Whale Profits, Crowded Shorts and Security Warnings: A Crypto Risk Snapshot

Historical roundup based on PANews reporting published November 8, 2026, at 17:20 (UTC+8). Prices, positions and incident updates below reflect that reporting, not current conditions.

CryptoQuant analysts described selling pressure in Bitcoin and a broad retreat in altcoins, while on-chain monitors reported large—and sharply contrasting—derivatives positions. The distinction matters: a profitable wallet is evidence of one account’s reported performance, not proof that its next trade will work.

A weaker market, not a confirmed turning point

CryptoQuant analyst Axel Adler Jr. said cumulative volume delta, a measure of aggressive buying versus selling, had turned negative since October 14. Over the same period, Bitcoin fell from $84,000 to $76,000. He interpreted the figures as evidence that sellers remained dominant.

Separately, CryptoQuant analyst Darkfost reported that altcoin market capitalization had contracted by roughly $200 billion, with about 70% of altcoins listed on Binance trading below their 200-day moving averages.

According to his analysis, altcoin capitalization excluding Bitcoin and stablecoins had gained $320 billion between mid-August and the end of September before surrendering nearly two-thirds of that increase. The share of Binance altcoins below their 200-day averages moved from 82% in mid-August to 10% in early October, then climbed back toward 80%.

Darkfost said such extremes had sometimes preceded trend changes historically. That was a qualified observation, not confirmation that a reversal was underway.

Large positions tell different stories

Onchain Lens reported that the whale known as Smartestmoney held a long position of 1.38 million HYPE, valued at approximately $106 million, with $52.76 million in unrealized profit. The position had been opened 11 months earlier and had a reported liquidation price of $71.08.

The same monitoring service reported a different positioning picture for Wintermute on Hyperliquid:

  • Historical profit: $222 million.
  • Open positions: $125.87 million, including $115.76 million in shorts.
  • Profit over 30 days: $18.83 million.
  • Unrealized profit: $3.46 million.

Its largest reported short positions were ETH at $26.16 million, BTC at $19.79 million, HYPE at $15.23 million and SOL at $12.72 million.

Glassnode separately reported that Hyperliquid whales had switched from net long to net short roughly two weeks earlier, after seven months of net-long positioning. Their BTC short exposure was the highest since October 2025. Glassnode noted that the previous comparable short buildup had accompanied a substantial price decline; that historical comparison did not establish what would happen next.

The “cracked trading tool” allegation remains an allegation

PANews reported that X account @cryptotrice had repeatedly promoted a purported reverse-engineered version of TradingView Premium since mid-October, with some posts receiving more than 300,000 views.

Installation reportedly required a password-protected archive and a KeyGen-generated license code. Although the account claimed the project was open source on GitHub, the download links did not point to GitHub. It also said the repository had become private and that links available inside the application expired after one use.

Multiple commenters alleged that the software could steal account information and crypto wallets. One user said antivirus software detected and deleted it upon extraction. These were reported user warnings, not a confirmed malware finding in the supplied article.

Wallet and API incidents: distinguish claims from completed recovery

Keplr said a Web3Auth infrastructure vulnerability had exposed private keys for some accounts created through Google or Apple login. It advised affected users to stop adding funds and move remaining transferable assets to accounts created with a seed phrase or hardware wallet. Recovery work was ongoing, with staked and locked assets potentially taking longer to handle.

Web3Auth said it was working with Keplr to move affected assets into secure recovery wallets. Both warned about impersonators and fraudulent recovery requests.

SignalPlus, meanwhile, said it had fully reimbursed all 23 affected users within 72 hours of detecting abnormal activity on November 4, paying a total of $81,897. It reported suspending affected services and tightening API, IP-whitelisting and internal-access controls. Earlier reporting attributed the attack to a compromised third-party Telegram account affecting some users without IP whitelists.

Solo-mining wins need their time window attached

Soloblocks.io data cited by PANews showed that solo Bitcoin miners found 36 blocks between February 11 and November 7, 2026, receiving approximately 113.149 BTC, including fees—about $8.5 million at the prices cited in the report. Some wins involved small home mining devices.

Those figures document successful blocks. They do not establish a typical miner’s odds, costs or profitability.

Original PANews article

Further reading