Vitalik Buterin is urging investors and developers to rethink how Ether is valued, arguing that the ETH store of value case is sturdier than the idea of ETH as a token whose worth comes from burning transaction fees. The Ethereum co-founder laid out his view in a post on X on November 8, 2026, as ETH traded near $2,240.

Why Buterin Is Questioning the Fee-Burn Thesis

The fee-burn argument took hold after EIP-1559, the upgrade that destroys part of each transaction fee. The pitch was that heavy network use would shrink ETH’s supply over time and reward holders. Buterin did not call for removing the mechanism. He said EIP-1559 should stay in place even when burning does not offset new token issuance. But he doubts burns can reliably anchor the asset’s price.

He illustrated the problem with a simple valuation example. If a network burned $1 billion in tokens each year and a 4% discount rate was applied, the stream could be said to justify a $25 billion valuation, much like recurring income supports a company’s value. Buterin’s objection is that this math assumes the revenue stays stable, which is hard to count on if the token’s own price drops.

“ETH as fee-burning token never was as strong as it seemed,” he wrote. He pointed to the surge in burning between 2021 and 2023, when NFT trading and decentralized finance drove intense demand for block space. In his telling, much of that activity depended on wealth already circulating inside crypto markets. A sharp fall in ETH’s price could shrink the spending that produced the fees in the first place.

Affordability, Decentralization and Outside Pressure

Buterin also made a design argument. Optimizing Ethereum to maximize fee revenue, he suggested, could conflict with keeping the network affordable, decentralized and hard for outside forces to capture. In his view, Ethereum’s long-term reliability matters more than squeezing out higher fees for token holders.

That is where the ETH store of value framing comes in. Under it, the asset’s appeal rests on the network’s decentralization, censorship resistance, privacy and security, rather than on a cash-flow model. Buterin described these as the foundations of his preferred long-term investment case.

The Market Backdrop for the ETH Store of Value Debate

The timing reflects how Ethereum’s economics have changed. Layer-two networks have grown and pulled activity off the main chain, which has reduced mainnet fee burning. During quieter periods, Ethereum issues more ETH than it burns. That undercuts the “ultra-sound money” narrative that once depended on burns outpacing issuance.

Buterin acknowledged that tokenized real-world assets now give Ethereum more financial activity tied to conventional markets. The source material available for this report cuts off before the rest of his comments, so the full detail of how he weighs that development, and of his remaining reasons, is not covered here. He said he had three primary reasons for his position, and only the first and part of the second were visible.

The post is a statement of Buterin’s own view, not a protocol change, and it does not settle how the market will price ETH. It does signal where one of Ethereum’s most influential voices wants the conversation to go. Rather than a race to maximize burned fees, he is pushing the community to treat durability and resistance to capture as the core of ETH’s value. Whether investors who built models around fee burns will agree remains an open question.

Explore more on this topic with Vexel Search.

File photo: VitalikButerinProfile.jpg by Romanpoet, CC BY-SA 4.0, via Wikimedia Commons.

The MEXC FinCEN order, issued Friday by the Treasury Department’s Financial Crimes Enforcement Network, is designed to sever the offshore crypto exchange from the American financial system. Treasury alleges the platform facilitated at least $16 billion in illicit flows between May 2021 and May 2026. Reuters reported the same cut-off, and Treasury described it as part of an effort it calls Operation Economic Outcast.

What the MEXC FinCEN order actually does

FinCEN’s final order finds MEXC to be a “primary money laundering concern in connection with Russian illicit finance,” using authority under section 9714(a) of the Combating Russian Money Laundering Act. Once the order is published in the Federal Register, covered U.S. financial institutions will have 30 days before they are barred from any funds transfer to or from MEXC, including transfers of convertible virtual currency. As of Friday evening, the Register’s public index showed no MEXC notice, so that clock has not yet started.

The order covers MEXC Global and several named affiliates and successors outside the United States. These include a Seychelles-incorporated entity, an Estonian company, a Swiss firm and a U.K. company. Institutions that willfully violate the ban could face civil or criminal penalties.

