On October 31 the FBI named the Binance attacker. The cyber alert says North Korea’s TraderTraitor group took more than $6 billion on or about October 29, with the Secret Service and IRS Criminal Investigation, and that stolen coins were being converted mainly into ether. The desk special already walks the clock. This brief records the alert and the other UTC-day documents.
Lending was the second story. LlamaRisk, writing at 18:05 UTC, said Aave V3 and V4 reserves frozen after the incident were open again, and it asked to restore the higher full-utilization borrow rates that had been cut on October 30. A research post decoded 92,627 fills on nine proprietary automated market makers. Coinbase reported short send delays on Solana and on Zcash. Kraken marked a Flow funding delay, open since October 29, as resolved at 04:43 UTC.
No price in this brief comes from a later market snapshot. The numbers are the ones the FBI alert, the Aave post, and the status pages stated. Ethereum’s history, the DeFi glossary, and the exchange entry are the background.
FBI attributes the Binance theft to TraderTraitor
The FBI published a cyber alert on October 31, 2026 saying North Korea was responsible for the Binance attack. The alert says the theft was more than $6 billion and occurred on or about October 29. It names the TraderTraitor group and says the FBI is working with the U.S. Secret Service and IRS Criminal Investigation. It says the stolen assets were being converted primarily to ether. The alert is the government attribution. It does not itemize every chain or publish a freeze total.
Aave is asked to restore full-utilization borrow rates
LlamaRisk posted on Aave's governance forum at 18:05 UTC on October 31, 2026. It said the Slope2 cuts made on October 30, after the Binance hot-wallet incident, should be reversed to the pre-incident values. As of that post, the Aave V3 and V4 reserves frozen during the incident were no longer frozen. On Aave V3 Core USDC, the table lists $2,342 million supplied and utilization of 94.0%. The borrow APR stays 4.50%. The APR at 100% utilization moves from 10.00% to 14.50%.
A research post prices 92,627 proprietary-AMM fills
An Ethereum Research post on October 31, 2026 decodes 92,627 fills on nine Ethereum venues it calls PropAMMs, where one maker sets the price by pushing quote state on chain. The sample runs 30 days, from September 10 to October 9, 2026. Of those fills, 69,827 were WETH against stablecoins, and the authors priced them against Binance one-second trades. The post says markouts change by under 0.1 basis point across the window in which relays received the block. It is a measurement note, not a governance proposal.
Coinbase opened a Solana incident at 07:38 Pacific on October 31, 2026, which is 14:38 UTC, and marked it resolved at 08:19 Pacific. The notice said some users might see delayed sends and receives on Solana. Buys, sells, and fiat deposits and withdrawals were unaffected, and the page said funds were safe. It did not state a cause. The resolved flag is the page's own, not an on-chain finality claim.
Coinbase opened a Zcash incident at 20:12 Pacific on October 30, which is 03:12 UTC on October 31, and marked it resolved at 23:44 Pacific (06:44 UTC). The notice said some users might see delayed sends and receives on the Zcash network. Buys, sells, and fiat deposits and withdrawals were not affected, and the page said funds were safe. It gave no cause and no count of delayed transfers.
Kraken marked its Flow funding incident resolved at 04:43 UTC on October 31, 2026. The incident had opened at 22:20 UTC on October 29. The notice said deposits and withdrawals might be delayed and that all other funding methods were operating normally. The October 31 change is the resolved flag. The page did not publish a value for delayed FLOW.
