Last week the industry counted a hole back up in percentages. This week the useful sentence was shorter: please take what is left and go. Some wallets were already empty. One exchange locked the door after reading an email.

Last Sunday I wrote about denominators: 80, 90, 95, and a hundred that answered a different question.¹ This week the calculator was put down again. In its place came a set of instructions that all pointed at the exit.

Move your remaining funds. Withdraw before the fee starts.

Consider taking action regarding your assets. Or, in one Korean exchange’s case, please wait: we have stopped you from doing any of those things, just in case the threat is real.

It is not progress exactly. It is a different kind of clarity.

A percentage hides the bottom half of a fraction. “Remaining funds” hides something else: remaining after what, and according to whom?

Emptied, for your own good

On Saturday afternoon, users of Keplr who had signed in with Google or Apple began to see balances they did not recognise, including empty ones.²

Keplr, a wallet widely used on Cosmos-based chains, had already paused those login options that morning after reports of unauthorised transactions.³ At 17:17 UTC it went further. A vulnerability in Web3Auth’s infrastructure had led to a private key breach for some social-login users, it said, and those users should move any remaining liquid assets to a wallet they controlled with a recovery phrase or a hardware device.⁴

Web3Auth, eleven minutes earlier, had offered an explanation for at least some of the emptiness. It and its partners had started a whitehat recovery on wallets that were vulnerable but not yet hit, using the same path as the original attacker. Some of those transfers, it added, had been mistaken for the attacker’s. The funds recovered this way were safe.⁵

This is an odd kind of reassurance. Your coins are gone because someone helpful took them first. You are asked to believe that the outgoing transaction on the explorer is a rescue, and that a verified list of recovery addresses will follow. When we wrote this up on Saturday evening, that list was still pending.⁶

I am not sneering at the whitehats. Moving coins out of a wallet whose key has leaked, before the other side does it, is often the least-bad option left.

What I am noting is the week’s most honest sentence, and how little comfort it offers: some of the wallets that emptied were emptied by the rescuers. Nobody had yet published a reliable map of which ones.

Seed-phrase and hardware wallets were not affected, Keplr said. The selling point of social login was that there was no seed phrase to write down, which is still true; it has simply become a different sort of problem.

Asked to leave

In France, and then in a wider set of European inboxes, the instruction was more conventional. Leave, or we will start charging you for staying.

Binance France told customers that deposits were closed and that every account would shut on 31 December. From 29 November, any balance still on the platform would be charged 0.025% a month or 10 USDC, whichever is higher. Users who withdrew everything before that date would pay nothing.⁷

A Binance spokesperson later confirmed to CoinDesk that affected accounts would close with effect from 31 December, as the exchange restricts services after the end of MiCA’s transition period, and that withdrawals of crypto and fiat remain open. Users in Spain, Italy and Poland said they had received similar emails; with France, those are the countries where Binance had run locally registered businesses.⁸ Co-CEO Yi He, replying to users on X, said local regulators require the assets to be held by a third-party custodian and that Binance subsidises the custody fee.⁹

This is not a hack. It is a closing-down sale without the sale: the customer is invited to become their own custodian, on a deadline, because the licensed entity that used to do it is winding up.

The fee is a nudge with a number attached. Ten USDC a month is a small number until you forget about it.

A regulator in Thailand issued a related kind of invitation. The Securities and Exchange Commission said it had filed a criminal complaint against BG Limited, which runs Bitget, alleging an unlicensed exchange for Thai users from 2022 to 2025, and asked the digital ministry to block the site and app from 5 December. Investors were told to “consider taking action regarding their assets held on the platform” before that date.¹⁰

Four weeks to move. After that, the door the customer used may simply stop opening.

Frozen, just in case

Gopax, in Seoul, chose the opposite courtesy.

On Friday it received one email threatening a hack. Around 14:55 Korea time it suspended withdrawals; at 15:53 it suspended trading. It said it had not confirmed a breach or a loss, and that it was moving customer assets to cold wallets. It later said it had reported the matter to the financial authorities, that it had no restart date, and that some manual withdrawals were being handled through support.¹¹

Read next to Keplr, the contrast is almost tidy. One set of users stared at empty balances and was told the emptiness was protection.

Another set of users stared at balances they could not touch and was told the freeze was protection. In both cases the customer is asked to treat inaccessibility as a favour.

I do not say Gopax was wrong to halt. An exchange that waits for proof of a breach before isolating wallets is sometimes the exchange that writes the post-mortem. I say only that “no breach confirmed” and “you cannot have your coins” can be true at the same time, and that this is a sentence the industry has become fluent in.

Elsewhere, the week’s other incidents were smaller and, in their way, clearer. Gnosis Pay said unauthorised access to the system behind its own-brand crypto debit cards had exposed customer information; funds, it said, were not affected.¹² SignalPlus, a trading terminal, said a fake Microsoft Teams invite sent from a vendor contact’s hijacked Telegram account had led Binance and Deribit to revoke every customer API key linked to it. It put losses below $82,000 and promised full repayment.¹³

Clear figures are a relief after a week of remaining funds. They are also a reminder that the large number is still the one from 29 October.

