A newly published iOS flaw known as worse_query could let a malicious app read files belonging to other apps on an iPhone, including crypto wallet seed phrases, and Apple has not said whether its newest updates close the hole. Binance raised the alarm on Tuesday, Nov. 10, urging users to check what is installed on their phones.

What the iOS flaw does

The bug is a sandbox escape. iOS normally walls each app into its own container so that one program cannot browse another’s data. A researcher posting as forcequitOS put worse_query on GitHub on Nov. 8, and Cointelegraph reports the researcher credited another researcher, 0xjohnny. The project’s documentation lists reachable locations such as other apps’ data containers and shared app group folders. It says the technique works on iOS 26.0 through 26.7.2 and on iOS 27.2, a wider span than the three versions Binance named: 26.7.1, 27.0.1 and 27.2.

The researcher calls the release a proof of concept for developers and stresses that it is not a jailbreak and is not useful by itself. Someone still has to build it into an app. That has already happened: developer Christoph Kolbicz published a file manager based on it that lets users browse and edit app data on iOS 27 without jailbreaking, which he said he tested on iOS 27.0.1.

How worried should wallet users be?

Binance stressed that this is “an iOS-level issue, not unique to Binance,” and a spokesperson said the exchange has found no confirmed cases of attackers using worse_query to reach wallets or steal funds. The researcher has not reported any thefts either.

Blockchain security firm SlowMist offered a more measured reading. Its chief information security officer wrote that the flaw cannot steal assets on its own. The danger arises when a user installs and runs an untrusted app, such as a sideloaded or manually signed IPA file, and only if a wallet keeps mnemonic phrases, keystores or cached data in plain text on the device. Wallets that avoid writing secrets to readable files are not exposed in the same way, and hardware wallets keep private keys off the phone entirely.

Apple’s update leaves a gap

Apple released iOS 27.2.1 and iOS 26.7.3 on Nov. 9, one day after the code went public. The published security notes mention fixes for AirPlay, Bluetooth pairing, brotli and other components, but they do not name worse_query or describe a sandbox escape like this one. Whether the updated builds block the technique therefore remains unclear. Cointelegraph said it asked Apple for comment and had not heard back by publication.

Until that is settled, Binance’s advice is basic hygiene. Delete apps from untrusted sources, update iOS and every app to the latest official versions, and, if you suspect a compromise, move funds to a new wallet created on a clean device and reset all active login sessions.

The warning lands at a tense moment for the exchange, which Bitcoin Magazine says lost $6.34 billion in an Oct. 29 attack that began with a fake job interview. For ordinary iPhone users, the practical takeaway is narrower than the headline suggests: the risk hinges on installing software from outside the App Store and on how carefully a wallet app stores its secrets.

Explore more on this topic with Vexel Search.

File photo: Apple iPhone Duo.jpg by SimonWaldherr, CC BY 4.0, via Wikimedia Commons.

Six companies, including Coinbase and Kalshi, have asked a federal court to let them defend the US derivatives regulator in a lawsuit that could decide the future of stock perpetual futures in the United States. The proposed friend-of-the-court brief arrives days after a judge signaled the regulator may have overstepped.

According to the filing shared by a Coinbase legal representative, the group also includes Kraken’s parent company Payward, trading firms DRW Holdings and Jump Trading, and crypto investment firm Paradigm Operations. Their request to submit the brief is still pending.

How the dispute began

The CFTC announced on Nov. 3 that single-stock perpetual futures, often called stock perps, could begin trading on US-regulated exchanges for the first time. According to one report, applications from KalshiEX, Coinbase Derivatives and Bitnomial, which is linked to Payward, were filed in mid-September. The products were treated as approved when a 45-day review window closed on Nov. 2 without objection.

Stock perps let traders bet on the price of an individual company’s shares without owning them. Unlike conventional futures, they never expire. Positions can be held indefinitely, and periodic funding payments keep the contract price close to the underlying stock. The design is a staple of crypto markets, and this is its first approved move onto US-listed equities.

