The cryptocurrency industry was still reeling from the unprecedented $6.3 billion Binance breach of October 29, 2026—the largest heist in crypto history—when a rapid-fire wave of four additional attacks struck within days, draining an estimated $146 million from a diverse set of targets.
These follow-on incidents—affecting Brazil’s largest exchange, an unnamed European Union entity, merchants using BTCPay Server, and a dozen DeFi websites—painted a grim picture of an ecosystem under sustained assault, where the fallout from a single catastrophic failure can embolden attackers and expose systemic vulnerabilities across multiple fronts.
Early this morning Mercado Bitcoin, Brazil’s largest crypto exchange, suffered a security incident that resulted in ~$49 million in stolen funds.
In the early hours of November 2 an attacker began moving assets held across 17 blockchains, working in waves to drain the estimated… https://t.co/SXrPBghxtM
— Chainalysis (@chainalysis) November 3, 2026
The Catalyst: The Record-Breaking Binance Breach
The wave of attacks was set in motion by the Binance breach, a sophisticated operation that exploited a combination of technical flaws and human error. On the night of October 29, 2026, attackers began draining hot wallets across at least ten blockchains, including Ethereum, Bitcoin, Tron, and Solana.
The primary vector on Ethereum was a manipulation of the EIP-7702 authorization mechanism. This feature, introduced in May 2025, allows a standard wallet to delegate its control and transfer rights to a smart contract. The attackers managed to obtain signed authorizations, likely through a compromised DevOps engineer’s laptop, which allowed them to install malicious code on Binance-linked wallets without directly accessing private keys. A single transaction submitted 50 pre-signed authorizations, enabling the attacker to sweep 167,464 ETH and dozens of other tokens, including 1.615 billion USDT.
Initial estimates placed the losses at approximately $6.3 billion, a figure more than four times larger than the previous record held by the Bybit hack in February 2025. In response, Binance froze roughly half of the stolen assets in collaboration with stablecoin issuers like Tether and Circle, and pledged to cover all user losses using its Secure Asset Fund for Users (SAFU) and corporate treasury. The FBI attributed the attack to TraderTraitor, a North Korean state-sponsored group linked to the Lazarus Syndicate.
The Four Follow-On Attacks
In the days following the Binance breach, the crypto community’s attention was briefly unified on the record heist. However, attackers quickly exploited the distraction and the generalized anxiety in the market to launch four distinct, high-impact operations.
1. Mercado Bitcoin: Brazil’s Largest Exchange Hit
On Monday, November 2, Mercado Bitcoin, Brazil’s largest cryptocurrency exchange, paused all deposits and withdrawals after detecting a security incident. Blockchain security firm Hypernative estimated that over $40 million was drained across at least ten blockchains, including Ethereum, Bitcoin, Solana, Tron, and Polygon, a figure later refined by other analysts to approximately $46 million.
The attack involved the unauthorized transfer of funds from wallets tied to the exchange, with the perpetrator(s) moving assets from over 27,000 different addresses. While Mercado Bitcoin stated that client funds and data were safe, the incident underscored the vulnerability of even the largest regional exchanges. Stablecoin issuers, including Tether, moved swiftly to freeze millions in connected USDT, but the event highlighted the persistent risks associated with centralized hot-wallet storage.
2. The $106 Million Mystery: An Unnamed EU Entity
In a separate and even more opaque incident, on-chain investigator ZachXBT flagged the suspected theft of more than $106 million from multiple centralized exchange accounts linked to an unnamed European Union entity on November 1. The attacker withdrew funds in the form of USDC and USDT, then systematically converted the stablecoins into Ethereum (ETH) and routed them through instant exchanges and privacy-focused tools like Monero (XMR) to obscure the trail.
ZachXBT noted that he was “confident it is NOT Lazarus Group,” suggesting that a different set of actors was exploiting the post-Binance chaos. The victim organization and the specific exchanges involved were not publicly named, adding a layer of mystery to an attack that, by some later estimates, may have grown to exceed $133 million.
3. BTCPay Server: Merchants’ Hot Wallets Swept
The third attack targeted the infrastructure layer of Bitcoin payments. On November 1, the maintainers of BTCPay Server, a popular self-hosted payment processor, issued an emergency warning after discovering an active attack vector targeting instances running version 2.4.1 (released July 23, 2026) or earlier. Attackers gained administrative access to outdated servers and swept the hot wallets, stealing Bitcoin and Litecoin from merchants.
The total loss was not immediately disclosed, but blockchain intelligence firm Bitquery later reported that approximately $1.6 million had been swept from merchant hot wallets. The incident forced many businesses to take their payment systems offline and served as a stark reminder that the security of the entire payment stack, not just exchanges, is critical.
4. Name.com DNS Hijacking: A Dozen DeFi Sites Compromised
Rounding out the wave was a coordinated DNS hijacking campaign that targeted a dozen decentralized finance (DeFi) websites, all of which were registered with the domain registrar Name.com. Late on Friday, October 31, visitors to legitimate sites—including Kintsu, Origami, Pickle Finance, FluxBeam, and StonkFun—were redirected to malicious copies of these sites.
These fraudulent pages were rigged with Step Drainer, a malware toolkit designed to trick users into signing transactions that would drain their connected wallets. The Block initially traced approximately $138,000 stolen, though later analysis by Bitquery suggested the total may have reached $202,000 taken from 32 wallets across six chains. While the financial loss was smaller than the other attacks, the DNS hijacking represented a direct assault on user trust in the DeFi front-end layer.
The four attacks that followed the Binance breach were not mere coincidences
They demonstrated a rapid diversification of attack vectors—from exchange hot wallets and payment processors to domain registrars and individual DeFi users. The attackers exploited the chaotic environment and the stretched resources of security teams focused on the Binance fallout. The events highlighted the interconnectedness of the crypto ecosystem, where a breach at one major entity can serve as a smokescreen for a multitude of smaller, opportunistic strikes.
Furthermore, the Binance breach itself, with its exploitation of the EIP-7702 feature, signaled a new era of sophisticated attacks that leverage legitimate protocol upgrades for malicious ends. The subsequent attacks, while varied in method, shared a common theme: the persistent vulnerability of hot wallets and centralized points of failure.
From Mercado Bitcoin’s exchange wallets to BTCPay merchants’ operational funds and the domain-level control of DeFi sites, the attacks underscored that in the relentless cat-and-mouse game of crypto security, the perimeter is constantly expanding, and the fallout from a single massive breach can be measured not just in the billions stolen directly, but in the wave of follow-on exploits it inspires.
Natalie Pierce tracks the parts of crypto that move fast and rarely wait for everyone to catch up. From South Africa, she covers DeFi, AI crypto, hacks, airdrops, sentiment and emerging narratives, especially when user behavior and protocol risk start to overlap.
Her reporting is built for messy sectors. Natalie looks at incentives, reactions, security concerns, social momentum and early signs of traction without pretending every new trend is already proven. Her voice is clear and accessible, but careful enough for areas where excitement can outrun the facts very quickly.