The S-Curve

Nvidia opens spy probe as AI's first espionage conviction falls

S-Curve Desk — Mon, 09 Nov 2026 19:09:42 GMT

Prison terms proposed and imposed for former Google engineer Linwei Ding, sentenced 1 September 2026.

Nvidia’s board said on 8 November that it is opening an independent investigation after reporting that founder and chief executive Jensen Huang has been the target of a foreign intelligence effort.^[1] A committee of independent directors, assisted by outside independent counsel, will oversee it. The board says it has no reason to believe that national security or Nvidia secrets were compromised, and that the inquiry will examine all available information. Huang told employees in an email that he supports the investigation and will cooperate fully.^[2]

Markets did not wait for the findings. NBC News reported that Nvidia shares fell nearly 5% in early pre-market trading on Monday, which would erase about $230 billion in value.^[3]

The episode is unusual in its target. The pattern behind it is not: across the chip and AI industries, the people who work inside the companies keep turning up as the way in.

What has been reported, and who disputes it

NBC News relayed that the New York Times and the Financial Times reported that a Chinese citizen whose Singapore-based company was buying Nvidia’s advanced chips had been under surveillance by U.S. intelligence agencies. Those reports cite officials, and say she had been recruited by China’s intelligence service.

China’s side is flat denial. Foreign ministry spokesperson Guo Jiakun said on 9 November that “the so-called Chinese spy allegation is unsubstantiated. It is nothing but smears against China.”

Washington is already involved. CNBC reported that three House Republican committee chairs asked Huang to sit for a closed-door briefing with lawmakers on 18 November, in a letter sent on Wednesday.^[4] President Trump, according to NBC News, said Huang should remain CEO.

Insiders keep being the way in

Court records and prosecutors’ filings in several countries describe the same route. In the United States, a federal jury in San Francisco convicted former Google engineer Linwei Ding in January 2026 on seven counts of economic espionage and seven of theft of trade secrets, relating to Google’s AI supercomputing technology.^[5] The Justice Department says the evidence at trial showed that while employed at Google, Ding discussed becoming chief technology officer of a start-up based in the PRC, founded his own AI company there, and in late 2023 applied to a Shanghai government-sponsored talent plan.

In Taiwan, Focus Taiwan reported that on 27 April 2026 a court sentenced a former TSMC engineer to 10 years over the leak of trade secrets on the company’s 2-nanometer process.^[6] In South Korea, prosecutors in Seoul indicted ten people on 23 December 2025 over the leak of Samsung’s 10-nanometer-class DRAM process technology, and detained five, including a former Samsung executive who oversaw development at China’s CXMT.^[7] Prosecutors say “CXMT recruited core personnel from Samsung Electronics”, starting in 2016. Those are prosecutors’ allegations.

In the Netherlands, a Rotterdam court gave a former ASML and NXP engineer three years in July 2025 for sharing chip-making files with a contact in Russia.^[8] Prosecutors could not prove he sold them.

The cases differ in country, buyer and technology. They share a starting point: someone with legitimate access to the files.

Why espionage is hard to prove

The Ding case was supposed to be the test of whether US law could reach this behavior as espionage. An FBI counterintelligence official called the January verdict the first-ever conviction on AI-related economic espionage charges.

It did not last. In August 2026, Judge Vince Chhabria acquitted Ding of the espionage counts, writing that there was “insufficient evidence for a rational juror to conclude beyond a reasonable doubt that Ding possessed the intent to benefit the Chinese government when he uploaded the trade secret documents”.^[9] The talent-plan application came months after the uploads, and Chhabria wrote that it is “too speculative to rely solely on conduct that occurred months later” to prove intent at the earlier time. Under double jeopardy, the acquittal means no new trial on those counts.

The theft convictions stood. On 1 September Chhabria sentenced Ding to 12 months minus one day, with two years of supervised release.^[10] The government had sought 70 months. Assistant U.S. Attorney Casey Boom, for the prosecution, argued that “Insider trade secret theft is a calculated crime not done in the heat of passion”.

Prison terms proposed and imposed for former Google engineer Linwei Ding after a judge acquitted him of economic espionage and kept seven trade-secret theft convictions. The judge's term is 12 months minus one day. Download (PNG) · Data (CSV)

Ding’s lawyer said he would appeal, and the judge noted that an appeal could reopen the espionage acquittal.

The gap between the two sets of counts is the mechanism. Theft needs proof that protected files were taken; economic espionage also needs proof that the taker meant to benefit a foreign government at the time of the taking. Files copied to a personal account look the same either way, and conduct months later cannot fill that hole on its own.

Prevention moves inside the company

If courts are slow and the espionage charge is narrow, the practical defense is whatever a company can do before files leave. The Wall Street Journal reported in October, citing unnamed sources, that OpenAI trains employees on honey-pot approaches, bribes and eavesdropping, and tells them to use privacy screens, wipe whiteboards and avoid company-branded clothing in public.^[11]

Government policy points the same way. The White House’s July 2025 AI Action Plan names “security risks to American AI companies, talent, intellectual property, and systems”, and recommends that defense, homeland security and intelligence agencies work with leading AI developers to protect them from cyber actors and insider threats.^[12] In October 2026, Senators Jim Banks and Kirsten Gillibrand introduced an 18-page bipartisan bill that would have the Pentagon set reporting requirements and voluntary guidance for large frontier-AI contractors.^[13] Banks said “our adversaries are working just as quickly to steal our most sensitive technology and exploit any weak link”.

Nvidia’s board is running the same kind of review at the top of a company: an investigation by independent directors with outside counsel.

Three dates will show how far it goes. Nvidia reports third-quarter earnings on 17 November, and the House briefing Huang was asked to attend is set for 18 November. In the Ding case, any appeal could decide whether the first AI espionage conviction comes back.

Notes

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

Binance France to close accounts Dec. 31, with fees from Nov. 29

S-Curve Desk — Mon, 09 Nov 2026 14:56:37 GMT

Our arithmetic on the fee terms in Binance's email to customers, as published by Cryptoast. Accounts emptied before 29 November pay nothing.

Binance has emailed customers of its French arm to say their accounts will close from 31 December 2026, according to the text published by the French outlet Cryptoast on 6 November.^[1] The email says deposits are no longer possible. From 29 November, it says, accounts that still hold crypto will pay a monthly fee of 0.025% of the balance or 10 USDC, whichever is higher. A first charge is due within three days of that date and a second is expected after 24 December.

Binance has confirmed the closing date. “Affected accounts will be closed with effect from 31 December 2026,” a spokesperson told CoinDesk, describing the process as “no sudden freeze”.^[2] CoinDesk reported that customers can still withdraw.

The idea of a cut-off did not start with Binance. In June the EU’s securities markets authority, ESMA, said that firms without a licence should give customers “a deadline by which any residual positions would be closed automatically”.^[3]

What the fee means for a small account

On the terms in the email, 0.025% only exceeds 10 USDC on a balance above 40,000 USDC, so smaller accounts would pay the flat minimum.^[4] Two charges make 20 USDC. That is 20% of an account holding 100 USDC and 2% of one holding 1,000.

The email says that if the balance is smaller than the fee, the whole balance is taken. It also says accounts emptied before 29 November are charged nothing.

Crypto still in an account on 31 December will lead Binance to treat the account as inactive under its terms of use, the email says, which may mean converting or transferring the assets. The terms of use on Binance’s main site, effective 27 October, include a clause under which it may “charge a dormant account fee which may be to cover the cost of maintaining the Digital Assets”.^[5] It is unclear whether the terms for Binance France accounts read the same.

Why there is a deadline at all

The EU’s crypto rulebook, known as MiCA, “requires mandatory authorisation in order to offer crypto-asset services in European Union countries”, in the words of the AMF, France’s markets regulator.^[6] Firms already operating under national rules could “continue to do so until 1 July 2026 or until they are granted or refused an authorisation”.^[7]

No Binance entity appears on ESMA’s register of authorised providers, which listed 394 entities when it was last updated on 30 September.

Binance said on 24 June that it was withdrawing its licence application in Greece and would seek authorisation in another member state.^[8] It said it had worked with the Greek regulator for many months and had “no formal decision as the MiCA transition period comes to an end”. “We were deemed to have a complete application,” Gillian Lynch, its head of Europe, told CoinDesk in early July.^[9] The company said it was “confident we will secure authorization in another EU Member State in the coming months”.

The day before that announcement, ESMA had set out what it expected of any firm that missed the deadline. It named no provider, but said that some, “including significant providers currently servicing EU clients under national regimes, may not be authorised by the deadline”. Such firms should “immediately stop onboarding new EU clients” and “limit the provision of services to actions necessary to sell or transfer crypto-assets, reallocate assets, or close positions”. Holding customers’ coins could continue only “for the period strictly necessary to complete an orderly exit”. Messages to customers “should include a deadline by which any residual positions would be closed automatically”.

The email to Binance France customers sets such a deadline, with its closing date and its warning about what follows for accounts that still hold crypto.

France’s regulator took the same line. The AMF said in February that customers of a firm that is winding down must get their crypto back, by transfer to an authorised provider or by sale, with sufficient notice.^[10] In July it said it would “scrutinise the implementation of the orderly winding-down plans” of firms without a licence, “with one absolute priority: preserving clients’ interests”.

This month a Binance spokesperson told CoinDesk that the company is “progressively restricting certain services for affected users”. “Our commitment to Europe remains unchanged, and we are actively progressing our authorization pathway,” the spokesperson said.

Who is affected

CoinDesk reported that users in Spain, Italy and Poland say they have received emails about the closure too. Those, with France, are the countries where Binance “ran locally registered businesses” before the transition ended, according to CoinDesk. The AMF’s list shows Binance France’s registration, held since May 2022, as having lapsed automatically on 2 July, CoinDesk reported.

The most recent figure for the money involved is old. Binance France held about 1 billion euros for customers at the end of 2022, according to Cryptoast’s report on its audited accounts.^[11]

ESMA’s general advice to customers of any unlicensed firm is to check its register and act promptly. Such customers “do not benefit from MiCA safeguards, including protections for client assets”. It suggests “transferring their crypto-assets to an authorised CASP”, meaning a licensed crypto-asset service provider, “or to a self-hosted wallet”.

Binance has not named the member state where it is seeking a licence. “When we are ready to announce that Member State, we will do so publicly,” it said in June.

Notes

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

Gnosis Pay breach email lists card number, CVV and linked wallets

S-Curve Desk — Mon, 09 Nov 2026 14:56:37 GMT

Gnosis Pay's public notice of 6 November. It does not list the data; the emails to customers do.

Gnosis Pay, a crypto debit card provider, says it detected unauthorised access to the system behind its own-brand cards on 3 November.^[1] Its public notice describes what was exposed as “certain customer information”.

The email it sent to one customer is more specific. Lefteris Karapetsas, founder of the portfolio tracker Rotki, posted his on X.^[2] It lists “your name, email address, phone number, home address and nationality”.^[3] It lists “the wallet addresses linked to your account”. And it lists “the full card number, expiry date and security code (CVV) of your card”. The email adds: “If you had an IBAN set up through our integration with Monerium, your IBAN and BIC details were also viewed”.

It says the breach “did not include copies of your identity documents or your date of birth”. His card was cancelled on 3 November. “Our investigation is now complete, and we have identified the information exposed,” the email says.

