News of the month: the Binance theft
On 29 October, Binance announced that roughly $6.3 billion had been taken from its wallets in a single security incident, and subsequently suspended deposits and withdrawals (Al Jazeera). The FBI attributes the attack, with high confidence, to TraderTraitor, a North Korean group linked to Lazarus. The exploit eclipses 2025’s $1.5B Bybit hack, which previously held the record.
Binance has assured users it will cover all losses and that user funds are safe, with about $3 billion in stolen funds frozen by stablecoin issuers. Withdrawals began reopening in phases on 1 November, with $3.64B in net outflows recorded on the day.
It’s worth noting that no cryptography was broken with this exploit, which is believed to have begun with a compromised employee laptop. The network simply moved the coins that valid signatures told it to move. Blockchain’s immutable nature means that finality is a double-edged sword: if the signing path is compromised, an attacker can use speed and irreversibility to their advantage. In light of this, strict access controls and proactive, layered security measures become especially critical.
This ethos is central to Xapo’s security philosophy: no single key, person, or system can move funds alone. A complete private key does not exist anywhere; it lives only as separate shards across geographically dispersed, network-segregated environments. Alongside the cryptography sits a separate set of rules that decides whether a transaction may proceed at all, and no individual at Xapo can move a member’s Bitcoin. Every withdrawal from the Vault is also held for 48 hours.
For a long-term holder, the takeaway is less about any one incident and more about where your Bitcoin sits. Funds you trade with will always carry some of the platform’s risk. The Bitcoin you plan to hold for years is worth protecting in layers, whether in a Vault, a well-run setup of your own, or a mix of both. Self-custody remains your right, and a sound choice for many holders. As we’ve seen, however, that is not a guarantee either.
Xapo Bank product update
2% cashback, paid in Bitcoin
One of our most requested features is receiving a major update. From Monday 9 November, your card spending earns 2% back in Bitcoin on your own monthly cashback allowance, set by your USD wallet. Always 2%. No tiers, no token.
Your allowance is set on the 1st of each month from your average USD wallet balance the month before, and you'll see it, and what's left, in the app. Keep more in your wallet, and next month's allowance grows.
Cashback is paid automatically in Bitcoin on the 1st of every month. Nothing to claim, nothing to activate, no expiry. Your wallet earns Bitcoin back; your savings earn yield.
Refer and earn
Refer as many friends as you like, and earn $500 for each one. Your reward lands once they’ve been an active member for 33 days, and they get $500 too.
Security
Three controls already in your app that are worth reiterating this week:
48-hour Vault hold: Every Vault withdrawal is held for 48 hours and triggers an email alert, so you can cancel a withdrawal from any device you’re logged in on.
Hardware security key: Once you add a hardware key, such as a Yubikey, Vault withdrawals need a physical tap to approve, so a stolen phone and PIN aren’t enough. It also won’t work on a fake site, however convincing.
Beneficiaries: In a few minutes, name who should receive your holdings. Your heirs then follow a guided process, with no seed phrase to find.
October BTC market update
Bitcoin opened October at $83,556 and set the month's high of $87,249 on 2 October, before ranging between $80K-$84K over the following three weeks. The Binance theft saw BTC fall to a low of $76,141 on 30 October, still above September's dip to around $75.5K. It closed the month at $77,424, down 7.3%, its weakest October since 2014.
(BTC:USD, 1D, Coinbase) Accessed 01.11.2026.
Spot Bitcoin ETFs recorded net outflows of $515M in October, as the broader market continued to trim risk appetite. This followed two months of large net inflows, with $2.65B in September and $3.52B recorded in August. The largest single-day outflow was $643.3M on 30 October, the session immediately following the theft.
(BTC Spot ETF Fund Flow, 1M, SoSoValue) Accessed 01.11.2026.
Among treasury companies, Strategy slowed its buying through the month and bought no Bitcoin between 19 and 25 October, holding about 849,327 BTC as of 4 November. It remains to be seen whether Bitcoin reclaims $80K support in the near-term, as the aftermath of the Binance exploit continues to unfold in a risk-off macro environment.
All things considered, Bitcoin showed such high resilience that it even surprised Xapo CEO, Seamus Rocca. He added: “...an asset that can absorb a black-swan event, decouple from tech equity turbulence, and quickly reclaim ground is demonstrating the exact foundational strength that drives multi-year compounding.”
Xapo in the room
The Digital Asset Conference (TDAC IV), London (Oct 19–20)
Our CFO Matt McPhee and Pablo Magro, Head of CCG & Institutional, met with clients and industry leaders at Fasanara’s annual digital asset conference.
Joey Garcia, Executive Director and Chief Digital Asset & Legal Officer, joined the panel “Balance Sheet Bitcoin: Treasuries, Banks and the Road to Adoption” and shared our view on what it will take to turn interest into adoption.
LABITCONF, Buenos Aires (Oct 29–31)
Xapo was proud to sponsor LABITCONF’s opening event, where Latin America’s first Satoshi Nakamoto monument was unveiled.
On the “Banks, DeFi and KYC” panel, Pablo argued that while banks and DeFi already share infrastructure, their standards of accountability remain worlds apart. In his view, that’s exactly what banking can bring to Bitcoin.
Institutional or corporate treasury?
If you’re weighing Bitcoin on the balance sheet, custody, or banking rails for your business, our Institutional team would like to hear from you. Write to [email protected].
Top 3 headlines
The SEC proposes a self-custody fallback for advisers
On 1 October, the SEC proposed custody rules that would allow US investment advisers and regulated funds to hold crypto themselves, but only when no permitted custodian can do so, with holdings documented and reviewed every quarter. It would also recognise eligible state trust companies as custodians. The proposal is currently open for comment.
Europe sets a deadline for non-compliant stablecoins
On 8 October, ESMA told national regulators that MiCA-authorised firms should stop serving EU clients with non-MiCA-compliant stablecoins, including holding them for customers. Existing positions are to be wound down by 8 January 2027 at the latest.
The first final rule under the GENIUS Act
On 21 October, the US Office of the Comptroller of the Currency became the first regulator to finalise its stablecoin rule, effective 18 January 2027. It sets standards for reserve backing and redemption, and bars issuers from paying interest directly on stablecoins.
Recommended reading
Idle or earning: where Bitcoiners keep cash while they wait to buy
Four places to keep your cash reserve while you wait to buy, and what each one costs you in returns, access and speed.
The definitive guide to institutional-grade Bitcoin storage and security
How split-key custody, a 48-hour withdrawal hold and regulated segregation fit together for holders of significant wealth.
