The $6.3 billion Binance security breach remained at the center of crypto's security concerns this week, as US authorities obtained court approval to seize or restrain more than $1.2 billion in stolen assets. At the same time, a series of DeFi exploits exposed weaknesses in lending calculations, protocol accounting, cross-chain bridges and wallet infrastructure.
The incidents varied in scale, but they showed how attackers could target both centralized exchange systems and individual components of decentralized finance. Kava Lend, Arcus Perps, Initia, ACryptoS and Ankr's bridge were among the projects affected. Indian exchange Unocoin also disclosed an estimated $200,000 loss from compromised hot wallets.
The week’s developments came as the FBI attributed the Binance theft to North Korean-linked group TraderTraitor and the Justice Department disrupted infrastructure connected to a separate cryptocurrency theft campaign known as FaceStealer.
DOJ Moves Against $1.2 Billion From Binance Theft
The US Department of Justice announced on November 12 that a court had authorized the seizure or restraint of more than $1.2 billion in cryptocurrency stolen from Binance. The action relates to the October 29 breach, which affected approximately $6.34 billion in digital assets, according to Binance.
The FBI attributed the attack to TraderTraitor, a group linked to North Korea. Binance previously said attackers gained unauthorized access to an internal wallet-signing service and used it to initiate transactions outside the exchange's normal withdrawal process.
The DOJ's action is part of a wider effort to restrict the movement of stolen funds. Government agencies and private-sector partners have frozen more than $2.7 billion, according to the department. Binance's November 3 update put the amount frozen or intercepted at approximately $2.85 billion, subject to reconciliation and market-price changes.
The DOJ also announced the disruption of cloud infrastructure used in FaceStealer, a North Korean-linked social engineering campaign. The FBI said the operation stole more than $400 million in cryptocurrency over 18 months. Investigators seized more than 900 webcam videos of victims, which were allegedly used alongside impersonation and deepfake techniques to trick other targets.
Kava Lend and Arcus Perps Expose Accounting Flaws
Several DeFi incidents involved flaws in how protocols calculated balances, deposits or withdrawals.
Kava Lend suffered one of the week's largest DeFi losses on November 14. On-chain data reviewed by The Block showed that an attacker drained approximately 55.2 million KAVA, worth about $3.76 million before the incident. The attacker targeted a dormant BUSD market and exploited an arithmetic edge case that inflated the value of deposits by roughly 243,000 times.
That inflated collateral allowed the attacker to borrow KAVA repeatedly. Around 49.2 million KAVA was then bridged to BNB Chain and sold for approximately $2.1 million in BNB and USDT.
Kava said the incident was isolated to Kava Lend and was not an infinite mint. The team had not published a complete post-mortem or an official final loss figure at the time of reporting. The incident also triggered a sharp decline in KAVA's price and precautionary deposit and withdrawal suspensions at partner exchanges.
Another accounting flaw affected Arcus Perps on Robinhood Chain on November 10. The attacker exploited transfers between subaccounts to inflate a recorded balance, allowing the withdrawal of approximately $2.23 million in USDG. A further $3 million in withdrawal requests was blocked by the bridge's rate limit and later reversed.
Arcus patched the vulnerability, restricted the attacker's accounts and covered the full $2.23 million shortfall from its company treasury. The project said user balances were unaffected.
Initia, Ankr and ACryptoS Suffer Separate Exploits
Other incidents highlighted risks involving infrastructure keys, cross-chain verification and smart contract input checks.
Initia lost approximately $615,000 on November 10 after attackers used compromised rollup infrastructure keys to fabricate IBC transfers and withdraw assets from escrow accounts. Around 605,000 USDC was among the assets transferred out through Noble. Validators halted the network while the team investigated the breach.
Ankr's Ethereum bridge lost approximately $304,500 on November 9. The attacker submitted five forged withdrawal receipts that referred to an Optimism deposit that had already been redeemed. The bridge accepted the receipts and released assets, including ankrETH, ankrPOL and ANKR. The origin of the unauthorized signatures remained under investigation.
ACryptoS lost approximately $665,429 across Arbitrum, BNB Chain, Polygon, Base and Optimism on November 8. The exploit involved a missing input-validation check in its concentrated-liquidity vaults. An incomplete token-amount array caused the contracts to undervalue existing assets and issue too many shares in return for small deposits.
