Choose a section or paragraph
The October 29, 2026, cyberattack on Binance has exposed one of the most serious security failures in cryptocurrency exchange history. Approximately $6.3 billion in digital assets was stolen from exchange-controlled wallets, according to Binance, while blockchain intelligence firm TRM Labs calculated the theft at approximately $6.36 billion across ten blockchain networks.
The scale alone makes the incident extraordinary. Yet the most important questions extend beyond the headline figure.
How did attackers obtain authorization to move assets from wallets operating on different blockchain networks? Why were multiple withdrawals executed within minutes? How much cryptocurrency remains under attacker control? And what exactly happened to BNB, the native asset of the BNB Chain ecosystem?
The last question deserves particular attention.
In its October 30 security update, Binance explicitly included BNB among the token assets affected by the theft. However, the publicly available network-by-network breakdown published by TRM Labs identifies Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon, without separately identifying BNB Chain.
This does not establish that BNB was untouched. Nor does it demonstrate that BNB Chain itself suffered a protocol-level exploit.
Instead, it exposes an important gap in the publicly disclosed transaction evidence: the precise quantity of BNB stolen, the originating wallet, the receiving address and the relevant transaction hashes have not been independently established in the materials reviewed for this investigation.
Cryptopian News examines the disclosed evidence, reconstructs the reported sequence of events and identifies the information needed to resolve the remaining questions.
October 29: How the Binance Security Breach Unfolded
The first major unauthorized transfers were observed at approximately 20:05 UTC on October 29, 2026.
According to TRM Labs, attackers moved cryptocurrency from Binance-attributed wallets across ten blockchain networks, with most of the stolen value transferred during a roughly 20-minute period.
The attack was not confined to Ethereum or to a single compromised wallet.
It involved multiple networks with fundamentally different transaction authorization mechanisms, including Bitcoin, Ethereum, Tron, XRP Ledger and Solana.
That distinction matters because a malicious Ethereum smart contract cannot independently authorize a Bitcoin transaction. Each blockchain has its own transaction-signing requirements.
For unauthorized transfers to occur across so many networks in such a short period, the attacker needed access to a broader set of transaction authorization capabilities.
TRM Labs concluded that the available evidence pointed toward a compromise of Binance’s hot-wallet signing infrastructure.
Binance initially identified a potentially compromised DevOps engineer’s laptop as part of its preliminary explanation.
However, its October 30 update acknowledged that investigators had uncovered additional breach points.
The exchange also stated that it had found no evidence that wallet private keys had been leaked.
Those findings do not necessarily contradict one another.
A criminal may be able to exploit an authorized transaction-signing service without extracting the underlying private keys. In such a scenario, the signing infrastructure itself becomes the target.
The full technical root cause remains under investigation.
How Much Was Stolen? A Breakdown of the $6.36 Billion Theft
TRM Labs calculated approximately $6.36 billion in stolen assets, using cryptocurrency prices at the time of the unauthorized transfers.
The reported distribution shows that Ethereum represented the largest portion of the theft, followed by Bitcoin and Tron.
| Blockchain | Estimated stolen value |
|---|---|
| Ethereum | $3.79 billion |
| Bitcoin | $1.47 billion |
| Tron | $628 million |
| XRP Ledger | $296 million |
| Solana | $96 million |
| Arbitrum, Optimism and Base | $39 million combined |
| Avalanche | $28 million |
| Polygon | $10 million |
These figures are rounded estimates from TRM Labs’ initial investigation. They should not be interpreted as audited final losses.
Ethereum accounted for approximately 200,630 ETH and 185 additional tokens.
Among the affected Ethereum assets were approximately 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD.
Bitcoin withdrawals totaled approximately 18,270 BTC.
On Tron, the reported transfers included approximately 612.7 million USDT and 46.4 million TRX.
The XRP Ledger accounted for approximately 233.46 million XRP, while Solana withdrawals included approximately 970,500 SOL.
These assets have different transfer restrictions, freezing mechanisms and recovery possibilities.
Stablecoin issuers may be able to freeze tokens through their contracts. Native Bitcoin and Ethereum transfers generally cannot be reversed through a comparable issuer-controlled mechanism.
That difference became central to the recovery operation.
