A newly formed company wants to bring round-the-clock tokenized stock trading to Solana, and it is relying on a fresh SEC carve-out to do it. Formation Securities said on Nov. 9 that it has notified the US Securities and Exchange Commission of plans to open a venue in early 2027. Tokenized shares of Galaxy Digital, Exodus Movement and Forward Industries are expected at launch.

Formation is licensing technology from the decentralized exchange Orca. It intends to operate under the SEC’s temporary Innovation Exemption, announced in September. According to the sources, the exemption lets verified investors trade certain US-listed shares at any hour while keeping voting, dividend and other shareholder rights. One report adds that operators can use it without registering as a traditional securities exchange.

How the Solana venue would work

The design leans on crypto-native plumbing. The venue would use automated market maker technology rather than a traditional order book. Investors could hold tokenized shares in their own wallets and settle trades onchain against stablecoins and other eligible assets. Buyers and sellers would be paid in a single blockchain transaction.

Superstate and Securitize are expected to supply the tokenized shares. Traditional transfer agents would still keep official shareholder records, which preserves each company’s direct relationship with its investors. Formation plans to distribute access through partners including Alpaca, Passage by CoinList, Anchorage Digital Bank, BitGo Bank & Trust, Fireblocks, Solflare and Squads. Participation would be limited to people who pass identity verification and meet eligibility rules.

Issuer consent is the pressure point

Formation is stressing that it will court companies rather than go around them. “Tokenized stocks will succeed only if public companies see the value in them, and we intend to build this market together with issuers,” President Christopher Montagano said. The pitch is a pointed contrast with a rival effort. As of early November, more than 50 companies had objected to having their shares tokenized on OKXICE, a proposed venue backed by OKX and NYSE parent Intercontinental Exchange.

The exemption gives issuers a formal say. Venues must notify companies in writing and wait at least 30 calendar days before listing shares tokenized by unaffiliated third parties. Nasdaq has also cautioned that tokenized stock trading could have unforeseen effects on liquidity, price discovery and long-term shareholder value.

Solana’s place in the tokenized equity race

Solana is already a significant player. RWA.xyz data cited by Cointelegraph put tokenized stock value on the network at about $575 million as of Monday. That trails Ethereum at $747 million and BNB Chain at $1.7 billion. A dedicated venue could help close that gap, though the sources offer no projections.

Plenty remains uncertain. Formation has not started trading, and the proposal stays subject to the exemption’s conditions. The exemption permits conditional trading but does not guarantee that any particular venue will be approved. Whether enough issuers consent beyond the three named companies may decide how far this model gets. For now, the plan shows how quickly the industry is moving to test the SEC’s new framework.

Solana is on track to get another tokenized stock venue. Formation Securities has notified the U.S. Securities and Exchange Commission of its plans, according to a Decrypt report published November 9, 2026. The firm intends to operate under the SEC’s “Innovation Exemption” and to list tokenized shares of three companies in early 2027: Exodus, Forward Industries and Galaxy Digital.

The most notable detail is the promise of parity with traditional equity. According to the report, the tokenized shares are meant to carry the same voting and dividend rights as the underlying real stock. That separates this approach from products that give traders only price exposure to a company without the rights of a shareholder. How those rights would be recorded and exercised in practice is not spelled out in the material available.

What the Formation filing signals for tokenized equities

Describing Formation’s plan as “another” Solana venue implies a growing field of platforms putting stock-linked assets on the network. The three initial names are all companies with ties to crypto or digital assets, which suggests the launch will lean on issuers already comfortable with blockchain-based markets rather than a broad slice of the S&P 500. That is an inference from the list, not something the report states.

The reference to an “Innovation Exemption” matters as well. Operating under a formal exemption, and telling the SEC in advance, points to a regulated path to market rather than an offshore or unregistered one. Any such exemption would carry conditions, and the report’s summary does not list them.

What remains unclear

The material available offers only a brief outline, and several key questions are unanswered. It does not say how the tokenized shares will be custodied or settled, who will be eligible to trade them, or what fees the platform will charge. It also does not say whether the three companies have formally agreed to participate. The early-2027 timeline is a plan, not a guarantee, and it could shift depending on how the SEC responds.