These incidents followed a broader pattern of vulnerabilities across DeFi applications. Altcoin Buzz previously examined how the Nostra oracle exploit allowed an attacker to borrow approximately $3.5 million against manipulated collateral on Starknet. While the technical cause was different, the incident also showed how a flaw in one component can put funds across a lending market at risk.
Rujira and Edel Report Further Losses
Rujira reported approximately $200,000 in losses after an attacker exploited a skew-calculation flaw in its Custom Concentrated Liquidity strategy on THORChain. The issue affected BTC/USDC order-book activity and disrupted liquidity positions.
Rujira halted its CosmWasm application layer and said it planned to remove the vulnerable skew parameter and reimburse affected users before resuming operations.
Edel Finance also reported that approximately $300,000 worth of EDEL tokens had been stolen and sold during November. The project began investigating the incident and coordinating with authorities and exchanges. The initial attack method, affected network and recovery status had not been disclosed.
Unocoin Confirms $200,000 Loss From Hot Wallet Breach
Indian cryptocurrency exchange Unocoin disclosed on November 14 that approximately $200,000 in cryptocurrency had been lost after three of its operational hot wallets were compromised.
The exchange said the transactions received the required second signature through a backup key held by Unocoin. The backup mechanism is designed to preserve access to funds if its custody provider becomes unavailable. Unocoin said it would cover the estimated loss from its own resources rather than deduct it from customer balances.
The company is also investigating potential exposure of customer information, including email addresses, residential addresses, encrypted passwords, KYC-related information and account balances. It said it had not found evidence that KYC documents were accessed, but the investigation remains ongoing.
The incident adds another operational-security concern to a week that included the Binance breach. It also shows why custody arrangements need to account for backup keys and signing procedures, not just the security of the primary wallet provider.
Across and LNbits Show Risks Beyond Smart Contracts
Not every incident involved a direct flaw in a protocol's smart contracts.
Across Protocol's domain was hijacked through a social engineering attack targeting its registrar, Namecheap. The attacker redirected visitors to a malicious website designed to collect wallet approvals. Across later restored its domain and said its systems were operational. Security firm GoPlus estimated losses at approximately $350,000, although Across had not confirmed a final figure.
The incident is covered in Altcoin Buzz's report on Across Protocol restoring its website after the phishing attack. The bridge's smart contracts were not the target; the attacker compromised the website users relied on to interact with the service.
The open-source Bitcoin Lightning wallet platform LNbits also reported an exploit affecting installations. One operator disclosed a loss of 2,285,545 satoshis, while the total impact across other installations remained unclear. LNbits released version 1.7.0 on November 10 to address the vulnerabilities and advised operators to rotate wallet keys and funding credentials.
Separately, HyprEarn disclosed unauthorized trading activity involving a small number of Hyperliquid accounts that had previously approved its trading-agent wallets. The team revoked its agents and asked affected users to remove the relevant approvals. The agents could execute trades but could not withdraw assets, and the financial impact had not been disclosed.
A Week of Different Security Failures
The incidents this week did not share one technical cause. Binance involved access to an internal signing service, Kava Lend and Arcus Perps suffered accounting or calculation flaws, Initia and Unocoin faced key-related compromises, and Ankr's bridge accepted forged withdrawal receipts. Across's domain takeover and the LNbits exploit added infrastructure and wallet-software risks to the list.
The scale also varied significantly. The Binance breach accounts for the largest share of the week's security concerns, while several DeFi incidents involved losses below $1 million. Some projects, including Arcus and Unocoin, said they would cover the reported losses from their own resources. Other investigations are still underway, and final recovery figures remain unavailable.
The broader picture is consistent with Altcoin Buzz's recent review, which found that crypto hacks and exploits had cost the industry $8.78 billion across 328 incidents in 2026. The Binance incident accounts for most of that total, but the smaller breaches show that security risks remain spread across protocols, bridges, wallets and operational infrastructure.
For users, the practical lesson is to check official incident updates before interacting with affected platforms, avoid signing unexpected wallet approvals and review existing permissions when a project reports a compromise. For protocols and exchanges, the incidents underline the need to test edge cases in financial calculations, secure signing and backup keys, and build safeguards around cross-chain messages and account permissions.
