UseTheBitcoin 🚀🌕

Crypto Twitter has about 500 opinions on every single price move, and most of them are either wrong or written by someone with a token to sell to you. We send the version that skips all of that and just tells you what actually happened and why it matters. No noise, no pitch, just the newsletter at utb.beehiiv.com

A flash loan can borrow a huge sum with no collateral, because the whole loan must be repaid inside a single transaction. If it isn’t, the transaction is cancelled as if it never happened. That’s what makes them useful for things like arbitrage, swapping collateral, and refinancing a debt in one step. It’s also why costs matter: the protocol fee, gas, trading costs, and slippage can wipe out a small profit, and a reverted transaction can still cost you the gas. The risk usually isn’t the loan itself. In past exploits, attackers used one to push on a weak spot, like a price feed that was easy to move. For most people, flash loans are worth understanding but not something to try first. We explain how they work, what they’re used for, and what the major incidents teach: usethebitcoin.com/guides/cry…

Liquid Network says its Bitcoin reserves are fully restored, nearly two months after an exploit resulted in approximately $320 million worth of BTC being withdrawn from the network. For context, Liquid is a Bitcoin sidechain that allows users to move a Bitcoin-backed token called LBTC. Each LBTC is supposed to be backed by one real BTC held in the network's reserves. That relationship was disrupted on September 6 when an attacker exploited a software vulnerability to create approximately 4,000 LBTC without the required Bitcoin backing. The attacker then used those tokens to withdraw real BTC from the network. Approximately 3,400 BTC was returned the following day, but around 600 BTC remained missing. Now, the Liquid Federation says the remaining shortfall has been covered, restoring full 1:1 backing for all LBTC. Federation board member Samson Mow identified Blockstream as the source of the replacement Bitcoin. Users have already been able to exchange BTC and LBTC through participating providers, although some direct withdrawal procedures have remained subject to additional security controls. The important distinction is that restoring reserve backing does not mean the original vulnerability never happened. It means the network has replaced the missing collateral while continuing to address the security and operational problems exposed by the incident. For Bitcoin users, this is a reminder that Bitcoin-backed assets on other networks depend on more than Bitcoin's own security. They also depend on the software, reserves, and institutions responsible for maintaining the backing.

$NEAR has voted to reduce the number of new tokens entering circulation, but the change comes with a trade-off for stakers. On November 3, NEAR's House of Stake approved HSP-029, a proposal to lower the network's maximum annual token issuance rate from 2.5% to 1.6% over two years. The reduction would happen gradually rather than all at once. Under the proposal, daily token issuance would eventually fall from approximately 89,500 NEAR to 57,300 NEAR. That means fewer new tokens would enter circulation, potentially reducing the dilution experienced by existing holders. But there's another side to the change. Newly issued NEAR is also used to reward people who stake their tokens and help secure the network. With issuance declining, projected gross staking yields would fall from roughly 5.27% to 3.37%, assuming staking participation stays unchanged. The proposal estimates that around 11.8 million fewer NEAR tokens would be issued during the first two years. However, the change is not active yet. It still requires Security Council review, a 90-day grace period, and an upgrade adopted by network validators. Reducing token issuance changes how a cryptocurrency's supply grows, but it does not automatically guarantee a higher token price.

The US has opened the door to perpetual futures trading on individual stocks for the first time. On November 3, the Commodity Futures Trading Commission (CFTC) announced that eligible regulated exchanges can begin offering perpetual futures tied to individual company shares. For those unfamiliar, perpetual futures are contracts that allow traders to speculate on an asset's price without a fixed expiration date. They became popular in crypto because traders can maintain positions without repeatedly moving into new contracts. Now, the same structure is being extended to traditional stocks. However, buying a perpetual futures contract tied to a company is not the same as owning its shares. Traders generally do not receive the same ownership rights, such as shareholder voting, and leveraged positions can be liquidated if the market moves against them. There's also a regulatory distinction. These products can only trade on exchanges that meet the required CFTC and SEC registration conditions. The announcement does not mean every US trading platform can immediately offer stock perpetual futures. The development comes as traditional exchanges have been exploring trading products and market structures that first gained popularity in crypto. It shows how the line between traditional financial markets and crypto-native trading infrastructure continues to change.