For now, the filing is best read as a sign of intent and a test of how far regulators will let on-chain equities go. If Formation delivers shares with full voting and dividend rights, this tokenized stock venue could become a reference point for how tokenized equities are structured in the U.S. Until the launch details are public, much of that remains speculation.

Vitalik Buterin is urging investors and developers to rethink how Ether is valued, arguing that the ETH store of value case is sturdier than the idea of ETH as a token whose worth comes from burning transaction fees. The Ethereum co-founder laid out his view in a post on X on November 8, 2026, as ETH traded near $2,240.

Why Buterin Is Questioning the Fee-Burn Thesis

The fee-burn argument took hold after EIP-1559, the upgrade that destroys part of each transaction fee. The pitch was that heavy network use would shrink ETH’s supply over time and reward holders. Buterin did not call for removing the mechanism. He said EIP-1559 should stay in place even when burning does not offset new token issuance. But he doubts burns can reliably anchor the asset’s price.

He illustrated the problem with a simple valuation example. If a network burned $1 billion in tokens each year and a 4% discount rate was applied, the stream could be said to justify a $25 billion valuation, much like recurring income supports a company’s value. Buterin’s objection is that this math assumes the revenue stays stable, which is hard to count on if the token’s own price drops.

“ETH as fee-burning token never was as strong as it seemed,” he wrote. He pointed to the surge in burning between 2021 and 2023, when NFT trading and decentralized finance drove intense demand for block space. In his telling, much of that activity depended on wealth already circulating inside crypto markets. A sharp fall in ETH’s price could shrink the spending that produced the fees in the first place.

Affordability, Decentralization and Outside Pressure

Buterin also made a design argument. Optimizing Ethereum to maximize fee revenue, he suggested, could conflict with keeping the network affordable, decentralized and hard for outside forces to capture. In his view, Ethereum’s long-term reliability matters more than squeezing out higher fees for token holders.

That is where the ETH store of value framing comes in. Under it, the asset’s appeal rests on the network’s decentralization, censorship resistance, privacy and security, rather than on a cash-flow model. Buterin described these as the foundations of his preferred long-term investment case.

The Market Backdrop for the ETH Store of Value Debate

The timing reflects how Ethereum’s economics have changed. Layer-two networks have grown and pulled activity off the main chain, which has reduced mainnet fee burning. During quieter periods, Ethereum issues more ETH than it burns. That undercuts the “ultra-sound money” narrative that once depended on burns outpacing issuance.

Buterin acknowledged that tokenized real-world assets now give Ethereum more financial activity tied to conventional markets. The source material available for this report cuts off before the rest of his comments, so the full detail of how he weighs that development, and of his remaining reasons, is not covered here. He said he had three primary reasons for his position, and only the first and part of the second were visible.

The post is a statement of Buterin’s own view, not a protocol change, and it does not settle how the market will price ETH. It does signal where one of Ethereum’s most influential voices wants the conversation to go. Rather than a race to maximize burned fees, he is pushing the community to treat durability and resistance to capture as the core of ETH’s value. Whether investors who built models around fee burns will agree remains an open question.

Explore more on this topic with Vexel Search.

File photo: VitalikButerinProfile.jpg by Romanpoet, CC BY-SA 4.0, via Wikimedia Commons.

The MEXC FinCEN order, issued Friday by the Treasury Department’s Financial Crimes Enforcement Network, is designed to sever the offshore crypto exchange from the American financial system. Treasury alleges the platform facilitated at least $16 billion in illicit flows between May 2021 and May 2026. Reuters reported the same cut-off, and Treasury described it as part of an effort it calls Operation Economic Outcast.

What the MEXC FinCEN order actually does

FinCEN’s final order finds MEXC to be a “primary money laundering concern in connection with Russian illicit finance,” using authority under section 9714(a) of the Combating Russian Money Laundering Act. Once the order is published in the Federal Register, covered U.S. financial institutions will have 30 days before they are barred from any funds transfer to or from MEXC, including transfers of convertible virtual currency. As of Friday evening, the Register’s public index showed no MEXC notice, so that clock has not yet started.

The order covers MEXC Global and several named affiliates and successors outside the United States. These include a Seychelles-incorporated entity, an Estonian company, a Swiss firm and a U.K. company. Institutions that willfully violate the ban could face civil or criminal penalties.