The Capital Markets Alliance Association (CMAA), a newly formed group whose members include Cboe and Citadel Securities, sued the CFTC shortly afterward. Its argument is that a contract with no fixed expiration date is not a security future at all. In its view, the product is a security-based swap, a category the Securities and Exchange Commission primarily oversees and one that carries tighter limits on retail trading.

A judge’s warning, but no halt

US District Judge Valerie Caproni gave the challengers an early boost. She said the CMAA was likely to succeed in arguing that the CFTC exceeded its statutory authority, and that the contracts appear to satisfy the definition of a swap. But she denied a temporary restraining order because the group had not shown imminent, irreparable harm. The CFTC’s approvals therefore remain in place while the case goes on.

That leaves an unusual situation. The products can trade, yet the only judicial view on the merits so far leans against the agency that allowed them. The CMAA is due to file its reply to the CFTC’s opposition to a preliminary injunction, the next major step in the case.

What the six firms argue

The companies in the proposed brief say nothing in the law requires a fixed expiration date for a contract to qualify as a security future. They contend that stock perpetual futures fit within the joint CFTC and SEC framework Congress created in 2000, and need not be moved wholesale into the SEC’s swap regime.

They also have a stake in the outcome. Coinbase and Kalshi are among the exchanges that sought to list the products, and supporters argue that regulated onshore access gives US traders an alternative to offshore venues. Critics from traditional finance, by contrast, point to concerns about market structure, leverage and risk to retail investors.

Why the ruling matters beyond one product

The case is also a test of whether decades-old commodity and securities statutes can absorb instruments built for crypto markets. If the court sides with the CMAA, retail access to stock perps could be curtailed and the onshore market slowed before it gets started. If the CFTC’s reading holds, other hybrid products that pair crypto-style design with traditional underlying assets may find an easier path to approval.

For now, trading continues on the approved platforms, but the legal footing remains uncertain. The judge’s early comments suggest the CFTC faces an uphill argument, and the six firms’ brief is an attempt to shift that balance before a decision on the injunction.

Explore more on this topic with Vexel Search.

Binance hack launderers are turning the internet’s meme-coin craze into a cover for moving stolen money, according to blockchain analytics firm Elliptic. Decrypt reports that the firm says the hackers are minting their own worthless tokens, some with cartoon animal logos and others with Elon Musk branding, and sending stolen funds through liquidity pools to break the trail.

The source material for this story is limited. It consists of a summary and the opening lines of a Decrypt report published November 9, 2026, so several details are not available here. They include how much was stolen, when the Binance incident happened, which tokens were created, and how much money passed through them. This article does not guess at those figures.

How the meme-coin laundering tactic works

Decrypt’s summary says the hackers create tokens that have no real purpose or value, then swap stolen assets for them using liquidity pools. These are the automated trading pools that let people exchange one token for another on decentralized platforms. Decrypt’s opening lines tie the activity to North Korea’s launderers, and the report’s image caption refers to North Korea and hacking. The summary does not make clear whether Elliptic itself attributes the activity to North Korea.

The logic is easy to see. When the people who create a token also control the pool, they can put stolen funds in and take different assets out. On a blockchain ledger, that looks like ordinary trading in a meme coin, a category that already produces huge volumes of speculative activity. Analysts tracing stolen money then have to sort real market activity from deliberate obfuscation.

Why Binance hack launderers are choosing meme coins

Meme coins are a convenient disguise. Thousands of them launch every day, many carry jokey branding, and most vanish quickly. A token with a cartoon animal or a celebrity face attracts little suspicion in that crowd. Binance hack launderers who adopt the same look can hide in plain sight, though that is an inference from the pattern described, not a claim made in the source.

The approach also shows how laundering methods keep changing. Investigators have long watched for stolen funds moving through mixers, bridges and exchanges. Self-made tokens and liquidity pools add another layer. Each swap creates a new on-chain record that has to be linked back to its origin.

What to watch next

The report raises questions that the available text cannot answer. Will Elliptic or exchanges publish the token addresses so others can flag them? Will decentralized platforms act against pools tied to the stolen funds? And how much of the haul has actually been obscured this way? Readers who want those details should consult Elliptic’s findings and the full Decrypt report directly.