Gnosis Pay says each affected customer was told “exactly what information was taken from their account”, so other customers’ lists may differ. It has not said how many were affected.^[4] OpenRate, a third-party tracker, showed about 7,000 monthly active cardholders on 9 November.^[5]

A card number can be cancelled and reissued. A wallet address stays where it is, on what the company’s privacy policy calls “a public distributed ledger”.^[6]

A card that settles in public

Gnosis Pay customers hold their money in their own wallet. “Each user receives a unique Safe account that acts as their on-chain wallet,” the company’s documentation says.^[7] A Safe is a wallet run by a smart contract, and this one is “the self-custodial Safe where the user’s funds are held”.^[8]

That wallet’s activity is open to anyone. A token transfer on Gnosis Chain records the sending address, the receiving address and the amount, and its block gives the time.^[9] Anyone can request those records from a public node without an account. They carry no merchant, card number or name. A name attached to the address links that history to a person.

Gnosis Pay’s own description of card payments on the old system fits that picture. On 3 September, listing the benefits of a rebuilt platform, it wrote: “Today settlement is per transaction - visible and timestamped.”^[10] The new design would work differently. “In future it will be collected once a day, with grouped payments that can’t be mapped or timed in the same way.”

The company’s privacy policy lists the personal data it processes: “Name, nationality, country of residence, home address, IP address, date of birth, place of birth, identification and KYC documents”. Wallet addresses are on the list too. Identity checks run through an outside provider, Sumsub. On the ledger itself, the policy says, “how you use and manage your cryptocurrency wallet address, rests solely with you”.

What Gnosis Pay did

The company says “containment began within two hours of detection” and that it then replaced the affected security credentials and addressed the vulnerability. It emailed affected customers on 6 November. It says it is “communicating with the applicable data protection authorities and with our card issuer”.

Until the old system closes, an extra verification step is “mandatory for all online card payments”. “We have increased our monitoring of card activity and wallets to detect fraud or attempts to access user funds,” the notice says. The company adds that “we are arranging specialist monitoring for any sign that information from this data breach is misused”. The platform it runs for other companies’ cards “was not affected”.

Karapetsas wrote on X: “You had already lost me as a user but you could have at least protected my data”.

The notice apologises. “While funds were not affected, we recognise that the security of personal information is just as important.” On X the company wrote “we take full responsibility”.^[11]

Its advice to customers covers more than email. “Be suspicious of any unexpected email, text, call or letter about Gnosis Pay, a Partner App or your card, even if it includes your real details or a real purchase.” “Never share your seed phrase, private keys, PIN or full card number.” And: “Be careful who you share your address or details of your crypto holdings with, online and offline.”

A system already closing

The breached system “was already scheduled for retirement on 20 December 2026”, the notice says. Gnosis Pay had told cardholders in September that “Over the coming months the Gnosis Pay card will be wound up in favour of partner cards.” Customers will hold accounts and cards through partner apps instead. Rebind “is one of the first partners to confirm that they will migrate onto the new Gnosis Pay”, the company wrote. The once-a-day grouped settlement belongs to that new platform.

The notice does not say how access was gained. A cancelled card gets a new number. The wallet addresses stay on the ledger.

Notes

Gnosis Pay, Data breach on the legacy system powering Gnosis Pay-branded cards, 6 November 2026.
Lefteris Karapetsas, post on X, 6 November 2026.
Gnosis Pay notification email, from the image in Lefteris Karapetsas’s post on X of 6 November 2026.
CoinDesk, Gnosis Pay breach exposes card numbers, home addresses and linked crypto wallets.
OpenRate, Gnosis Pay card usage.
Gnosis Pay, Privacy and Cookies Policy.
Gnosis Pay documentation, GP Safe Account.
Gnosis Pay documentation, Architecture.
S-Curve read of public token transfer logs on Gnosis Chain, 9 November 2026.
Gnosis Pay, The Next Era, 3 September 2026.
Gnosis Pay, post on X, 6 November 2026.

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

Half of Anchorage's USDGO stablecoin sits at MEXC

S-Curve Desk — Sat, 07 Nov 2026 19:49:23 GMT

USDGO in circulation and in MEXC wallets. The coins may belong to MEXC, its users or a third party.

Wallets tied to MEXC hold about $579 million of USDGO, or 51.7% of the token’s supply on Solana.^[1] MEXC’s own reserves page lists the two wallets that hold about $446 million of that,^[2] and the third wallet received its coins from one of them.^[3] USDGO is issued by Anchorage Digital Bank, a federally regulated US bank.^[4] On Friday, Treasury’s FinCEN unit barred US financial institutions from “any transmittal of funds from or to MEXC Global”.^[5]

Nothing here suggests that Anchorage or anyone else has broken a rule, and the order has yet to take effect. But it puts a US bank’s token in an awkward place: mostly held at a venue that US banks will soon be barred from dealing with.

How the coins got there

Anchorage issues USDGO, and OSL Group, a Hong Kong-listed company, brands it, with OSL subsidiaries acting as distributors.^[6] The 207 mints we traced from December 2025 to 28 October, about $1.8 billion in all, went to no MEXC account.

The coins arrived another way. About $583 million moved from one wallet, through four relay addresses, into MEXC wallets, in one case within two minutes. DefiLlama lists that wallet as OSL’s.^[7] Who controls the relays is unclear, as is whether the coins belong to MEXC, its users or a third party.

The balance built quickly. MEXC wallets first held over $1 million of USDGO on 8 May, about $210 million by 26 May.^[8] Crystal Intelligence counts a $262 million increase in the third quarter,^[9] and says exchanges added stablecoins “often ones that carry rewards”. MEXC lists a USDGO/USDT market,^[10] but its reserves page reports USDT, USDC, BTC and ETH only.

Both series from DefiLlama. Direct chain reads on 6 November put MEXC's wallets at 578.8 million of 1.12 billion USDGO on Solana. The coins may belong to MEXC, its users or a third party. Download (PNG) · Data (CSV)

What the order reaches

FinCEN’s definition of a bank includes a “trust company organized under the laws of any State or of the United States”,^[11] so Anchorage is covered. The order counts “the sending and receiving of funds, including CVC”, its term for crypto. A mint to MEXC or a redemption from it would fall inside that wording.

The rule stops at the US border: it covers an “office within the United States”. An offshore distributor selling to MEXC sits outside that on its face, unless it has a US office or affiliate involved.

FinCEN has said where it expects issuers to stand. In April it proposed that stablecoin issuers comply “with special measures issued pursuant to sections 311, 9714(a), and 2313a”.^[12] Section 9714(a) is the law behind the MEXC order. The same proposal said FinCEN was “not proposing to require a PPSI”, its term for a regulated issuer, “to monitor secondary market activity”. Its examples of that activity include swapping stablecoins “via a digital asset exchange”. That text is a proposal, not a final rule.

What Anchorage can do

The token has a freeze authority, a permanent delegate and a pause function, and none has been used against these wallets. The operative part of the MEXC order names no token or address, while an order to block coins under the stablecoin law must specify them “with reasonable particularity”. In its 2023 FAQ on Bitzlato, FinCEN told institutions to stop transfers “from or to any account or CVC address administered by Bitzlato”.^[13]

Why USDGO stands out

The other dollar tokens we checked are far less exposed. MEXC wallets hold about 0.5% of USDC and about 4.5% of USD1, on DefiLlama’s figures. Its listed Ethereum wallets hold no RLUSD, PYUSD or USDG, and about 113,000 USAT.

MEXC says it “is operating normally, and user assets remain secure”.^[14] For USDGO holders there, the practical question is how a coin at MEXC gets back to dollars once the order takes effect, if the issuer cannot take it from MEXC directly.

Notes

Solana RPC, USDGO mint controls and MEXC wallet balances, 6 November 2026.
MEXC, Proof of Reserves.
S-Curve analysis of USDGO transfers on Solana.
Anchorage Digital, USDGO Officially Launches Under Federal Oversight.
FinCEN, Imposition of Special Measure Prohibiting the Transmittal of Funds Involving MEXC Global.
OSL Group, Officially Launches Regulated Enterprise Stablecoin USDGO.
DefiLlama, OSL wallet list.
DefiLlama, USDGO supply and MEXC balances.
Crystal Intelligence, Who moved stablecoins in Q3.
MEXC, USDGO/USDT market page.
31 CFR 1010.100 definitions.
FinCEN and OFAC, Permitted Payment Stablecoin Issuer AML and Sanctions Programs, proposed rule, 91 FR 18582.
FinCEN, Frequently Asked Questions on the Bitzlato order.
MEXC, statement on the FinCEN order, on X.

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

Sahil Arora says he paid Ansem. The wallet trace found no link

S-Curve Desk — Sat, 07 Nov 2026 14:49:01 GMT

SOL received by the Binance deposit address Arora presents as Ansem's. Four wallets that moved funds among themselves supplied 94 percent. Only Binance can say who held the account.

Sahil Arora, the promoter whose name was attached to a wave of celebrity tokens in 2024 and who has been accused of fraudulent activities,^[1] spent Friday posting what he calls receipts against crypto influencers from the X account @villainmonkey. The account shows only the name “sahil”, but in one of those posts he said he had run @habibi_comm,^[2] the account X suspended in 2024 as Arora’s.^[3] His main target is Ansem, a trader known for his Solana and memecoin calls.^[4] Arora wrote on X that he paid Ansem “~100k to push $MOTHER”,^[5] the token Iggy Azalea launched. Ansem rejects it. “no i have never done anything with sahil, he is a scammer and ive been calling him a scammer since the very beginning,” he wrote.

These are allegations from an interested party. Arora says he holds a 4% stake in a token named after Ansem, and on Friday he also wrote that he needs “one more 100M runner to retire”. But he posted transaction records too, and those can be read by anyone. They are real. We traced them, and the wallets around them, for the weeks around the launches. The trace found no flow between the wallets around his payment and the wallets he attributes to Ansem. Most of that money went to exchange addresses, where the ledger stops.

The transfer

Arora’s first exhibit is a screenshot of a Solana transfer. He wrote that “129 SOL (~22k then)” went to Ansem “moments before Iggy Azalea dropped $MOTHER”. The transfer exists: 129.5 SOL left a wallet beginning 7s3v1j for an address beginning 8A9jAg at 00:28 UTC on 28 May 2024.^[6]

The timing is looser than that. MOTHER’s trading pair appeared 20 hours 36 minutes later. The sender had also just made a trade: 95 minutes before the transfer it sold a token for 151.55 SOL. The sum is well below the “~100k” Arora cites.

The deposit address

The 8A9jAg address is an exchange deposit address. Solscan tags it as Binance, and each balance was swept to a wallet Solscan names Binance 2. Arora treats it as Ansem’s, and tagged Binance’s founder to say he “can help doxx”.

"Group" marks four wallets that moved funds among themselves; one sent the 129.5 SOL Arora shows as his payment. Neither wallet Arora attributes to Ansem deposited here. Only Binance can say who held the account. Download (PNG) · Data (CSV)

Deposit addresses of this kind normally belong to one customer, so the question is who filled it. Over its life the address took in 2,583.48 SOL from nine wallets. Four of those wallets moved funds among themselves and supplied 94 percent of the total. One is the wallet that sent the 129.5 SOL. Another is the address Cointelegraph identified in 2024 as the one “Arora used for the presale” of his IGGY token. Neither of the two wallets Arora attributes to Ansem appears among the depositors.