It is not a sanctions designation by the Treasury’s Office of Foreign Assets Control, and the order says it does not rewrite existing Bank Secrecy Act duties or OFAC rules. It is a funds-transmittal prohibition, not a proposed rulemaking under Section 311 of the USA PATRIOT Act.

The allegations behind the cut-off

The Treasury’s numbers are specific. Of the $16 billion total, nearly $1.5 billion is tied to Russian sanctions evasion, and about $22 million is linked to Iran’s central bank and the Islamic Revolutionary Guard Corps’ Qods Force. FinCEN also cites roughly $1 billion in direct traffic with more than 40 Iranian crypto exchangers, nearly $26 million with the OFAC-sanctioned A7 sanctions-evasion network, and almost $200 million tied to the A7A5 stablecoin. North Korean facilitators and cybercrime flows are also alleged.

Treasury says MEXC was still processing trades with the sanctioned exchange Garantex and its successor, Grinex, as recently as June 2026, more than four years after OFAC designated Garantex. These are Treasury’s allegations. MEXC had not publicly responded as of Friday, and its main X account kept posting marketing content through the afternoon.

Who feels it, and who doesn’t

Founded in 2018, MEXC is among the world’s 20 largest centralized crypto venues by volume. Treasury puts its daily turnover above $1 billion, its reserves near $5 billion as of mid-2026, and its reach at more than 170 countries. The exchange already lists the United States as a prohibited jurisdiction in its user terms. That suggests the MEXC FinCEN order will mostly hit any remaining dollar rails, banking partners and counterparties that still touch U.S. institutions, rather than American retail traders.

Regulators elsewhere had already flagged the platform. The U.K. Financial Conduct Authority put MEXC Global Ltd on its warning list as unauthorized in March 2024. Hong Kong’s Securities and Futures Commission warned that same month that it was marketing to local investors without a licence. In May 2026, Seychelles’ Financial Services Authority said it had acted against MX Global Ltd for unlicensed virtual-asset operations, an action FinCEN footnotes in its order.

A familiar template, and open questions

The approach follows earlier 9714 actions, such as the one against the exchange Bitzlato. It also arrives during a busy week of sanctions activity touching crypto, including North Korea-related designations and an action against an Iranian exchange.

The practical effect is that U.S. banks, money transmitters and other covered firms will be unable to move dollars or crypto to MEXC accounts once the ban takes hold. Offshore users may still trade peer-to-peer, but any bank clearing for the exchange would take on legal risk. What remains unclear is how MEXC responds: it could contest the finding, seek an exemption, or quietly reroute its liquidity. Until the Federal Register notice appears, the timeline for the MEXC FinCEN order remains incomplete, though Treasury’s claim of at least $16 billion in illicit volume is already on the record.

Explore more on this topic with Vexel Search.

The United States has sanctioned eight Canadian money exchange businesses it accuses of helping Iranian entities get around financial restrictions, widening a pressure campaign that now reaches deep into North American financial services. The US Treasury announced the designations on Friday, saying the firms are based in Ontario and British Columbia.

What the Treasury says the firms did

According to the Treasury, the businesses handled transactions with sanctioned Iranian digital-asset exchanges and with crypto addresses linked to Iran’s Islamic Revolutionary Guard Corps (IRGC). The department also says they converted Iranian rials and other currencies into digital assets, which allowed money to move across borders. One report on the announcement adds that some of the firms allegedly helped an alleged head of a drug-trafficking ring. These are the Treasury’s allegations, and the sources do not include responses from the companies.

The named businesses include Million Exchange, Amin Exchange and Cryptoyal, along with several others operating under corporate names such as Diverse Trade Inc, Top PC Technician Inc and NIA Nations Currency Ltd. The Treasury also said some of the entities changed their names and addresses to avoid detection.

What the sanctions actually do

Being designated effectively isolates a company from the dollar-based financial system. Any assets the firms hold in the US are frozen, and American people and entities are barred from dealing with them. For a currency-exchange business, losing access to dollar channels can be crippling even if it never operates on US soil.

Treasury Secretary Scott Bessent framed the move as a message to Ottawa’s financial sector as much as to Tehran. “Canada cannot be a safe haven for illicit financial facilitators that provide sanctions evasion services to the Iranian regime and its proxies,” he said. The Treasury is calling the broader effort “Operation Economic Outcast.”