It is not a sanctions designation by the Treasury’s Office of Foreign Assets Control, and the order says it does not rewrite existing Bank Secrecy Act duties or OFAC rules. It is a funds-transmittal prohibition, not a proposed rulemaking under Section 311 of the USA PATRIOT Act.

The allegations behind the cut-off

The Treasury’s numbers are specific. Of the $16 billion total, nearly $1.5 billion is tied to Russian sanctions evasion, and about $22 million is linked to Iran’s central bank and the Islamic Revolutionary Guard Corps’ Qods Force. FinCEN also cites roughly $1 billion in direct traffic with more than 40 Iranian crypto exchangers, nearly $26 million with the OFAC-sanctioned A7 sanctions-evasion network, and almost $200 million tied to the A7A5 stablecoin. North Korean facilitators and cybercrime flows are also alleged.

Treasury says MEXC was still processing trades with the sanctioned exchange Garantex and its successor, Grinex, as recently as June 2026, more than four years after OFAC designated Garantex. These are Treasury’s allegations. MEXC had not publicly responded as of Friday, and its main X account kept posting marketing content through the afternoon.

Who feels it, and who doesn’t

Founded in 2018, MEXC is among the world’s 20 largest centralized crypto venues by volume. Treasury puts its daily turnover above $1 billion, its reserves near $5 billion as of mid-2026, and its reach at more than 170 countries. The exchange already lists the United States as a prohibited jurisdiction in its user terms. That suggests the MEXC FinCEN order will mostly hit any remaining dollar rails, banking partners and counterparties that still touch U.S. institutions, rather than American retail traders.

Regulators elsewhere had already flagged the platform. The U.K. Financial Conduct Authority put MEXC Global Ltd on its warning list as unauthorized in March 2024. Hong Kong’s Securities and Futures Commission warned that same month that it was marketing to local investors without a licence. In May 2026, Seychelles’ Financial Services Authority said it had acted against MX Global Ltd for unlicensed virtual-asset operations, an action FinCEN footnotes in its order.

A familiar template, and open questions

The approach follows earlier 9714 actions, such as the one against the exchange Bitzlato. It also arrives during a busy week of sanctions activity touching crypto, including North Korea-related designations and an action against an Iranian exchange.

The practical effect is that U.S. banks, money transmitters and other covered firms will be unable to move dollars or crypto to MEXC accounts once the ban takes hold. Offshore users may still trade peer-to-peer, but any bank clearing for the exchange would take on legal risk. What remains unclear is how MEXC responds: it could contest the finding, seek an exemption, or quietly reroute its liquidity. Until the Federal Register notice appears, the timeline for the MEXC FinCEN order remains incomplete, though Treasury’s claim of at least $16 billion in illicit volume is already on the record.

Explore more on this topic with Vexel Search.

The United States has sanctioned eight Canadian money exchange businesses it accuses of helping Iranian entities get around financial restrictions, widening a pressure campaign that now reaches deep into North American financial services. The US Treasury announced the designations on Friday, saying the firms are based in Ontario and British Columbia.

What the Treasury says the firms did

According to the Treasury, the businesses handled transactions with sanctioned Iranian digital-asset exchanges and with crypto addresses linked to Iran’s Islamic Revolutionary Guard Corps (IRGC). The department also says they converted Iranian rials and other currencies into digital assets, which allowed money to move across borders. One report on the announcement adds that some of the firms allegedly helped an alleged head of a drug-trafficking ring. These are the Treasury’s allegations, and the sources do not include responses from the companies.

The named businesses include Million Exchange, Amin Exchange and Cryptoyal, along with several others operating under corporate names such as Diverse Trade Inc, Top PC Technician Inc and NIA Nations Currency Ltd. The Treasury also said some of the entities changed their names and addresses to avoid detection.