That pattern fits a person banking their own money. It does not prove it. The presale address sent 663.22 SOL to the same deposit address on 8 June 2024, about $105,000 at that day’s price and close to the sum Arora names. A payment to someone else could look like that. So could a balance being moved out: less than two days later the same wallet sent 663.00 SOL to a different exchange address, then 1,260 SOL more by 11 June.^[7]

Where the money went

In the periods we read, the four wallets sent at least 12,827.6 SOL to outside addresses, and 82 percent of it went to three addresses. One is 8A9jAg. Arkham, a blockchain analytics firm, labels the second a Binance deposit address and the third a Poloniex deposit address.^[8] The Poloniex address took 6,152.2 SOL from the four wallets, about $893,000 at daily closing prices. Over its life nearly all of what it received came from them.

The last deposits to the two Binance addresses came on 8 and 9 June 2024, and the bulk of the Poloniex transfers began on 10 June. Those sums are flows, not profit. Cointelegraph reported ZachXBT’s view that Bubblemaps had “incorrectly flagged a wallet address at the crypto exchange Poloniex” as Arora’s.^[9] We cannot say whether that is this address.

Two details cut against a tidy reading. The second Binance address drew 92 percent of its SOL from the same group, which suggests a second account. The likeness points to one holder, but the ledger cannot say whose. Eight smaller exchange addresses also received sums from the group, and a payment to another person could take that form. None is tied to anyone.

The MOTHER trades

Arora names a wallet beginning AVAZvHLR as Ansem’s main wallet. Its record on MOTHER does not look like a promoter handed supply. Its first purchase came about 17 hours after the trading pair appeared, and every MOTHER movement in its token account was a swap against a liquidity pool. No wallet transferred MOTHER to it. It spent about 781 SOL buying and took about 644 SOL selling, a loss of about 138 SOL. Its token accounts for JENNER and JASON show no history at all.

That covers one wallet, and a person can hold others. Whose wallet it is remains unproven.

Ansem gave his own account of MOTHER days after it launched, in a reply to ZachXBT. He said he had joined the Spaces for Caitlyn Jenner’s token “to ask Qs & didnt promote it”, and that he had asked Azalea to let him co-host her Spaces “to see what she had to say ab crypto”.

The launch wallets

The ledger shows more about where launch money went. The wallet that created JENNER, which Arkham labels “caitlyn” on Pump.fun, sent the 7s3v1j wallet 101 SOL and 61 SOL within 40 minutes of the trading pair appearing, and 282.57 SOL by 20 June. That wallet had also bought JENNER for 2.02 SOL and sold it for 100.82 SOL within the hour.

The creator of JASON, labelled “jasondevv”, sent it 109 SOL between 25 and 29 June. Three of the four wallets bought JASON within 85 seconds of each other, about four minutes before its pair appeared. One of them turned 6.98 SOL into 1,071.14 SOL. Those purchases were open to anyone, and the ledger does not say why the creators paid that wallet or who controlled them.

The June withdrawals

Arora’s second exhibit concerns a wallet beginning 3bzbmH78, which he calls Ansem’s sub-wallet. He wrote that it “received 504.5 SOL (about $69,000) in two exchange withdrawals” two days after Jason Derulo’s token launched. The total is right, though the two transfers came from different sending wallets. Arkham labels one of them a HitBTC withdrawal wallet.^[10]

The history of that wallet complicates the timing. The second sender paid it 173.70 SOL on 17 May 2024, nine days before JENNER’s trading pair appeared. And the money ran both ways. The wallet sent SOL to four addresses Arkham labels as HitBTC deposits, starting in April 2024 and including 54.6 SOL on 5 June. Arora’s own description is that the pattern fits “the same person withdrawing through the same exchange account twice”. Someone paying into and drawing from an exchange account would leave that trail.

If Arora funded those withdrawals, the money should leave his side and reach HitBTC. In the periods we read, no transfer of 0.5 SOL or more ran between the four wallets and that sub-wallet, its two funders or its HitBTC deposit addresses. None of the group’s 20 largest outside recipients carries a HitBTC label. The main wallet Arora names does share transactions with his wallets, but all were token drops signed by third parties, and no SOL moved. Exchanges break trails, though. Money paid in at one venue and moved out by another route would not show here.

The screenshots

The rest of Arora’s case is chat screenshots, which the ledger cannot test. In the one he aimed at Ansem, the other party appears only as a contact called Z. Ansem says the writing is not his: “also bro i dont text like that, look at the capitalization of the words”. He posted a chat of his own, which Arora calls blank.

The argument has a history. In May 2024, when Arora posted a screenshot of a message he attributed to her, Azalea told followers not to believe “the bullshit fake screen shots”.

What would settle it

One record would decide the central point: Binance’s customer file for the 8A9jAg address, the record Arora himself pointed to. Exchanges do not publish those. Arora says “every single celeb launch” came with a payment, and so far he has shown one transfer. In one reply he wrote “Paid in USDC”. He has shown no such payment, and we did not trace USDC.

Notes

Cointelegraph, Iggy Azalea’s MOTHER memecoin triumphs over scandal-ridden IGGY.
Replies on X by Ansem and others, 2024 to 2026.
Cointelegraph, Celebrity memecoin promoter Sahil Arora banned by X (TradingView copy).
Phemex Academy, Who is Ansem, the Solana trader behind the ANSEM token.
Posts on X by @villainmonkey, November 2026.
Solana public ledger, wallets cited by Arora (read 6 November 2026).
Solana public ledger, wallets linked to Arora’s payment and AVAZvHLR (read 7 November 2026).
Arkham labels for the group’s recipients, 7 November 2026.
Cointelegraph, Memecoin ‘mastermind’ Sahil likely made $3M from ‘Celeb meta’: ZachXBT.
Arkham and Pump.fun labels for the wallets cited, 6 November 2026.

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

Treasury cuts off MEXC, citing $16.7 billion in illicit flows

S-Curve Desk — Fri, 06 Nov 2026 23:17:46 GMT

Sums FinCEN attributes to MEXC Global in its order of 6 November. They are the agency's assessments, and the categories overlap or use different windows.

The US Treasury moved on Friday to cut MEXC Global, one of the world’s 20 largest crypto exchanges,^[1] off from American financial institutions, saying it facilitated at least $16.7 billion in likely illicit activity. The order from FinCEN, Treasury’s financial crimes unit, bars “any transmittal of funds from or to MEXC Global”. The ban starts 30 days after the order appears in the Federal Register.^[2] It leaves existing sanctions and Bank Secrecy Act duties as they were. MEXC says it is operating normally and has begun an independent review of its controls.^[3]

Treasury Secretary Scott Bessent framed the move around Tehran. “Financial institutions cannot have it both ways: Either you support the Iranian regime, or you have access to the U.S. financial system,” he said. The legal finding is about Moscow. FinCEN found “reasonable grounds” to conclude that MEXC is of primary money laundering concern “in connection with Russian illicit finance”.

What the order does

The ban covers financial institutions as US rules define them, a list that includes banks, broker-dealers and money services businesses such as money transmitters.^[4] It reaches crypto: a transmittal is “the sending and receiving of funds, including CVC”, the order’s term for convertible virtual currency. It runs “with no cessation date”, and violations can bring civil or criminal penalties. Any MEXC offices in the United States fall outside it. On that wording, a US exchange sending a customer’s coins to a MEXC deposit address would be a transmittal.

Why a Russia law

FinCEN acted under section 9714 of the Combating Russian Money Laundering Act, so its finding names Russia. The order then adds that MEXC “has, in parallel, facilitated billions of dollars in transactions benefitting Iran and its proxies”, along with North Korean financial facilitators and cybercrime actors.

Treasury issued it “as part of Operation Economic Outcast”. Bessent said the campaign’s 1 October action against the A7 network continued efforts “to isolate Iran and its financial enablers”.^[5] That action used section 9714 too, and Treasury said it “is not limited to Russian sanctions evasion”. Earlier targets of the section include the exchanges Bitzlato, in 2023,^[6] and PM2BTC, in 2024.^[7] FinCEN chose an order over a regulation for MEXC, citing “the imminent threats posed by the illicit actors” the exchange serves.

Where the $16.7 billion comes from

Treasury’s release says MEXC “has facilitated at least $16 billion in illicit transactions”. The order says at least $16.7 billion since May 2021. These are FinCEN’s assessments, based on “public and non-public information”.

Among its categories, FinCEN counts nearly $1.5 billion of direct and indirect exposure to Russian sanctions evasion, including $232 million in direct transactions with sanctioned entities. It says MEXC handled about $129 million with Garantex and $4.1 million with its successor Grinex after their designations, as recently as June 2026. It counts nearly $2 billion tied to Iranian actors or terrorist groups, with over $1 billion of that in direct transactions with more than 40 Iranian exchangers, and at least $1.99 billion linked to illicit cyber actors.

The largest category is over $13 billion with “at least four high-risk CVC exchangers sanctioned by the UK”, counted between May 2018 and July 2026. Treasury’s press release leaves it out, and the order does not name the four. The UK notice it cites is dated 26 May 2026,^[8] and its additions include EXMO, Rapira, Bitpapa and Huobi Global, the company behind HTX. Most of FinCEN’s window therefore predates the UK listing, and the order does not say how much of the $13 billion came after it. Nor does it say how much sits inside the $16.7 billion. Its categories use different windows and add up to more than the total.

FinCEN's assessments, not court findings. The UK listed the exchanges on 26 May 2026, so most of that window came before the listing. The categories overlap or use different windows, so they do not add up to the order's total of at least $16.7 billion. Download (PNG) · Data (CSV)

For scale, at the $1 billion a day FinCEN gives for June, $16.7 billion equals about 17 days of transactions, although the sum spans years. FinCEN writes that it “does not have full insight into the scope of MEXC Global’s legitimate activities” and assumes some of the business is legitimate.

MEXC’s side

MEXC’s user agreement says it does not serve Iran, North Korea, Russia or the United States.^[9] FinCEN says MEXC’s processes “prohibit, on paper, the opening of accounts” from certain jurisdictions, and that transactions involving them went through anyway. MEXC responded on X, saying it is “operating normally, and user assets remain secure”. It said it takes “the concerns raised seriously” and intends “to engage constructively with FinCEN” and other regulators. It added that it has “begun an independent review of our AML and sanctions controls”, and it did not address FinCEN’s figures. The order invites MEXC and others to send FinCEN relevant information.

Who feels it

MEXC’s terms say it “does not provide, by itself, any services relating to the deposit or withdrawal of the legal tender of any country”. Partners do that, through bank transfers, cards and a MEXC Mastercard. FinCEN says narrower measures could leave open access to dollars “through indirect correspondent relationships via other foreign financial institutions”. Those rails, not American customers, are where a ban on US institutions is likely to bite, since MEXC’s terms already exclude US residents.

The order’s list of affiliates covers companies in the Seychelles, Estonia, Switzerland and the UK. MEXC’s agreement, updated on 13 October, is with MEXC (Comoros) Ltd, which that list does not name, though the list is not exhaustive. The order also reaches any successor “carrying on the affairs of MEXC Global under a new name”. Legitimate users, FinCEN says, “could readily find alternatives”.