The BNB Mystery: Why Binance’s Own Token Disclosure Needs Further Explanation
The BNB question emerges from comparing two different kinds of disclosure.
Binance’s October 30 Security Incident Update #2 stated that the exchange had set aside more than $6.34 billion in company funds, including approximately $5 billion held in the affected token assets.
It specifically named USDC, USDT, BTC, ETH and BNB among those assets.
This is an important statement because it identifies BNB as part of the exchange’s affected-asset disclosure.
However, the statement did not provide an individual BNB loss figure.
It did not identify the blockchain network on which the BNB was held, disclose a BNB-specific attacker wallet or publish a transaction hash demonstrating the unauthorized transfer.
Meanwhile, TRM Labs’ network breakdown does not separately include BNB Chain.
The two statements therefore leave a question that cannot be answered from the published summaries alone.
Was native BNB stolen from a Binance-controlled address on BNB Chain? Was a tokenized representation of BNB affected on another network? Or does the difference arise from the scope of the respective reports?
Those possibilities should be tested rather than assumed.
The absence of a separate BNB Chain entry is not proof that no BNB was stolen. Equally, Binance’s reference to BNB does not establish the quantity or exact transaction route.
A conclusive answer requires blockchain-level records.
BNB Theft Versus a BNB Chain Exploit: Why the Difference Matters
BNB is a cryptocurrency asset, while BNB Chain is a blockchain ecosystem.
A security incident affecting BNB held by a centralized exchange does not automatically mean that the underlying blockchain was compromised.
Consider three scenarios.
In the first, an attacker gains unauthorized control of a Binance wallet holding native BNB and transfers those tokens to another address. The blockchain itself could continue operating exactly as designed.
In the second, an attacker steals a tokenized or bridged representation of BNB on another supported network. The relevant transaction may not appear as a native BNB transfer on BNB Chain.
In the third, an attacker exploits a vulnerability in the BNB Chain protocol or associated infrastructure, such as a bridge or smart contract.
These scenarios involve different vulnerabilities and different evidence.
The October 29 incident is currently documented primarily as a compromise of Binance-controlled wallet authorization infrastructure.
The published evidence reviewed for this report does not establish a BNB Chain consensus or protocol failure.
For this reason, describing the event simply as a BNB Chain hack would be misleading.
What a Real BNB Transaction Investigation Must Establish
Blockchain investigations depend on verifiable records, not merely wallet balances or market movements.
The first step would be identifying Binance-controlled BNB addresses with reliable ownership attribution.
The next step would be examining transfers occurring during the October 29 attack window and the hours immediately before and after it.
For each suspicious transaction, investigators would need to establish the sender, receiver, transferred quantity, block timestamp, transaction hash and execution status.
For tokenized BNB, the investigation would also need to identify the relevant token contract and examine its transfer events.
But those details alone would not prove that a transaction was malicious.
Centralized exchanges regularly move large amounts of cryptocurrency between operational wallets, cold storage, custody systems and liquidity accounts.
A transfer must be connected to the known attacker infrastructure or supported by additional evidence demonstrating that it was unauthorized.
Investigators should also check whether suspected receiving wallets subsequently interacted with bridges, decentralized exchanges, lending protocols or known laundering addresses.
Until these steps are completed, any specific claim about stolen BNB quantities or final destinations would be premature.
The Ethereum Attack: How EIP-7702 Was Used
The most detailed technical findings concern Ethereum.
TRM Labs reports that the attacker exploited an authorization mechanism associated with EIP-7702, an Ethereum improvement that allows externally owned accounts to delegate execution to smart-contract code.
The mechanism itself is a legitimate Ethereum feature.
The security failure occurs when an attacker obtains or abuses the authorization necessary to make a wallet execute malicious code.
In the Binance incident, the attacker reportedly prepared 50 pre-signed authorizations before the main theft.
According to TRM, the attacker prepared authorizations covering consecutive nonce values, increasing the likelihood that at least one would remain valid when the attack was executed.
Once the relevant authorization succeeded, the attacker delegated execution from a Binance hot wallet to malicious sweeping code.
Approximately three minutes and 24 seconds later, the attacker triggered a transfer that moved roughly 167,464 ETH and 63 additional tokens.
That transaction included approximately 1.615 billion USDT.
