On 7 November, Web3Auth (part of Consensys since June 2025) paused its “embedded wallets” service after an incident affecting third-party integrators, and said that an initial investigation had found no sign of impact on MetaMask users. A few hours earlier, Keplr had reported unauthorized transactions on accounts created through Google or Apple login, and suspended both methods. Web3Auth then confirmed that the flaw affected Keplr's embedded wallets and started moving funds to safety.
Bitquery puts the outflows at about $6.01 million to two collection addresses, from 44,041 wallets on seven Cosmos networks and 7,603 addresses on Injective, or about 44,700 wallets once duplicates are removed. The Cosmos Hub accounts for about $3.5 million, followed by Osmosis, Celestia, Akash, Noble, Babylon and dYdX. Bitquery also notes 1.96 million staked ATOM taken out through tokenization of staking shares, which avoids the 21-day unbonding period. Josh Lee suggests that about 20% of Keplr accounts using social login could be exposed, with only a fraction actually exploited.
Two caveats before drawing conclusions. First, the “white hat” operations use the same path as the attack: part of the outflows counted by Bitquery may be funds moved to safety, and it's not yet possible to tell losses from recoveries. Second, the “50 million users” quoted here and there is the user base Web3Auth claimed when it was acquired, not a measure of exposure. Accounts with a recovery phrase or a hardware wallet aren't affected, according to Keplr, and no compensation has been announced.
The 6 November email concerns the accounts of Binance France SAS, removed from the AMF's register of digital asset service providers (PSAN) on 2 July 2026, for lack of a MiCA license. The closure takes effect “as of 31 December 2026”. Deposits are closed, and withdrawals remain open.
The fee is 0.025% of the balance per month, with a minimum of 10 USDC that applies up to $40,000. The balance is set on 29 November, with a first charge within three days and a second one after 24 December, taken in USDC first, then from the other assets. After 31 December, unwithdrawn assets fall under the dormancy clause in the terms of use: conversion, transfer or other handling, with no further detail.
For your records and your taxes in France, a withdrawal to a wallet whose keys you hold or to a licensed platform is a transfer between your own accounts, outside the scope of Article 150 VH bis of the French tax code (CGI). A sale for euros is a taxable disposal, subject to the 30% flat tax (PFU) once your disposals for the year exceed €305. A swap for USDC stays tax-deferred. Fees taken in tokens are recorded as fees.
The intrusion took place on 3 November, on the legacy system behind the Gnosis Pay-branded cards, issued by Monavate under a Visa license. Gnosis Pay says it shut it down in less than two hours and changed the credentials, but it only published its statement and wrote to customers on 6 November.
The customer notifications list identity data (name, nationality, postal address, email, phone number), the full PAN with expiry date and CVV, the addresses of linked wallets, and IBAN and BIC for Monerium accounts. The contracts (Safe, Delay and Roles modules) and the funds are intact, unlike in the June exploit ($1.5 million).
We still don't know how many accounts are affected, how the intruder got in, or who it is. GDPR notification and card replacement are still pending. With no funds moved, there are no disposals to account for. The card spends EURe (a euro stablecoin) from the Safe: under French tax rules, each purchase is a disposal of a digital asset (Article 150 VH bis of the French tax code) included in your overall capital gain, unless your disposals for the year total less than €305. Transaction history can only be exported until 20 December. Finally, the leak links identities to on-chain addresses, public history included.
Binance under ESMA scrutiny, MEXC blacklisted: where the non-MiCA exchanges stand
France's transitional regime expired on 30 June 2026. Binance, left without a CASP license after withdrawing its application to Greece's HCMC on 24 June, switched its French accounts to exit-only mode on 1 July: spot orders and bots canceled, fiat and crypto deposits cut off, Earn moved back to the Spot wallet, RWUSD converted into USDC. Remaining margin positions and loans were liquidated automatically on 1 October, and API keys were revoked. No end date has been given for withdrawals.
According to the FT on 1 October, ESMA, along with the AMF, BaFin and the HCMC, is taking a close look at how Binance uses reverse solicitation (Article 61 of MiCA). ESMA points out that any website, app or influencer campaign aimed at EU residents counts as solicitation and voids the exception. There has been no decision or penalty so far, and Reuters couldn't confirm the FT's report.
MEXC has no MiCA license. It has been on the AMF's crypto blacklist since 4 June 2024, and on ESMA's interim register of non-compliant entities since a decision by the Dutch regulator AFM on 16 September 2025. Its exit from the Netherlands happened in four waves between 23 August and 24 October, with a process that closes on 16 November and unwithdrawn balances handed over to a custodian. France isn't on its list of prohibited jurisdictions, but its terms of use provide for arbitration in Hong Kong, and the AMF can get access to the site blocked through emergency court proceedings.
