Source publication: November 6, 2026, at 17:36:56 UTC+8. This roundup reflects the reports and proposal statuses recorded at that time.
Frozen balances, exchange withdrawals and trading-pool prices describe different parts of blockchain infrastructure. PANews’ November 6 digest covered each of these, alongside security incidents affecting analytics services and wallet users. The distinction matters: a recovery proposal is not a completed transfer, and a price observed in decentralized exchange pools is not a market-wide valuation.
Binance requests the return of frozen ETH and ARB
Binance submitted a proposal on the Arbitrum governance forum seeking the return of 8,425.997 ETH and 74,559,805.2 ARB frozen on Arbitrum One. The requested destination was a Binance-designated recovery address, with the assets intended to compensate affected users.
According to the report, the Arbitrum Security Council had frozen the funds following the attack on Binance’s hot wallet and moved them to a designated address.
At publication, the proposal remained in forum discussion. It still required a Snapshot sentiment vote and on-chain governance, a process expected to take approximately 49 days. Legal proceedings restricting asset transfers could extend that timeline. The proposal did not request additional DAO spending.
Separately, Binance’s ninth security-incident recovery update said withdrawals for another group of assets would begin reopening in stages from 12:00 Beijing time on November 6. The listed networks included BSC, Base, Ethereum, Optimism, Polygon and Arbitrum; assets included USDE, PENDLE, ZRO, XRP and CAKE.
Binance said each batch would reopen after security checks, rather than all assets becoming available simultaneously. Deposits remained operational. Recovery priorities reflected user demand over the preceding week, and some withdrawals could experience temporary delays or longer processing times.
Chainalysis reports exposed credentials and service interruptions
Chainalysis said it discovered on the Monday preceding publication that certain customer information affecting all its users had been exposed to malicious actors. The information included names, usernames, password hashes and active tokens.
The company removed access to Reactor and Data Solutions during its investigation. It said there was no evidence at that point that investigation data had been accessed or its attribution data manipulated. That statement described the evidence available during the investigation, not a final determination.
After detecting further abnormal activity on November 6, Chainalysis took its KYT interface and API, other address-screening products, and login page offline. It directly notified customers whose KYT accounts were suspected of unauthorized access.
The company planned to begin restoring KYT and address-screening access the following day, requiring password resets and API-key rotation, while continuing work on Reactor and Data Solutions.
Wallet-theft reports describe distinct datasets
A Bitquery report linked thefts beginning in mid-October to a common transaction-fee wallet. Researchers attributed the activity to one group that stole at least 4.06 million USDT from 365 wallets on TRON, then drained another 65 wallets across eight chains, including Ethereum and BNB Chain, causing losses exceeding $103,000 on those chains.
The reported sequence was to obtain private keys, send victims small amounts of TRX to cover transaction fees, and then transfer out their funds. Bitquery said there was no evidence that applications such as Trust Wallet were themselves vulnerable; it identified iPhone hacking tools, including DarkSword, as a risk to stored recovery phrases.
A separate item in the digest reported that security researchers and commentators had associated the DarkSword iOS exploit toolkit with losses of up to $5.57 million, involving more than 20 wallets and at least 18 malicious websites. According to that account, visiting an infected website through Safari could enable malicious code to run without a wallet connection or signature authorization.
These reports used different scopes and figures; the digest did not establish whether their losses overlapped. Their totals should therefore not be added together.
SignalPlus and Binance revoke connected API keys
SignalPlus said it detected an attack early on November 4, originating from a compromised third-party Telegram account. Some affected user accounts lacked IP allowlists.
The company said total losses were below $82,000, promised full compensation, and temporarily suspended terminal services. It worked with centralized-exchange partners to revoke all API keys associated with SignalPlus.
Binance separately confirmed removing all SignalPlus-linked API keys as a precaution. Binance said its own systems were unaffected and user funds were safe. It advised users to review positions and open orders directly through Binance and avoid reconnecting keys until SignalPlus confirmed the issue was resolved.
Bridge-token pricing and infrastructure changes
Blockaid reported that DAI.e associated with Avalanche Bridge had moved away from its $1 peg, trading at approximately $1.10 in active Avalanche DEX pools—about 10% above the peg. The observation concerned that bridged asset in those pools; it did not establish a price change across all DAI markets or explain the cause.
Other infrastructure developments in the digest included:
- Zilliqa’s planned transition: The team said it would move from an independent Layer 1 to an Ethereum Layer 2 for regulated institutions, named Zilliqa Institutional Layer. The ZIL token would remain, holders needed to take no immediate action, and technical details would follow.
- Lido’s Swap launch: Lido said its interface now supported token swaps on Ethereum, Arbitrum and Base through CoW Swap. It described an additional protection layer for larger swaps using Chainlink price oracles.
- Samsung Wallet’s USDC accounts: Decrypt reported availability for eligible US Galaxy users, using USDC on Solana through a service built with Bastion and Coinbase. The report cited approximately 82 million compatible devices, fee-free transfers, bank withdrawals in more than 60 countries, and a 4% credit-card funding fee. New York was excluded at publication.