What the sanctions actually do

Being designated effectively isolates a company from the dollar-based financial system. Any assets the firms hold in the US are frozen, and American people and entities are barred from dealing with them. For a currency-exchange business, losing access to dollar channels can be crippling even if it never operates on US soil.

Treasury Secretary Scott Bessent framed the move as a message to Ottawa’s financial sector as much as to Tehran. “Canada cannot be a safe haven for illicit financial facilitators that provide sanctions evasion services to the Iranian regime and its proxies,” he said. The Treasury is calling the broader effort “Operation Economic Outcast.”

Canada’s role in the Canadian money exchange action

The action was not unilateral. Canada’s financial intelligence unit, FINTRAC, said it worked with the US Financial Crimes Enforcement Network (FinCEN) and described routine intelligence-sharing with foreign counterparts to combat money laundering, terrorist financing and sanctions evasion. The IRGC is also listed as a terrorist organisation in Canada, which gives Ottawa its own reasons to cooperate.

Part of a wider push on Iran and crypto

Friday’s announcement came alongside other measures. FinCEN issued an order barring US financial institutions from processing transfers involving Seychelles-incorporated exchange MEXC Global, which it says facilitated at least $16 billion in illicit transactions linked to Iran, North Korea and Russia. Separately, the State Department’s Rewards for Justice program offered up to $20 million, plus possible relocation, for information on Iran’s nuclear program, including its facilities, equipment and personnel. The announcement cited the International Atomic Energy Agency’s loss of “continuity of knowledge” about Iran’s enriched uranium production.

Earlier in the week, the Treasury targeted a network in India and Turkiye that it says helped Iran evade limits on oil exports and airline operations. Washington also claims the campaign has pushed Iran’s rial to new lows and driven inflation to about 90 percent, a figure that comes from the US side and was not independently verified in the sources.

Taken together, the steps show a strategy built on following money wherever it moves: through small exchange houses, crypto platforms and third-country trading networks. The Canadian money exchange designations suggest Washington sees smaller, lightly scrutinised intermediaries in allied countries as a significant weak point in its sanctions regime. The cases will also test how far Ottawa and Washington will keep aligning on enforcement.

Explore more on this topic with Vexel Search.

The Gnosis Pay breach has left an unknown number of stablecoin card customers with personal details in the hands of an unauthorised party, including home addresses. The company, which issues white-label stablecoin cards, says it detected unauthorised access on November 3 to the system behind its Gnosis Pay-branded cards, the consumer-facing (B2C) side of its business.

What the Gnosis Pay breach exposed

According to the notice sent to customers, the exposure was uneven. Some users were told that the affected data was their name as printed on the card, their shipping address and their Gnosis Pay account reference. That is a modest-sounding list, but a name paired with a physical address is exactly the kind of information that can be used for targeted phishing or other social-engineering attempts.

Others appear to have been hit harder. Lefteris Karapetsas, founder of the crypto portfolio tool Rotki, shared that his notification said the compromised information included his full home address, his name, his card number and every wallet address linked to his account. Linking wallet addresses to a real name and address matters in crypto, where on-chain activity is otherwise pseudonymous. Anyone holding that combination could connect a person’s identity to their public transaction history.

A system already on its way out

Gnosis Pay had already planned to retire the affected system at the end of this year. That timing offers little comfort to customers whose data has already been exposed, but it suggests the company was winding down the platform before the incident came to light. The reports do not say how the intruder got in, how long they had access or how many customers were affected.

The coverage also does not say whether customer funds were touched. The notices described by users focus on exposed information, not stolen assets, but the available reporting does not explicitly address the safety of balances, so users should look for confirmation directly from the company. Protos said it contacted Gnosis Pay for comment and had not received an immediate reply.

Part of a broader run of crypto incidents

The Gnosis Pay breach lands amid a rough stretch for the industry. Recent headlines include a reported $391,000 hack at BitMart, losses at Mercado Bitcoin that were reported at $46 million and still growing, and data leaks affecting users of Coinbase and Bithumb. Binance also dropped SignalPlus API keys after a potential hack. Not all of these involve the same kind of failure, but together they show how often crypto firms are targeted, whether for tokens or for customer data.