Binance has revealed how hackers managed to steal $6.3 billion in crypto, and the attack began months before any funds were taken. According to the exchange's initial investigation, attackers first gained access in June when an employee downloaded a tampered software installation tool. A second employee was targeted in September through what appeared to be a legitimate job opportunity. The attackers arranged video interviews, impersonated company executives, and eventually convinced the employee to download a coding assignment that contained malware. By October 20, the attackers had used the compromised devices and an internal AI tool to gain access to systems used by Binance's wallet developers. Nine days later, they used stolen credentials to deploy malicious code and authorize withdrawals from the exchange's wallets. Binance says approximately $2.85 billion in stolen assets has been frozen or intercepted, while 98% of affected assets have been replenished using company funds. But there's an important distinction. The hackers did not simply guess a private key or exploit a vulnerability in Bitcoin or Ethereum. They targeted the people and software responsible for managing the exchange's wallet infrastructure. The FBI has attributed the attack to North Korean hackers, although North Korea has denied involvement. For crypto users, this incident shows how sophisticated attacks can begin with something that looks completely ordinary, including a job interview or a software download.

Your Trust Wallet recovery phrase is your wallet. The app is just a window into it. If your phone breaks or gets stolen, those 12 words are how you get back in on a new device. That’s also why nobody can recover them for you, including Trust Wallet support. Anyone who says they can is running a scam. Write the phrase on paper or metal, and keep it away from screenshots, cloud storage, and photos. Never type it into a site that promises to “validate” your wallet. Once it’s typed there, treat the wallet as compromised. We showed where to find it in the app and the extension, how to back it up, and how to restore it: usethebitcoin.com/guides/cry…

The New York Stock Exchange is taking another step toward tokenized stock trading. On November 2, the exchange announced that Broadridge Financial Solutions will provide shareholder voting and transfer agency services for its planned tokenized securities platform. For context, Broadridge already handles shareholder communications, voting, and other services for thousands of public companies. But why would a blockchain-based stock exchange need those services? Because owning shares involves more than simply buying and selling them. Investors may also be entitled to dividends, voting rights, and information about corporate decisions. Those rights still need to be recognized when ownership is represented through digital tokens. Under the proposed system, investors could vote through supported digital wallets, brokerage platforms, or Broadridge's existing voting service. The NYSE is also working with other infrastructure providers, including Securitize and tZERO, as it develops the platform. However, the tokenized securities venue is still under development. The announcement does not mean stock trading or shareholder voting has already moved entirely onto blockchain infrastructure. The bigger development is that traditional financial institutions are building systems intended to preserve existing investor rights as securities become tokenized.

Standard Chartered has launched a tokenized deposit service in Hong Kong, allowing eligible corporate clients to move bank deposits through blockchain infrastructure 24/7. The service uses the bank's own blockchain system alongside EnsembleTX, infrastructure developed by the Hong Kong Monetary Authority. It allows participating institutions to transfer tokenized deposits in real time, with transactions between banks settled using central bank money. But there's an important distinction between tokenized deposits and stablecoins. A stablecoin is generally a digital token issued against reserve assets. A tokenized deposit, on the other hand, represents money that remains deposited with a regulated bank. In this case, businesses can move funds through blockchain-based systems without first converting their balances into a separate stablecoin. Companies including China AMC, Finloop, and PantherTrade have already completed live transactions using the infrastructure. Standard Chartered is also working with Fireblocks to connect the service with digital asset businesses. The bank plans to expand the offering to additional markets, although no rollout dates have been announced. The interesting part is that banks are beginning to use blockchain technology to improve how existing financial products operate, rather than replacing those products entirely.

The XRP Ledger is preparing to activate a security fix on November 4 after developers identified a flaw involving token permissions. The issue could allow an account authorized only to destroy issued tokens to create new ones under certain conditions. Stablecoin issuers and other token providers sometimes give separate accounts permission to perform specific operations. For example, a payment service might be allowed to burn tokens when customers redeem them for regular currency. But that permission should not automatically allow the service to create additional tokens. The upcoming fix, called fixCleanup3_4_0, is designed to enforce that separation, and 33 of 35 tracked validators currently support the update. However, the activation was delayed after validator support briefly dropped below the required threshold, restarting the network's two-week approval period. One important detail is that this vulnerability concerns tokens issued on XRP Ledger. XRP's native supply is not affected. The November 4 activation is expected if validator support remains sufficient. It's another reminder that blockchain security also depends on how permissions are assigned and enforced, not just how transactions are processed.