On the AMF's register of CASPs (PSCA in French), Kraken (Payward Europe Solutions, Central Bank of Ireland), OKX (OKCoin Europe, MFSA) and Coinbase (Coinbase Luxembourg, CSSF) serve France through passporting, for custody, exchange against funds or other crypto, and transfers. For an active customer, the choice between them comes down to fees and the withdrawal networks on offer.
Bitcoin: the Nasdaq correction triggers $1.08 billion in liquidations
On Thursday, 5 November, BTC lost 6% to around $75,500 (a low of $75,463 on Bitstamp, $75,568 according to The Block), falling below its 50-week moving average ($75,733), a level not seen since 16 September. ETH gave up 7.5 to 8% ($2,230 to $2,250), SOL 6 to 8% ($89), and Wednesday's bounce above $80,400, after the Democratic win in both the House and the Senate, has been wiped out.
CoinGlass reports $1.08 to $1.1 billion liquidated in 24 hours across about 210,000 accounts, including $954 million in longs (88%) and $127 million in shorts, most of it ($880 to $896 million, including $818 million in longs) in the four hours after the US open. The Nasdaq, down 5.5%, is now in correction territory, more than 14% below its October record. The S&P 500 gave up 4.4%, the Dow 3.4%, chip stocks 12%, and the VIX jumped 60 to 70%. Coinbase and Strategy lost 10%, and listed miners 13 to 20%.
Thursday's ETF flows still need to be confirmed, after three sessions of outflows totaling more than $1.1 billion and then $74 million of inflows on Wednesday. The Coinbase Premium is still negative, Wintermute is watching $73,000 and then $68,000, and the chain itself had no incident. Under French tax rules, the drop doesn't trigger anything. A liquidation on a lending protocol sells the collateral for stablecoins, a crypto-to-crypto swap that isn't taxed at the time in France, but it does show up in your history. Losses on futures fall under a different regime, which is still being debated.
Binance: the 31 October proof of reserves covers 692,187 BTC at 100.04%
Since 2 November, the ZK proof and the Merkle tree for the 31 October snapshot, limited to 10 assets instead of 55, cover 692,187 customer BTC at 100.04%, 29.48 billion USDT at 100% (103.88% on 1 October) and 42.6 million BNB at 101.3%. The 4 November snapshot will be proven 40 to 50 hours later.
On 31 October, the SAFU transferred out 7,499 BTC (about $580 million) of its 15,000. On Arbitrum, on 30 October, the Security Council (9 of 12) replaced the Inbox contract, for one Ethereum transaction, with a version that issues messages in the hacker's name. Two unsigned 0x65 transactions sent 8,425.998 ETH and 74,559,805 ARB to a 0DA0 address, then the old code was put back, as happened in April at KelpDAO (30,766 ETH).
The Arbitrum DAO will vote on these funds, and there is no timeline for refilling the SAFU. On an L2, holding the private key does not protect you from the upgrade path. For French tax purposes, a verified balance is still a deposit, not a disposal.
Binance: $3.64 billion in net outflows in nine and a half hours, or 2.1% of holdings
Withdrawals reopened on 1 November at 07:00 Paris time, and their first phase (15 networks and assets) was completed at 13:36. From 07:00 to 16:30, Binance counts $4.649 billion withdrawn and $1.01 billion deposited, or $3.64 billion in net outflows, 2.1% of the $171 billion in customer assets as of 28 October. DefiLlama sees $5.8 billion over a rolling 24 hours.
Elliptic counts $2.85 billion stolen and frozen, 94% of it in stablecoins, and $3.25 billion that cannot be frozen, including 18,270 BTC sitting still on the 19 addresses listed by the FBI. On Tron, $242 million left in two days through Relay, THORChain, Chainflip and Symbiosis, after a detour through JustLend to get around Tether's freezes. On Solana, 970,522 SOL are being swapped into bitcoin via Relay, and nearly half of that has already gone through.
The ZK proof of reserves as of 31 October is expected on 2 November or 3. The 5% not replaced are thinly traded tokens. For tax purposes in France, a withdrawal to your own wallet is neither a disposal nor a taxable event. Your report reads the Binance balance as it is.
Aave reopens after the Binance hack but keeps LTV at zero on 9 assets
On 29 October, between 20:57 and 21:01 UTC, the hacker deposited $60 million in USDT on Aave V3 Ethereum Core, in two goes ($10 million, then $50 million), and borrowed 19,762 WETH. The position was overcollateralized ($59.9 million against $43.8 million of debt), so it posed no risk to lenders according to LlamaRisk. The hacker also built up about 253,000 ETH through UniswapX and successive swaps, and turned 36 million RLUSD into 15,439 ETH before Ripple's freeze (about $200 million).