For card holders, the practical takeaway is caution. After a breach like this, the immediate risks are unsolicited messages that use accurate personal details to look credible, and the possibility of being tied to known wallet addresses. Treat any unexpected email or text referencing your card or account with suspicion, and rely on the company’s official notice rather than links sent by third parties. Customers who want to know exactly which of their details were affected should check the email Gnosis Pay sent them, since the company indicated the scope differed from person to person.

Explore more on this topic with Vexel Search.

South Korean exchange Gopax shut down trading and standard withdrawals on Friday after a Gopax hacking threat landed in the company’s inbox, and it has not said when normal service will return. The exchange says no funds have been lost. It describes the freeze as a precaution while it moves customer crypto into offline storage.

What Gopax shut down, and when

According to the exchange’s notices, deposits and standard withdrawals stopped at 2:55 p.m. local time (5:55 a.m. UTC). Trading followed at 3:53 p.m., and all unfilled orders were canceled. Customers cannot send coins out through the website or app. They must apply through the customer support center, where each request is checked and approved manually, so processing will be slower than usual.

Reports differ slightly on deposits. Some coverage said they were paused with withdrawals, while a later Korean report cited by Bitcoin Magazine said deposits had been restored and only web and app withdrawals remained shut.

What is known about the threat

A Gopax representative told Korean media the email came from someone claiming they could hack the exchange. The company has not verified that claim. It also said that when services stopped, there had been no hack and no attempted theft. The exchange has framed the move as preventive, aimed at shrinking what an attacker could reach online by shifting remaining hot-wallet balances into cold storage, which is kept disconnected from the internet.

The notices also cited recommendations from financial regulators, following a run of leaks and hacking incidents at financial institutions.

Why regulators and rivals are on edge

The Gopax hacking threat arrives in an unusually tense week for exchange security. South Korea’s Financial Services Commission recently urged domestic platforms to raise their cold-wallet holdings after the roughly $6.3 billion theft from Binance’s hot wallets on Oct. 29. Bitcoin Magazine reports the FBI has tied that attack to North Korea, and that Binance says it is covering customer losses from its own funds. Brazil’s Mercado Bitcoin also froze deposits and withdrawals this week after a security incident, with preliminary estimates of suspicious transfers near $40 million.

Korean exchanges must keep at least 80% of customer crypto offline. Financial Supervisory Service data showed Gopax held 80.54% offline at the end of September, only a sliver above the line. That makes a push toward deeper cold storage look as much like a compliance cushion as a response to one email.

Gopax’s record is also under scrutiny. In October the FSC reported cybersecurity deficiencies at 130 of 555 financial companies it reviewed. It named Gopax operator Streami, along with exchange Prabang, among 16 firms tied to earlier security incidents. Prabang suspended services on Oct. 24 after abnormal hot-wallet withdrawals and reported losses of about 100 million won (roughly $70,000), which it said it would reimburse.

Separately, Yonhap reported that abnormal access to some Gopax user accounts since early September leaked personal information on seven customers and two current or former employees, with further leakage confirmed last month. The company treats that as distinct from Friday’s email, and no link has been confirmed.

What to watch next

For customers, the practical result is a queue. Coins are being parked offline while support staff approve outgoing transfers one at a time. The key questions are whether Gopax finishes the cold-wallet transfer, clears withdrawal requests without any loss, and gives a date for trading to resume. The company has not commented beyond its notices, and Cointelegraph and crypto.news both said their requests for comment went unanswered. Until the threat is either substantiated or dismissed, the Gopax hacking threat remains an open question hanging over an exchange that regulators were already watching closely.

Explore more on this topic with Vexel Search.

