Web3Auth, the Consensys service that lets you open a wallet with a Google or Apple account, suspended its embedded wallet offering on 7 November after a “security issue” affecting some of its clients. Keplr, one of them, had reported unauthorized transactions overnight on accounts created this way, and shut down those logins. Keplr is adamant that its own code isn't at fault.
According to Bitquery, about $6 million left some 44,700 wallets, on seven networks in the Cosmos ecosystem and on Injective, including $3.5 million on the Cosmos Hub. Josh Lee, Keplr's co-founder, estimates that about 20% of Keplr accounts opened with Google or Apple could be affected, and that only some of them were actually drained. This figure is provisional, and it doesn't apply to all Keplr accounts or to all Web3Auth users.
The “50 million users” figure going around comes from Web3Auth itself, which claimed nearly 50 million users when it joined Consensys in 2025: that's its audience, not the number of victims. Web3Auth says it has found, so far, no impact on MetaMask users. An empty balance doesn't necessarily mean theft: security teams move funds along the same path as the attacker to keep them safe. The losses still have to be tallied, and nothing guarantees a refund yet.
The email went out on 6 November. Binance France is announcing the closure of all its French customers' accounts “as of 31 December 2026”, as part of the orderly wind-down of its business. Deposits are already impossible, and withdrawals remain open. Since 1 July, for lack of a MiCA license, these accounts could only be used to sell and withdraw.
29 November becomes the “calculation day”. After that, Binance charges 0.025% of the balance or 10 USDC each month, whichever is higher, which means the minimum applies to anything under $40,000. A first charge comes within three days, and a second one after 24 December, taken in USDC first, then from your other crypto. Anyone who has withdrawn everything before the 29th pays nothing.
After 31 December, an account that still holds funds will be treated as dormant, which could mean a conversion, a transfer or “other handling” of the assets. Binance doesn't say which. Under French tax rules, a transfer to a wallet or another platform isn't a taxable disposal. A sale for euros, on the other hand, counts toward your 2026 capital gains.
On Friday, 6 November, Gnosis Pay published a statement about unauthorized access to the legacy system that runs its branded Visa cards, which are linked to a Safe on Gnosis Chain. The intrusion was detected on 3 November and shut down in less than two hours, but customers only got an email on the 6th. The number of affected accounts hasn't been disclosed.
Cointelegraph was able to read the notifications, and Lefteris Karapetsas, a former customer, posted a screenshot of one. The intruder saw the name, postal address, email, phone number, full card number with expiry date and security code, the addresses of linked wallets and in some cases the IBAN. Funds are intact, and so are the white-label cards from the platform's business offering.
Gnosis Pay replaced the compromised credentials and is requiring 3D Secure verification on online payments until 20 December, the date these cards are discontinued. The real risk is targeted phishing, since identity, postal address and wallet addresses end up in the same file. Transaction history, for its part, can only be exported until that date.
Binance, MEXC: the exchanges without a MiCA license four months after the grace period
The MiCA transition period ended in France on 30 June 2026. Binance, which had withdrawn its application in Greece on 24 June, stopped serving French residents on 1 July: no more new accounts, no more deposits, no more spot orders, no more Earn subscriptions. Existing customers, about two million according to the press, can still reduce their positions and withdraw. On 1 October, margin positions that were still open were closed automatically.
The case isn't closed. According to the Financial Times, ESMA and the French, German and Greek regulators are looking at how Binance keeps opening accounts for Europeans by invoking the “reverse solicitation” rule in Article 61 of MiCA, an exception reserved for customers who come of their own accord, without advertising or marketing. No authority has found a violation so far.
MEXC, widely used for small tokens, is in a clearer position: on the AMF blacklist since 4 June 2024, without a MiCA license, and in the process of leaving the Netherlands, where accounts have been closed since 24 October. France isn't on its list of banned countries, but nothing protects a French customer if the platform shuts down or freezes accounts, and the AMF can ask a judge to block access to it.
On the licensed side, the AMF lists Kraken (licensed in Ireland), OKX (through OKCoin Europe, in Malta) and Coinbase (in Luxembourg), which operate in France thanks to the European passport. A license doesn't protect you from a hack or from an account freeze for verification, but it does give you a regulator to complain to.
Bitcoin falls back to $75,500 after Wall Street's worst session since April 2025
Bitcoin dropped about 6% on Thursday, 5 November, to around $75,500, and touched close to $75,460 on Bitstamp, its lowest since 16 September. On Wednesday, a brief post-election bounce had pushed it back above $80,000. Ether lost 7.5 to 8%, to around $2,240, and solana 6 to 8%, to around $89.
The shock came from Wall Street's worst session since April 2025: the Nasdaq gave up 5.5%, the S&P 500 4.4% and the Dow 3.4%. Investors sold AI and chip stocks, worried that a Congress now in Democratic hands would slow down data centers. Coinbase and Strategy lost about 10%. CoinGlass counts $1.08 billion liquidated in 24 hours across more than 210,000 accounts, 88% of it in bets on a rise.
Bitcoin is moving in step with tech again. Without leverage, this is only a drop in valuation. For a borrowed position on Aave or elsewhere, everything depends on the liquidation price: Wintermute names $73,000 and then $68,000 as the next levels to watch.
Binance: its proof of reserves covers ten cryptos at least 1:1
On Monday, 2 November, Binance published the proof of reserves for its 31 October snapshot. It covers ten assets (BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, ZEC), all backed at least 1:1, with bitcoin at 100.04%, USDT at 100% and BNB at 101.3%. As of 1 October, it covered 55 assets and backed USDT at 103.88%. A broader snapshot will follow on Wednesday, 4 November.