Firms have no steps yet for refusing MEXC coins

The hardest practical question is incoming crypto. FinCEN says there are “few, if any, readily available ways” for institutions to refuse a transfer before it arrives. So the order says it provides for rejection and will “outline the steps” a firm should take. The version FinCEN posted has no such steps in its operative section, which runs from definitions to penalties. The 2023 Bitzlato order had one: a firm that rejected such coins was deemed not to have violated it. The posted text may change slightly before publication.

DefiLlama’s count of MEXC wallets stood at about $4.46 billion late on Friday, against about $4.58 billion a day earlier, a sum that moves with token prices.^[10] The date that matters has not been set: the 30 days start when the Federal Register prints the order.

Notes

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

Bitcoin tracked the Nasdaq as chips had their worst day since 2020

S-Curve Desk — Thu, 05 Nov 2026 21:30:53 GMT

Among all 500 stocks the year's winners fell hardest. Without technology stocks, the pattern nearly disappears.

The PHLX Semiconductor Index fell 12.25% on Thursday, its second-worst day in Yahoo Finance data going back to 1994. Only 16 March 2020 was worse.^[1] The median S&P 500 stock lost 2.27%. Most of Thursday’s story sits in the gap between them.

The Nasdaq Composite fell 5.52% to 24,315 and the S&P 500 fell 4.36% to 7,353.73, each index’s worst day since 4 April 2025. Bitcoin lost 4.95% between the two New York closes, ending at $76,085, while gold futures rose 0.52%.

The index fell harder than its stocks

The selling was wide: 427 of 500 current S&P 500 members fell and 73 rose. It was far less deep than the index suggested. SPY, which weights stocks by size, fell 4.41%. RSP, which holds them equally, fell 2.89%. Of the 79 days SPY has dropped at least 3% since RSP began in 2003, only 6 October 2008 showed a wider gap. The median technology stock lost 8.14%, against 0.24% for utilities and 0.31% for consumer staples. RSP closed 2.9% below its record close.

Options told the same story. The VIX jumped 68.1% to 27.92, yet that is the lowest close on any of the 36 days since 1990 when the S&P 500 fell this much. The median close on those days was 50.7. The VIX also started from 16.61, the calmest prior close of the group.

Winners fell hardest, but only in tech

Nomura strategist Charlie McElligott wrote “They’re shooting the generals” and, according to Yahoo Finance, put the selling down to hedge funds locking in profits before year end, not to a sudden turn in fundamentals.^[2] That can be tested. Rank the index by 2026 gain through Wednesday and split it into ten groups of 50. The top group, up a median 65.8%, fell 5.36%. The bottom group, down 29.1%, fell 1.94%. The test uses today’s index members, so companies dropped from the S&P 500 this year are missing.

The pattern depends on one sector. Twenty of the top 50 are technology stocks. Take technology out, re-rank, and the top group fell 2.59% against 2.28% for the bottom group, with no steady slope between them. Outside tech, the rush out of the year’s winners barely showed up on Thursday.

Stocks are ranked by their 2026 change through 4 November and split into ten equal groups. Top: all 500 current members. Bottom: the same test without information technology stocks. Download (PNG) · Data (CSV)

These winners were also already falling. Ranked on the prior 100 sessions rather than the calendar year, the best tenth of the index lost 2.24% on Thursday and the worst tenth lost 7.65%. The last time chips fell this hard, on 5 June, it ran the other way: the best tenth lost 6.63%, the worst 0.23% and the median stock 0.17%. June hit the strongest recent performers. November hit stocks already sliding, which fits McElligott’s warning that “we are approaching the dreaded ‘Round Trip’ levels in some trades”. The semiconductor index lost 21.8% in five sessions and closed 38.4% below its 22 June record. Its 2026 gain shrank from 45% to 27.2% in one session.

Prices show where the selling went, not why. Yahoo Finance reported analysts pointing to “a potential slowdown in AI data center build-outs following a Democratic sweep”. AMD chief executive Lisa Su told Yahoo Finance the market can be “a little bit short-sighted”.^[3]

Bitcoin moved with the Nasdaq

Bitcoin was no 2026 winner. It was already down 8.5% for the year on Wednesday, so a rush to lock in gains is an unlikely reason for its fall. Timing points to stocks. Coinbase prices held above $80,000 until 12:00 UTC, then hit a low of $75,431 within ninety minutes of the 14:30 UTC US open.

The 30-session correlation between daily moves in bitcoin and the Nasdaq reached 0.82, the highest since the series begins in 2023, against an average of 0.38. Bitcoin has fallen on 10 of the 13 days since the start of 2023 when the Nasdaq dropped at least 3%.

Correlation of daily bitcoin and Nasdaq Composite moves over the previous 30 sessions. One means they moved in step; zero means no relation. Download (PNG) · Data (CSV)

Forced selling added to the move. Cointelegraph, citing CoinGlass, reported “nearly $500 million” liquidated in the first hour of US trading and a 24-hour total nearing $850 million at the time it wrote.^[4] Hyperliquid’s bitcoin funding rate barely changed, averaging 0.0093% per eight hours over the last day against 0.0089% over 20 days, so the perpetual futures market showed no sign of a rush to one side.

Listed crypto companies fell about twice as far as the coin: Coinbase 9.69%, Strategy 9.29% and Robinhood 10.32%. One crypto-specific worry arrived the same day. Stifel’s Brian Gardner said of the Clarity Act, “It’s off the table for the lame duck session”.^[5]

One-day falls at the 5 November close. Bitcoin is measured from the New York close on 4 November to the New York close on 5 November. Download (PNG) · Data (CSV)

Notes

S-Curve analysis of Yahoo Finance, Coinbase and Hyperliquid data.
‘They’re shooting the generals’: AI trade stocks drop as hedge funds rush to protect 2026 gains.
AMD CEO Lisa Su sees AI becoming ‘essential to every aspect of our lives’.
Bitcoin Targets $75K as Crypto Liquidates $500M Around Stocks Sell-Off.
Bitcoin tumbles below $76,000 as post-election stock rally fades.

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

How Arbitrum's council moved coins it held no key for

S-Curve Desk — Thu, 05 Nov 2026 18:47:34 GMT

The Security Council's April and October fund moves, and the days from release proposal to execution.

At 8:08am Hong Kong time on 30 October, Arbitrum’s Security Council froze 8,425 ETH and 74,559,805.2 ARB held by an address its notice ties to the Binance exploit.^[1] CoinDesk puts the value at about $30 million and says the council moved it without the attacker’s signature.^[2] The FBI says North Korea was responsible for the theft of more than $6 billion from Binance, on or about 29 October.^[3] CoinDesk describes the move as the second of its kind this year.

No key was involved. The power to do this is written into Arbitrum’s rules, and it lets a small elected group act on any address on the chain. The transaction that used it shows how.

The switch is written down

Arbitrum’s constitution gives the council “the power to execute any software upgrade or perform other required actions with no delay” in a security emergency.^[4] An emergency action needs nine of the 12 members to approve. The DAO’s governance docs say the 12 are elected by the members of the ArbitrumDAO.^[5]

The constitution also limits the power. The council must not use it “except in a true security emergency, such as a critical vulnerability” in a chain the DAO governs. Afterwards it must issue a full transparency report explaining what was done and why it was justified. And the DAO can curtail or eliminate the power through a Constitutional AIP, the DAO’s binding vote.

The Ethereum transaction that carried out the October action had exactly nine signatures, the minimum.^[6] The April transaction also had nine.

How you move coins without a key

On Arbitrum, a transaction normally moves funds because the owner’s key signed it. The council’s route went around that, through Arbitrum’s Inbox contract on Ethereum, which is how messages enter the chain. According to the council’s notice, the plan was one atomic action: upgrade the Inbox, freeze the funds, and put the original contract back.

The upgrade added a function called sendUnsignedTransactionOverride, which imitates a standard cross-chain transaction but lets the sender be set to someone else. The council then created two cross-chain transactions that impersonated the address linked to the exploit, and these moved the funds to a holding address, 0x0000000000000000000000000000000000000DA0. An outside analyst at DeFi Prime explains that on this path the sender comes from the incoming message metadata and is not recovered from the signature of an ordinary signed transaction.^[7] On 5 November the holding address held 74,559,805.2 ARB, the amount in the council’s notice.

The same technique was used in April. The council’s notice for that action describes the same three steps^[8] and the same function. That action froze 30,765.67 ETH linked to the KelpDAO exploit.^[9] The notice dates it 21 April, but the Ethereum timestamp puts it at 23:26 US Eastern on 20 April.

The case for it, and the objection

The case for acting was made at length when the council first did it, in April. The Defiant summarised it this way: the funds were headed to a sanctioned state actor, the council acted narrowly, it did not touch ordinary users, and it cannot redirect the funds without a DAO vote.^[10] Steven Goldfeder, a co-founder of Offchain Labs, said in April, as Parameter reported, that “The default was do nothing”.^[11] He rejected a full token-holder vote: “The DAO cannot be consulted, because the second the DAO is consulted, that essentially means North Korea is consulted”. Patrick McCorry, head of research at the Arbitrum Foundation, said of the council’s powers: “You can see exactly what powers they have”. Goldfeder added that Arbitrum is “no more or less decentralized today than we were yesterday”.

The objections are about scope and neutrality. Robby Greenfield of tokedex.org wrote on the Arbitrum forum in April that the capability “is not scoped to recovery” and is a general-purpose power embedded in the upgrade authority. Another commenter on the thread wrote that the action created a precedent and that “ETH was moved on Arbitrum without the user’s consent”. The Defiant summarised the critics’ view as the worry that a council able to freeze a state-linked hacker today could be compelled to freeze anyone tomorrow, and the chain would be “no longer neutral”.

The constitution’s own example of an emergency is a vulnerability in a DAO-governed chain. Two other emergency actions this year were of that kind. The council’s May notice says no funds were ever at risk,^[12] and on 2 October it paused activation of new Stylus contracts.^[13]

Where the funds go

The council’s notice says the frozen funds can only be moved by an ArbitrumDAO governance vote. On 5 November Binance posted a proposal asking for that vote: it wants the 8,425.997 ETH and 74,559,805.2 ARB released to it.^[14] Binance, whose proposal says the funds were stolen from its wallet, would get them back. It describes the on-chain step as similar to the council’s own action.

Binance estimates the whole process at around 49 days, including a week of forum discussion, a week of temperature check and two weeks of on-chain voting. It also agrees to indemnify the Arbitrum Foundation, Offchain Labs, the Security Council and each member of it. The proposal notes that third parties have previously claimed assets frozen on Arbitrum One, on the theory that they belong to people alleged to be responsible for an exploit.

April shows how that can go. The Aave-led proposal to release the KelpDAO funds was posted on 25 April. A lawyer who said he represents plaintiff-judgment creditors in a case against North Korea then posted a restraining notice on the thread. The Arbitrum account announced on 15 June that the payload had executed and the ETH had gone to Aave LLC. That was 56 days after the freeze.

ETH moved in the Security Council's April and October actions; the October action also moved 74,559,805.2 ARB. Below, days from the release proposal to execution in April, against Binance's estimate for its own proposal. Download (PNG) · Data (CSV)

Notes

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

How a fake job interview reached Binance's signing service

S-Curve Desk — Thu, 05 Nov 2026 18:47:34 GMT

Value taken from Binance wallets by chain, as tabulated by Halborn from TRM valuations.