Canada’s role in the Canadian money exchange action

The action was not unilateral. Canada’s financial intelligence unit, FINTRAC, said it worked with the US Financial Crimes Enforcement Network (FinCEN) and described routine intelligence-sharing with foreign counterparts to combat money laundering, terrorist financing and sanctions evasion. The IRGC is also listed as a terrorist organisation in Canada, which gives Ottawa its own reasons to cooperate.

Part of a wider push on Iran and crypto

Friday’s announcement came alongside other measures. FinCEN issued an order barring US financial institutions from processing transfers involving Seychelles-incorporated exchange MEXC Global, which it says facilitated at least $16 billion in illicit transactions linked to Iran, North Korea and Russia. Separately, the State Department’s Rewards for Justice program offered up to $20 million, plus possible relocation, for information on Iran’s nuclear program, including its facilities, equipment and personnel. The announcement cited the International Atomic Energy Agency’s loss of “continuity of knowledge” about Iran’s enriched uranium production.

Earlier in the week, the Treasury targeted a network in India and Turkiye that it says helped Iran evade limits on oil exports and airline operations. Washington also claims the campaign has pushed Iran’s rial to new lows and driven inflation to about 90 percent, a figure that comes from the US side and was not independently verified in the sources.

Taken together, the steps show a strategy built on following money wherever it moves: through small exchange houses, crypto platforms and third-country trading networks. The Canadian money exchange designations suggest Washington sees smaller, lightly scrutinised intermediaries in allied countries as a significant weak point in its sanctions regime. The cases will also test how far Ottawa and Washington will keep aligning on enforcement.

Explore more on this topic with Vexel Search.

The Gnosis Pay breach has left an unknown number of stablecoin card customers with personal details in the hands of an unauthorised party, including home addresses. The company, which issues white-label stablecoin cards, says it detected unauthorised access on November 3 to the system behind its Gnosis Pay-branded cards, the consumer-facing (B2C) side of its business.

What the Gnosis Pay breach exposed

According to the notice sent to customers, the exposure was uneven. Some users were told that the affected data was their name as printed on the card, their shipping address and their Gnosis Pay account reference. That is a modest-sounding list, but a name paired with a physical address is exactly the kind of information that can be used for targeted phishing or other social-engineering attempts.

Others appear to have been hit harder. Lefteris Karapetsas, founder of the crypto portfolio tool Rotki, shared that his notification said the compromised information included his full home address, his name, his card number and every wallet address linked to his account. Linking wallet addresses to a real name and address matters in crypto, where on-chain activity is otherwise pseudonymous. Anyone holding that combination could connect a person’s identity to their public transaction history.

A system already on its way out

Gnosis Pay had already planned to retire the affected system at the end of this year. That timing offers little comfort to customers whose data has already been exposed, but it suggests the company was winding down the platform before the incident came to light. The reports do not say how the intruder got in, how long they had access or how many customers were affected.

The coverage also does not say whether customer funds were touched. The notices described by users focus on exposed information, not stolen assets, but the available reporting does not explicitly address the safety of balances, so users should look for confirmation directly from the company. Protos said it contacted Gnosis Pay for comment and had not received an immediate reply.

Part of a broader run of crypto incidents

The Gnosis Pay breach lands amid a rough stretch for the industry. Recent headlines include a reported $391,000 hack at BitMart, losses at Mercado Bitcoin that were reported at $46 million and still growing, and data leaks affecting users of Coinbase and Bithumb. Binance also dropped SignalPlus API keys after a potential hack. Not all of these involve the same kind of failure, but together they show how often crypto firms are targeted, whether for tokens or for customer data.

For card holders, the practical takeaway is caution. After a breach like this, the immediate risks are unsolicited messages that use accurate personal details to look credible, and the possibility of being tied to known wallet addresses. Treat any unexpected email or text referencing your card or account with suspicion, and rely on the company’s official notice rather than links sent by third parties. Customers who want to know exactly which of their details were affected should check the email Gnosis Pay sent them, since the company indicated the scope differed from person to person.

Explore more on this topic with Vexel Search.

South Korean exchange Gopax shut down trading and standard withdrawals on Friday after a Gopax hacking threat landed in the company’s inbox, and it has not said when normal service will return. The exchange says no funds have been lost. It describes the freeze as a precaution while it moves customer crypto into offline storage.

