BTCPay Server told its users to turn off their servers on Nov. 11. The order came three days after Binance lost $6.3 billion in the worst crypto theft on record3. BTCPay runs bitcoin payments for merchants who skip a bank in the middle. Its alert named one culprit: hot wallets. These wallets sign transactions on their own, skipping a human's approval before the money moves. A hot wallet keeps its keys on a server that talks to the internet, the same design behind both hacks this week. Bitcoin traded near $77,803 as this piece went to press, CoinGecko showed, at 12:10 UTC on Nov. 2, 20265.
BTCPay's Old Code Bites Again
Nicolas Dorier founded BTCPay Server4. It is a free tool merchants run themselves to take bitcoin directly. Dorier says the drains hit builds older than version 2.4.1, which came out July 23, 2026. Version 2.4.7, the newest release, logged zero drains, Dorier added. Operators who update promptly have stayed ahead of the pattern so far.
A hot wallet keeps its private key on the same server that takes orders from the internet. It can sign a payout the moment a script tells it to, fast for a merchant and risky if an outsider gets administrator access. BTCPay also offers cold storage, keys stored on a device kept off the network, though many merchants still run the faster, hot setup instead.
The same gap opened once before2. An August 2026 bug let attackers steal Lightning Network credentials from servers running versions before 2.4.2. BTCPay offered a 10 percent bounty then, capped at 3 BTC, to win funds back.
Dorier's team still has a gap in its own account. The attacker "logged in with administrator privileges on the affected instances," Dorier said2. His team had yet to learn how. BTCPay posted its warning at 22:25 UTC1. The post drew 2,926 likes and 260 replies by that same hour, 12:10 UTC on Nov. 2. BTCPay asked every affected operator to send logs and information to its security team. That step starts a drain investigation of this kind.
Both sides, in their own words
Does a second drain inside one week prove crypto's oldest risk persists?
“There are no built-in protections for when these inevitable hacks take place”
“reports of hot-wallet thefts appear to involve BTCPay Server releases older than version 2.4.2”
Binance Keeps Climbing Back
The exchange spent the week rebuilding trust. On Nov. 2, Binance opened fiat withdrawals in five new currencies: U.S. dollars, UAE dirhams, Vietnamese dong, Philippine pesos and Indonesian rupiah78. That list now sits beside yen, euros, Brazilian reals and 20 more currencies Binance already served.
Co-founder Yi He answered comparisons to FTX the same morning. “Our top priority right now is to ensure the environment is secure, after which users can withdraw their funds and Binance can resume operations,” she wrote9. crypto.news read her post as a line drawn between Binance's open books and exchanges that "absconded" with customer funds10.
Binance says it has already replaced 95 percent of what the hack took10. The money came from company reserves, a futures insurance fund and the Secure Asset Fund for Users. CZ built that last reserve after a 2019 breach. Customers pulled roughly $3.64 billion once withdrawals reopened, a small share of the exchange's reported holdings. Yi He's own figure puts Binance's total assets near $171 billion, a cushion few rivals can match.
The Leaks Keep Coming Too
Binance's own hacker kept moving money this week too. On Oct. 29, the hacker's wallets took 233.46 million XRP12. That was worth about $296 million at the time, moved within five minutes of the first breach. The stash then sat untouched for 80 hours.
On Nov. 2, the hacker split the XRP across six fresh wallets12. Binance, separately, finished emptying its own drained wallet the same day: two transfers of 40 million XRP each, 50 seconds apart. Together they were worth about $101 million and left just 23.7 XRP, roughly $30, behind11. Only Tether and Circle's stablecoins carry a freeze switch. XRP's ledger lacks one, so draining the wallet was the only way left to stop further losses.
Arkham traced about $4 million more from the hacker's cluster to three Binance deposit addresses13. That move may point to nested platforms that ride on Binance's own infrastructure. A nested platform runs its own customer accounts on top of an exchange's wallets. Such a deposit can land closer to Binance than a plain customer transfer would.
Arkham's wider count puts the hacker cluster's holdings at $5.875 billion across 65 tokens, as of Oct. 3014. Tether and Circle had frozen $2.54 billion of that haul by the same day. That included $1.567 billion in USDT and $823 million in USDC. KuCoin News reported the hacker reached Binance's hot wallets through the EIP-7702 delegation feature on Ethereum. The hacker financed the attack through Tornado Cash.
EIP-7702 is an Ethereum upgrade. It lets a regular wallet batch several transactions into one signature, a trick once reserved for a smart contract. The feature shipped to make ordinary wallets more useful. This hacker turned that convenience into one signature that drained several Binance wallets at once. Investigators at the FBI pressed node operators at Thorchain14. Thorchain is a network the hacker used to swap assets across chains. The FBI wanted operators to block transactions tied to the case, KuCoin News reported.
Binance's Hacker Still Held $5.875B of the $6.3B Taken, Oct. 30
Dollar value of the Binance hack, by stage, as tracked by Arkham and reported by KuCoin News
Sources: CoinDesk [3]; KuCoin News [14].
Read the chart as a table
| Item | Value |
|---|---|
| Taken from Binance, Oct. 29 | $6.300B |
| Still held by the hacker, Oct. 30 | $5.875B |
| Tether and Circle froze, Oct. 30 | $2.540B |
The week's events line up in a short, dated sequence.