The Greece crypto tax is now law: lawmakers in Athens voted on Thursday, Nov. 5, 2026, to tax cryptocurrency profits at 10% from Jan. 1, 2027. It is the country’s first dedicated framework for taxing digital assets. The measure was part of a wider bill covering loan oversight, debt protections and financial market rules, and it lands below the 15% rate floated in an earlier October draft.

How the Greece crypto tax works

The levy applies to net gains, meaning the difference between what an investor paid for an asset and what it was sold for, not the full sale proceeds. According to the reports, trading fees and related costs can be factored into that calculation. Simply holding a coin that rises in value does not trigger a bill.

A taxable event is not limited to cashing out into euros. Spending crypto on goods or services can also realize a gain, and so can contributing it to a company’s capital. Swapping one token for another is intended to stay outside the tax net, according to the explanatory material cited by Bitcoin Magazine. Bitcoinist adds that parliamentary legal reviewers have raised questions about the exact wording on that point, so the treatment of swaps may still need to be clarified.

The €500 exemption is a threshold, not an allowance

Annual net gains of up to €500 (about $560) are exempt. Coverage differs slightly on what happens above that line. Cointelegraph describes an exemption for investors whose gains “do not exceed” €500. Bitcoin Magazine and Bitcoinist, citing Greek analyses of the legislation, say that once a year’s net gains pass the limit, the 10% rate applies to the entire gain rather than only the portion above €500. If that reading holds, the exemption works as a cliff edge that protects only very small traders.

Losses above €500 in a tax year can be carried forward for up to five years. They can be offset only against future crypto gains.

Staking, lending and DeFi income taxed at 15%

Not all crypto income is treated alike. Cointelegraph and Bitcoinist report that returns from staking, crypto lending and providing liquidity to decentralized protocols face a separate 15% tax. Bitcoinist says these returns are classed as interest income. The split means passive on-chain yield is taxed more heavily than profit from trading.

Amnesty window and source-of-funds checks

Two provisions are aimed at bringing past and future activity into the system. Investors get 12 months to voluntarily declare previously unreported crypto gains. They must pay the resulting tax within 60 days of filing to avoid penalties and interest. Bitcoinist adds that the window comes with specific conditions.

From 2027, crypto purchases are also pulled into Greece’s existing “source of funds” checks. Buyers may need to show that the money used came from declared income or another lawful source. Bitcoin Magazine notes this is not a purchase tax, but it widens the audit trail around how holdings were financed.

Enforcement is the open question

A senior finance ministry official told Reuters that further implementation directives, including transparency and audit rules, will be published “in the coming weeks.” The same official said state revenue from the levy could not be projected. Most Greek investors use platforms based abroad, which makes the size of the domestic market hard to measure.

That gap is where the Greece crypto tax will be tested. A 10% rate on paper matters only if authorities can verify cost-basis and transaction data. The EU’s DAC8 rules, which require crypto service providers to report user and transaction data to national tax authorities, should help. Bitcoin Magazine says they have applied since January, and Greece has already written them into domestic law.

Where Greece sits in Europe

Bitcoin Magazine, citing the ministry official, says EU crypto gains rates typically run from about 8% to 30%, with no unified system. By that measure Greece sits toward the lenient end. The outlet contrasts it with France’s often-cited 30% and Cyprus’s 8%. It also notes that the Netherlands is moving toward a realized capital gains tax from 2028, while Germany and Portugal still exempt crypto held for more than a year.

For Greek investors, the rate is settled and the start date is fixed. Details on audits, reporting and the treatment of swaps will come with the ministry’s forthcoming guidance.

Explore more on this topic with Vexel Search.

The Binance hack, the largest crypto theft on record, was not a single clever exploit but a slow-burn campaign that began months before any money moved, according to a postmortem the exchange published on November 3. Binance says attackers combined poisoned software downloads, a bogus recruitment process and access to an internal AI tool to reach the systems that sign wallet transactions.

How the Binance hack unfolded

Binance’s account starts in June, when an engineer on the wallet team looking for an AI coding tool downloaded a tampered installer. Reports differ slightly on the details. One describes a malicious Google ad, another a compromised Homebrew installation. Binance says its security staff caught the malware and replaced the device, but the attackers had already learned who worked on wallet infrastructure and how.