The malicious delegation remained active after the first withdrawal.
This meant that new assets entering the affected wallet could be transferred out through additional attacker-triggered executions.
TRM identified subsequent sweeping activity at approximately 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC.
This was not simply a single unauthorized payment.
The attacker had established a mechanism for repeatedly draining assets from the affected wallet.
Why the 50 Pre-Signed Authorizations Are Important
The presence of 50 pre-signed authorizations is among the most technically significant findings.
An ordinary wallet transaction requires valid authorization associated with the account’s current state.
By preparing authorizations covering consecutive nonce values, the attacker increased the likelihood of executing the malicious delegation despite changes in the account’s transaction state.
TRM interpreted the batch as evidence that the attacker may have had access to a signing system for a limited period or had to request signatures through an intermediary process.
That interpretation is consistent with a compromise of transaction-signing infrastructure.
However, the existence of those authorizations does not independently establish how the attacker obtained them.
Potential explanations include compromised credentials, abused internal services, malicious software, social engineering or other authorization failures.
Determining which explanation applies requires additional evidence from Binance’s internal logs and security investigation.
The Attack Began Before October 29
TRM Labs’ analysis indicates that preparation began at least 36 hours before the major withdrawals.
On October 28, an attacker-associated operator wallet reportedly received three small withdrawals from Tornado Cash.
Tornado Cash is a privacy-oriented cryptocurrency mixing service that can obscure the relationship between deposit and withdrawal addresses.
Its use is relevant to transaction tracing, but it does not independently establish the identity of the person controlling a wallet.
The attacker subsequently deployed an initial version of the malicious code and tested it against separate wallets.
Additional rehearsals took place before the final version was installed on the Binance hot wallet.
TRM reports that the attacker conducted a rehearsal approximately four hours before deploying the code against the targeted Binance infrastructure.
This preparation suggests a planned operation involving technical testing, transaction sequencing and advance access to authorization capabilities.
The evidence supports advance preparation.
It does not, by itself, establish participation by Binance executives or other insiders.
Minute-by-Minute Timeline of the Reported Exploit
The available TRM findings allow investigators to reconstruct several key stages.
| Time (UTC) | Reported activity |
|---|---|
| October 28 | Attacker-associated wallet receives Tornado Cash withdrawals |
| October 29, earlier | Malicious code is deployed and tested |
| 20:05–20:09 | Approximately 233.46 million XRP transferred from five Binance wallets |
| Shortly after 20:10 | Unauthorized activity reported on Solana and Optimism |
| Approximately 20:20 | 18,270 BTC transferred from a Binance hot wallet |
| Within two minutes | Large Tron withdrawals involving USDT and TRX |
| 20:41–23:56 | Additional Ethereum sweeps recorded |
| Approximately 23:05 | Further unauthorized activity reported on Avalanche and Polygon |
The timeline shows why the incident cannot be explained solely through the Ethereum delegation mechanism.
Several affected networks do not use Ethereum’s EIP-7702 authorization system.
TRM’s assessment therefore points toward a broader compromise of the infrastructure responsible for signing or approving transactions across multiple chains.
Bitcoin: The 18,270 BTC Transfer and Subsequent Splitting
At approximately 20:20 UTC, a Binance Bitcoin hot wallet reportedly transferred 18,270 BTC to an attacker-controlled address.
TRM observed the funds being divided into smaller transfers, including amounts of approximately 1,000 BTC and 100 BTC.
This pattern is commonly described as a peel chain.
A peel chain involves moving cryptocurrency through a sequence of transactions, repeatedly splitting off portions while forwarding the remaining balance.
The technique can complicate forensic tracing because the funds become distributed across multiple outputs and addresses.
However, Bitcoin transactions remain publicly recorded.
Investigators can follow transaction outputs, identify clusters and compare subsequent activity against known exchange deposits, mixing services or other destination addresses.
The presence of a peel chain does not mean the Bitcoin has disappeared.
It means that attribution and recovery become more complex.
XRP Ledger: The First Major Transfers
TRM identifies XRP Ledger activity as the opening stage of the theft.
Between approximately 20:05 and 20:09 UTC, five Binance-attributed XRP wallets reportedly transferred a combined 233.46 million XRP to one attacker-controlled address.