For now, the core claim is simple and notable. Binance hack launderers, as described by Elliptic, are not just moving stolen crypto between wallets. They are building fake markets around tokens made for the purpose and using the meme-coin economy as cover.

Explore more on this topic with Vexel Search.

File photo: 5 years birthday Binance cake in Paris – 2022-07-08.jpg by Bretwa, CC BY-SA 4.0, via Wikimedia Commons.

A newly formed company wants to bring round-the-clock tokenized stock trading to Solana, and it is relying on a fresh SEC carve-out to do it. Formation Securities said on Nov. 9 that it has notified the US Securities and Exchange Commission of plans to open a venue in early 2027. Tokenized shares of Galaxy Digital, Exodus Movement and Forward Industries are expected at launch.

Formation is licensing technology from the decentralized exchange Orca. It intends to operate under the SEC’s temporary Innovation Exemption, announced in September. According to the sources, the exemption lets verified investors trade certain US-listed shares at any hour while keeping voting, dividend and other shareholder rights. One report adds that operators can use it without registering as a traditional securities exchange.

How the Solana venue would work

The design leans on crypto-native plumbing. The venue would use automated market maker technology rather than a traditional order book. Investors could hold tokenized shares in their own wallets and settle trades onchain against stablecoins and other eligible assets. Buyers and sellers would be paid in a single blockchain transaction.

Superstate and Securitize are expected to supply the tokenized shares. Traditional transfer agents would still keep official shareholder records, which preserves each company’s direct relationship with its investors. Formation plans to distribute access through partners including Alpaca, Passage by CoinList, Anchorage Digital Bank, BitGo Bank & Trust, Fireblocks, Solflare and Squads. Participation would be limited to people who pass identity verification and meet eligibility rules.

Issuer consent is the pressure point

Formation is stressing that it will court companies rather than go around them. “Tokenized stocks will succeed only if public companies see the value in them, and we intend to build this market together with issuers,” President Christopher Montagano said. The pitch is a pointed contrast with a rival effort. As of early November, more than 50 companies had objected to having their shares tokenized on OKXICE, a proposed venue backed by OKX and NYSE parent Intercontinental Exchange.

The exemption gives issuers a formal say. Venues must notify companies in writing and wait at least 30 calendar days before listing shares tokenized by unaffiliated third parties. Nasdaq has also cautioned that tokenized stock trading could have unforeseen effects on liquidity, price discovery and long-term shareholder value.

Solana’s place in the tokenized equity race

Solana is already a significant player. RWA.xyz data cited by Cointelegraph put tokenized stock value on the network at about $575 million as of Monday. That trails Ethereum at $747 million and BNB Chain at $1.7 billion. A dedicated venue could help close that gap, though the sources offer no projections.

Plenty remains uncertain. Formation has not started trading, and the proposal stays subject to the exemption’s conditions. The exemption permits conditional trading but does not guarantee that any particular venue will be approved. Whether enough issuers consent beyond the three named companies may decide how far this model gets. For now, the plan shows how quickly the industry is moving to test the SEC’s new framework.

Solana is on track to get another tokenized stock venue. Formation Securities has notified the U.S. Securities and Exchange Commission of its plans, according to a Decrypt report published November 9, 2026. The firm intends to operate under the SEC’s “Innovation Exemption” and to list tokenized shares of three companies in early 2027: Exodus, Forward Industries and Galaxy Digital.

The most notable detail is the promise of parity with traditional equity. According to the report, the tokenized shares are meant to carry the same voting and dividend rights as the underlying real stock. That separates this approach from products that give traders only price exposure to a company without the rights of a shareholder. How those rights would be recorded and exercised in practice is not spelled out in the material available.

What the Formation filing signals for tokenized equities

Describing Formation’s plan as “another” Solana venue implies a growing field of platforms putting stock-linked assets on the network. The three initial names are all companies with ties to crypto or digital assets, which suggests the launch will lean on issuers already comfortable with blockchain-based markets rather than a broad slice of the S&P 500. That is an inference from the list, not something the report states.