To replace 95% of the stolen assets, Binance took 7,499 BTC out of the SAFU fund, about $580 million. This $1 billion fund now holds only half that amount, and its charter has nothing on refilling it after a hack.
On Arbitrum, the Security Council took back 8,426 ETH and 74.6 million ARB, about $30 million, from the hacker's address as early as 30 October. These funds are waiting for a DAO vote. Binance withdrawals are expanding to more networks starting Tuesday, and every customer can check their balance in the proof of reserves section of the app.
Binance: $3.64 billion in net outflows as withdrawals reopen
Binance reopened withdrawals in phases on Sunday, 1 November, at 7:00 a.m. Paris time. Fifteen networks and assets went first, including bitcoin, ether, USDT, USDC, BNB and XRP, and the rest is following gradually. Between 7:00 a.m. and 4:30 p.m., $4.65 billion went out and $1.01 billion came in, which makes $3.64 billion in net outflows and 2.1% of the $171 billion in customer assets. DefiLlama counts $5.8 billion over 24 hours, a figure Binance disputes.
Part of the funds went to competitors, with OKX in the lead. Prices held up, with bitcoin still around $78,000 and ether near $2,290, about 5% below their level before the theft.
On the thieves' side, the laundering goes on. In two days, $242 million left the Tron network through Relay, THORChain, Chainflip and Symbiosis, and 970,000 SOL are being turned into bitcoin. About $2.85 billion remains frozen, almost entirely stablecoins. Binance promises an updated proof of reserves on Monday or Tuesday. A withdrawal only goes through if the token's network has reopened.
Aave froze 292 reserves for a day after the Binance hack
On Thursday, 29 October, between 20:57 and 21:01 UTC, a wallet belonging to the Binance hacker deposited $60 million in stolen USDT on Aave V3 (Ethereum), then borrowed 19,762 ETH (about $44.6 million). The idea was to swap stablecoins, which Tether can freeze, for ether, which cannot be frozen. The hackers also converted stablecoins into ether on Uniswap.
Within the hour, Aave's Guardians froze 292 reserves on V3 and V4, blocking deposits and borrowing, but not withdrawals or repayments. Its contracts were not attacked, and everything reopened on 30 October in four steps. Kamino, on Solana, suspended borrowing on its SOL/BTC market as a precaution, without being hit.
On 30 October, the value locked in DeFi lost 5.3%, down to $83.95 billion, its lowest level since 21 August, while AAVE and LINK fell 9% and UNI 8%. About $3 billion of the stolen funds is frozen, mostly stablecoins, and since 31 October the FBI has been asking DeFi apps to block the hacker's addresses.
Binance reopens withdrawals in stages after a $6.3 billion theft
On Thursday evening, 29 October, Binance's hot wallets were drained of about $6.3 billion. According to TRM Labs, that means 18,270 BTC, 200,630 ETH, nearly $2.7 billion in USDT and USDC on Ethereum, 233 million XRP and 970,500 SOL. It is a record, far ahead of the Bybit hack in February 2025 ($1.5 billion).
On Saturday, the FBI named the North Korean group TraderTraitor, which was already behind Bybit. The funds are being converted into ether before being laundered through DeFi and instant exchange services. About $3 billion, in stablecoins, could be frozen by their issuers, something that is impossible with bitcoin or ether.
Binance suspended withdrawals and then reopened them on Sunday in phases, with BTC, ETH, USDT, USDC, BNB and XRP first, then Base, Dogecoin and Optimism. The platform says it has replaced 95% of the assets from its own funds, SAFU included, and promises a full proof of reserves. Crypto left on a platform therefore depends on that platform to get out, unlike crypto in a wallet where you hold the keys.
Trezor: an Indonesian customer reports an implant hidden in his Safe 5
On 28 October, an Indonesian customer reported to Trezor an implant in a Safe 5 he bought in August on Tokopedia. It is an added board, with a cellular module and an antenna, that would read the screen, recovery phrase included. Trezor has not received the device and is relying on his description and a video call. No losses are known.
On 30 October, Trezor asked people who bought from CryptoBilis since March 2026 to create a new wallet without reusing the old phrase. The device can be replaced through support. Trezor had removed CryptoBilis from its resellers on 9 October, the day of the theft from Ledger customers, and found nothing on four devices bought from it.
On 13 August, Trezor had already announced a leak at ShipMonk, its logistics provider, affecting about 13,700 customers. On 4 September, the figure rose to about 80,700, because ShipMonk had kept old US orders. No recovery phrase or private key leaked, but since then customers have received calls and letters with QR codes in Trezor's name.
Ledger: a chip hidden in CryptoBilis devices led to the theft of $93 million
On 9 October, 315 Ledger wallets were drained across six blockchains in about 47 minutes. Bitquery puts the haul at $93.2 million, including $70.5 million on Tron, mostly in USDT. Tether froze about $10 million of it, and the thieves converted about $14.9 million into USDD, a stablecoin that Tether does not control.
Ledger confirmed the cause on 13 October. An implant had been slipped into the casing of devices sold by CryptoBilis, its official reseller in Malaysia, Indonesia and the Philippines. It read the recovery phrase on the screen during setup and sent it by eSIM over the mobile network. The Secure Element, the operating system and transaction signing are intact, but the Genuine Check, Ledger's authenticity check, does not see these additions.
As of 1 November, Ledger has not given any total, and estimates range from $86 million to $103 million. Its CEO, Pascal Gauthier, says he is leading the investigation himself to find out who modified the devices, and at what stage. No refund or arrest has been announced. MediaMarkt pulled Ledger devices from its shelves after a report in Germany, even though Ledger considers the stock it checked there to be clean. Trezor issued the same alert about this reseller on 30 October.
