WuBlockchain’s daily roundup on Oct. 30 covered a series of crypto security and regulatory developments, led by Binance’s disclosure that a security incident involved about $63 billion in assets. The exchange said its initial investigation found the attack may have begun with a compromised employee computer, though later findings identified additional intrusion points. Binance said there is currently no evidence that wallet private keys were leaked.
Binance says more than $63.4 billion has been reserved to cover losses
Binance said it has frozen about $3 billion in related assets with the help of partners and pledged to absorb all losses.
The latest update said the company has set aside more than $63.4 billion to replenish affected assets. Of that amount, $50 billion is already held in the corresponding tokens, while the remainder is being sourced through public markets and over-the-counter, or OTC, purchases. Binance said that funding arrangement does not include the assets already frozen.
Chainalysis said the attacker rapidly swapped hundreds of millions of dollars in stablecoins in about 20 minutes and used a large number of automated transfers to obscure fund flows.
SEC sues two firms over alleged $130 million-plus crypto investment fraud
The U.S. Securities and Exchange Commission said it has filed charges against BG Wealth Sharing Ltd and DSJ Exchange Pty Ltd, alleging that the two companies used false regulatory filings to carry out an investment fraud that raised more than $130 million from tens of thousands of retail investors.
According to the complaint, from October 2025 to June 2026, the firms lured investors by claiming crypto asset trading signals could deliver high returns without risk. The SEC said they submitted false Form ADV and Form D filings and displayed fake SEC certification documents to create the appearance of regulatory approval.
The agency also alleged that the companies made periodic payments to some investors in a Ponzi-like structure while misappropriating the rest of the funds. The SEC is seeking permanent injunctions, disgorgement of ill-gotten gains and civil penalties. The false filing documents have been removed from the SEC website.
Polymarket restricts trading functions after users report unauthorized transfers
Multiple Polymarket users said in community posts that assets were transferred out of their accounts without authorization, with some reporting losses in the hundreds of thousands of dollars.
Some users said they suspected a front-end security flaw or malicious code injection on the website. They also said the abnormal transfers stopped after they closed all browser tabs that were logged into Polymarket, though the cause has not been confirmed.
Polymarket said the platform has moved into cancel-only mode and has paused relayer operations while it investigates the incident.
The company had previously reported that one of its third-party vendors was compromised, leading to malicious code being injected into the website front end and about $3 million in user assets being stolen. Polymarket said at the time that the vulnerability had been fixed and that affected users would be fully reimbursed.
Coinbase executives adopt plans to sell up to 13.6 million COIN shares
BeInCrypto, citing Coinbase’s third-quarter SEC filings, reported that Coinbase CEO Brian Armstrong, co-founder Fred Ehrsam and President Emilie Choi have each adopted Rule 10b5-1 stock sale plans. In total, the plans cover up to about 13.6 million COIN shares, worth about $2.2 billion based on the Oct. 29 closing price.
Armstrong’s plan covers up to about 8.17 million shares between Nov. 16, 2026 and October 2027. The filing said those sales would be executed only if the stock reaches preset price thresholds, meaning the shares have not already been sold.
Microsoft says North Korean hackers are using AI to scale attacks
Microsoft’s threat intelligence team said in an Oct. 29 report that North Korean hackers are using generative AI to accelerate phishing, identity impersonation and malware development.
Of the eight groups tracked by Microsoft, Jade Sleet, Coral Sleet and Jasper Sleet have already incorporated AI into routine operations, while four others are moving quickly in the same direction.
Between August and September this year, Onyx Sleet produced more than 100 customized phishing PDF files targeting users in South Korea. Microsoft said dozens of those files were generated within minutes and were highly likely to have involved AI.
From June 8 to June 12, Jade Sleet ran recruitment phishing campaigns through three fake companies, including one posing as a recruiter for an AI blockchain intelligence company to approach software engineers.
Microsoft also said the groups are using AI to study the business processes of crypto wallets, exchanges and DeFi services, and may be using AI coding tools such as Cursor to assist malware development. Onyx Sleet and Pearl Sleet have already used the open-source AI penetration testing framework ARTEX in operations.
Microsoft said AI is currently being used mainly to improve operational efficiency and that these campaigns have not become fully autonomous.