What Gopax shut down, and when

According to the exchange’s notices, deposits and standard withdrawals stopped at 2:55 p.m. local time (5:55 a.m. UTC). Trading followed at 3:53 p.m., and all unfilled orders were canceled. Customers cannot send coins out through the website or app. They must apply through the customer support center, where each request is checked and approved manually, so processing will be slower than usual.

Reports differ slightly on deposits. Some coverage said they were paused with withdrawals, while a later Korean report cited by Bitcoin Magazine said deposits had been restored and only web and app withdrawals remained shut.

What is known about the threat

A Gopax representative told Korean media the email came from someone claiming they could hack the exchange. The company has not verified that claim. It also said that when services stopped, there had been no hack and no attempted theft. The exchange has framed the move as preventive, aimed at shrinking what an attacker could reach online by shifting remaining hot-wallet balances into cold storage, which is kept disconnected from the internet.

The notices also cited recommendations from financial regulators, following a run of leaks and hacking incidents at financial institutions.

Why regulators and rivals are on edge

The Gopax hacking threat arrives in an unusually tense week for exchange security. South Korea’s Financial Services Commission recently urged domestic platforms to raise their cold-wallet holdings after the roughly $6.3 billion theft from Binance’s hot wallets on Oct. 29. Bitcoin Magazine reports the FBI has tied that attack to North Korea, and that Binance says it is covering customer losses from its own funds. Brazil’s Mercado Bitcoin also froze deposits and withdrawals this week after a security incident, with preliminary estimates of suspicious transfers near $40 million.

Korean exchanges must keep at least 80% of customer crypto offline. Financial Supervisory Service data showed Gopax held 80.54% offline at the end of September, only a sliver above the line. That makes a push toward deeper cold storage look as much like a compliance cushion as a response to one email.

Gopax’s record is also under scrutiny. In October the FSC reported cybersecurity deficiencies at 130 of 555 financial companies it reviewed. It named Gopax operator Streami, along with exchange Prabang, among 16 firms tied to earlier security incidents. Prabang suspended services on Oct. 24 after abnormal hot-wallet withdrawals and reported losses of about 100 million won (roughly $70,000), which it said it would reimburse.

Separately, Yonhap reported that abnormal access to some Gopax user accounts since early September leaked personal information on seven customers and two current or former employees, with further leakage confirmed last month. The company treats that as distinct from Friday’s email, and no link has been confirmed.

What to watch next

For customers, the practical result is a queue. Coins are being parked offline while support staff approve outgoing transfers one at a time. The key questions are whether Gopax finishes the cold-wallet transfer, clears withdrawal requests without any loss, and gives a date for trading to resume. The company has not commented beyond its notices, and Cointelegraph and crypto.news both said their requests for comment went unanswered. Until the threat is either substantiated or dismissed, the Gopax hacking threat remains an open question hanging over an exchange that regulators were already watching closely.

Explore more on this topic with Vexel Search.

The Greece crypto tax is now law: lawmakers in Athens voted on Thursday, Nov. 5, 2026, to tax cryptocurrency profits at 10% from Jan. 1, 2027. It is the country’s first dedicated framework for taxing digital assets. The measure was part of a wider bill covering loan oversight, debt protections and financial market rules, and it lands below the 15% rate floated in an earlier October draft.

How the Greece crypto tax works

The levy applies to net gains, meaning the difference between what an investor paid for an asset and what it was sold for, not the full sale proceeds. According to the reports, trading fees and related costs can be factored into that calculation. Simply holding a coin that rises in value does not trigger a bill.

A taxable event is not limited to cashing out into euros. Spending crypto on goods or services can also realize a gain, and so can contributing it to a company’s capital. Swapping one token for another is intended to stay outside the tax net, according to the explanatory material cited by Bitcoin Magazine. Bitcoinist adds that parliamentary legal reviewers have raised questions about the exact wording on that point, so the treatment of swaps may still need to be clarified.

The €500 exemption is a threshold, not an allowance

Annual net gains of up to €500 (about $560) are exempt. Coverage differs slightly on what happens above that line. Cointelegraph describes an exemption for investors whose gains “do not exceed” €500. Bitcoin Magazine and Bitcoinist, citing Greek analyses of the legislation, say that once a year’s net gains pass the limit, the 10% rate applies to the entire gain rather than only the portion above €500. If that reading holds, the exemption works as a cliff edge that protects only very small traders.