The reference to an “Innovation Exemption” matters as well. Operating under a formal exemption, and telling the SEC in advance, points to a regulated path to market rather than an offshore or unregistered one. Any such exemption would carry conditions, and the report’s summary does not list them.

What remains unclear

The material available offers only a brief outline, and several key questions are unanswered. It does not say how the tokenized shares will be custodied or settled, who will be eligible to trade them, or what fees the platform will charge. It also does not say whether the three companies have formally agreed to participate. The early-2027 timeline is a plan, not a guarantee, and it could shift depending on how the SEC responds.

For now, the filing is best read as a sign of intent and a test of how far regulators will let on-chain equities go. If Formation delivers shares with full voting and dividend rights, this tokenized stock venue could become a reference point for how tokenized equities are structured in the U.S. Until the launch details are public, much of that remains speculation.

Vitalik Buterin is urging investors and developers to rethink how Ether is valued, arguing that the ETH store of value case is sturdier than the idea of ETH as a token whose worth comes from burning transaction fees. The Ethereum co-founder laid out his view in a post on X on November 8, 2026, as ETH traded near $2,240.

Why Buterin Is Questioning the Fee-Burn Thesis

The fee-burn argument took hold after EIP-1559, the upgrade that destroys part of each transaction fee. The pitch was that heavy network use would shrink ETH’s supply over time and reward holders. Buterin did not call for removing the mechanism. He said EIP-1559 should stay in place even when burning does not offset new token issuance. But he doubts burns can reliably anchor the asset’s price.

He illustrated the problem with a simple valuation example. If a network burned $1 billion in tokens each year and a 4% discount rate was applied, the stream could be said to justify a $25 billion valuation, much like recurring income supports a company’s value. Buterin’s objection is that this math assumes the revenue stays stable, which is hard to count on if the token’s own price drops.

“ETH as fee-burning token never was as strong as it seemed,” he wrote. He pointed to the surge in burning between 2021 and 2023, when NFT trading and decentralized finance drove intense demand for block space. In his telling, much of that activity depended on wealth already circulating inside crypto markets. A sharp fall in ETH’s price could shrink the spending that produced the fees in the first place.

Affordability, Decentralization and Outside Pressure

Buterin also made a design argument. Optimizing Ethereum to maximize fee revenue, he suggested, could conflict with keeping the network affordable, decentralized and hard for outside forces to capture. In his view, Ethereum’s long-term reliability matters more than squeezing out higher fees for token holders.

That is where the ETH store of value framing comes in. Under it, the asset’s appeal rests on the network’s decentralization, censorship resistance, privacy and security, rather than on a cash-flow model. Buterin described these as the foundations of his preferred long-term investment case.

The Market Backdrop for the ETH Store of Value Debate

The timing reflects how Ethereum’s economics have changed. Layer-two networks have grown and pulled activity off the main chain, which has reduced mainnet fee burning. During quieter periods, Ethereum issues more ETH than it burns. That undercuts the “ultra-sound money” narrative that once depended on burns outpacing issuance.

Buterin acknowledged that tokenized real-world assets now give Ethereum more financial activity tied to conventional markets. The source material available for this report cuts off before the rest of his comments, so the full detail of how he weighs that development, and of his remaining reasons, is not covered here. He said he had three primary reasons for his position, and only the first and part of the second were visible.

The post is a statement of Buterin’s own view, not a protocol change, and it does not settle how the market will price ETH. It does signal where one of Ethereum’s most influential voices wants the conversation to go. Rather than a race to maximize burned fees, he is pushing the community to treat durability and resistance to capture as the core of ETH’s value. Whether investors who built models around fee burns will agree remains an open question.

Explore more on this topic with Vexel Search.

File photo: VitalikButerinProfile.jpg by Romanpoet, CC BY-SA 4.0, via Wikimedia Commons.

The MEXC FinCEN order, issued Friday by the Treasury Department’s Financial Crimes Enforcement Network, is designed to sever the offshore crypto exchange from the American financial system. Treasury alleges the platform facilitated at least $16 billion in illicit flows between May 2021 and May 2026. Reuters reported the same cut-off, and Treasury described it as part of an effort it calls Operation Economic Outcast.

