Signing Risk & ETF Inflows

Buyers returned to Bitcoin as Binance’s post-mortem showed the weak point is people, not keys.

Bitcoin traded at $80,393 at about 06:03 UTC on November 5, 2026, 36% below its $126,156 all-time high, after a November 4 close of $80,416. Price has cleared the $77,000 level examined in the Coinjuice video on Bitcoin’s 77K resistance against Nvidia and gold, and briefly pushed above $81,000 before stalling under its 3-day average.

Meanwhile, spot ETF buyers returned for one day, and Binance’s own account of its breach placed the failure in the people and systems around its keys rather than in the keys themselves.

Binance Post-Mortem: Attackers Went Around the Keys

The November 4 Read traced how the attackers got in. Binance’s post-mortem, published November 3, adds what failed at the end of that chain and what has changed since:

• The path in one line: A tampered Homebrew download in June, a fake recruiter in September and an internal AI tool on October 20 gave the attackers control of wallet engineers’ devices, per Binance’s account reported by The Hacker News.

• The point of failure: On October 29 the attackers used Binance’s internal wallet signing service to start transactions from five hot wallets outside the exchange’s normal withdrawal process, per Cointelegraph’s report syndicated on Yahoo.

• The size of the loss: Reported figures range from $6.3 billion to $6.43 billion across outlets. None is confirmed as final.

• The fixes: Binance says it rebuilt the affected wallet system in a new environment, rebuilt the internal AI tool and its access controls, replaced devices and retired the affected engineers’ credentials and tokens. It also added tighter device controls, stronger wallet-service risk controls and wider AI-based anomaly detection.

• What remains undisclosed: Binance has not explained how the internal AI tool enabled access to the other engineers’ devices, per Hackread.

Two Immunefi leaders read the attack the same way in on-record comments provided to Coinjuice. Coinjuice’s interview with Immunefi covers how the firm approaches onchain security.

Gonçalo Magalhães, Head of Security at Immunefi:

“Crypto has made it very hard to steal the keys that move funds, so attackers now go after the people and the software around those keys that sign transactions. In this case, it seems the attacker compromised Binance’s signing system so that it would send malicious withdrawals. Bybit followed the same pattern last year, and Bitget did in September.”

Simone Imbrescia, VP of Engineering, Product and Design at Immunefi explained that:

“One of the striking things about this breach is how little code was actually needed on-chain. The sweeper contract was only around 130 lines. That is a useful reminder that the sophistication of an attack is not always in the smart contract itself. The hard part sometimes is getting access to a system powerful enough to make very simple code devastating.”

“In crypto, we naturally focus heavily on protecting private keys and auditing smart contracts. But the people, infrastructure and workflows capable of instructing those keys are part of the security perimeter too. If an attacker compromises that operational layer, they may not need to steal a key or discover an exotic smart-contract vulnerability at all.”

What the comments and the data add:

• The pattern in the data: Centralized exchanges were behind only 20 of the 191 hacks in Immunefi’s onchain hack cost research for 2024 and 2025, about one in ten. Those 20 accounted for 54.6% of all funds stolen.

• Where Binance’s fixes landed: The remediation list targets devices, tokens, internal tools and the signing service. That is the same operational layer Imbrescia describes, rather than the keys themselves.

• What it means for holders: The Bitcoin protocol did not fail, and neither did the cryptography protecting Binance’s keys. A company’s internal chain of approvals did, which is a risk carried by anyone who keeps coins with a custodian.

ETF Inflows: Spot Funds Snap a Three-Session Outflow Streak

The rebound came with buyers behind it, at least for one session:

• The turn: US spot Bitcoin ETFs took in a net $74.6 million on November 4 after three outflow sessions, per DefiLlama, matching the Farside figure reported by CoinNess.

• Who bought: FBTC led with $236.7 million and ARKB added $19.9 million. IBIT shows no reported flow for November 4 in the DefiLlama data, so the fund split may change once it updates.

• The rest of the field: The four funds below netted +$256.6 million against +$74.6 million for all funds, which leaves the remaining funds about $182.0 million net negative combined.