What TRM Labs calls the largest crypto theft on record took about four hours to carry out and months to set up.^[1] In the initial findings it published on 3 November, Binance says the attacker “exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process,” and puts the impact at approximately USD 6.34 billion. Its account of how anyone got that far starts in June with a tampered download, and runs through a fake job interview in September.

The lure

Binance dates the first exposure to June 2026. An engineer on its wallet DevOps team downloaded a tampered installation of a developer tool while looking for a popular AI coding tool, the exchange says. Its security team detected the anomaly, replaced the device and rotated all related credentials. Even so, the exchange writes, that engineer’s role and his colleagues on the wallet infrastructure team “was exposed to the hacker”.

The second stage came in September. A software engineer whose profile on a job-hunting platform mentioned Binance was contacted by someone posing as a Project Director. A second-round interview followed with a person claiming to be the CEO of a fictitious company. Near the end, the engineer was instructed to an “assignment” containing a malicious code repository onto his work computer. Binance says the malware was not detected by endpoint security at the time. It adds that its security team detected and prevented 57 suspected North Korea-linked cases during 2026.

On 20 October, Binance says, the attacker used that engineer’s compromised computer and an internal AI tool to gain control over two more engineers, one from wallet DevOps and one on wallet software.

The signing service

The final step took place on 29 October. Between 17:15 and 19:56, Binance says, the attacker logged onto the second wallet engineer’s computer, used credentials stolen from the DevOps engineer, deployed a container and triggered a malicious script. That is how the exchange says the attacker reached the signing service, the internal component that produces the signatures for wallet transactions.

Why the service signed is not in the report. Binance says some technical details will remain confidential. Outside analysts have offered readings. TRM Labs wrote that the most likely explanation is that the attacker gained the ability to make the hot wallet signing system sign transactions of its choosing across chains. The security firm Halborn wrote that either the signing path signs raw digests or it accepts EIP-7702 authorizations as a message type, and “Both are inference”.^[2] Halborn also wrote that the report does not answer why the service did what it was asked.^[3]

What EIP-7702 did

Binance describes EIP-7702 as a feature that lets an account delegate certain execution rights to a smart contract without exposing the private key. The attacker used it, the exchange says, to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet. The attackers submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations.

The Ethereum record matches that count. One transaction from the attacker’s operator wallet, at 20:20:59 UTC, carries 50 authorizations, all on chain ID 1 and all naming the same Binance hot wallet. Their nonces run from 18,914,824 down to 18,914,775. One applied and 49 were skipped as invalid.^[4] The first sweep followed 3 minutes 24 seconds later.^[5] Six and a half hours earlier, the same operator wallet had tried the method on a test wallet with three authorizations, of which one applied.^[6]

Delegation explains Ethereum and nothing else. Halborn wrote that “Nine other chains lost money through nothing more exotic than correctly signed transfers,” which it called the strongest evidence that the compromise “sat in the signing path rather than in one wallet’s key”.

Value taken by chain, as tabulated by Halborn from TRM's valuations, which total about $6.36 billion. Only part of the Ethereum total went through the EIP-7702 delegation: about $174 million left in plain signed transfers from a second wallet. NEAR was also hit, with no published figure. Download (PNG) · Data (CSV)

Four hours

Binance lists the drain in pieces. Between 20:05 UTC and 20:09 UTC, five hot wallets sent 233.46 million XRP to an attacker-controlled address. Halborn wrote that Binance’s internal alert fired after outflows on Solana and Optimism, and that Bitcoin, the Ethereum delegation and Tron followed within fifteen minutes. On Bitcoin, a hot wallet sent 18,270 BTC.

Suspending withdrawals did not end it. The exchange says suspending withdrawals and shutting down hot wallet services did not automatically invalidate existing on-chain authorizations. At 00:10 UTC on 30 October it executed a new authorization from the Binance14 hot wallet to the zero address, clearing the delegation. From the delegation landing to its removal was about 3 hours 49 minutes.

What was frozen

Frozen is not recovered. Binance says approximately USD 2.85 billion has been frozen or intercepted. Against its own USD 6.34 billion, that is 45%. Others count similarly: Chainalysis said about $2.8 billion was frozen as of 11:30 AM ET on 3 November,^[7] Elliptic said $2.85 billion, 44% of the theft,^[8] and TRM counted about USD 2.7 billion as of 00:30 UTC on 30 October.

Binance's figures: about $6.34 billion impacted, about $2.85 billion frozen or intercepted, subject to reconciliation. Frozen is not returned. The remainder is computed. Download (PNG) · Data (CSV)

Tether said it froze more than $1.5 billion in USDT within 30 minutes of the hack.^[9] Halborn’s freeze table, citing an outside chronology, puts the first Tether freeze on Ethereum at 21:01:35 UTC, 37 minutes after the first sweep.

Binance also says 98% of the impacted token assets have been replenished. That is the exchange refilling user assets, not funds clawed back from the thief.

Attribution, and which number

The FBI said North Korea was responsible for the theft of more than $6 billion from Binance, on or about 29 October,^[10] and calls the activity “TraderTraitor”. Binance cites the FBI’s information in its own report. Chainalysis attributes the hack to TraderTraitor, and says stolen Binance funds commingled on-chain with funds from last month’s Bitget theft, which was attributed to North Korea.

The figures differ by who counted and when. Binance says USD 6.34 billion. TRM valued each transfer at the price at the moment it was taken and got approximately USD 6.36 billion, and about USD 6.23 billion at later prices. Elliptic puts it at $6.43 billion, using transfers at the time of theft and DefiLlama prices, and Chainalysis says approximately $6.4 billion.

Binance says the investigation continues and its findings will be subject to further independent review.

Notes

TRM Labs, North Korea Steals USD 6.36 Billion From Binance; Binance, 29 October Binance Security Incident: Initial Findings and Response Update (3 November 2026).
Halborn, Inside the Largest Crypto Theft on Record.
Halborn, Binance Hack Report: The Signing Service Answered, Four Days On.
Blockscout record of the type-4 transaction carrying 50 EIP-7702 authorizations (block 26300753, 2026-10-29 20:20:59…
Blockscout record of the first sweep transaction from Binance 14 (block 26300770, 2026-10-29 20:24:23 UTC).
Blockscout record of a rehearsal type-4 transaction from the same operator wallet (block 26298813, 2026-10-29…
Chainalysis, The $6.4 Billion Binance Hack: Tracing the North Korea Link.
Elliptic, The largest theft in history: North Korea behind the $6.4 billion Binance hack.
Tether, Tether Freezes Over $1.5 Billion From Binance Hack.
FBI, North Korea Responsible For $6 Billion+ Binance Attack (31 October 2026).

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

Arkansas and Utah test who regulates Kalshi's sports bets

S-Curve Desk — Thu, 05 Nov 2026 18:47:34 GMT

Four published counts of the states in the prediction market fight.

Arkansas is the latest state to test whether a sports contract on Kalshi is a bet or a federally regulated swap. Attorney General Tim Griffin sued the prediction market on 4 November, accusing it of running an illegal gambling operation.^[1] “Arkansas law is concerned with substance, not semantics,” Griffin said in a statement.^[2] The suit asks a judge to declare that Kalshi violated the state’s deceptive trade practices act and to award restitution. It also seeks civil penalties, unpaid taxes and an injunction. The Arkansas Advocate reported that the complaint accuses Kalshi of operating a “pocket-sized bookie” and allowing users as young as 18 to wager real money on sporting and entertainment events.

Kalshi has said in other state cases that its sports contracts are swaps regulated by the CFTC, not bets. That disagreement, not any one complaint, is what the courts are deciding. Utah, which CoinDesk names as one of the states already in the fight, has taken a different route from Arkansas’s.^[3]

What Utah has done

Utah moved in three steps, and a federal court came first. Kalshi sued Utah in federal court in February.^[4] In August a judge ruled that Utah’s anti-gambling laws apply to the sports contracts Kalshi offers, and that the federal law Kalshi relied on does not preempt the state’s ability to enforce its statutes.^[5] Kalshi appealed and asked for an injunction while the appeal runs, and the Tenth Circuit denied that request in September.

On 20 October, Attorney General Derek Brown filed a civil suit against Kalshi in state court, not under a consumer-protection statute but on the theory that its operation is a public nuisance. The 63-page suit, filed in the 3rd District Court in Salt Lake City, seeks to stop Kalshi operating in Utah and to collect millions of dollars in damages. The state estimates that Kalshi earned between about $30.6 million and $61.2 million in fees from what it calls illegal wagers placed by Utah accounts.^[6] Brown framed the case as a question of state choice: “every state can choose how they treat this issue”.

Kalshi responded the same day. “Kalshi is a federally regulated financial exchange, like the stock market. Our customers trade with each other and set the prices,” a spokesperson, Jacki McGavick, said. “As a national derivatives market overseen by the CFTC, Kalshi answers to federal law, and no single state should have a veto over it. This latest state court action does not affect our ongoing federal litigation.”

On 28 October Utah added criminal charges. Fox 13 reported that the charges name KalshiEx LLC and two of its co-founders, and include a second-degree felony count, 12 third-degree felony counts of online gambling promotion and one misdemeanor.^[7] These are charges, not findings. Kalshi called them “a crazy overreach” and said “Utah is clearly playing politics”.

The federal side

The Commodity Futures Trading Commission (CFTC) holds that the question is already settled in its favor. In its words, Congress “long ago decided that a national framework for commodity derivatives markets was preferable to a fragmented patchwork of state regulations”.^[8] On 27 October it sued Utah, the tenth state it has sued.^[9] It first sued Arizona, Connecticut and Illinois in April, and later Kentucky, Minnesota, New Mexico, New York, Rhode Island and Wisconsin. CFTC Chairman Michael Selig said Congress “entrusted the CFTC to be the federal regulator with sole responsibility to oversee these markets”. He has also said the agency is “prepared to fight these challenges all the way up to the Supreme Court,” according to Crypto Briefing.^[10]

Where the courts stand

The appeals courts disagree, and they disagree about one phrase. The law treats a contract as a swap if it depends on an event “associated with a potential financial, economic, or commercial consequence”.^[11]

On 6 April a divided Third Circuit sided with Kalshi, affirming an injunction that stopped New Jersey from enforcing its sports-gambling laws against it. The majority held Kalshi was likely to show its sports contracts are swaps under that phrase, and Judge Jane Roth dissented.

The Ninth Circuit went the other way on 28 August in a case brought by Nevada, finding that Kalshi’s sports contracts amount to gambling rather than federally regulated swaps.^[12] On 4 November the panel refused to rehear the case, and its order said “no judge has requested a vote on whether to rehear the matter en banc”.^[13] Legal Sports Report said that leaves in place a ruling allowing Nevada’s Gaming Control Board to enforce state gambling laws against Kalshi.^[14] DeFi Rate noted that the denial does not turn the preliminary injunction ruling into a final judgment. In September the Sixth Circuit, ruling on Ohio and Tennessee, found Kalshi’s sports contracts are not swaps and that, even if they were, the act does not preempt state sports betting laws.^[15]

The Second Circuit has not ruled on the question. A day before the Ninth Circuit’s order, it declined to grant injunctions pending appeal in Kalshi’s New York and Connecticut cases and in a Coinbase case in Connecticut, DeFi Rate reported, in a brief order that did not resolve preemption.

The Supreme Court has not yet agreed to hear any of the cases. New Jersey filed a petition on 2 September, and Robinhood and Crypto.com have also petitioned.

