November 4 brought new evidence about stolen cryptocurrency moving across multiple blockchains, alongside a security investigation into the control issuers retain over tokenized stocks. Today’s crypto roundup covers roughly $72 million in SOL movements linked to the $6.3 billion Binance hack, fresh asset conversions following the Mercado Bitcoin and BlueMove incidents, and findings that four tokenized-stock issuers can remove holdings without wallet-owner approval. Separately, a Hyperliquid trader suffered six Bitcoin short liquidations, while a wallet linked to Yeti0x began selling HYPE.
Binance hacker moves $72 million in SOL as investigators uncover 50 approvals
Blockchain intelligence firm Bitquery identified another round of transactions linked to Binance’s October 29 security breach, tracing 779,097 SOL, worth approximately $72 million, from the attacker’s main Solana wallet to 91 new addresses between November 3 and 4.
Many of the receiving wallets forwarded the funds within hours. Investigators identified a conversion route involving SOL swaps into USDC, transfers through Circle’s Cross-Chain Transfer Protocol (CCTP), purchases of ETH and subsequent swaps into Bitcoin through THORChain.
At least 10.8 million USDC reached new Ethereum wallets through the bridge between the evening of November 3 and the morning of November 4. Some of the ETH acquired through those transactions was then deposited into THORChain with instructions to deliver BTC.
Bitquery associated at least 497 BTC, worth approximately $39 million, in THORChain payouts with nine Bitcoin addresses specified in attacker-linked swaps. Six related payout addresses subsequently forwarded 366 BTC to 62 new addresses that had not spent those funds at the investigation’s cutoff.
The $39 million figure represents traced conversion activity, not a confirmed amount withdrawn into fiat currency or successfully cashed out. The SOL transfers and subsequent BTC movements are stages of overlapping transaction flows and cannot be added together as independent losses.
It was a long route, and not all of it is traced even now.
The latest activity follows Binance’s phased withdrawal reopening after the $6.3 billion hack, which began November 1. The exchange said it had sourced replacement assets covering approximately 95% of the affected holdings, using corporate resources and protection funds.
Bitquery’s November 4 investigation also identified a more detailed mechanism behind the original theft. According to its analysis, Binance’s own transaction-signing infrastructure authorized 50 approvals that allowed attacker-controlled code to operate through a heavily used Ethereum hot wallet.
The approvals were recorded at approximately 20:20:59 UTC on October 29. Binance revoked the authorization at 00:10:35 UTC on October 30, leaving an interval of approximately three hours and 50 minutes.
The researcher estimates that $729 million in stolen USDT escaped before Tether’s freezes took effect. Much of that value was converted into ETH and TRX, while approximately 60 million USDT entered Aave-related transactions.
Bitquery separately calculated that approximately $2.7 billion in stolen assets had been frozen or rescued through actions involving stablecoin issuers and blockchain authorities. Its latest estimate put another $3.1 billion under attacker control at 09:56 UTC on November 4.
That is a seperate issue from the funds Binance has already replaced.
The investigator’s reconstructed amounts are not an independently audited accounting of Binance’s customer liabilities, and frozen cryptocurrency is not necessarily recovered cryptocurrency. The on-chain evidence establishes that authorizations were signed, but it does not establish how the attacker obtained access to Binance’s signing infrastructure.
Mercado Bitcoin and BlueMove wallets continue moving funds
New transactions also emerged from wallets associated with the November 2 Mercado Bitcoin security incident.
Onchain Lens reported that approximately 1.92 million VIRTUAL tokens, valued around $1.14 million, had been transferred from an attacker-labeled wallet to address 0xbaa512541a232068E694a4cBA7c03f8989a8E896, followed by smaller swaps.
A separate Bitquery investigation found that addresses associated with the Mercado Bitcoin breach exchanged approximately $11.9 million across 136 different tokens for ETH during November 3 and 4, using MetaMask’s swap service.
PEPE, AAVE and UNI were among the largest assets converted. Bitquery’s November 4 snapshot showed approximately 8,678 ETH, worth about $20.1 million, distributed across ten attacker-associated Ethereum wallets.
The research also raised its estimate of the original November 2 outflows to approximately $48.6 million across ten blockchains. That amount is an investigator’s reconstruction, rather than a final loss figure confirmed by Mercado Bitcoin.
As detailed in DaveFinances’ earlier report on Mercado Bitcoin’s withdrawal suspension, the Brazilian exchange acknowledged a security incident while stating that customers had suffered no financial losses.
Bitquery additionally reported that approximately $11.8 million had been frozen by stablecoin issuers and that thousands of customer deposit addresses on Ethereum had been emptied after the attack began. Its assessment of the affected addresses and the timing of the transfers has not been confirmed in a technical post-mortem from the exchange.
The VIRTUAL transfer and the $11.9 million in token conversions describe potentially overlapping activity. Their dollar values should not be combined without reconciling the underlying transactions.
Meanwhile, blockchain security firm PeckShield identified another approximately $393,000 in movements associated with an address labeled as belonging to the BlueMove attacker.