• The week is still red: Across five reported days from October 29 to November 4, all funds lost $1.066 billion. The four listed funds lost $824.4 million, about $164.9 million per session.

• The price move: Bitcoin rose as much as 4.2% to just over $81,000 on November 4 as stocks reversed their post-election losses, per Bloomberg.

• One day is not a trend: A single inflow session follows a week in which the October 30 exit alone reached about $643 million. Sustained demand would need repeated inflow days.

Source: DefiLlama ETF flow data, latest reported flow day November 4, 2026, as of 05:00 UTC November 5. The 7D window covers five reported flow dates; no rows were present for October 31 and November 1. IBIT shows no reported flow for November 4.

Technicals: BTC Reclaims Its 20-Day Average as Momentum Turns

Source: Indicators calculated on DefiLlama completed daily closes through November 4, 2026.

• The 40 line held: RSI closed November 3 at 38.5, just under 40. The November 4 close lifted momentum back above 50, the move the Coinjuice method watches for after a test of 40.

• Thin margin: Price sits about 0.2% above its 20-day average, so one weak daily close would put it back underneath.

Moving Averages Across Timeframes

Source: Simple averages calculated on CryptoQuant daily closes (all exchanges, BTC/USDspot), against the CryptoQuant November 4 close of $80,434. Thanks to CryptoQuant for the data. The DefiLlama close used elsewhere in this edition is $80,416. Percentages show price versus each average.

For technical analysis from a wide range of analysts, see the CryptoQuant QuickTake community.

Coinjuice Lens: Bitcoin Ownership

Binance’s remediation list reads like a map of where custodial trust sits: devices, deployment tokens, internal tools and the service that signs. None of it is visible to a depositor. Self-custody removes that layer, but it does not remove trust; it moves it to the holder’s own device and setup, as Coinjuice’s analysis of whether a hardware wallet can generate a weak Bitcoin seed traces. Buyers returned to Bitcoin as Binance’s post-mortem showed the weak point is people, not keys.

Readers looking to prepare for a test of the 50-day average can start with the Coinjuice ebook, Bitcoin Trading Without Leverage, now 15% off with the code TRADE15OFF, or go deeper with a Coinjuice subscription, currently 30% off the annual plan, where we start and complete trades and you will learn to snipe them independently.

Something new is about to land THIS WEEK: the Coinjuice merchandise store is kicking off and we are excited to share it with you. Make sure to sign up and we will send you an early bird discount that only our pre-members will gain for our merch!

Also please follow us on FB, YouTube, IG and X, it would mean a lot to us! Follow along on YouTube to catch the Coinjuice live sessions.

We’re looking for hungry talent: Coinjuice is looking for an Instagram creator to lead @coinjuicehq. No experience required, just a willingness to learn the Coinjuice trading framework. If you want to be a part of something special send email hello@coinjuice.com.

News Behind Today’s Read

• Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft (The Hacker News). Source for the internal wallet signing service, the remediation steps and the $6.43 billion figure.

• Binance traces $6.34B hack to fake interviews and AI tool breach (crypto.news). Source for the November 3 publication of the report and the $6.34 billion figure.

• Immunefi Study Finds Largest Hacks Increase in Value (Crowdfund Insider). Source for the 54.6% centralized exchange share of funds stolen across 2024 and 2025, alongside figures supplied by Immunefi.

• Bitcoin Rebounds With Stocks Despite Threat to Crypto Agenda (Bloomberg). Source for the intraday rise of as much as 4.2% to just over $81,000.

• Bitcoin rebounds after Democratic sweep despite three days of ETF outflows (CryptoSlate). Source for the rebound context against the three-session outflow streak that preceded the November 4 inflow.

Continue the read: Nov. 4 · Nov. 3 · Nov. 2

Market Snapshot

Data as of November 5, 2026, about 06:03 UTC. Source: DefiLlama.

This article was developed with the support of artificial intelligence tools as part of Coinjuice’s editorial process and reviewed by our editorial team before publication.