Loopscale: The protocol has faced continuous attacks over the past week, suspending operations and replenishing affected vaults.

Malaysian national news agency Bernama reported that Malacca police raided a residential property in Kota Shahbandar yesterday, arresting 13 foreign suspects and dismantling a cyber fraud gang involved in "pig butchering" scams and fake cryptocurrency trading platforms. Malacca Central Police District Chief Halim Abas stated that the gang used apps including Telegram, QQ and Soul to lure Chinese victims with sweet talk, convincing them to transfer funds to so-called high-return cryptocurrency investments. Preliminary investigations indicate the gang members entered Malaysia on tourist visas via air travel between February and September last year, from locations including the Philippines, Taiwan region, Laos and China, and began operating at the property approximately three months ago. Police seized 12 laptops, 1 desktop computer, 26 mobile phones and one router, with the seized assets valued at around 50,000 ringgit. The suspects have been remanded until November 8 to assist with investigations, while total losses suffered by victims are still being verified.

Bitcoin mining firm Hut 8 released its Q3 2026 financial report, disclosing that the company sold roughly 954 bitcoins during the third quarter, generating net revenue of approximately $74.8 million, which it used to repurchase and cancel around 953,800 common shares valued at $74.7 million. Following the quarter, Hut 8 sold an additional 2,148 bitcoins, bringing in net proceeds of $175.4 million, and repurchased and canceled another 2,384,700 shares for $175.3 million. In total, the company sold about 3,100 bitcoins, raised roughly $250 million, and fulfilled its previously planned $250 million share repurchase program. Hut 8 stated that its board of directors subsequently increased the total repurchase authorization to $1 billion.

According to Lookonchain’s monitoring, the hacker who tampered with Ledger hardware wallets sold by Southeast Asian dealer CryptoBilis deposited an additional 885 ETH into Tornado Cash two hours ago, valued at roughly $2.14 million.

Backpack CEO Armani Ferrante stated that once Wall Street becomes an API accessible to any developer, programmable finance will spark a large wave of experimentation. He gave an example: in the programmable Wall Street era, a five-person dorm-based team could build the next Robinhood, which was almost impossible in the past. Ferrante also mentioned that traditional financial products can be re-implemented and written into smart contracts, thereby reducing fees. For instance, fees for products benchmarked against the SPY S&P 500 ETF could be pushed close to zero, and a large number of such attempts will emerge in the future.

The CryptoBilis Ledger Drainer deposited another 885 $ETH ($2.14M) into #TornadoCash 2 hours ago.

GitBook released a post-mortem of its November 2 security incident, stating that attackers exploited a vulnerability in its single sign-on (SSO) process to forge employee login sessions, then accessed misconfigured GitHub App authentication details within the organization, gained entry to internal code repositories, obtained Cloudflare API keys, and ultimately leveraged service accounts to acquire full production environment access. GitBook disabled the relevant internal service accounts within hours to halt the attack, leading to a roughly 16-hour platform outage, with full service restored at 11:56 UTC on November 3. The attackers remained in the production environment for a total of approximately 3 hours and 25 minutes. GitBook has rotated all infrastructure and hosted customer keys, and revoked API tokens. GitBook noted that current indicators show the attack targeted a single customer rather than the entire platform, and no other customer content was found to have been tampered with. However, since attackers could access customer data on the platform, the company is proceeding under the assumption that all customer data may have been exposed. The exposed data includes API tokens, integration keys, session signing keys, assistant Q&A records, and GitHub/GitLab application permissions for authorized repositories; billing information, passwords, and IP addresses were not affected. GitBook stated that the attack’s speed and precision relied heavily on automation and AI. SlowMist’s Chief Information Security Officer 23pds shared the post-mortem, identifying the named target as Trade.xyz. Trade.xyz had previously stated that the document anomalies stemmed from the GitBook infrastructure breach, with no signs of its own infrastructure being compromised, and plans to migrate away from GitBook within days.