In September, a different engineer was approached through a recruitment platform by someone posing as a project director. The engineer went through a video interview with a supposed HR representative, then another with the “CEO” of a fictitious company. At the end, the engineer was told to download an assignment onto a work computer. Instead, the code swapped the legitimate pyenv development tool for a malicious version that opened a backdoor. Binance says this malware had not been seen before and slipped past its endpoint protection while scrubbing its own traces.

By October 20, the attackers had used that machine and an internal AI tool to take over the computers of two more wallet engineers. One of them held a container deployment token. On October 29, the attackers used it to deploy a container that ran a malicious script reaching the wallet-signing service.

Minutes to move billions

The report says that between 20:05 and 20:09 UTC that day, five hot wallets sent 233.46 million XRP to an attacker-controlled address. Other wallets sent roughly 970,500 SOL, 44.2 million OP and 18,270 BTC. The attackers also used the signing service to set up malicious permissions through Ethereum’s EIP-7702 mechanism, which lets a wallet delegate execution to smart contract code.

That step explains why stopping the theft was so hard. Transfers continued for nearly two hours, even after Binance suspended its normal withdrawals. Because the hot wallet used multi-party computation, Binance says, no single private key existed that could immediately revoke those authorizations.

Who is blamed, and who is paying

The FBI has attributed the theft to a North Korean unit it calls “TraderTraitor.” North Korea has pushed back: Kim Yo Jong, sister of leader Kim Jong Un, called the attribution politically motivated. Attribution is the FBI’s finding, and North Korea has denied involvement.

On the financial fallout, Binance says $2.85 billion in stolen assets has been frozen or intercepted. Its leadership says no user bears the loss. By October 31, it had replenished 98% of the affected tokens and was buying the remaining, less liquid assets. Withdrawals have broadly resumed. Co-founder Yi He said the exchange blocked 57 suspected North Korea-linked threats this year, including fake interviews and malicious packages, but added that “the cost of failing to stop even one was severe.”

The questions that remain

Much of what is known comes from Binance’s own postmortem, which has not been independently verified. Even so, the account raises uncomfortable questions. The Verge notes that it remains unclear why this attack succeeded when the danger of interview tasks that require running code on employer-connected machines has been widely warned about for years. Binance also detected the June intrusion yet still could not stop what followed. And it has not publicly explained how an internal AI tool let an intruder take control of other engineers’ machines.

For the wider industry, the Binance hack is a reminder that the weakest point in a crypto exchange may not be its blockchain code but the laptops of the people who run it. A convincing recruiter and a plausible coding test were enough to start a chain of events that ended with billions leaving the exchange’s wallets in a matter of minutes.

Explore more on this topic with Vexel Search.

French banking group Crédit Mutuel Arkéa has confirmed it suffered a cyberattack that enabled “fraudulent operations,” shortly after onchain investigator ZachXBT named it as the alleged victim of a crypto theft worth more than $133 million. The bank’s statement, as reported by Decrypt, did not mention cryptocurrency and said it is still assessing the amounts involved.

How the $133M figure grew

The estimate climbed over three days. On Monday, ZachXBT flagged more than $106 million in suspicious withdrawals from centralized exchanges. By Tuesday he had raised the total to over $133 million after finding roughly $27 million in further withdrawals, some of which happened after his first warning. On Wednesday he identified the bank as the alleged victim, describing it as an institution with about $235 billion in assets that was exploited over several days.

He also cautioned that the real number may be higher. “I suspect the amount stolen is larger when accounting for OTC activity,” he said, suggesting that over-the-counter deals were not captured in the earlier tallies.

