BTCPay Server is the free software a bitcoin merchant runs on their own machine to take payments without a middleman. On Sunday night its team said attackers are sweeping the hot wallets on those servers (the wallets that keep spending keys online) and told everyone running one to shut it down until the investigation is finished. The alert didn't say which versions are affected, and there's no patch yet.

On Saturday an attacker asked b14g, a bitcoin staking service on the Core network, to withdraw zero tokens from 91 positions that weren't theirs. Core's staking code reads zero as "withdraw everything," and b14g let the requests through, according to Bitquery. About 97 million CORE left, worth around $1.5 million.

The same day Talis Protocol, an NFT marketplace on Injective, said a contract bug let an attacker take about 5,700 NFTs held in escrow and sell them into open offers.

None of the three was an exchange. Thursday's Binance theft took $6.3 billion and was the only story in crypto for three days.

This weekend's were small by comparison, and each one was a tool people use instead of an exchange. One is the payment processor you host yourself, one is the staking contract you trust to count, and one holds your NFT while a sale goes through. Self-custody means you hold the keys, and the software around the keys can still be broken.

We don't know yet whether the BTCPay problem is a flaw in the code or a lot of badly set up servers. Either way, if you run an instance or pay a shop that does, that hot wallet is the target right now. Shut it down, move what's in it to a cold wallet (keys kept offline, and untouched in all three incidents), and wait for the team to say it's safe.

Binance switched withdrawals back on Sunday, bitcoin first, and in the first nine and a half hours customers took out a net $3.64 billion. Binance says that is 2.1% of the $171 billion it holds and that the rush slowed after the first spike. DefiLlama shows its wallets down about $6.2 billion between our Sunday and Monday snapshots, with bitcoin up about 1% in between, so Binance's figure is the smallest on offer.

The US Secret Service is investigating and says it froze a large part of the haul within minutes. The thieves moved about $242 million of the rest through Tron in two days, more than half of it onward through bridges.

The full proof of reserves is due tomorrow. If you left coins on Binance, the button worked and most people didn't press it. Tomorrow's report says whether the backing is whole.

Fifty companies have now told OKXICE, the tokenized-stock venue run by OKX and the New York Stock Exchange's owner ICE, that it may not trade tokens of their shares. Nvidia, Nike, Costco and Reddit were among twelve added in a notice dated October 30.

Microsoft, Alphabet, Goldman Sachs and JPMorgan were already there. When the list first surfaced on October 17 it had nine names.

The SEC's innovation exemption is the rule that lets a crypto venue tokenize listed stocks, and a company that objects inside the window takes its shares out of reach.

So the biggest names in the index are opting out, a week after the DTCC (the body that holds nearly all US securities) started minting tokens of its own. If you were hoping to buy tokenized Nvidia on a crypto venue, Nvidia has said no, and the SEC's rule is what let it say so.