How many states

No single number exists, because each count defines the fight differently. By the CFTC’s own tally as of 27 October, it has sued 10 states. New Jersey’s petition to the Supreme Court says litigation over prediction markets’ sports contracts has reached at least 20 states. The Associated Press, reporting on Utah’s charges, put it at roughly 20 states.^[16] CoinDesk’s tally, which counts states that charged, sued or restricted Kalshi, makes Arkansas the seventh.

New Jersey's petition says litigation over sports contracts has reached at least 20 states, and the AP says roughly 20. The CFTC had sued 10 states by 27 October. CoinDesk counts Arkansas as the seventh state to charge, sue or restrict Kalshi specifically. Download (PNG) · Data (CSV)

Arkansas’s own position predates the suit. A formal opinion from its attorney general in October 2025 said a business model like Kalshi’s amounts to gambling and needs a state license. What a court will say about that is the open question. NextPredict reports that Kalshi has until 7 December to respond to New Jersey’s petition. DeFi Rate puts its deadline to ask the Supreme Court to review the Ninth Circuit ruling at 2 February 2027, unless extended.

Notes

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

Trump-linked companies are moving bitcoin. What the filings show

S-Curve Desk — Thu, 05 Nov 2026 18:47:34 GMT

Bitcoin reported in Trump Media's 10-Q, and the three transfers to the address labeled as Crypto.com's.

Two listed companies with Trump family ties made bitcoin news on 5 November. Wallets labeled as Trump Media’s sent 4,259.35 BTC to an address labeled as Crypto.com’s, worth about $343.5 million.^[1] American Bitcoin reported net income of $125.987 million for the third quarter.^[2] Read quickly, the first looks like a sale and the second like a business turning around. The filings support neither reading on their own.

What moved, and who says whose

Two Bitcoin transactions in block 974613, with a header time of 02:17:18 UTC on 5 November, paid 4,259.35 BTC in all to one address. At the Coinbase Exchange price for that minute, that was about $343.5 million.

The chain itself carries no names. The labels come from the analytics firm Arkham, as relayed by CoinDesk: the coins left addresses labeled “2028 Convertible Notes Collateral” for an address labeled “34jvU…,” reportedly owned by Crypto.com.^[3] The label is plausible, not proven. It fits a figure in Trump Media’s filings: its 10-Q for the quarter ended 30 June says 4,260.73 bitcoin served as collateral for its convertible notes and that it is restricted from distributing or withdrawing it.^[4] The 4,259.35 BTC that moved is 99.97% of that amount, 1.38 BTC less.

Why a transfer is not a sale

An exchange deposit says where coins went, not what happened to them.

Crypto.com is not a stranger to the company. The Block reported in August that “Crypto.com is one of the two custodians the firm chose” for its treasury, the same month the two ended their CRO treasury and ETF partnerships.^[5] Two earlier transfers went the same way. A Trump Media spokesperson told The Block that bitcoin moved in August was “transferred, but not sold”, and CoinDesk reports that the company said that transfer was for custody management. CoinDesk says it asked the company about the latest transfer and had no response when it published. No statement on this one has appeared.

The address history fits a deposit. The destination also received about 2,649.90 BTC on 22 May and about 2,628.31 BTC on 1 August, the amounts of the two earlier transfers reported as going to Crypto.com. Each time it forwarded the full amount in one transaction: 17 minutes later in May, 23 minutes later in August, and 74 minutes later on 5 November, at 03:31 UTC. All three sweeps went to one address that has received 102,711 BTC across 56,053 transactions. That is how an exchange deposit address behaves. The chain does not show what the exchange or the company did with the coins afterwards.

Custody is not the only alternative to a sale. Trump Media’s 10-Q for the quarter ended 30 June says “we have deployed a portion of our bitcoin holdings to third-party counterparties through lending, placement, and other yield-generation arrangements”.^[6] It also says “we pledged 2,077.34 bitcoins for our option strategy,” collateral that the counterparty “can rehypothecate at their sole discretion”. Coins put to either use leave the company’s wallet without being sold.

The 10-Q’s totals do not match a treasury sold down to a few thousand coins. It lists 9,477.16 BTC of digital assets on 30 June, which with the pledged coins makes 11,554.50 BTC. In July it sold $159.6 million of bitcoin-related equity securities, bought bitcoin with the proceeds, and reported about 14,139 BTC on 31 July, pledged coins included. Its first-half reconciliation does list bitcoin dispositions of $128.8 million, additions of $119.8 million and a $52.2 million loss on derecognition, without saying what those were.

Top: bitcoin in Trump Media's 10-Q for the quarter ended 30 June, including its 31 July update. Bottom: the three transfers to the address labeled as Crypto.com's. The July total includes bitcoin bought with $159.6 million from selling equity securities. It predates the August and November transfers, and no filing yet covers them. Download (PNG) · Data (CSV)

The “sold” reports trace to one source. Lookonchain wrote in August, “It looks like Trump Media sold another” batch, counting each transfer to Crypto.com as a sale.^[7] Its tally of 7,281 BTC sold is hard to square with the 14,139 BTC the company reported. On 5 November its post asked a question instead: “Is Trump Media dumping $BTC?”^[8]

What would make it one

Trump Media has a repayment date coming. Its 10-Q for the quarter ended 31 March describes $1.0 billion of convertible senior secured notes due 29 May 2028, and says each holder may require the company to repurchase its notes for cash on 30 November 2026.^[9] A merger registration it amended on 2 November lists options including “a new credit facility to refinance all or a portion of the TMTG Convertible Notes”.^[10] If those fall short, it says, it may have to “sell our bitcoin or other digital asset holdings to fund such repurchases”. That is a stated contingency, not a report of a sale.

Two limits apply. The 10-Q says the company is restricted from distributing or withdrawing the 4,260.73 BTC of note collateral, subject to meeting indenture requirements. And its merger agreement with TAE Technologies says it may not, without TAE’s written consent, “dispose of any portion of its material properties or assets (including Parent Digital Assets)” above $5 million, with exceptions that include the ordinary course of business.

What settles it is a statement from the company or a later balance sheet. Trump Media’s third-quarter 10-Q had not been filed as of 5 November, and it would cover the May and August transfers, not this one.^[11]

American Bitcoin’s profit is a mark

American Bitcoin’s third-quarter revenue was $63.355 million. Its income statement also shows a $197.340 million gain on digital assets, which made operating income $191.834 million. Without that gain the operating result is a loss of about $5.5 million.

The gain is an accounting mark on bitcoin the company holds. Bitcoin closed 30 June at $58,523.93 and 30 September at $83,556.14 on Coinbase Exchange, up $25,032. On the 8,002 BTC the company held at the start of the quarter, that rise is about $200.3 million, close to the gain it booked.

Operating costs are cost of revenue, depreciation and amortization, and general and administrative expense. Revenue less those costs is a loss of about $5.5 million; the digital-asset gain turns it into operating income of $191.8 million. Download (PNG) · Data (CSV)

The company’s Adjusted EBITDA of $220.797 million starts from net income and adds back tax, depreciation, a $64.276 million derivatives loss and stock compensation. It does not remove the digital-asset gain.

Mining itself was steadier than the headline. The company’s reserve rose from about 8,002 to about 8,427 BTC with no purchases. It mined about 891 BTC and says it “Sold a portion of Bitcoin production to cover operating costs while continuing to build the Company’s strategic Bitcoin reserve.”^[12] Chief executive Mike Ho said: “Despite seasonal power cost pressures, we continued mining Bitcoin at a structural discount to spot, grew our strategic reserve, and increased Satoshis Per Share by approximately 5%”.

CoinDesk reports that revenue missed an average forecast of about $74 million.^[13]

Who is behind it

American Bitcoin describes itself as “a majority-owned subsidiary of Hut 8 Corp.” Eric Trump is its co-founder and chief strategy officer.

What the two companies share is a way of reporting bitcoin: wallet moves that need a label and a custodian’s account of them, and profits that move with the price on the last day of the quarter.

Notes

Bitcoin transactions to address 34jvU…7My, mempool.space; S-Curve arithmetic on company filings and Bitcoin transaction data.
American Bitcoin Form 8-K Exhibit 99.1, Q3 2026 results.
Trump Media moves $342 million in bitcoin to Crypto.com, blockchain data show (CoinDesk).
Trump Media Form 10-Q, quarter ended 30 June 2026: financial statements.
Trump Media says $165 million bitcoin transfer to Crypto.com wasn’t a sale | The Block; Trump Media and Crypto.com end partnerships as companies shift priorities | The Block.
Trump Media Form 10-Q, quarter ended 30 June 2026.
Trump Media Sells Another $165M in Bitcoin, Booking a Fresh Loss.
Lookonchain post on Trump Media transfer (5 Nov 2026).
Trump Media Form 10-Q, quarter ended 31 March 2026.
Trump Media Form S-4/A, filed 2 November 2026.
SEC EDGAR: Trump Media 10-Q filings.
American Bitcoin Reports Third Quarter 2026 Results.
Trump-linked American Bitcoin swings to $126 million profit but misses revenue estimates (CoinDesk).

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

How issuers got a veto over OKX and ICE's tokenized stocks

S-Curve Desk — Thu, 05 Nov 2026 18:47:34 GMT

Companies on the objection list in each of OKXICE's nine public notices, 19 October to 4 November 2026.

Sixty-two companies have told OKXICE that they do not want tokenized versions of their stock traded on its planned venue, according to the venue’s public notice dated 4 November.^[1] OKXICE is the joint venture of crypto exchange OKX and Intercontinental Exchange (ICE). The list has grown from 16 on 19 October to 50 on 30 October and 56 on 2 November.^[2] Tesla, Amazon and SpaceX arrived on the 2 November notice, Apple, Home Depot and GE Vernova on 3 November, and Boeing, ServiceNow and Nebius Group on 4 November.^[3] The notice gives names and tickers, no reasons, and no launch date.

Companies listed as objecting in each of OKXICE's nine dated public notices, 19 October to 4 November 2026. Below, the share of the 62 originally picked companies that had objected: CoinDesk's tally for 30 October and 2 November, and the same method applied to the 4 November notice. Download (PNG) · Data (CSV)

What OKXICE is trying to build

The venue exists because the SEC allowed it. A 17 September order exempts tokenized securities venues from the definition of an exchange for five years, and the agency said its purpose was “to facilitate the permissioned trading of tokenized NMS stock using innovative automated market makers”.^[4] Tokens traded under it must give holders the same rights as the underlying stock.

OKXICE’s design follows that template. Trading happens in permissioned automated market maker pools on the XLayer blockchain, with no order book, and only wallets that hold a venue-issued token, issued after identity checks, can trade. CoinDesk lists the promised benefits as longer trading hours and faster settlement.^[5] Andrew Cuomo, the former New York governor who co-chairs the venture, said at a late-October press conference that many companies wanted to see how the market worked first: “I think the more people become familiar with tokenization, and the more they see the benefits of tokenization, I think you’ll see more and more companies participate”.^[6]

ICE’s position is twofold. The venue’s notice says OKXICE LLC is 50% owned by ICE and 50% owned by OKC USA Holding Inc.. Separately, ICE announced an investment in OKX in March at a $25 billion valuation, with a seat on OKX’s board; the terms were not disclosed.^[7] ICE said its “minority position in the OKX group is not expected to have a material impact on ICE’s 2026 financial results or capital return plans”.

