The biggest crypto theft ever, and what came next

This one is late, and that's on us. The Briefing should have reached you on Sunday, November 1. It didn't, and I'd rather say so than pretend otherwise. Here is what you missed, and it was a big stretch.

On October 29 someone took about $6.3 billion from Binance, the world's largest crypto exchange. It is the largest crypto theft ever reported. Nobody broke Bitcoin or Ethereum to do it. The FBI says the people behind it usually get in with a job offer.

What happened. Binance said late on October 29 that a breach affected about $6.3 billion in crypto. It paused withdrawals and said about $3 billion was frozen with help from other firms. It says it will cover users' losses from its own money. Our first report

Who did it. On October 31 the FBI named TraderTraitor, a North Korean state hacking group, the same group it blamed for the $1.5 billion Bybit theft in 2025. Its usual way in is a fake recruiter who sends a "coding test" or an app that plants malware. Binance reopened withdrawals on November 1, and customers pulled a net $4.72 billion in the first days. How that group gets in

Who paid for it. Binance used about half the bitcoin in its SAFU emergency fund toward covering the loss, leaving just over 7,500. SAFU is Binance's own money, not outside insurance. Binance promises to refill it to about $1 billion, with no date. What SAFU is

It wasn't the only one. Brazil's largest exchange, Mercado Bitcoin, lost more than $40 million from its hot wallets and says customers won't pay for it. And investigator ZachXBT says an unnamed EU organization lost more than $106 million from its exchange accounts on November 1, with part of it moved into Monero. Mercado Bitcoin · The $106 million theft

The part that reaches you. A hack this size isn't followed by more hacking. It's followed by messages: "claim your refund," "verify your account," "move funds to SAFU." Binance doesn't need your login, your codes or your recovery phrase to pay anyone back. A refund lands in your account. It never needs your help.

After a big hack, the next danger is the message about the hack.

Scam of the Week

Scam of the Week: the fake FTC call. On October 22 the FTC warned about callers who pose as FTC officials and say a phone in your name is being used for scams abroad. Then they pass you to a fake police officer. If you hesitate, they tell you exactly what to search online to "check" the police number. The number you find is theirs. The FTC doesn't shut off phone numbers. Hang up, and look up the agency yourself. How the trap works

Also this week

The SEC sued BG Wealth Sharing. It says the scheme raised more than $130 million promising at least 60% a month, and showed investors SEC filings as proof of a license. A filing is not a license. If you're asked to pay a "tax" to unlock an account, don't pay. Our report

Got a Coinbase data breach email? Coinbase says it wasn't hacked. Amplitude, an analytics company it uses, exposed contact details for a small group of customers. The risk now is fake follow-up emails. Our report

"Anthropic pre-IPO shares" offers. Anthropic filed to go public on October 26. Until its shares trade, offers to sell you pre-IPO shares or a token tied to them deserve deep suspicion. Our report

A fake Google support thief got 25 months. A 20-year-old posed as Google, crypto firms and Trezor to talk people out of their codes. One victim lost 185 bitcoin. Our report

New guides on DMJ

 

 

 

 

 

Coming next week: more scam guides, including the "wrong number" text that starts most investment scams, pig butchering vs. romance scams, and what to do when a wallet is drained. And this Briefing back on Sunday, November 8.

Loss figures in this issue are estimates from researchers and news reports unless a company or agency confirmed them. News and education, not financial advice. Tokens and NFTs can lose all their value.

DeFi Market Journal, PO Box 114, Belen, NM 87002