According to TRM, each source wallet was left with only its required minimum balance.
This pattern is notable because it suggests the transfers were designed to remove nearly all available assets from the affected wallets.
TRM reported that the stolen XRP remained in place at the time of its initial analysis.
That finding represents a historical snapshot rather than confirmation of the address’s present balance.
The XRP transactions provide another important reference point for reconstructing the attacker’s timing and coordination across networks.
Tron: Hundreds of Millions in Stablecoins Moved
The Tron network was another major target.
TRM reported unauthorized withdrawals involving approximately 612.7 million USDT and 46.4 million TRX, with a combined estimated value of approximately $628 million.
The distinction between USDT and TRX matters.
USDT is issued by Tether, which can freeze specific token balances under its contract controls.
TRX is the native asset of the Tron network and does not have the same centralized issuer-freezing mechanism.
This difference shaped the response.
Tether and other token issuers were able to restrict portions of the stolen stablecoin balances.
Native cryptocurrency assets remained more difficult to immobilize without control of the receiving wallet’s private keys or cooperation from services holding the assets.
The Stablecoin Freeze: How Billions Were Immobilized
One of the most important developments after the theft was the coordinated response by cryptocurrency issuers and blockchain security organizations.
TRM Labs reported approximately $2.7 billion in frozen or otherwise immobilized assets during the initial response.
Tether accounted for approximately $1.77 billion in frozen USDT across several networks.
Circle froze approximately $825 million in USDC.
Ripple froze approximately 40.5 million RLUSD.
World Liberty Financial froze approximately 27.8 million USD1.
Arbitrum’s Security Council intervened to move approximately 8,426 ETH and 74.6 million ARB beyond the attacker’s control.
The Arbitrum action was particularly significant because it involved emergency governance capabilities rather than a conventional stablecoin issuer freeze.
These interventions reduced the value immediately accessible to the attacker.
However, freezing cryptocurrency and recovering it for affected customers are separate processes.
A frozen balance may require additional legal, technical and operational steps before it can be returned.
How the Attacker Tried to Escape Stablecoin Freezes
The attacker reportedly moved quickly to convert assets that could be frozen by token issuers into cryptocurrencies without equivalent issuer-controlled restrictions.
TRM identified approximately 325 million USDT sold through professional liquidity providers and decentralized trading infrastructure in exchange for roughly 122,300 ETH.
The conversion involved substantial unfavorable pricing.
TRM estimated that the implied ETH purchase price was materially above prevailing market levels.
Such a premium suggests the attacker prioritized moving into less readily freezeable assets rather than obtaining the best possible exchange rate.
The investigation also identified approximately 60 million USDT supplied to Aave, followed by borrowing of roughly 19,760 ETH.
This structure allowed the attacker to obtain ETH liquidity against stablecoin collateral.
On Tron, approximately 300 million USDT reportedly moved toward activity involving the JustLend lending protocol.
These transactions illustrate how decentralized financial infrastructure can be used during post-theft asset conversion.
They also show why security incidents involving stablecoins can rapidly spread across exchanges, lending markets and decentralized trading systems.
How Much Cryptocurrency Remained Under Attacker Control?
At the time of TRM Labs’ initial analysis, the attacker reportedly controlled more than 420,000 ETH and approximately 18,270 BTC, along with smaller amounts on other networks.
TRM estimated that approximately $2.4 billion in assets remained beyond the immediate reach of token issuer freezes.
This figure should not be confused with the original theft total.
It reflects an early assessment of assets that the attacker could still potentially move without relying on a centrally controlled token issuer.
Nor does it establish that the funds were successfully converted into fiat currency.
A cryptocurrency address may hold stolen assets for extended periods without the controller successfully cashing them out.
The next stages of laundering could involve additional transfers, bridges, swaps, exchanges or intermediaries.
Those movements require continuing analysis.
North Korea Attribution: What Investigators Actually Found
TRM Labs attributed the Binance attack with high confidence to TraderTraitor, a North Korean state-linked hacking group.
The assessment drew on blockchain intelligence and additional investigative information.
TRM identified several operational similarities to previous North Korea-linked cryptocurrency thefts.