Aave Labs, Tokenlogic and Certora set up an emergency cell, then the Guardian multisigs froze 175 V3 reserves on 16 networks and 117 V4 reserves on 4 networks, without waiting for a five-day governance vote. At the reopening on 30 October, LTV was left at zero (a zero collateral factor on V4) for USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG and OP, and V3 borrowing capacity was cut to $3.7 billion. Stablecoin pools hit 100% utilization, LlamaRisk lowered Slope2, and GHO slipped to $0.997 after 4.6 million were bought back against USDT through the stability module.
Chainalysis describes how the freezes are being bypassed on Tron, with stablecoins deposited on lending protocols and then the receipt tokens transferred, which the issuer cannot block (about $500,000 traced so far). On 31 October, the FBI attributed the attack to TraderTraitor, published hundreds of addresses and named THORChain specifically, which had refused in September to filter funds from the Bitget hack. On 30 October, DeFi TVL fell to $83.95 billion (-5.3%), with AAVE and LINK down 9%, UNI down 8% and ARB down 6%.
Binance robbed of $6.3 billion by North Korea's TraderTraitor group, says the FBI
The attack drained Binance's hot wallets on the evening of Thursday, 29 October. The platform speaks of $6.3 billion, and TRM Labs breaks it down as 18,270 BTC ($1.47 billion), 200,630 ETH, 1.875 billion USDT and 823 million USDC on Ethereum, 233.46 million XRP and 970,500 SOL, plus USDT on other networks. On 31 October, the FBI attributed it to TraderTraitor (Lazarus), which had left the same signature at Bybit in February 2025, with a massive conversion into ETH followed by dispersal over several months through DeFi and instant swaps.
About $3 billion is frozen, mostly stablecoins, because Tether and Circle blacklisted the addresses. The FBI has published these addresses and is asking platforms and on-chain analysts alike to block the related flows. The stolen BTC and ETH, on the other hand, can still move and go through bridges or mixers, so the selling pressure on ETH may last.
Binance suspended withdrawals, then reopened them on 1 November in phases, with a first window from 06:00 to 09:00 UTC for BTC, ETH, USDT, USDC, BNB and XRP, then Base, DOGE and OP. It says it has bought back 95% of the assets with its own funds and the SAFU, and it has announced a proof of reserves. The remaining 5% are tokens outside the top 10, which are less liquid. For your tax report, nothing changes, since your Binance positions are read as they are, and under French tax rules a possible reimbursement in kind is not a disposal.
Trezor: a cellular implant reported in a Safe 5, not yet confirmed in the lab
The report came in on 28 October through the responsible disclosure program. On a Safe 5 bought in August 2026 on Tokopedia, in Indonesia, an added board with a cellular module and an antenna would read the screen while the seed is displayed, like the LTE implant confirmed at Ledger. Trezor has not had the device in hand or any lab confirmation, and no losses have been reported.
Trezor had removed CryptoBilis from its resellers on 9 October and inspected four of the reseller's devices (one Safe 7, two Safe 5, one Safe 3), with no sign of tampering. On 30 October, it asked anyone who bought from CryptoBilis since March 2026 to migrate to a new seed, and it replaces the device through support. It is also cutting down its reseller network. Modified Trezors sold on TikTok and Facebook had already been reported in August.
Trezor is also coming out of a leak at ShipMonk, announced on 13 August, which hit 11,742 customers (name, email, phone, address) and 1,947 others in part, for orders from 10 May to 8 August 2026. On 4 September, the total rose to about 80,700 people, with US archives from 2019 to 2021 that had never been purged. No seed, key or firmware leaked, and SatoshiLabs' infrastructure is not at fault. Targeted phishing followed, with calls citing real orders and letters with QR codes.
Ledger: the LTE implant in CryptoBilis devices drained 315 wallets in 47 minutes
The victims had received small test amounts about two weeks earlier. On 9 October, 315 wallets were drained across six chains in about 47 minutes, including 111 Bitcoin addresses in a single block and 25 Tron wallets signed within three seconds. Bitquery counts about $93.2 million, including $70.5 million on Tron. Tether froze roughly $10 million, but $14.9 million went into USDD, which cannot be frozen. One scammer even lost $4.9 million in BTC to the attack.
This is a physical supply chain attack. A microcontroller housed in the casing decoded the screen while the 24-word seed was displayed and sent it over LTE via eSIM. The Secure Element, the OS and the signing path are sound, but the seed is enough to derive every key. The Genuine Check vouches for the original chip, not for the absence of anything added. Ledger had CryptoBilis's sales suspended on 9 October and confirmed the implant on 12 October and 13. The founders of CryptoBilis say they sold the company in March 2026.
As of 1 November, Ledger has not confirmed any total (Galaxy Research puts it at around $91 million). Pascal Gauthier is running the investigation, and no compensation or arrest has been announced. Cases are coming in from Japan, Thailand and Singapore's airport, where Mark Karpelès reported a Ledger Flex, without confirmation from Ledger. MediaMarkt has suspended its sales, and on 30 October Trezor asked CryptoBilis buyers to make the same migration.