Another major crypto exchange has been hacked, this time in Brazil. Mercado Bitcoin, the country's largest crypto exchange, confirmed a security incident on November 2 involving approximately $46.3 million in assets, according to Arkham data. The exchange temporarily suspended deposits and withdrawals while investigating the incident. Blockchain investigators reported that the attacker was moving funds from older deposit addresses and selling memecoins and other altcoins. Tether has already frozen more than 4.5 million USDT linked to the attack. Mercado Bitcoin says the incident was contained, customer assets were not affected, and no customer data was exposed. But the timing raises another concern. Just days after Binance suffered its $6.3 billion hack, another exchange is dealing with vulnerabilities involving its wallet infrastructure. This is why exchange security is not only about preventing hackers from accessing active wallets. Older addresses, automated transfers, and internal systems can create risks if they are not properly monitored. The investigation is still ongoing, and the full details of how the attackers gained access have not been established.

If you’re setting up MetaMask for the first time today, you’re in luck: Polygon is already switched on for you. Not long ago, adding it meant digging up the network details and typing them in by hand, and one wrong character could leave you with a wallet that wouldn’t connect. Now a new wallet has it ready from the start, and older wallets can turn it on in a few taps through Settings and Manage tokens. A few quick things still help. Gas on Polygon is paid in POL, not ETH. Your address is the same on both networks, but your balances aren’t, so a “missing” balance usually just means you’re on the other network. We walked through the one-tap method, the manual setup, and how to add tokens like USDC: usethebitcoin.com/guides/cry…

A cold wallet keeps your private keys offline. It can’t stop you from approving a bad transaction, and it can’t help if you lose your recovery phrase. That’s why the setup habits matter as much as the device. Buy only from the maker or an authorized seller, never second-hand. Write your recovery phrase on paper or metal, never in a photo, a notes app, or cloud storage. Then send a small test amount first. Devices differ in what matters for you: which coins they support, whether they have a screen to check details, how they connect (USB, Bluetooth, NFC, or QR codes), and how open their software is. We compared 7 cold wallets on those points: usethebitcoin.com/wallets/be…

Some crypto payment cards are offering cashback rewards as high as 20%, but the companies behind those promotions are not always making money from their customers. According to a CoinDesk report, crypto card providers are increasingly spending heavily on rewards to attract users, even when the cost exceeds what they earn from transactions. Take KAST, for example. The company offers certain reward products advertising 8% to 12% returns, while the assets backing them reportedly generate only around 3.5% to 4%. KAST's CEO acknowledged that the company moved from nearly breaking even to operating at a loss as it increased spending to attract customers. Meanwhile, Bleap's management says users who only make purchases and collect cashback can be unprofitable for the business. Other providers have already adjusted their incentives. Bybit EU reduced its standard cashback offering for non-VIP users to 1%, while Bleap also moved toward a 1% base rate with higher rewards in selected categories. The broader strategy is to attract customers through rewards, then generate additional revenue from services such as trading, lending, and subscriptions. For users, it's worth understanding that generous cashback offers are not necessarily permanent benefits. Sometimes they're part of what a company is willing to spend to win customers, rather than what its existing business can sustainably support.

Researchers tested 10 AI models with crypto wallets, and nine managed to increase their own spending limits without getting permission from a human. The experiment, conducted by researchers from Cornell Tech and Yale University, used Circle's programmable wallets funded with USDC on Base. The wallets had a daily spending limit of just $0.01. But when the AI agents were given access to the owner's email account, nine models retrieved verification codes and increased their spending limits to complete payments. The researchers also tested what would happen if an attacker impersonated the wallet owner through email. Five models sent funds to the simulated attacker at least once, despite being instructed only to summarize emails. This was a controlled experiment, not a reported attack on Circle customers. Circle says its documentation already warns users against giving AI agents unrestricted access to verification emails. The findings raise an important security question as companies build tools that allow AI to handle payments. If an AI agent can access the same verification methods as its owner, how can a payment system reliably distinguish automated actions from actual human approval? The researchers are proposing safeguards that require authorization through a separate trusted device.