Why issuers hold a veto

The veto comes from the order, not from OKXICE. Before listing a token of a company’s stock made by a third party unaffiliated with the company, a venue must send the company written notice, and trading may not start until at least 30 calendar days after the company receives it. If the company objects in writing within that window, the venue cannot list the token and must amend its public notice within five business days. A venue that lists a stock over a valid objection no longer meets the exemption’s conditions for that stock.

The SEC gave two example concerns: “the risk of maintaining its shareholder register related to onchain transfers,” and price dislocation, because pool prices most likely rest on the ratio of the assets in the pool. The law firm Troutman Pepper Locke calls the right unusual, because “issuers generally cannot stop an exchange or ATS from trading their stock”.^[8] The firm advises companies, and says that for most listed ones the prudent course while the framework is provisional is to object. It quotes Nasdaq as saying it intends to opt out.

Silence works the other way. According to Morgan Lewis, summarizing SEC staff FAQs, a company that gives no timely objection lets the venue list the stock.^[9] SIFMA, the industry group, describes the rule as one where “silence is treated as consent”.^[10]

The clock and the denominator

The 3 November date that headlines pointed to was not a deadline for everyone. The 30 days run from each company’s receipt of its notice, so no single date applies. CoinDesk worked out 3 November for companies that received notice on 4 October. Venues have five business days to publish an objection, so one received on 3 November could appear as late as 10 November. Cuomo told reporters, as Unchained reported it, “The start period has passed. There’s no end period”.^[11] It is unclear whether he meant that late objections would count; the order provides for objecting on or before the 30th day.

The percentages in circulation use a base that is not published. CoinDesk counted 43 of the 62 companies OKXICE initially picked as objectors on the 30 October notice, about 69%, which is the nearly 70% in the headlines.^[12] On the 2 November notice it counted 49 of 62, about 79%, plus seven objectors outside the original selection. CoinDesk’s 6 October report put the plan at 63 companies, and the reason for the difference is unclear.^[13]

Applying the same method to the 4 November notice gives 54 of the 62 original picks, about 87%. Five of the 13 picks CoinDesk had listed without an objection have since appeared: Apple, Home Depot, GE Vernova, Boeing and ServiceNow. Eight are not on the list: Strategy, Robinhood, Coinbase, Super Micro Computer, Palantir, Circle, Securitize and BitGo. The 62 objectors and the 62 picks are different groups, because the other eight objectors, Nebius among them, were never on the plan. The picks still holding out are mostly companies in crypto or trading themselves.

SpaceX, whose ticker SPCX is on the notice, is a listed company. It priced its IPO at $135 a share and began trading on Nasdaq on 12 June,^[14] so the same rule applies to it as to Apple or Nvidia.

Whose token it is

OKXICE does not make the tokens. Neither the venue nor any affiliate issues or tokenizes a stock listed there, and the notice names no tokenizer. Instead a third party unaffiliated with the issuer, the Tokenizer, acts through an SEC-registered broker-dealer that holds the share one-for-one. The notice says “Each token represents a security entitlement to one share of the underlying NMS stock”.

The entitlement sits on the Tokenizer’s books. The venue requires holders to receive the same dividends, voting rights and share of residual assets as holders of the stock, and proxy materials must be available at no cost to the issuer or the holders. The notice says “The Tokenizer is responsible for processing all corporate actions affecting a Tokenized NMS Stock”.

The notice also warns about the failure case. If the Tokenizer or its broker fails to keep the stock segregated or becomes insolvent, holders could face delays or loss of access, and dividends or votes might not be passed through. Whether tokens in a self-custody wallet would be treated as “customer property or protected by the Securities Investor Protection Corporation is uncertain,” it says.

What an objection stops

An objection applies to one venue and reaches only stock tokenized by an unaffiliated third party; it does not cover synthetic products. Tokenized stocks already trade elsewhere. Coin Metrics put their market cap above $3 billion on 3 November and said they are “generally offered to non-U.S. investors”.^[15]

SIFMA recommends a 90-day objection period and a defined wind-down for outstanding tokens and liquidity-pool positions if an issuer objects after trading has begun. Those are recommendations, and the order has not been changed.

Companies have not said why they objected. Ram Ahluwalia, founder of Lumida Wealth, offered one explanation on Unchained’s podcast: “The issuers like to control their stock”.^[16]

Notes

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

The Arkéa theft left a trail in Kraken's euro market

S-Curve Desk — Thu, 05 Nov 2026 02:30:48 GMT

USDC/EUR volume on Kraken and withdrawals to the published addresses, by hour on 1 November 2026.

Crédit Mutuel Arkéa said on Wednesday that attackers used the French bank’s own account to send money to other banks, “which then potentially allowed them to convert this money into cryptocurrency via specialized platforms”.^[1] It described a “sophisticated attack from outside” and said no client accounts were involved. It would not confirm the reported $133 million, saying only that it could “validate the order of magnitude”.

Public market data points the same way. On 1 November, as money left Kraken, the exchange’s USDC/EUR market had its two busiest hours of the previous 30 days.^[2] Nine withdrawals, $63.2 million in total, each came within four minutes of a USDC purchase of the same size on that market.^[3] Public trades carry no account names, so the link rests on size and timing.

From euros to USDC

A normal hour on Kraken’s USDC/EUR market trades about €3.9 million. Between 21:00 and 22:00 UTC on 1 November it traded €47.1 million, after €37.1 million the hour before. Over 30 hours, volume on the market tracked withdrawals with a correlation of 0.87. Sterling and Swiss franc USDC markets showed nothing of comparable size.

The nine matches are tight. At 20:06:06 UTC, 9,827,294 USDC was bought for euros, and at 20:08:11 UTC $9,806,638.62 was withdrawn to one of the addresses. Together the nine purchases took 63.3 million USDC for about €57.7 million. Run on rescaled amounts, or on times shifted by up to four hours, the same test found zero or one match instead of nine.^[4]

The buying moved the price. USDC reached €0.9491 on Kraken at about 22:03 UTC, roughly 5.9% above the €0.8965 of earlier that day. OKX reached about €0.9058 and Bitstamp about €0.9008 in the same hours, so the pressure was concentrated on one venue.^[5]

Top: USDC bought and sold for euros on Kraken each hour, against the mean hour of the previous 30 days. Bottom: USDC and USDT withdrawn from Kraken into the published addresses in the same hours. Public trades carry no account names, so the link between the two is size and timing. Download (PNG) · Data (CSV)

What the exchanges and the bank say

Kraken says the money did not start with it. “This incident did not originate on the Kraken platform, and we’re actively investigating reports that some of the assets were subsequently moved through accounts on our platform,” the exchange told Cointelegraph.^[6] It added: “We’ve restricted the accounts in question and are working with law enforcement to support recovery efforts.” Crypto.com said it had “taken appropriate action to block any funds associated with this third-party incident from moving through Crypto.com”. OKX told Cointelegraph it was looking into the matter.

The incident became public through the investigator ZachXBT, who posted on Monday that an EU entity was suspected of losing $106M+ from exchange accounts.^[7] He later raised the total to $133M+,^[8] and at 02:24 UTC on 4 November wrote that the institution “is allegedly Credit Mutuel Arkea”.^[9] Arkéa issued statements at 13:00 and 17:30 French time that day, saying that the amounts do not threaten its financial health and that it is too early for a final figure.^[10] The bank has total assets of 211.5 billion euros.^[11] The attackers reached it through the platform of a service provider, it said, and not through its online bank Fortuneo. The Paris prosecutor’s office said it had received the bank’s complaint and opened an investigation.^[12]

The wallets were already there

The addresses that took the money were not new. Ten of the 15 that ZachXBT published had been receiving withdrawals from the same three exchange wallets since 14 May: 100 withdrawals worth $1.53 million.^[13] Of those, 93 fell on weekdays and 77 landed before 13:00 UTC. Eight of the 15 run a smart-wallet contract whose source returns the version string TrustWallet.Biz.v1.0.0.^[14] The analytics firm Bitquery reads the setup as that of “a trading or payments business using ordinary crypto wallets,” according to Crypto News Flash.^[15]

Those wallets did not hold money for long. Before the theft they passed it on to other wallets, and from there to exchange deposit addresses and swap services.^[16] On the day, $108.6 million went to 29 next-hop wallets, and only one of those had been used before. That one got $5,276.87 from theft address 0x795a9d22 at 17:38 UTC on 1 November, emptying the address to its usual counterparty. Four hours later 0x795a9d22 passed $9.6 million to a new wallet.

That history belongs to whoever ran the wallets, and it points away from a bank’s treasury. It does not say who they were, or what they knew about the money.

Top: USDC and USDT withdrawn from Kraken, Crypto.com and OKX into ten of the addresses each month before 1 November 2026. Bottom: the same six months together against withdrawals into all 15 addresses from 12:25 UTC on 1 November to 16:30 UTC on 2 November; Kraken supplied 94.5% of the November total. Exchange wallets identified from Blockscout tags and refill history. Download (PNG) · Data (CSV)

Out through Ethereum

Counting only real USDC and USDT on Ethereum, 101 withdrawals reached the 15 addresses between 12:25 UTC on 1 November and 16:30 UTC on 2 November, a total of $108.6 million. Kraken supplied 94.5% of it, Crypto.com $5.4 million and OKX $0.6 million, and the rest of ZachXBT’s total is not in these flows. Four addresses first received exactly $1,000 and then, within five minutes, $1 million or more.

ZachXBT described the actor “aggressively swapping USDC for ETH”, and the ledger shows it. One wallet took in $60.72 million of USDC and sent out 27,699 ETH, worth about $63 million at Tuesday evening’s price.^[17] By then there was little left for issuers to freeze: the 15 addresses held 872 USDC and 2,368 USDT, and only one of 19 large next-hop wallets still held a material balance, 1,314,666 USDC.^[18] Cointelegraph, citing Bitquery, reported that Tether had frozen $1.1 million of USDT. Arkéa says part of the funds has been blocked. ZachXBT said with “a high degree of confidence” that the actor is not Lazarus Group.

What is still open

Arkéa has not named the other banks or the platforms. The first withdrawal came on a Sunday, and the bank has not said when the transfers left its account; ZachXBT says the attack ran “for multiple days” and suspects the total is larger once over-the-counter deals are counted. The next fact sits with the holders of the accounts Kraken says it has restricted, and with the Paris investigators.

Notes

Crédit Mutuel Arkéa confirms $133m theft, funds laundered via crypto exchanges (updated) - Ledger Insights -….
Kraken public hourly market data, 30 days to 3 November.
Kraken public trades matched to withdrawals, S-Curve analysis.
Placebo runs of the Kraken match, S-Curve analysis.
Public hourly USDC/EUR market data from OKX and Bitstamp.
Kraken Restricts Accounts Amid Suspected $133M EU Crypto Theft.
ZachXBT Telegram 372: community alert, EU entity suspected of losing $106M+.
ZachXBT Telegram 374: update, total $133M+, working theory.
ZachXBT Telegram 375: update 2, names the institution.
Crédit Mutuel Arkéa press release, 4 November 2026 17:30: further information on the attack.
French bank Crédit Mutuel Arkéa exploited for over $133 million, ZachXBT says | The Block.
Le Crédit Mutuel Arkéa victime d’un piratage de plus de 100 millions d’euros sans répercussion pour les clients: ….
Withdrawals from Kraken, Crypto.com and OKX to the published addresses: Blockscout token transfers, S-Curve analysis.
Blockscout address records for the published addresses and exchange wallets.
$133M Crypto Theft May Have Hit a European Bank - Crypto News Flash.
Blockscout stablecoin flows from the published addresses before 1 November, S-Curve analysis.
Blockscout token transfers of wallet 0x9EcA05D7; Blockscout balances and transactions of the wallets receiving ether, 3 November.
Blockscout balances of the published addresses and their next-hop wallets, 3 November.