These included advance wallet preparation, Tornado Cash-funded operator addresses, prearranged transaction authorizations and coordinated asset movements.
The FBI previously attributed the February 2025 Bybit cryptocurrency theft to TraderTraitor.
The similarities provide relevant context for the attribution.
However, independent readers should distinguish between a security firm’s attribution assessment and evidence establishing the identity of every individual participant.
Attributing the attack to a North Korean-linked group also does not prove that all stolen cryptocurrency was transferred into North Korean government-controlled accounts.
Such a conclusion would require additional evidence concerning ownership, control, asset conversion and final beneficiaries.
Did Binance’s Security Architecture Fail?
The attack raises substantial questions about centralized exchange security.
Cryptocurrency exchanges often maintain hot wallets to support deposits, withdrawals and operational liquidity.
Unlike cold storage, hot wallets are connected to systems that must authorize transactions frequently.
That operational requirement creates a different security environment.
A properly designed exchange infrastructure should use layered controls, including transaction limits, privileged-access restrictions, independent authorization systems, monitoring and emergency shutdown procedures.
The October 29 incident raises questions about whether those protections were sufficient.
Why were unauthorized transactions approved across several blockchain networks?
Could one compromised workstation or service access multiple signing systems?
Were withdrawal limits or transaction-risk controls bypassed?
Why were suspicious transactions not stopped before billions of dollars had left the affected wallets?
The answers depend on technical evidence that Binance has not yet fully disclosed.
The reported failure should not automatically be interpreted as evidence of deliberate wrongdoing.
But the exchange’s responsibility to explain the security breakdown remains substantial.
What Binance’s October 30 Statement Revealed
Binance’s second security update acknowledged the seriousness of the incident and promised to absorb the financial impact rather than pass the losses to users.
The exchange stated that more than $6.34 billion in company funds had been allocated, including approximately $5 billion held in the affected token assets.
It said it was purchasing additional replacement assets through market and over-the-counter channels.
Binance also reported that approximately $3 billion had been frozen on-chain.
The exchange said it had contained compromised infrastructure, revoked affected authorizations and introduced additional security controls.
Withdrawals remained subject to security reviews and phased restoration.
Binance further committed to publishing an updated Proof of Reserves report, with results expected by November 2, and a detailed technical post-mortem.
The exchange acknowledged that the initial laptop-compromise explanation was incomplete, stating that additional breach points had been identified.
This makes the forthcoming technical findings particularly important.
The Difference Between Reimbursement and Recovery
Binance’s promise to reimburse affected users is significant, but it should not be confused with recovery of the stolen assets.
Reimbursement means the exchange uses its own resources or designated protection funds to replace customer balances.
Recovery means stolen cryptocurrency is actually retrieved, returned or otherwise restored from the attacker-controlled funds.
These are different financial processes.
An exchange may compensate users before law enforcement or blockchain investigators recover stolen assets.
Conversely, frozen assets may remain inaccessible for an extended period.
Independent verification of Binance’s replacement reserves will therefore be important.
The exchange’s Proof of Reserves disclosures should also be interpreted carefully because proof of asset holdings does not, by itself, provide a complete audit of every corporate liability or operational risk.
Why the Missing BNB Details Matter for Transparency
The BNB question is not important merely because BNB is associated with Binance.
It matters because transparent incident reporting should enable independent researchers to distinguish confirmed losses from assumptions.
If BNB was stolen, the amount and transaction route should be established through verifiable evidence.
If no native BNB transfers occurred on BNB Chain, that fact should also be clearly explained.
If BNB was affected through a representation on another network, the relevant token contract and transaction records would resolve the apparent reporting gap.
Without that information, readers may incorrectly conclude either that BNB Chain was hacked or that Binance’s statement was necessarily inconsistent with the blockchain intelligence findings.
Neither conclusion is justified by the available summaries alone.
Does the Evidence Support Claims of an Insider Conspiracy?
The technical findings raise questions about privileged access, transaction authorization and internal security controls.
They do not establish that Binance executives intentionally organized the theft.
There is currently no verified evidence in the sources reviewed for this report that Changpeng Zhao planned, authorized or facilitated the operation.
The fact that a sophisticated attacker obtained access to signing infrastructure does not identify the attacker as an authorized insider.