What the MEXC FinCEN order actually does

FinCEN’s final order finds MEXC to be a “primary money laundering concern in connection with Russian illicit finance,” using authority under section 9714(a) of the Combating Russian Money Laundering Act. Once the order is published in the Federal Register, covered U.S. financial institutions will have 30 days before they are barred from any funds transfer to or from MEXC, including transfers of convertible virtual currency. As of Friday evening, the Register’s public index showed no MEXC notice, so that clock has not yet started.

The order covers MEXC Global and several named affiliates and successors outside the United States. These include a Seychelles-incorporated entity, an Estonian company, a Swiss firm and a U.K. company. Institutions that willfully violate the ban could face civil or criminal penalties.

It is not a sanctions designation by the Treasury’s Office of Foreign Assets Control, and the order says it does not rewrite existing Bank Secrecy Act duties or OFAC rules. It is a funds-transmittal prohibition, not a proposed rulemaking under Section 311 of the USA PATRIOT Act.

The allegations behind the cut-off

The Treasury’s numbers are specific. Of the $16 billion total, nearly $1.5 billion is tied to Russian sanctions evasion, and about $22 million is linked to Iran’s central bank and the Islamic Revolutionary Guard Corps’ Qods Force. FinCEN also cites roughly $1 billion in direct traffic with more than 40 Iranian crypto exchangers, nearly $26 million with the OFAC-sanctioned A7 sanctions-evasion network, and almost $200 million tied to the A7A5 stablecoin. North Korean facilitators and cybercrime flows are also alleged.

Treasury says MEXC was still processing trades with the sanctioned exchange Garantex and its successor, Grinex, as recently as June 2026, more than four years after OFAC designated Garantex. These are Treasury’s allegations. MEXC had not publicly responded as of Friday, and its main X account kept posting marketing content through the afternoon.

Who feels it, and who doesn’t

Founded in 2018, MEXC is among the world’s 20 largest centralized crypto venues by volume. Treasury puts its daily turnover above $1 billion, its reserves near $5 billion as of mid-2026, and its reach at more than 170 countries. The exchange already lists the United States as a prohibited jurisdiction in its user terms. That suggests the MEXC FinCEN order will mostly hit any remaining dollar rails, banking partners and counterparties that still touch U.S. institutions, rather than American retail traders.

Regulators elsewhere had already flagged the platform. The U.K. Financial Conduct Authority put MEXC Global Ltd on its warning list as unauthorized in March 2024. Hong Kong’s Securities and Futures Commission warned that same month that it was marketing to local investors without a licence. In May 2026, Seychelles’ Financial Services Authority said it had acted against MX Global Ltd for unlicensed virtual-asset operations, an action FinCEN footnotes in its order.

A familiar template, and open questions

The approach follows earlier 9714 actions, such as the one against the exchange Bitzlato. It also arrives during a busy week of sanctions activity touching crypto, including North Korea-related designations and an action against an Iranian exchange.

The practical effect is that U.S. banks, money transmitters and other covered firms will be unable to move dollars or crypto to MEXC accounts once the ban takes hold. Offshore users may still trade peer-to-peer, but any bank clearing for the exchange would take on legal risk. What remains unclear is how MEXC responds: it could contest the finding, seek an exemption, or quietly reroute its liquidity. Until the Federal Register notice appears, the timeline for the MEXC FinCEN order remains incomplete, though Treasury’s claim of at least $16 billion in illicit volume is already on the record.

Explore more on this topic with Vexel Search.

The United States has sanctioned eight Canadian money exchange businesses it accuses of helping Iranian entities get around financial restrictions, widening a pressure campaign that now reaches deep into North American financial services. The US Treasury announced the designations on Friday, saying the firms are based in Ontario and British Columbia.

What the Treasury says the firms did

According to the Treasury, the businesses handled transactions with sanctioned Iranian digital-asset exchanges and with crypto addresses linked to Iran’s Islamic Revolutionary Guard Corps (IRGC). The department also says they converted Iranian rials and other currencies into digital assets, which allowed money to move across borders. One report on the announcement adds that some of the firms allegedly helped an alleged head of a drug-trafficking ring. These are the Treasury’s allegations, and the sources do not include responses from the companies.