What the bank has and hasn’t said

The gap between the bank’s wording and ZachXBT’s claims is the key point. Crédit Mutuel Arkéa acknowledged an attack and fraud, but its statement, as Decrypt describes it, stops short of confirming that digital assets were taken or that it is the source of the funds ZachXBT traced. The two outlets also differ on timing: Cointelegraph said the bank had not responded to its request for comment when it published, while Decrypt reported the confirmation afterward.

Cointelegraph noted that the bank’s alleged involvement had not been independently verified. ZachXBT has also not explained how the attackers got access to the funds, so the method of intrusion is unknown.

Exchanges respond as funds move

Blockchain analytics firm Bitquery traced withdrawals from accounts at Kraken, Crypto.com and OKX. It found that about $63 million in stablecoins was swapped into Ether within four hours. Swapping out of stablecoins is significant because issuers can freeze them, whereas Ether cannot be frozen the same way.

Kraken and Crypto.com later told Cointelegraph they had restricted accounts or blocked funds tied to the suspected theft. Both said their platforms remained secure. The sources do not say whether OKX took similar action, and they do not report any recovery of funds.

What remains unclear

Several questions are still open. The bank has not said whether the fraudulent operations involved crypto, how much was lost, or how the attackers got in. ZachXBT’s numbers are an onchain investigator’s estimates, not audited losses, and he says they could rise. Until Crédit Mutuel Arkéa finishes its assessment or authorities weigh in, the link between the bank’s confirmed cyberattack and the $133 million in traced withdrawals rests on the investigator’s analysis.

For now, the case shows how quickly stolen crypto can move through major exchanges and how much of the early public picture comes from independent trackers rather than the institutions affected. Any further statement from Crédit Mutuel Arkéa, or from the exchanges that froze funds, should clarify how large the loss is and whether any of it can be recovered.

Explore more on this topic with Vexel Search.

File photo: Accueil du siège social du Crédit Mutuel Arkéa.jpg by FJaffres, CC BY-SA 4.0, via Wikimedia Commons.

Justin Sun sanctions efforts against World Liberty Financial have opened a new front in a dispute over frozen WLFI tokens. The Tron founder says the Trump family-backed crypto company hid a key fact about its corporate identity until months into the case, and that the delay cost him heavily in legal fees.

Sun announced the motion in a November 3 post on X, saying his lawyers filed it the night before. The motion asks the court to sanction not only World Liberty but also its attorneys. The dispute, as Sun frames it, turns on a technical but consequential question: who owns World Liberty, and where those owners are considered citizens.

What the Justin Sun sanctions motion alleges

Sun’s lawsuit was filed in April in California federal court. He says World Liberty was obliged from the outset to disclose its owners and their citizenship, so the court could confirm it had jurisdiction. According to Sun, the company’s first filing named only World Liberty itself and listed Florida as its sole citizenship. He says its lawyers certified they were “unaware of anyone else who needed to be disclosed.”

That changed after an August hearing, Sun says. At the hearing, some of his claims were allowed to stay in federal court while others were sent to arbitration. Shortly afterward, World Liberty amended its disclosure. Instead of one entity, it identified 22 in its ownership chain, and it listed citizenship in Florida, Delaware, Puerto Rico and the United Arab Emirates.

Why the UAE citizenship matters for jurisdiction

Sun, a foreign plaintiff, brought the case under federal diversity jurisdiction, which generally lets certain disputes between parties from different jurisdictions be heard in federal court. Once World Liberty disclosed a UAE connection, it argued that the federal court could no longer hear the case because foreign parties sat on both sides.

Sun says the timing is the problem. His lawyers, he says, spent months and hundreds of thousands of dollars opposing World Liberty’s push for private arbitration, only for the company to then challenge the court’s jurisdiction. In his telling, a correct disclosure at the start could have avoided much of that spending.

What happens next

Sun says he plans to refile his lawsuit in California state court once the sanctions motion is resolved. That would keep alive his fight over the freezing of his WLFI tokens, which is the underlying grievance. In his post, Sun described himself as one of World Liberty’s early backers, though the available text of his statement was cut off before he elaborated.

