Historical roundup based on PANews reporting published November 6, 2026, at 17:36:56 UTC+8. Statuses and plans below reflect that report, not subsequent developments.
Security incidents dominated the technical updates: Chainalysis restricted services while investigating exposed customer information, Binance continued a phased withdrawal recovery, and researchers warned of iPhone-based wallet theft. Separately, Zilliqa outlined a move to Ethereum Layer 2, while Lido added token swaps.
Chainalysis restricts services during security investigation
Chainalysis said it discovered on Monday that some customer information concerning all its users—including names, usernames, password hashes and active tokens—had been exposed to malicious actors.
The company removed access to Reactor and Data Solutions during its investigation. It said there was still no evidence that investigation data had been accessed or its attribution data manipulated.
After detecting additional abnormal activity on November 6, Chainalysis also took its KYT interface and API, other address-screening products and login page offline. It directly notified customers whose KYT accounts were suspected of unauthorized access.
At the time of reporting, the company planned to begin restoring KYT and address-screening access on November 7, requiring password resets and API-key rotation. Work to restore Reactor and Data Solutions remained ongoing.
Binance recovery: withdrawals and frozen Arbitrum assets
Binance’s ninth security-incident recovery update scheduled another batch of asset withdrawals to reopen progressively from noon Beijing time on November 6. The batch covered assets across BSC, Base, Ethereum, Optimism, Polygon and Arbitrum, including USDE, PENDLE, ZRO, XRP and CAKE.
The exchange said withdrawals would resume only after security checks, rather than reopening for every asset simultaneously. Deposits remained operational, while some withdrawal requests could face temporary delays.
Separately, Binance proposed that ArbitrumDAO return 8,425.997 ETH and 74,559,805.2 ARB to a designated recovery address to compensate affected users. Arbitrum’s Security Council had frozen and moved those assets after the Binance hot-wallet attack.
The proposal was still at the forum-discussion stage. It required a Snapshot temperature check and onchain governance, with the process expected to take about 49 days, potentially longer if legal proceedings restricted transfers. It did not request new DAO spending.
SignalPlus reports losses below $82,000
SignalPlus said it detected abnormal activity early on November 4 and confirmed a cyberattack. According to the company, a compromised third-party Telegram account led to some user accounts without IP whitelists being affected.
It reported total losses below $82,000 and promised full compensation to affected users. SignalPlus said it worked with centralized-exchange partners to revoke all associated API keys and temporarily suspended terminal services, with full restoration expected within days.
Binance separately confirmed it had removed all SignalPlus-linked API keys as a precaution. It said its own systems were unaffected and user funds were safe. It advised affected users to check positions and open orders directly on Binance, avoid reconnecting keys until SignalPlus confirmed resolution, and enable IP whitelisting.
iPhone wallet-theft reports carry different loss estimates
PANews cited warnings from security researchers and crypto commentators about DarkSword, an iOS exploit toolkit reportedly exploiting underlying iOS 18 flaws. According to those warnings, opening an infected website through Safari could allow malicious code to run without a wallet connection or signature authorization, exposing passwords, files, private keys and seed phrases.
That account identified at least 18 malicious websites and reported losses of up to $5.57 million across more than 20 wallets.
A separate Bitquery investigation attributed thefts from 430 wallets since mid-October, totaling about $4.16 million, to one group. It traced at least 4.06 million USDT stolen from 365 TRON wallets, plus more than $103,000 from another 65 wallets across eight chains.
These were separate reported findings, not figures to add together. Bitquery said there was no evidence that wallet applications such as Trust Wallet themselves were vulnerable; it identified tools stealing seed phrases from iPhones as the principal risk. Its recommendations included updating iOS and avoiding storage of seed phrases in phone photos or notes.
Infrastructure warning: Alpine Linux and OpenSSH
Changpeng Zhao shared a warning about an OpenSSH vulnerability on Alpine Linux that he said had existed for 10 years. The reposted account described an emergency fix for an authentication bypass in which passwords longer than 256 bytes could unlock key-only accounts on affected servers without the actual credentials.
The roundup did not identify affected versions or provide a patch identifier, so it does not support a more specific remediation claim.
Zilliqa plans a Layer 2 transition; Lido launches swaps
Zilliqa said it would transition from an independent Layer 1 to Zilliqa Institutional Layer, an Ethereum Layer 2 aimed at regulated institutions. The team cited insufficient usage, capital and liquidity, alongside maintenance costs highlighted by a recent security incident.
This was a planned transition, not a completed deployment. The ZIL token would remain, holders needed to take no immediate action, and technical details would be published in advance. Any conversion or migration would be governed by official website announcements.
Lido, meanwhile, said its Swap feature was live across Ethereum, Arbitrum and Base, powered by CoW Swap. For larger swaps, its widget added price protection using Chainlink price oracles to help users avoid unusually unfavorable exchange rates.
Bitcoin’s “quantum landmine” remains a thought experiment
Bitcoin Core developer Cory Fields proposed a mechanism requiring a would-be quantum attacker to post bitcoin collateral. An owner who retained their private key could use a previously established hidden ownership proof during a lockup period—30 days was an example—to recover the targeted coins and seize the attacker’s collateral.
Fields also discussed an auction-based concept for inactive wallets. He explicitly described the ideas as thought experiments; execution rules had not been written. They were not deployed Bitcoin protections.