6 min read · 12 sources

Binance has replenished 90% of the $6.3 billion drained from its hot wallets on October 29, backing 100% of its top-ten assets including BTC, ETH, USDT, BNB, and SOL. The exchange covered the shortfall using its Secure Asset Fund for Users (SAFU), regulatory-cleared tranches of its Futures insurance fund, and corporate treasury reserves, with a Zero-Knowledge Proof of Reserves snapshot scheduled for November 3.

The post-incident forensics reveal an architectural failure familiar to backend infrastructure teams: the attackers never needed the raw private keys. Instead, they compromised a DevOps laptop, accessed internal transaction-dispatching microservices, and tricked an automated signing pipeline into approving arbitrary state changes.

Here is the technical reality of the exploit, how security operations at major perp DEXs compare, and the rest of the day’s infrastructure shifts across the ecosystem.

Hyperliquid holds $5.6B of its $6.5B USDC in a Coinbase-controlled treasury address moved by unsigned system transactions, meaning a single key or validator compromise reaches the bulk of user funds.

Signing policies failed on EIP-7702 delegations

Source: links.tldrnewsletter.com ↗

According to incident disclosures and post-mortem analysis, the attackers hit Binance’s internal withdrawal systems by compromising a DevOps engineer’s machine. Once inside the internal network, the attacker submitted an authorization request containing an EIP-7702 delegation. EIP-7702 allows standard externally owned accounts (EOAs) to temporarily execute smart contract logic by pointing their code field to an external contract address for the duration of a transaction or until overwritten.

Because Binance’s automated signing orchestrator relied on a blocklist of known-bad payload patterns rather than a strict allowlist of deterministic function signatures, the novel EIP-7702 authorization payload was approved and signed. Control of the hot-wallet address was effectively delegated to an attacker-controlled contract. A month earlier, Bitget lost $350 million via the exact same signing architectural flaw.

The security post-mortem points out that perp DEXs share similar centralized systemic risks. Hyperliquid, for example, holds $5.6 billion of its $6.5 billion USDC balance in a Coinbase-controlled treasury address moved by unsigned system transactions; a single compromise of those validator signing keys gives complete access to the underlying collateral. By contrast, zero-knowledge exchange architectures like Lighter enforce a 14-day forced-exit escape hatch where server compromise alone cannot drain user balances, although Lighter’s 4-of-7 multisig bypassed upgrade timelocks five times in October alone.

Despite the operational failure, Binance confirmed that all primary assets are fully backed and users will absorb no financial shortfall. Less liquid, non-top-10 tokens make up the remaining 10% deficit, which Binance is buying back through OTC and open-market execution.

Chainalysis hit by agentic breach while tracking North Korean laundering

Source: links.tldrnewsletter.com ↗

Chainalysis confirmed an intrusion where an attacker used “offensive agentic techniques” to compromise an internal corporate system. The exfiltrated data was limited to non-sensitive customer metadata: user IDs, names, email addresses, and organizational roles. The firm confirmed that investigation outputs, proprietary query graphs, session tokens, passwords, and multi-factor secrets were not exposed.

The intrusion was explicitly disassociated from the Binance attack, which Chainalysis attributes to North Korean state-sponsored threat groups. The on-chain tracking data shows the Binance attackers are deploying automated agents to cycle funds through thousands of intermediate hops, routing capital into JustLend on Tron to skirt stablecoin issuer blacklists. Out of the roughly $6.4 billion stolen across all chains in that wave, centralized issuers have managed to freeze approximately $2.8 billion in flight.

Stateless compute: "L1.5" ephemeral rollups on Ethereum

Source: ethresear.ch ↗

Ethereum researchers proposed a new architectural pattern dubbed “L1.5” or Ephemeral Rollups, designed to eliminate the long-term state burdens carried by standard Layer 2 sequencers. In normal rollup architectures, the L2 holds both user state and application state, requiring complex, stateful fraud proofs or validity assertions alongside exit bridges to allow withdrawals back to the base layer.

Under the L1.5 paradigm, the compute layer is completely stateless:

1. The user’s wallet stores and maintains their private state.
2. Ethereum L1 holds the shared state, commitments, nullifiers, and verification contracts.
3. Untrusted, dynamic provers execute transactions as stateless functions over the user’s inputs and current L1 state.
4. Proofs settle directly to L1, updating storage without intermediate rollup operators maintaining user balances.