Several things remain unclear from the material available. The reporting does not include a response from World Liberty or its lawyers, and it does not say how the court has reacted to the motion. The allegations about the timing and purpose of the amended disclosure are Sun’s, not findings by a judge. Whether the court agrees that the disclosure was improperly delayed will determine if the Justin Sun sanctions request goes anywhere.

For now, the filing shows how a fight over frozen tokens has become a contest over venue, corporate structure and disclosure rules. Where the case is heard may matter as much as the merits of Sun’s claims.

Explore more on this topic with Vexel Search.

File photo: Head of the Grenadian Delegation to the 12th World Trade Organization Ministerial Conference Justin Sun.jpg by World Trade Organization, CC BY-SA 2.0, via Wikimedia Commons.

Tether bitcoin holdings are larger than the stablecoin issuer’s own reserve paperwork suggests, according to CEO Paolo Ardoino. Speaking at the Plan ₿ Forum in Lugano, Switzerland, he said the company holds “give or take 150,000 bitcoin,” adding, “It’s not much, but it’s honest work.” At recent prices near $77,600, that stack is worth roughly $11.6 billion.

The number stands out because Tether’s third-quarter reserve report, published October 30 with an attestation from BDO, points to a much smaller position. It lists $8.37 billion in bitcoin, valued at $83,621.23 per coin on September 30. That works out to about 100,060 BTC, leaving a gap of roughly 50,000 coins.

Why the Tether bitcoin holdings figures don’t match

The sources do not describe a fresh 50,000 BTC purchase, and Ardoino gave no acquisition timeline or wallet breakdown. The likelier explanation is structural. Tether has said that investments made from its profits are kept separate from the reserves backing USDT. Coins held by an affiliate such as Tether Investments, which holds the group’s venture and equity positions, would therefore not show up in the attestation. Ardoino did not say which entity owns the extra coins, so that remains an inference rather than a confirmed answer.

Tether has been buying bitcoin since it adopted a policy in May 2023 of putting a portion of its profits into the asset. Its wider exposure also runs through mining and energy ventures in Latin America, a full takeover of Twenty One Capital in May, and backing for Adecoagro’s mining operations in Brazil. Whether any of those positions are counted in the 150,000 figure is unclear.

A bigger cushion, but one tied to volatile assets

The disclosure comes as Tether’s balance sheet leans more heavily on bitcoin and gold. The Q3 report shows $191.45 billion in reserve assets against about $183.50 billion in liabilities, an excess of $7.95 billion. That is up from roughly $4.1 billion at the end of June. Treasury bill exposure remains the backbone at about $132.4 billion, though the direct holdings account for about $122.84 billion of that. Gold, at around $19.1 billion, and the $8.37 billion in bitcoin together exceed the excess several times over, so a sharp fall in either would eat into the buffer.

Most of the bitcoin line’s rise during the quarter reflected price, not buying. Estimates based on the attestation suggest only about 1,130 BTC were added, up from roughly 98,930 at the end of June. Tether also reported about $1.5 billion in net operating profit for the quarter and $4.5 billion over nine months. In August it completed its first independent audit with KPMG, after years of relying on attestations alone.

If the 150,000 figure is accurate, Tether would rank among the largest corporate bitcoin holders. It would still sit far behind Strategy, which held 848,517 BTC as of the third quarter. Ardoino also said USDT has more than 730 million users and adds about 30 million wallets each quarter. He framed the company’s future around an “Independence Stack” covering energy, mining, communications, self-custody wallets and artificial intelligence.

For now, the 150,000 figure is a CEO’s verbal estimate rather than an audited number. Tether has not said whether it will publish a breakdown of coins held outside the reserve. Until it does, the gap between the keynote and the attestation will keep drawing scrutiny from analysts weighing Tether bitcoin holdings against its reserve disclosures.

Explore more on this topic with Vexel Search.

File photo: Paolo Ardoino by Gage Skidmore.jpg by Gage Skidmore, CC BY-SA 3.0, via Wikimedia Commons.