ~$0.6M after 11 fresh accounts pulled $1.62M of margin from XPL longs, then let the $12M position get liquidated into it as XPL dropped 18%.
🧰 The Toolkit
Rabby, the wallet, is dropping native support for MegaETH. Btw, users can still add it as a custom chain in the wallet.
Ambire launched Ice, an open-source, quantum-ready hardware wallet built for Safe. Pre-orders are open.
Trezor raised its passphrase limit from 50 to 128 characters after the Coldcard thefts.
📰 Industry News
Devcon, one of the major Ethereum conferences, is currently underway in Mumbai. It'll end tomorrow, November 6.
OKX launched its card in the US: 2% cashback on eligible USDG purchases, up to 10% at the top tier.
Coinbase beat New Jersey on staking after 3+ years. Wisconsin, Maryland, California and Washington are next on its list.
CFTC Chair Selig wants crypto exchanges registered federally, under the same safeguards derivatives markets use.
📉 Down Bad
Chainalysis confirmed a hacker got into its internal systems, exposing customer names, emails, and organization roles.
Trezor told anyone who bought from reseller CryptoBilis since March to move their funds to a new seed after a reported hardware implant in a Safe 5.
Monero users may be exposed after an alleged leak from swap service Wagyu put 38,628 orders and 10,139 IPs in the open. Monero's cryptography wasn't broken. The leak links swaps on either side of it.
trade.xyz says its GitBook docs were tampered with, and told users not to click links in them while it investigates.
Old iPhones as cold wallets are a bad idea. iPhone 11 and older carry a chip-level bug that no iOS update can fix.
THORChain halted swaps on 10 chains after an Ethereum reorg made a vault pay out 10 ETH it never received. The user has returned the 10 ETH.
🚨 Rekt Report
BTCPay Server told operators to switch off their servers after hot wallets were drained on multiple instances.
zkLink was exploited for ~$783K through a transient storage flaw that let the attacker forge a batch root and pull 12 withdrawals.
Premia was exploited for $464.6K. The attacker bridged from Arbitrum to Ethereum and swapped to BTC through Chainflip and NEAR Intents.
b14g, a Bitcoin staking protocol on Core, had 97M CORE drained (~$1.47M) through zero-value withdrawal requests. Staked BTC wasn't touched.
Iron Fish is shutting down after an attacker used a Merkle tree inflation bug from 2019 to spend the same note twice and exit through the ChainPort bridge.
Polymarket was drained of ~$2.7M from more than 700 wallets after an attacker swapped out a monitoring script from third-party vendor DebugBear.
Recall Network is winding down after deciding its AI agent evaluation protocol isn't commercially viable. The foundation is burning ~35.86% of RECALL supply, and holders get nothing from the treasury.
Mercado Bitcoin, Brazil's largest exchange, confirmed a cyberattack and paused deposits and withdrawals. Hypernative estimates over $40M in suspected losses.
🐦⬛ X Hits
- Robinhood’s roundup of growth and developer activity on their chain.
- Belief assets & cashflow assets: the two types of durable cryptos.
- The McDonaldization of venture capital
- Market analysis from @goodalexander
- A guide for doing a security sweep.
😂 Meme
Until next time,
Edgy
Today's email was written by Edgy and Yayya.
DISCLAIMER: I'm NOT a financial advisor. This content is for education and information purposes only. Crypto and DeFi are risky and speculative. Please do your research before investing.
Whenever you're ready, here's how we can help you:
- 🚀 The DeFi Edge Ventures - We identify, invest, and help amplify DeFi Protocols that positively impact the Crypto space.
EdgyWrites The DeFi Edge every Thursday
Next issue ·
Get the next issue in your inbox
One short email a week: what happened in DeFi, what it means, and what Edgy is watching next. Free, about 7 minutes, no shilling.
Your inbox, every Thursday
15,000+ readers, including people at
“Very well curated, non chaotic.”
Reader survey