External attackers can compromise internal systems through stolen credentials, malicious software, social engineering or vulnerable services.
Determining whether any employee or executive knowingly participated would require direct evidence, including authenticated communications, access records, financial relationships or verified witness testimony.
The North Korean attribution does not change that evidentiary requirement.
Cryptopian News considers such distinctions essential to responsible investigative reporting.
Five Questions Binance Must Answer
1. What happened to BNB?
The exchange should identify whether native or tokenized BNB was stolen and disclose the precise amount, relevant blockchain networks and transaction hashes.
2. How was multi-chain signing authority compromised?
Investigators should explain how the attacker obtained the ability to authorize transactions involving wallets on several different blockchain networks.
3. What were the additional breach points?
Binance should clarify its October 30 acknowledgment that the incident involved more than the initially suspected compromised laptop.
4. Where are the remaining stolen assets?
Updated blockchain intelligence findings should distinguish frozen balances, attacker-controlled assets, recovered funds and assets whose final destinations remain unknown.
5. Can replacement reserves be independently verified?
Binance should provide meaningful evidence supporting its commitments to restore affected customer balances and strengthen its security infrastructure.
What This Hack Means for Centralized Cryptocurrency Exchanges
The incident illustrates a central challenge facing cryptocurrency exchanges.
Blockchain networks can operate correctly while custodial infrastructure fails.
The security of an exchange therefore depends not only on cryptography but also on operational controls, software integrity, privileged access management and incident response.
The attack also highlights the growing importance of coordinated responses involving stablecoin issuers, blockchain investigators, exchanges and law enforcement.
Billions of dollars in assets were reportedly frozen during the early response, but a substantial portion remained outside immediate issuer control.
For cryptocurrency users, the incident reinforces the distinction between holding assets through a centralized custodian and controlling assets directly through self-custody.
Neither approach eliminates every risk.
However, the party controlling transaction authorization ultimately determines how assets can move.
Cryptopian News Investigation: What We Know and What Remains Unanswered
The available evidence supports several findings.
Binance experienced a major security breach on October 29, 2026.
Approximately $6.3 billion in assets was stolen according to Binance, while TRM Labs calculated approximately $6.36 billion across ten blockchain networks.
The attacker used sophisticated transaction authorization techniques, including Ethereum EIP-7702 delegation and coordinated signed transfers across several other networks.
TRM Labs attributed the attack with high confidence to North Korea-linked TraderTraitor.
Stablecoin issuers and other organizations immobilized billions of dollars in affected assets.
Binance committed to absorbing the financial impact and restoring customer balances.
But the BNB-specific transaction trail remains unresolved in the public evidence reviewed for this investigation.
Binance named BNB among the affected assets. Independent blockchain researchers have not yet established a publicly verified BNB-specific theft amount, receiving wallet or transaction hash in the materials examined here.
That is a question of disclosure and evidence, not proof of concealment.
The next significant development should come from transaction-level records, independently verified wallet attribution and Binance’s full technical post-mortem.
Until those records are available, the responsible conclusion is straightforward: the Binance hack is confirmed, the scale is extraordinary, and the precise BNB transaction trail requires further verification.
Editorial disclosure: This article is an original Cryptopian News analysis of public disclosures and third-party blockchain intelligence. Cryptopian News has not independently reproduced every reported transaction or established a BNB-specific theft hash. Reported balances and attribution assessments reflect the publication dates of the cited sources and may change as the investigation develops.
Sources and References
Binance — Security Incident Update #2, October 30, 2026
https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751
TRM Labs — North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
CryptoTicker — Binance SAFU Fund and Reimbursement Analysis
https://cryptoticker.io/en/binance-safu-fund-full-reimbursement/
CryptoTicker — Binance Hack: Cause and $6.3 Billion Estimate
https://cryptoticker.io/en/binance-hack-cause-devops-laptop/
- Binance $6.3 Billion Hack: Where Is the BNB Transaction Trail? Inside the Wallet Exploit, North Korea Links and Missing Evidence - October 30, 2026
- Google Cloud’s Crypto Security Technology Could Change How Institutions Protect Digital Assets - October 29, 2026
- Crypto Industry Spends $176 Million on US Elections as Battle Over Future Rules Intensifies - October 27, 2026