Bitcoin Amazons Weekly: The Custody Test

Binance’s promise now has to survive the withdrawal test

On October 29, attackers took roughly $6.3 billion in tokens from Binance’s hot wallets, the internet-connected wallets used to process transfers. The exchange’s October 30 update said withdrawals remained suspended. Deposits and other unaffected services were operating.

Binance said it would absorb the financial impact. It reported more than $6.34 billion of company funds set aside, including $5 billion already held in the affected tokens. Those are replacement resources, not a statement that every withdrawal has resumed.

The exchange also reported about $3 billion frozen onchain. A freeze can prevent further movement of a token. Getting it legally and operationally back to the right parties is another step. Adding that figure to the replacement pot would produce very confident, very bad arithmetic.

TRM Labs’ investigation described signed account-delegation instructions on Ethereum and ordinary signed transfers on other chains. Delegation lets an account authorize code to act for it. The evidence points investigators toward signing systems; the complete breach path remained under investigation.

That distinction matters. This was not evidence that Bitcoin’s base chain had failed, or that Ethereum’s entire network had been hacked. It was a severe failure at a major custodian with access to customer-facing infrastructure.

Nyra Chen: Frozen, funded and withdrawable belong in separate columns. The spreadsheet does not award bonus points for optimism.

For users, the next useful evidence is an actual withdrawal restart, credible reserve information and a detailed account of what was compromised. Binance’s reopening target was conditional. Its update targeted reserve results by November 2. Independent reporting described a wider breach than the initial laptop explanation.

Polymarket’s front door became the attack route

Prediction market Polymarket had a different problem. Its October 30 postmortem said a compromised third-party performance-monitoring script used active website sessions to sell positions and move funds on October 29.

A monitoring tool normally helps a site understand how its pages perform. If malicious code gets that position inside the page, it can exploit the privileges available to a logged-in session. The security boundary includes the website you use, not just the blockchain beneath it.

Polymarket removed the script, cleared caches, paused parts of the service and forced fresh logins. Trading resumed. By its Friday update, 95% of affected wallets had been refunded. It said $3.9 million was being returned: $2.7 million drained plus $1.2 million of losses related to the pause. AP reported the initial disruption and reimbursement promise.

Kaia Reyes: The uninvited guest arrived dressed as website analytics. Terrific guest list.

A refund percentage measures progress, not a finished repair. Watch for completion and a fuller explanation of the supplier compromise. For anyone using Web3 applications, wallet ownership still leaves questions about session permissions and what the interface persuades you to authorize.

Datavault AI discovers that a BTC credit can stay a credit

Datavault AI’s October 26 filing disclosed that a withdrawal requested in June remained unfulfilled.

The backstory is a September 2025 equity transaction with Scilex, originally priced at $150 million payable in Bitcoin. Following an adjustment, 1,309.04 BTC were credited in an offchain wallet at Biconomy Pte Ltd. Datavault later sold some of those credits back to Scilex.

The filing said the arrangement did not qualify for the digital-asset accounting previously used. The balance would instead be treated as a subscription receivable, an amount owed in connection with the share subscription. Several earlier financial statements should no longer be relied on and would need restating. The Block covered the disclosure and market reaction.

The $150 million deal price is not a verified amount stolen. Nor does the filing establish why withdrawal failed.

Aurelia: A treasury deserves a withdrawal test before it gets a victory lap.

Investors now need the restated accounts and evidence of access or recovery. The wider lesson is practical: A company’s reported Bitcoin exposure can depend on another company’s records and performance.

ICE wants Hyperliquid technology inside a US rulebook

Intercontinental Exchange, the group that owns the New York Stock Exchange, announced an investment and agreement with Trade[XYZ] on October 29. The plan is a regulated US market and clearing structure using Hyperliquid’s blockchain infrastructure.

Trade[XYZ] develops perpetual markets. A perpetual is a derivative without a fixed expiry date: Traders take exposure to an asset’s price, with funding payments helping keep the contract near its reference market. Buying an equity-linked perpetual does not give you the underlying share.

The proposed American business still needs regulatory approvals. Customers would enter through regulated intermediaries with identity and anti-money-laundering checks. Markets Media explains the division of roles: Hyperliquid supplies infrastructure, Trade[XYZ] designs markets and ICE operates the regulated market and clearing structure.

Valeria Stone: Wall Street likes the engine. It is keeping the entrance desk.

More trading hours can make access more convenient. They also give leveraged positions more hours in which to go wrong. The next evidence is approval, a published product structure and a usable launch, not another celebratory announcement.

Ripple’s trust-bank approval has a specific job

Ripple announced on October 26 that it received final approval from the Office of the Comptroller of the Currency, a US bank regulator, to establish its national trust bank.

The announced business focuses on custody, reserve management and related services for RLUSD, Ripple’s stablecoin, a token designed to track one US dollar. Ripple says Standard Custody & Trust Company remains RLUSD’s issuer under New York supervision. The new charter does not magically turn a stablecoin into Bitcoin or remove its issuer.

This is Ripple’s account of final approval, also reported by CoinDesk. We did not obtain the regulator’s final decision letter. The company describes services that will operate upon opening, so approval and an operating launch should stay separate.

Valeria: A federal badge may improve the custody framework. It does not hand you the issuer’s keys.

For RLUSD users and businesses, watch the bank’s opening, actual service terms and reserve disclosures. Institutional oversight can change accountability; the holder still depends on an issuer honoring the token’s promise.

Tether’s bigger cushion deserves more than a victory graphic

Tether, issuer of the dollar stablecoin USDT, reported on October 30 $1.5 billion in third-quarter net operating profit and a reserve excess of $7.95 billion at September 30. That excess is the difference between reported assets and liabilities, not cash distributed to USDT holders.

The accompanying BDO assurance report covers a specific reporting date. It explicitly does not provide assurance for every other day. Its scope also differs from a full set of financial statements.

Unchained’s comparison of reserve reports attributes most of the cushion’s quarterly recovery to higher Bitcoin and gold valuations. Those market gains can move the other way. Treating the whole increase as fresh operating cash would miss what the reserves contain.

Nyra: A thicker cushion is welcome. Please read the stuffing label.

USDT remains a claim whose reliability depends on reserves, liquidity and redemption arrangements. The useful follow-up is consistent reporting that makes changes in valuation, earnings and capital movements easy to distinguish.

On our radar

Binance’s withdrawal restart and promised November 2 reserve results. Polymarket’s remaining refunds. Datavault’s restated accounts and access to its credited BTC. ICE’s regulatory applications. Ripple’s bank opening. And the November 3 Bitcoin Optech discussion, scheduled for 16:30 UTC.

The market moves. The chain continues. The Amazons stand watch.