Incident ledger

  • Binance · about $6.3 billion taken on 29 Oct, on Binance’s figure. The FBI attributes the theft to North Korea’s TraderTraitor. Elliptic said at 08:00 UTC on 7 Nov that about 2,300 BTC, roughly $175 million, had been converted into new bitcoin addresses, mostly via XRP swapped through THORChain, and that only a negligible amount had likely been turned into spendable money. Elliptic’s update · the FBI’s attribution.
  • Keplr / Web3Auth · unauthorised transactions on some Google and Apple login wallets; Keplr called it a private key breach and told those users to move remaining liquid assets. Web3Auth said it had run whitehat sweeps that may explain some empty balances. No official loss total. Saturday evening’s alert.
  • Gopax · withdrawals and trading halted on 6 Nov after a threat email; no breach or loss confirmed; restart unset. the Gopax halt.
  • Gnosis Pay · customer data exposed from the legacy card system after unauthorised access on 3 Nov; funds untouched, the company says. the card-data breach.
  • SignalPlus · fake Teams invite; Binance and Deribit revoked linked API keys; losses put below $82,000, with repayment promised. the SignalPlus breach.
  • Bitget, for Thai users · not a hack: a regulator complaint and a planned access block from 5 Dec, with users told to deal with assets first. the Thai complaint.
  • Binance France (and, CoinDesk reported, Spain, Italy and Poland) · not a hack either: accounts to close on 31 Dec, with a monthly fee from 29 Nov on anything left behind. the closure notice.

Running total: not summed. Binance says it bears its own loss; Keplr has not published a figure; Gopax has not confirmed a loss; two of the week’s largest service notices are closures and freezes rather than thefts. Adding them would produce a total of unlike things.

Elsewhere

  • Seventeen more companies objected to OKXICE trading tokenized versions of their shares, taking the list to 67. Apple and Meta joined, so every Magnificent Seven name has now opted out of that venue: the latest objections.
  • Binance named Justin Yek, lately of Airwallex, as chief financial officer as Kaiser Ng left after more than five years. The exchange said the handover had been planned for six months, and announced it nine days after the theft: the finance-chief change.
  • The US Treasury moved to cut MEXC Global off from American funds transfers, citing at least $16 billion in alleged illicit flows: FinCEN’s order.
  • China’s central bank said it had halted Solana’s Shanghai events and would investigate the advertising behind them: the PBoC’s action.

Close

Last week I suggested that when someone hands you a percentage, you ask for the bottom half. This week the question is ruder, and more useful.

Remaining after what, emptied by whom, frozen until when — and if the instruction is to leave, does the door still open?

See you next Sunday. — L.C.

Footnotes

  1. The Percentage Week, 1 Nov.
  2. User reports collected in Keplr’s remaining-funds alert; Keplr did not publish a count of affected wallets.
  3. Keplr on X, 7 Nov, 04:38 UTC; see the social-login pause.
  4. Keplr on X, 7 Nov, 17:17 UTC.
  5. Web3Auth on X, 7 Nov, 17:06 UTC.
  6. Our alert of 7 Nov, 21:37 UTC. Web3Auth said a verified list of recovery addresses was being prepared.
  7. Binance France email as published by Cryptoast, 7 Nov; see our report.
  8. CoinDesk, 7 Nov, citing a Binance spokesperson and user reports from Spain, Italy and Poland.
  9. Yi He on X, 7 Nov; translated from Chinese in our update to that report.
  10. Thailand SEC, News 241/2026, 5 Nov; see our report.
  11. Gopax notices of 6–7 Nov; see our report, including the 7 Nov update.
  12. Gnosis Pay’s card-data breach.
  13. the SignalPlus breach. North Korea is named above only as the FBI’s attribution of the Binance theft; it has previously denied hacking allegations.

References

  • Keplr on X, 7 Nov 2026. https://x.com/keplrwallet/status/2119117067500806350
  • Web3Auth on X, 7 Nov 2026. https://x.com/Web3Auth/status/2119114303907196932
  • Cryptoast, Binance France account closure, 7 Nov 2026. https://cryptoast.fr/binance-annonce-cloture-comptes-utilisateurs-francais-31-decembre/
  • CoinDesk, Binance users in some European countries told to pull crypto, 7 Nov 2026. https://www.coindesk.com/business/2026/11/07/binance-users-in-some-european-countries-told-to-pull-crypto-before-fees-kick-in-with-accounts-closing-by-year-end
  • Thailand SEC, News 241/2026, 5 Nov 2026. https://www.sec.or.th/EN/Pages/News_Detail.aspx?Lang=EN&NewsNo=241&NewsYear=2026&SECID=13530
  • Elliptic, update stamped 08:00 UTC, 7 Nov 2026. https://www.elliptic.co/insights/how-north-korea-is-laundering-the-6-4-billion-stolen-from-binance/

Related: The next Sunday Ledger, The Spare Key Week, looks at where this week's keys and passwords had been kept

This article is for information only and is not investment advice.