BTCPay's Alert Came 3 Days After Binance's $6.3B Hack, Nov. 1
The week's dated events, from Binance's Oct. 29 hack to Arkham's Nov. 2 trace
Read the chart as a table
| Date | Event |
|---|---|
| Oct. 29, 2026 | Binance's hacker takes $6.3 billion |
| Oct. 29, 2026 | The hacker's wallets take 233.46M XRP |
| Nov. 1, 2026 | BTCPay tells users to shut down |
| Nov. 2, 2026 | Binance empties its last $101M |
| Nov. 2, 2026 | Arkham traces $4M back to Binance |
Does Old Code Still Carry the Risk?
Tyler Moore, a cybersecurity professor at the University of Tulsa, has followed crypto for a decade. Moore framed the stakes before BTCPay's alert even landed. “There are no built-in protections for when these inevitable hacks take place,” he told CNBC on Oct. 31, after Binance's breach but before BTCPay's own6.
Dorier draws a narrower lesson. He told TokenPost that “reports of hot-wallet thefts appear to involve BTCPay Server releases older than version 2.4.2”4. The project retired that build months ago. Read plainly, his account argues the software already works. An operator only has to run the version that exists.
Both views survive the same fact. The August bug and the November one hit the identical weak spot, a release operators left unpatched for months. Blockaid's chief executive, Ido Ben-Natan, struck a middle note on exchange risk generally. “I actually don't think it's a bad idea for users to put money in these exchanges. These exchanges need to work really hard to make sure they don't take another hit like this,” he told CNBC6. His sentence doubles as the test BTCPay now faces too. An update that exists differs plainly from an update an operator actually installs.
By the numbers
- $6.3 billion: what Binance's hacker took on Oct. 29, the largest crypto theft on record3.
- 2.4.1: the newest BTCPay Server build the current drains have hit, released July 23, 20262.
- $5.875 billion: what the hacker's cluster still held across 65 tokens on Oct. 3014.
- Tether and Circle froze $2.54 billion of that haul by the same day14.
- $101 million: the XRP Binance's drained wallet gave up in its last two transfers, Nov. 211.
- 2,926: the likes on BTCPay's shutdown order, counted at 12:10 UTC on Nov. 2, 20261.
- 95 percent: the share of hack losses Binance says it has already replaced10.
- $171 billion: Binance's total assets, by Yi He's own account on Nov. 210.
What to watch
Watch for BTCPay's own count of affected servers and stolen bitcoin once its investigation closes. A third drain on an old release would back Moore's reading over Dorier's; a quiet month would back the opposite. Watch the frozen $2.54 billion too. A court order or a swap that moves it toward victims would mark recovery as more than a promise. Binance's new currency list and its coming proof-of-reserves report are worth checking on schedule. Either one landing on time would be the clearest sign the exchange can run its ordinary business again.
Sources
- BTCPay Server, "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers," X (@BtcpayServer), Nov. 1, 2026, https://x.com/BtcpayServer/status/2117020340815819262
- CoinDesk staff, "BTCPay, a Bitcoin Payment Tool, Tells Users to Switch Off Their Servers After Reports of Drained Wallets," CoinDesk, Nov. 2, 2026, https://www.coindesk.com/tech/2026/11/02/btcpay-a-bitcoin-payment-tool-tells-users-to-switch-off-their-servers-after-reports-of-drained-wallets
- CoinDesk staff, "Potential Multi-Billion Binance Hack Hitting Crypto Markets," CoinDesk, Oct. 29, 2026, https://www.coindesk.com/business/2026/10/29/potential-multi-billion-binance-hack-hitting-crypto-markets
- TokenPost staff, "BTCPay Founder Says Theft Reports May Involve Older Versions," TokenPost, Nov. 2, 2026, https://www.tokenpost.com/news/technology/46072
- CoinGecko, "Simple Price API: bitcoin/usd," CoinGecko, Nov. 2, 2026, https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd
- CNBC staff, "Binance's $6.3 billion hack raises questions about crypto wallet safety," CNBC, Oct. 31, 2026, https://www.cnbc.com/2026/10/31/binance-hack-crypto-wallet-safety.html
- Binance, "Fiat Withdrawal Update," X (@binance), Nov. 2, 2026, https://x.com/binance/status/2117164969582330063
- TechFlow staff, "Binance Adds Support for 5 Fiat Currency Withdrawals Including USD," TechFlow, Nov. 2, 2026, https://www.techflowpost.com/en-US/newsletter/142468
- Yi He, "Our top priority right now is to ensure the environment is secure," X (@heyibinance), Nov. 2, 2026, https://x.com/heyibinance/status/2117155170568253732
- crypto.news staff, "Binance's Yi He pushes back on FTX comparisons after $6.3B hack," crypto.news, Nov. 2, 2026, https://crypto.news/binances-yi-he-pushes-back-on-ftx-comparisons-after-6-3b-hack/
- U.Today staff, "XRP's Final Move: Binance Empties Hacked Wallet of Last $101 Million," U.Today, Nov. 2, 2026, https://u.today/xrp-final-move-binance-empties-hacked-wallet-of-last-101-million
- Bitcoin.com News staff, "Binance Hacker Moves All $293M in Stolen XRP as $242M Slips out Through Tron," Bitcoin.com News, Nov. 2, 2026, https://news.bitcoin.com/security/binance-hacker-moves-293m-stolen-xrp/
- TechFlow staff, "Arkham: Binance Hacker Transfers Approximately $4 Million to Binance Deposit Address," TechFlow, Nov. 2, 2026, https://www.techflowpost.com/en-US/newsletter/142512
- KuCoin News staff, "Binance Hacker Cluster Holds $5.875B Across 65 Tokens; $2.54B in Related Funds Frozen," KuCoin News, Oct. 30, 2026, https://www.kucoin.com/news/flash/binance-hacker-cluster-holds-5-875b-across-65-tokens-2-54b-in-related-funds-frozen