According to the November 4 alert, the wallet transferred 193,000 USDC from Ethereum to Hyperliquid and acquired 306.59 units of XMR-linked exposure at approximately $630 per unit.
A second 200,000 USDC followed a different route, moving from Ethereum to Solana through Wormhole, then returning to Ethereum through deBridge before being deposited into Railgun.
The tokens moved again, but these were movements tied to an older incident, not a newly identified theft.
Railgun provides privacy-focused transaction infrastructure, while the Hyperliquid transaction involved XMR-linked trading exposure. Neither transaction alone proves that native Monero was recieved into a shielded wallet or that the underlying funds became untraceable.
PeckShield’s address label also does not independently establish the legal identity of the person operating the wallet.
Four tokenized-stock issuers retain powers over $750 million
A separate November 4 investigation by Bitquery identified administrative controls allowing four tokenized-stock issuers to remove or destroy certain customer-held tokens without requiring signatures from the wallets holding them.
The researchers examined seven issuers operating across six blockchains: Robinhood, Binance, xStocks, Ondo Global Markets, Coinbase, Backpack and PreStocks.
Four of the seven—Robinhood on its blockchain, xStocks on Solana, Coinbase and PreStocks—were found to retain administrative keys capable of moving or burning tokens from external wallets within minutes, without modifying contract code or waiting for a timelock.
The affected holdings were valued at approximately $750 million using October 30 prices, representing about 23% of the $3.25 billion in tokenized assets issued by the seven providers in the investigation. Approximately 441,000 wallets held at least $1 of the tokens subject to those immediate administrative powers.
The wallet holds the token, but the issuer still has a hand on it.
Bitquery documented historical use of these capabilities by two issuers. On October 5, Coinbase used an administrative key to remove and burn approximately 0.0129 DraftKings-linked tokens, worth about $0.25, from two addresses.
In September 2025, PreStocks moved tokens out of 32 accounts it did not own. Most movements related to open orders, but tokens from three ordinary wallets were transferred into a PreStocks-controlled vault, according to the investigation.
These transactions do not, on their own, establish misconduct. Administrative restrictions and recovery powers can serve sanctions compliance, court orders, erroneous-transfer correction and other operational purposes.
Bitquery also reported that 593 addresses on Binance’s bStocks sanctions list held approximately $30,945 in tokens that could not be transferred as of its November 4 examination.
The findings add another dimension to the debate over Coinbase’s model for tokenized equities and the rights attached to underlying shares. Securities backing, redemption eligibility and wallet-level administrative authority are distinct aspects of a tokenized-stock product.
The U.S. Securities and Exchange Commission’s staff addressed the differences between issuer-sponsored and third-party tokenized securities in its January 28 statement on tokenized securities. It explained that third-party arrangements may provide rights materially different from those attached to the underlying security, including additional exposure to the intermediary.
For holders, smart-contract permissions therefore deserve examination alongside prospectuses, custody arrangements and redemption terms. The research identifies powers that are technically availble to administrators, rather than evidence that those powers will be exercised against customers generally.
Hyperliquid trader suffers six BTC short liquidations
On-chain monitoring platform Lookonchain reported six liquidations against a single trader’s Bitcoin short positions on Hyperliquid during approximately two hours on November 4, as BTC rebounded above $78,000.
The account, identified by wallet address 0x4b62652d2f176bf5422c8157c5b37984837d57ca, reportedly had 199.83 BTC in position notional liquidated, equivalent to approximately $15.45 million at the time.
Following those liquidations, the account still held a short position of around 70.99 BTC, valued at $5.5 million. Lookonchain placed its updated liquidation price near $78,192.79.
Six hits on the short, and the short was still there.
The reported $15.45 million is the notional value of positions liquidated, not an independently calculated realized trading loss. The wallet’s subsequent exposures and liquidation thresholds could also have changed after the monitoring snapshot.
Separately, Onchain Lens identified an approximately $2.49 million KHYPE transfer from a multisignature wallet associated with Yeti0x.
The tokens were converted into approximately 29,870 HYPE, valued around $2.45 million, and deposited into Hyperliquid. The monitoring account reported that spot-market selling had begun.
The identified wallet was 0x7fA77093e83C9292C2357ea799AC2C57EC138203. Its observed transactions support the reported conversion and transfer, although the exact quantity subsequently sold and the wallet’s beneficial ownership remain unconfirmed.
Both Hyperliquid reports illustrate different forms of market activity: forced liquidation of leveraged exposure and voluntary movement of tokens toward spot sales. Neither establishes a platform security breach.
Across the November 4 developments, the strongest new evidence concerns the continued movement of assets from previously reported attacks and the administrative powers built into tokenized-stock contracts. Binance’s authorization records, Mercado Bitcoin’s post-incident token conversions and the issuer-control investigation provide transaction-level findings, while the identity of several wallet operators, final recovery totals and the reasons behind administrative interventions remain unresolved.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574