This construction relies on three core Ethereum improvement proposals. EIP-8141 introduces frame transactions, allowing contracts to self-pay execution gas only after verifying an execution proof. EIP-8250 introduces keyed nonces to repurpose zero-knowledge nullifiers against double-spending attacks without running an EVM account counter. EIP-8288 standardizes proof aggregation, condensing an entire block’s worth of stateless executions into a single recursive SNARK verified once by an L1 node. The design directly serves use cases like private RPC payment ticketing, anonymous balance proofs, and MEV-shielded transaction pools.

Stripe deploys Bridge rails into Walmart's OnePay

Source: links.tldrnewsletter.com ↗

Stripe has launched stablecoin payment orchestration for OnePay, the consumer finance application backed by Walmart. The backend is operated by Bridge, the crypto orchestration company Stripe acquired.

Select US customers can now deposit USDC into OnePay checking accounts directly from external exchanges or self-custody wallets across 12 distinct networks, including Ethereum, Base, and Solana. Bridge provides programmatically generated unique deposit addresses, automates real-time compliance and sanctions screeners, and handles immediate off-ramping into US dollars with zero conversion fees for end users. The target market is cross-border and gig-economy workers, enabling native stablecoin payroll to be routed into FDIC-insured bank accounts without using secondary exchanges.

Base cuts block times to 200ms with Denim upgrade

Source: links.tldrnewsletter.com ↗

Base deployed its Denim network upgrade to the Sepolia testnet, with mainnet activation slated for November 5. Denim cuts the Layer 2 block execution time down to 200 milliseconds, optimizing latency for on-chain order books and high-frequency state updates.

The network saw substantial volume across consumer and institutional integrations this month:

• October on-chain card settlement volume reached $243 million, marking an 80% jump from March 2026.
• Coinbase Tokenized Stocks cleared $4 billion in cumulative decentralized exchange volume.
• FalconX launched an institutional-grade USDC credit lending facility directly on Base.
• Ripple opened an initial liquidity deployment for its RLUSD stablecoin.
• Y Combinator disbursed a $500,000 funding round to portfolio company MochaTrade entirely in USDC on Base, alongside releasing a revised Request for Startups highlighting crypto AI agents.

Morpho liquidity analysis reveals a curator bottleneck

Source: links.tldrnewsletter.com ↗

An institutional supply-side audit by RWA.xyz analyzing $6.1 billion deposited into Morpho’s variable-rate stablecoin vaults concluded that stablecoin supply, not borrower leverage demand, remains the primary growth bottleneck. Curators - principally Steakhouse, Sentora, Gauntlet, SparkDAO, and RockawayX - control over 80% ($5.0 billion) of deployed capital allocation.

Of the $2.6 billion in explicitly attributed institutional liquidity, $1.1 billion stems from retail-facing exchange “earn” integrations, and another $1.1 billion comes from Sky-authorized (formerly MakerDAO) protocol balance sheets. Protocol allocations are effectively capped by internal governance-mandated credit lines, while synthetic dollar reserves like Ethena are restricted by off-chain delta-neutral collateral requirements. The report notes that consumer platform earn integrations represent the only uncapped source of stablecoin liquidity capable of driving further yield-market expansion.

Infrastructure notes: Aave, Solana rails, and tokenized equities

Source: threadreaderapp.com ↗

• Aave protocol revenues: Aave recorded its fourth consecutive month of net fee growth, with annualized revenue run-rates hitting $77 million for October driven by elevated borrow rates across core markets.
• Polygon payments reach Solana: Polygon’s Open Money Stack payment suite expanded API execution to Solana, unifying fiat rails, multi-chain settlement, and automated conversions alongside its existing deployments on Base, Ethereum, BNB Chain, and Tron.
• Equity issuer backlash against OKXICE: Fifty public corporations with an aggregate market valuation topping $25 trillion have filed formal objections against unauthorized tokenized equity representations of their shares trading on OKXICE, with twelve new issuers joining the challenge this week.
• Coinbase Q3 earnings: Coinbase posted Q3 net income of $719 million, climbing 66% year-over-year from $433 million. Operating net results were heavily buoyed by an unrealized $715 million accounting mark-to-market gain on crypto assets held on its corporate balance sheet.