Losses above €500 in a tax year can be carried forward for up to five years. They can be offset only against future crypto gains.

Staking, lending and DeFi income taxed at 15%

Not all crypto income is treated alike. Cointelegraph and Bitcoinist report that returns from staking, crypto lending and providing liquidity to decentralized protocols face a separate 15% tax. Bitcoinist says these returns are classed as interest income. The split means passive on-chain yield is taxed more heavily than profit from trading.

Amnesty window and source-of-funds checks

Two provisions are aimed at bringing past and future activity into the system. Investors get 12 months to voluntarily declare previously unreported crypto gains. They must pay the resulting tax within 60 days of filing to avoid penalties and interest. Bitcoinist adds that the window comes with specific conditions.

From 2027, crypto purchases are also pulled into Greece’s existing “source of funds” checks. Buyers may need to show that the money used came from declared income or another lawful source. Bitcoin Magazine notes this is not a purchase tax, but it widens the audit trail around how holdings were financed.

Enforcement is the open question

A senior finance ministry official told Reuters that further implementation directives, including transparency and audit rules, will be published “in the coming weeks.” The same official said state revenue from the levy could not be projected. Most Greek investors use platforms based abroad, which makes the size of the domestic market hard to measure.

That gap is where the Greece crypto tax will be tested. A 10% rate on paper matters only if authorities can verify cost-basis and transaction data. The EU’s DAC8 rules, which require crypto service providers to report user and transaction data to national tax authorities, should help. Bitcoin Magazine says they have applied since January, and Greece has already written them into domestic law.

Where Greece sits in Europe

Bitcoin Magazine, citing the ministry official, says EU crypto gains rates typically run from about 8% to 30%, with no unified system. By that measure Greece sits toward the lenient end. The outlet contrasts it with France’s often-cited 30% and Cyprus’s 8%. It also notes that the Netherlands is moving toward a realized capital gains tax from 2028, while Germany and Portugal still exempt crypto held for more than a year.

For Greek investors, the rate is settled and the start date is fixed. Details on audits, reporting and the treatment of swaps will come with the ministry’s forthcoming guidance.

Explore more on this topic with Vexel Search.

The Binance hack, the largest crypto theft on record, was not a single clever exploit but a slow-burn campaign that began months before any money moved, according to a postmortem the exchange published on November 3. Binance says attackers combined poisoned software downloads, a bogus recruitment process and access to an internal AI tool to reach the systems that sign wallet transactions.

How the Binance hack unfolded

Binance’s account starts in June, when an engineer on the wallet team looking for an AI coding tool downloaded a tampered installer. Reports differ slightly on the details. One describes a malicious Google ad, another a compromised Homebrew installation. Binance says its security staff caught the malware and replaced the device, but the attackers had already learned who worked on wallet infrastructure and how.

In September, a different engineer was approached through a recruitment platform by someone posing as a project director. The engineer went through a video interview with a supposed HR representative, then another with the “CEO” of a fictitious company. At the end, the engineer was told to download an assignment onto a work computer. Instead, the code swapped the legitimate pyenv development tool for a malicious version that opened a backdoor. Binance says this malware had not been seen before and slipped past its endpoint protection while scrubbing its own traces.

By October 20, the attackers had used that machine and an internal AI tool to take over the computers of two more wallet engineers. One of them held a container deployment token. On October 29, the attackers used it to deploy a container that ran a malicious script reaching the wallet-signing service.

Minutes to move billions

The report says that between 20:05 and 20:09 UTC that day, five hot wallets sent 233.46 million XRP to an attacker-controlled address. Other wallets sent roughly 970,500 SOL, 44.2 million OP and 18,270 BTC. The attackers also used the signing service to set up malicious permissions through Ethereum’s EIP-7702 mechanism, which lets a wallet delegate execution to smart contract code.

That step explains why stopping the theft was so hard. Transfers continued for nearly two hours, even after Binance suspended its normal withdrawals. Because the hot wallet used multi-party computation, Binance says, no single private key existed that could immediately revoke those authorizations.