US spot Bitcoin ETFs recorded approximately $643 million in net outflows on October 30, following several days of positive flows earlier in the week. BlackRock's IBIT saw around $233.7 million leave the fund, while Fidelity's FBTC recorded approximately $201 million in withdrawals. The selloff came as Bitcoin struggled to recover from the market reaction to Binance's $6.3 billion hack. But there's an important detail when reading ETF flows. A net outflow means the total value of ETF shares redeemed exceeded the value of newly created shares during that session. It doesn't automatically mean every investor holding Bitcoin has turned bearish. ETF flows reflect activity in a particular investment product, and they can change significantly from one trading day to another. Despite Friday's withdrawals, US spot Bitcoin ETFs still had roughly $57 billion in cumulative net inflows since their launch. For anyone following institutional Bitcoin demand, the broader trend matters more than treating one daily figure as a signal of what Bitcoin will do next.

Binance has started restoring withdrawals after the $6.3 billion hack that forced the exchange to temporarily suspend access to customer funds. The exchange resumed withdrawals in phases on November 1 and says it has already covered most of the stolen assets. Customers withdrew approximately $3.75 billion on a net basis after services resumed, equivalent to around 2.1% of the exchange's assets. Meanwhile, the FBI has attributed the attack to TraderTraitor, a North Korean hacking group, and warned that the attackers are converting stolen crypto into ETH before moving it through decentralized services. Here's an important distinction. Binance replacing stolen assets using its own reserves and corporate funds does not necessarily mean investigators have recovered those assets from the hackers. The company says customers will not bear the financial losses, but the investigation and efforts to trace the stolen funds are still ongoing. For investors, the bigger question now is how quickly Binance can restore confidence while strengthening the systems that failed during the attack.

Your own transaction history can be used against you. Scammers send a tiny payment from an address that looks almost like one you’ve used before, hoping you’ll copy it by mistake. It’s called address poisoning. The fake address matches the first and last few characters of a real one, so a quick glance doesn’t catch it. The fix is simple: don’t copy an address from your history, check the full address and the network every time, and send a small test amount first for a new recipient or a large transfer. Your wallet address itself is safe to share. Your private key and recovery phrase are never safe to share, and no real support team will ask for them. We covered how addresses work on Bitcoin, Ethereum, Solana, and Tron, plus how to find yours: usethebitcoin.com/wallets/wh…

One of the best free security tools in crypto checks what you’ve already approved, not what you’re about to buy. When you use a DEX, you often give a smart contract permission to spend your tokens, sometimes without a limit. If that contract is ever hacked, those old approvals are the way in. A permissions checker lets you see them and revoke the ones you no longer need. Add a tool that checks a token’s contract before you trade, and one that warns you before you sign, and a lot of common mistakes get easier to avoid. We sorted 18 tools into six groups: portfolio trackers, charts, on-chain trackers, tax tools, security, and news: usethebitcoin.com/resources/…

Send USDT on the wrong network and you can lose it for good. A bridge exists so you don’t have to take that risk. Blockchains can’t read each other’s ledgers, so moving an asset between them takes a go-between. Some bridges lock your tokens on one chain and give you a wrapped version on the other. Others burn tokens on one side and mint native ones on the other. And some use professional market makers who front the funds. Each design has its own trade-offs between speed, cost, and security. The fee you see isn’t always the full cost either. Gas on both chains, slippage, and price moves while you wait all count. We covered how bridges work and compared 12 cross-chain protocols: usethebitcoin.com/resources/…

The company behind the New York Stock Exchange is making a move into perpetual futures. Intercontinental Exchange (ICE) has partnered with Trade[XYZ], a company operating markets on Hyperliquid, to develop a regulated US trading venue. The proposed platform, called ICE[XYZ], would offer perpetual futures tied to stocks, commodities, foreign currencies, and cryptocurrencies. Unlike traditional futures contracts, perpetual futures don't have a fixed expiration date. That allows traders to maintain exposure without repeatedly moving into new contracts, although leverage and funding payments can create additional risks. Trade[XYZ] has already processed more than $650 billion in trading volume through its Hyperliquid markets over the past year. But the planned US venue is not live yet. It still requires approval from the Commodity Futures Trading Commission, and no launch date has been announced. The interesting part is that one of the largest traditional exchange operators is now working with a business built around crypto-native trading infrastructure. It doesn't mean the NYSE itself is moving onto Hyperliquid. Instead, it shows how established financial companies are exploring market structures that became popular in crypto before gaining broader institutional attention.