The named businesses include Million Exchange, Amin Exchange and Cryptoyal, along with several others operating under corporate names such as Diverse Trade Inc, Top PC Technician Inc and NIA Nations Currency Ltd. The Treasury also said some of the entities changed their names and addresses to avoid detection.

What the sanctions actually do

Being designated effectively isolates a company from the dollar-based financial system. Any assets the firms hold in the US are frozen, and American people and entities are barred from dealing with them. For a currency-exchange business, losing access to dollar channels can be crippling even if it never operates on US soil.

Treasury Secretary Scott Bessent framed the move as a message to Ottawa’s financial sector as much as to Tehran. “Canada cannot be a safe haven for illicit financial facilitators that provide sanctions evasion services to the Iranian regime and its proxies,” he said. The Treasury is calling the broader effort “Operation Economic Outcast.”

Canada’s role in the Canadian money exchange action

The action was not unilateral. Canada’s financial intelligence unit, FINTRAC, said it worked with the US Financial Crimes Enforcement Network (FinCEN) and described routine intelligence-sharing with foreign counterparts to combat money laundering, terrorist financing and sanctions evasion. The IRGC is also listed as a terrorist organisation in Canada, which gives Ottawa its own reasons to cooperate.

Part of a wider push on Iran and crypto

Friday’s announcement came alongside other measures. FinCEN issued an order barring US financial institutions from processing transfers involving Seychelles-incorporated exchange MEXC Global, which it says facilitated at least $16 billion in illicit transactions linked to Iran, North Korea and Russia. Separately, the State Department’s Rewards for Justice program offered up to $20 million, plus possible relocation, for information on Iran’s nuclear program, including its facilities, equipment and personnel. The announcement cited the International Atomic Energy Agency’s loss of “continuity of knowledge” about Iran’s enriched uranium production.

Earlier in the week, the Treasury targeted a network in India and Turkiye that it says helped Iran evade limits on oil exports and airline operations. Washington also claims the campaign has pushed Iran’s rial to new lows and driven inflation to about 90 percent, a figure that comes from the US side and was not independently verified in the sources.

Taken together, the steps show a strategy built on following money wherever it moves: through small exchange houses, crypto platforms and third-country trading networks. The Canadian money exchange designations suggest Washington sees smaller, lightly scrutinised intermediaries in allied countries as a significant weak point in its sanctions regime. The cases will also test how far Ottawa and Washington will keep aligning on enforcement.

Explore more on this topic with Vexel Search.

The Gnosis Pay breach has left an unknown number of stablecoin card customers with personal details in the hands of an unauthorised party, including home addresses. The company, which issues white-label stablecoin cards, says it detected unauthorised access on November 3 to the system behind its Gnosis Pay-branded cards, the consumer-facing (B2C) side of its business.

What the Gnosis Pay breach exposed

According to the notice sent to customers, the exposure was uneven. Some users were told that the affected data was their name as printed on the card, their shipping address and their Gnosis Pay account reference. That is a modest-sounding list, but a name paired with a physical address is exactly the kind of information that can be used for targeted phishing or other social-engineering attempts.

Others appear to have been hit harder. Lefteris Karapetsas, founder of the crypto portfolio tool Rotki, shared that his notification said the compromised information included his full home address, his name, his card number and every wallet address linked to his account. Linking wallet addresses to a real name and address matters in crypto, where on-chain activity is otherwise pseudonymous. Anyone holding that combination could connect a person’s identity to their public transaction history.

A system already on its way out

Gnosis Pay had already planned to retire the affected system at the end of this year. That timing offers little comfort to customers whose data has already been exposed, but it suggests the company was winding down the platform before the incident came to light. The reports do not say how the intruder got in, how long they had access or how many customers were affected.

The coverage also does not say whether customer funds were touched. The notices described by users focus on exposed information, not stolen assets, but the available reporting does not explicitly address the safety of balances, so users should look for confirmation directly from the company. Protos said it contacted Gnosis Pay for comment and had not received an immediate reply.