Who is blamed, and who is paying

The FBI has attributed the theft to a North Korean unit it calls “TraderTraitor.” North Korea has pushed back: Kim Yo Jong, sister of leader Kim Jong Un, called the attribution politically motivated. Attribution is the FBI’s finding, and North Korea has denied involvement.

On the financial fallout, Binance says $2.85 billion in stolen assets has been frozen or intercepted. Its leadership says no user bears the loss. By October 31, it had replenished 98% of the affected tokens and was buying the remaining, less liquid assets. Withdrawals have broadly resumed. Co-founder Yi He said the exchange blocked 57 suspected North Korea-linked threats this year, including fake interviews and malicious packages, but added that “the cost of failing to stop even one was severe.”

The questions that remain

Much of what is known comes from Binance’s own postmortem, which has not been independently verified. Even so, the account raises uncomfortable questions. The Verge notes that it remains unclear why this attack succeeded when the danger of interview tasks that require running code on employer-connected machines has been widely warned about for years. Binance also detected the June intrusion yet still could not stop what followed. And it has not publicly explained how an internal AI tool let an intruder take control of other engineers’ machines.

For the wider industry, the Binance hack is a reminder that the weakest point in a crypto exchange may not be its blockchain code but the laptops of the people who run it. A convincing recruiter and a plausible coding test were enough to start a chain of events that ended with billions leaving the exchange’s wallets in a matter of minutes.

Explore more on this topic with Vexel Search.

French banking group Crédit Mutuel Arkéa has confirmed it suffered a cyberattack that enabled “fraudulent operations,” shortly after onchain investigator ZachXBT named it as the alleged victim of a crypto theft worth more than $133 million. The bank’s statement, as reported by Decrypt, did not mention cryptocurrency and said it is still assessing the amounts involved.

How the $133M figure grew

The estimate climbed over three days. On Monday, ZachXBT flagged more than $106 million in suspicious withdrawals from centralized exchanges. By Tuesday he had raised the total to over $133 million after finding roughly $27 million in further withdrawals, some of which happened after his first warning. On Wednesday he identified the bank as the alleged victim, describing it as an institution with about $235 billion in assets that was exploited over several days.

He also cautioned that the real number may be higher. “I suspect the amount stolen is larger when accounting for OTC activity,” he said, suggesting that over-the-counter deals were not captured in the earlier tallies.

What the bank has and hasn’t said

The gap between the bank’s wording and ZachXBT’s claims is the key point. Crédit Mutuel Arkéa acknowledged an attack and fraud, but its statement, as Decrypt describes it, stops short of confirming that digital assets were taken or that it is the source of the funds ZachXBT traced. The two outlets also differ on timing: Cointelegraph said the bank had not responded to its request for comment when it published, while Decrypt reported the confirmation afterward.

Cointelegraph noted that the bank’s alleged involvement had not been independently verified. ZachXBT has also not explained how the attackers got access to the funds, so the method of intrusion is unknown.

Exchanges respond as funds move

Blockchain analytics firm Bitquery traced withdrawals from accounts at Kraken, Crypto.com and OKX. It found that about $63 million in stablecoins was swapped into Ether within four hours. Swapping out of stablecoins is significant because issuers can freeze them, whereas Ether cannot be frozen the same way.

Kraken and Crypto.com later told Cointelegraph they had restricted accounts or blocked funds tied to the suspected theft. Both said their platforms remained secure. The sources do not say whether OKX took similar action, and they do not report any recovery of funds.

What remains unclear

Several questions are still open. The bank has not said whether the fraudulent operations involved crypto, how much was lost, or how the attackers got in. ZachXBT’s numbers are an onchain investigator’s estimates, not audited losses, and he says they could rise. Until Crédit Mutuel Arkéa finishes its assessment or authorities weigh in, the link between the bank’s confirmed cyberattack and the $133 million in traced withdrawals rests on the investigator’s analysis.

For now, the case shows how quickly stolen crypto can move through major exchanges and how much of the early public picture comes from independent trackers rather than the institutions affected. Any further statement from Crédit Mutuel Arkéa, or from the exchanges that froze funds, should clarify how large the loss is and whether any of it can be recovered.

Explore more on this topic with Vexel Search.

File photo: Accueil du siège social du Crédit Mutuel Arkéa.jpg by FJaffres, CC BY-SA 4.0, via Wikimedia Commons.