₿ Bitcoin News

Bitcoin is edging back toward $79,000 – Binance opens the floodgates, ETF investors pull out money#

Four days after the biggest crypto hack in history, Bitcoin stands at around 78,400 US dollars on Monday morning. Binance has reopened withdrawals and billions are flowing out, the spot ETFs recorded their biggest daily outflow in months – and yet the price holds.

Bitcoin worked its way back toward $79,000 as markets shook off the biggest hack in crypto history. A look back shows how hard October was. Bitcoin ended the month down almost eight percent; over the week, the price lost just under three percent to around $77,800 in the wake of the Binance hack.

Binance: withdrawals are running – and the money is flowing out#

The most important event of the weekend was the reopening of withdrawals at Binance. According to Binance, up to the time of the report $4.6 billion in withdrawals faced only $1 billion in deposits, a net outflow of $3.6 billion. The stablecoins USDT and USDC saw the heaviest withdrawals, followed by Bitcoin.

Still, this number needs context: Binance says it manages around $171 billion in customer funds. The outflows were initially strong but have since slowed and stabilized, the exchange says.

ETFs: biggest outflow in months#

Wall Street reacted far more nervously. On Friday, investors pulled $643.2 million out of US spot Bitcoin ETFs – the biggest daily outflow in October and the biggest in four months.

It was the first full trading day after the attack began. It completely wiped out a four-day inflow streak of $441 million. On a weekly basis the funds are down about $202 million, and about $516 million for October. Since their launch in January 2024, cumulative net inflows still add up to $57.4 billion, with assets under management at $103.2 billion.

What's coming up?#

• US election: On Tuesday, November 3, the US midterm elections take place. Who sits in Congress will help decide the regulation of exchanges and stablecoins.
• Macro: This week brings mainly new US jobs data and Apple's quarterly results. Additional headwind comes from the Fed: two members voted for a hike, and traders are pricing in a rate hike in December at over 70 percent.

Tech#

BTCPay Server: hot wallets drained – why updates are now mandatory#

In the night to Monday, the BTCPay Server team sounded the alarm: attackers emptied hot wallets on self-hosted payment servers. According to the current state of knowledge, only outdated versions are affected.

What happened at BTCPay#

On Sunday evening at around 11:25 PM (CET), the project published an urgent warning (BTCPay on X):

"We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers."

In other words, there are reports that hot wallets on BTCPay Servers are being emptied by unauthorized parties. Operators should immediately shut down their instances with the command ./btcpay-down.sh.

The investigation has identified an attack path affecting instances running version 2.4.1 (from July 23, 2026) or older. For users of the current version 2.4.7, there are no credible reports of drained hot wallets.

According to BTCPay, hosting providers such as LunaNode may have automatically shut down instances after the first warning to protect older versions. How much was stolen and how many merchants are affected has not yet been published; a detailed blog post has been announced.

Why old versions are dangerous#

There are signs that attackers gained administrator access through vulnerabilities in versions before 2.4.2. In August, a hole had already been closed through which unauthenticated attackers could obtain so-called LND macaroons – these are access keys for the Lightning node. Whether exactly this or another old vulnerability was exploited is still unclear.

Version 2.4.7 was only released on October 29. It fixes 85 findings from an AI-assisted security audit carried out as part of an open-source initiative by Anthropic, including one critical and 13 high-severity ones.

The practical advice for merchants: update BTCPay to 2.4.7 immediately, and regularly move revenue from the hot wallet to a cold wallet or a pure watch-only setup – BTCPay can also receive payments entirely without keys on the server, using only a public key (xpub). Then there is simply nothing on the server to steal.

Social media#

Sunday was comparatively quiet among the observed accounts on X and Nostr – until the BTCPay alarm reached the timelines in the night.

Sofia: the biggest Bitcoin conference in the Balkans#

Away from the hacks, there was also good news. @LightningNewsX reported from BTC Balkans in Sofia, in its own words the biggest Bitcoin conference in the Balkans: "Adoption never sleeps…". For two days the topics ranged from first wallets to hard questions about AI, deepfakes and power outages – plus intense networking in the hallways.

Conclusion#

After the Binance hack comes the next security incident with BTCPay – this time involving software that merchants run themselves. The lesson of the week is therefore not "Bitcoin is insecure", but: self-custody also means self-responsibility – install updates, keep hot wallets small.