Part of a broader run of crypto incidents

The Gnosis Pay breach lands amid a rough stretch for the industry. Recent headlines include a reported $391,000 hack at BitMart, losses at Mercado Bitcoin that were reported at $46 million and still growing, and data leaks affecting users of Coinbase and Bithumb. Binance also dropped SignalPlus API keys after a potential hack. Not all of these involve the same kind of failure, but together they show how often crypto firms are targeted, whether for tokens or for customer data.

For card holders, the practical takeaway is caution. After a breach like this, the immediate risks are unsolicited messages that use accurate personal details to look credible, and the possibility of being tied to known wallet addresses. Treat any unexpected email or text referencing your card or account with suspicion, and rely on the company’s official notice rather than links sent by third parties. Customers who want to know exactly which of their details were affected should check the email Gnosis Pay sent them, since the company indicated the scope differed from person to person.

Explore more on this topic with Vexel Search.

South Korean exchange Gopax shut down trading and standard withdrawals on Friday after a Gopax hacking threat landed in the company’s inbox, and it has not said when normal service will return. The exchange says no funds have been lost. It describes the freeze as a precaution while it moves customer crypto into offline storage.

What Gopax shut down, and when

According to the exchange’s notices, deposits and standard withdrawals stopped at 2:55 p.m. local time (5:55 a.m. UTC). Trading followed at 3:53 p.m., and all unfilled orders were canceled. Customers cannot send coins out through the website or app. They must apply through the customer support center, where each request is checked and approved manually, so processing will be slower than usual.

Reports differ slightly on deposits. Some coverage said they were paused with withdrawals, while a later Korean report cited by Bitcoin Magazine said deposits had been restored and only web and app withdrawals remained shut.

What is known about the threat

A Gopax representative told Korean media the email came from someone claiming they could hack the exchange. The company has not verified that claim. It also said that when services stopped, there had been no hack and no attempted theft. The exchange has framed the move as preventive, aimed at shrinking what an attacker could reach online by shifting remaining hot-wallet balances into cold storage, which is kept disconnected from the internet.

The notices also cited recommendations from financial regulators, following a run of leaks and hacking incidents at financial institutions.

Why regulators and rivals are on edge

The Gopax hacking threat arrives in an unusually tense week for exchange security. South Korea’s Financial Services Commission recently urged domestic platforms to raise their cold-wallet holdings after the roughly $6.3 billion theft from Binance’s hot wallets on Oct. 29. Bitcoin Magazine reports the FBI has tied that attack to North Korea, and that Binance says it is covering customer losses from its own funds. Brazil’s Mercado Bitcoin also froze deposits and withdrawals this week after a security incident, with preliminary estimates of suspicious transfers near $40 million.

Korean exchanges must keep at least 80% of customer crypto offline. Financial Supervisory Service data showed Gopax held 80.54% offline at the end of September, only a sliver above the line. That makes a push toward deeper cold storage look as much like a compliance cushion as a response to one email.

Gopax’s record is also under scrutiny. In October the FSC reported cybersecurity deficiencies at 130 of 555 financial companies it reviewed. It named Gopax operator Streami, along with exchange Prabang, among 16 firms tied to earlier security incidents. Prabang suspended services on Oct. 24 after abnormal hot-wallet withdrawals and reported losses of about 100 million won (roughly $70,000), which it said it would reimburse.

Separately, Yonhap reported that abnormal access to some Gopax user accounts since early September leaked personal information on seven customers and two current or former employees, with further leakage confirmed last month. The company treats that as distinct from Friday’s email, and no link has been confirmed.

What to watch next

For customers, the practical result is a queue. Coins are being parked offline while support staff approve outgoing transfers one at a time. The key questions are whether Gopax finishes the cold-wallet transfer, clears withdrawal requests without any loss, and gives a date for trading to resume. The company has not commented beyond its notices, and Cointelegraph and crypto.news both said their requests for comment went unanswered. Until the threat is either substantiated or dismissed, the Gopax hacking threat remains an open question hanging over an exchange that regulators were already watching closely.

Explore more on this topic with Vexel Search.