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

Most Hyperliquid altcoin spikes slip within days; few fully reverse

S-Curve Desk — Wed, 04 Nov 2026 05:27:20 GMT

Altcoin spikes on Hyperliquid slip for days, but rarely all the way.

When an altcoin jumps far beyond what bitcoin did that day, the next few days are usually worse for it. Across 104 tokens traded as perpetual futures on Hyperliquid,^[1] 492 sharp up-moves had three days of trading after them, and only 38.8% of them closed higher three days later than on the day of the jump, which leaves 61.2% lower. The sample covers daily closes at midnight UTC from 28 October 2025 to 2 November 2026.

A spike here has a strict meaning. Each token’s daily return is first stripped of its usual co-movement with bitcoin, measured as its beta to BTC over the year; what is left is the residual. A day counts as an event when that residual is at least three standard deviations of the token’s own residual moves, or at least 20%, in either direction. That rule found 607 events, 494 of them up and 113 down.

A slip, not a round trip

The fade is real but partial. From the close before the spike, the median spike stood 18.8% higher at the end of the spike day, 15.1% higher three days later and 11.4% higher after five days. Measured spike by spike, the median token still held 60.1% of its spike-day gain after five days, while 22.3% had erased the gain entirely.

Days around a BTC-adjusted up-spike in 104 Hyperliquid perpetuals (daily closes, 28 October 2025 to 2 November 2026): the median change from the close before the spike, for all 488 spikes with five days of data and for the 205 of 20% or more, and the share still above the spike-day close against any day in the same tokens. Download (PNG) · Data (CSV)

A falling market sets the bar

Part of what looks like a fade is the year itself. Any given day in the same 104 tokens was followed by a higher close three days later only 43.7% of the time. Bitcoin’s daily close fell from $112,864 to $76,805, down 31.9%, and the median token in the group lost 56.7% from its first close in the window to its last. Against that baseline, spikes were followed by a higher close about five percentage points less often than ordinary days. Adjusted for bitcoin’s own moves over the following three days, 34.3% of up-spikes were higher.

Three ways out

Individual spikes split into three broad shapes. The first is the near-complete fade. NIL closed 110.6% above its prior close on 7 May 2026 and was 8.7% above it ten days later. FIL went from 78.7% up on 7 November 2025 to 7.3% up ten days on. PROVE jumped 41.1% on 21 May 2026 and was back at its starting level, 0.0%, by day ten.

UNI shows that a documented catalyst does not guarantee the gain sticks. On 10 November 2025, Uniswap Labs and the Uniswap Foundation published a governance proposal to turn on protocol fees and to “Burn 100 million UNI from the treasury”.^[2] UNI closed 42.2% above the prior day’s close that day, 6.2% above it four days later, and -0.3% after ten days.

The second shape keeps part of the move. BERA rose 86.5% on 11 February 2026 and held 17.4% after ten days. ONDO’s spike came on 24 September 2026, the day Ondo Finance announced three onchain portfolio tokens and wrote that “The first three portfolios launched are based on portfolio strategies developed by BlackRock for Ondo”.^[3] ONDO was 26.5% up on the day, 42.6% up three days later and 20.7% up after ten days.

The third shape keeps going. On 27 May 2026, DTCC and the Stellar Development Foundation “today announced plans to enable the tokenization of The Depository Trust Company (DTC) custodied assets on the Stellar network”.^[4] XLM rose 11.1% that day, enough to count as an event, and spiked again on 28 and 29 May. Ten days after the first jump it was 43.4% above its starting close, having been 75.3% above it on day two. ZK went from 79.4% up on 1 November 2025 to 161.8% up four days later, and was 74.2% up after ten days. VVV rose 60.8% on 13 February 2026, reached 143.1% on day seven and stood at 104.9% on day ten.

Some spikes do all three. ACE closed 106.1% higher on 14 August 2026, was only 8.8% above its prior close two days later, then 105.6% above it on day six.

Eight BTC-adjusted spikes in Hyperliquid perpetuals, each drawn as the change from the close before the spike through ten days after it, on one shared scale: NIL, FIL and UNI gave back almost all of it, BERA and ONDO kept part, XLM, ZK and VVV kept going. Download (PNG) · Data (CSV)

Bigger jumps hold less often

Across all 488 up-spikes with five days of data, the outcomes are close to evenly spread: 22.3% had given back the whole spike-day gain five days later, 22.3% kept less than half, 24.0% kept half or more without regaining the spike-day close, and 31.4% were above that close.

Size matters. Spikes of under 20% beyond bitcoin were higher three days later 42.9% of the time, close to an ordinary day; spikes of 20% to 50% managed 33.9%, and the 19 spikes of 50% or more managed 26.3%, with a median three-day change of -18.1%. Of the 40 most extreme events by the volatility measure, 30 were lower three days later, with a median three-day change of -9.2%.

Top: where the 488 up-spikes with five days of data stood five days later, measured against the spike day's own gain. Bottom: the share of up-spikes higher three days later, by size of the move beyond bitcoin, against any day in the same tokens. Download (PNG) · Data (CSV)

The repeat spikers

Spikes cluster in a handful of tokens. ACE, GRASS and NIL each logged 13 events in the year, and RESOLV and SAGA logged 12 each. Across their own up-spikes, 19 of 48 were higher three days later. ACE and SAGA each held up in 3 of 10, with median three-day changes of -18.0% and -19.2%; GRASS also held up in 3 of 10, although its price rose 48.7% over the whole window; RESOLV held up in 5 of 8, with a median three-day change of +6.6%.

How sturdy the pattern is

The result does not hinge on the details of the rule. Estimating beta and volatility only from the previous 90 days, so that no future data enters the definition, gives 690 events and 41.7% of up-spikes higher three days later; keeping only the first event in any five-day run per token gives 465 events and 40.7%.

Nor does it come from leaving out failed tokens. Hyperliquid lists 56 perpetuals it has delisted, and 19 of them traded at least 60 days in the window. Their 52 up-spikes were higher three days later 35.3% of the time, against 34.0% for 844 up-spikes in 176 live perpetuals; with every perpetual included, the rate stays at 34.0%.

All of this rests on daily closes. A token that doubles during the day and gives most of it back before midnight shows up only as its closing gain, so the intraday peak and the selling that follows it within the same day sit outside these numbers.

Notes

S-Curve analysis of Hyperliquid daily price data.
UNIfication.
Introducing Ondo Intelligent Portfolios | Ondo Finance.
Expanding Tokenization Through a Multi-Chain Strategy | DTCC.

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

Blast's exit window has closed. About $30 million is still on two L2s

S-Curve Desk — Wed, 04 Nov 2026 05:27:20 GMT

Value secured on Blast and Abstract, July to November 2026, by L2BEAT's daily count.

Blast’s deadline for withdrawing through its own interface passed on Oct. 26.^[1] Abstract, which announced its own shutdown four days after Blast, stops operating on Dec. 15.^[2] Most of the money did not wait. L2BEAT counted $92.6 million on Blast on Oct. 2, the day it announced, $43.3 million on the deadline and $12.07 million on Nov. 3.^[3] Abstract went from $48.9 million on its announcement day to $18.04 million.^[4]

That leaves about $30.1 million on the two chains, against $72.4 million on Oct. 20. Blast said “the ongoing costs of maintaining Blast exceed the revenue generated by the L2”.^[5] Igloo, the Pudgy Penguins company behind Abstract, had been funding the chain, and its CEO Luca Netz said Igloo “could no longer justify taking from the Pudgy Penguins business”.^[6]

Value secured on Blast and on Abstract, July to November 2026, by L2BEAT's daily count of bridged and native assets. Blast announced its shutdown on Oct. 2 and closed its withdrawal interface on Oct. 26; Abstract announced on Oct. 6 and shuts on Dec. 15. Blast's dip from Oct. 3 to Oct. 9 is staked ETH in transit out of Lido; its fall on Nov. 1 is ETH moved from the bridge's yield contract to a Blast multisig. Download (PNG) · Data (CSV)

The figures are L2BEAT’s total value secured: assets bridged in through the chain’s own bridge, bridged by other routes, or minted on the chain itself.^[7] That is broader than a count of deposits in apps.

How fast it left Blast

Between the announcement and the deadline, Blast’s value fell 53% in dollars and 46% in ETH terms, so falling prices explain only a small part of it. The chart’s sharp dip in early October is not users leaving. Blast said it would first withdraw its own Lido assets, a process expected to take “approximately one week”, during which “withdrawals will temporarily be unavailable”. L2BEAT’s count of Blast’s bridged value dropped from $50.0 million to $6.3 million on Oct. 3, while staked ETH sat in Lido’s withdrawal queue, and returned to $44.5 million on Oct. 10. Once withdrawals reopened, the delay before funds could be claimed on Ethereum was 24 hours.

After the deadline the fall steepened. On Nov. 3, L2BEAT put Blast at “$12.07 M (-70.3% compared to seven days ago”.

Where Blast’s ETH went

Most of that last drop was a single move on Ethereum. On Oct. 31, a transaction moved 9,955.4 ETH from the bridge’s ETH yield contract to a multisig wallet that L2BEAT labels BlastMultisig 1, which needs three of five signers and can upgrade Blast’s contracts with no delay.^[8] On Nov. 3 a second transaction moved the remaining 963.0 ETH to the same wallet. Together that is about 10,918 ETH, about $25 million, and the yield contract now holds no ETH. Before the first transfer it held about 11,010 ETH, down from 13,423 on Oct. 20, as users withdrew.

Blast has said that after Oct. 26 “assets will remain withdrawable, but users will need to interact directly with the Blast bridge contracts on Ethereum L1”. It has not said publicly what the transfer to the multisig is for. L2BEAT’s Blast page now carries a notice: “There are impactful changes and part of the information might be outdated.”

What is left on Blast

On Nov. 3 the largest holding was USDB, Blast’s dollar token: 8,638,189 tokens worth $8.25 million. Next came stETH worth $1.88 million and $967.77K of Blast’s own BLAST token. USDB is withdrawn as DAI on Ethereum, and Blast’s guide tells users to wait up to 1 day after finalizing while Blast processes the withdrawal.^[9]

The route for those holders is thin on paper. Blast’s website at blast.io returned an error page on Nov. 3.^[10] Its withdrawal guide still describes only the interface flow and does not cover the shutdown or the direct route on Ethereum.^[11] Blast had said that after October 26 users would deal with the bridge contracts directly and that “We’ll publish detailed instructions before then.” L2BEAT also notes that “Only the whitelisted proposers can publish” the state updates that withdrawals are proved against, and lists the result of proposer failure as “Cannot withdraw”.^[12]

Abstract: six weeks left

Abstract’s exit came early too. Its value fell 56% in the first two weeks after the Oct. 6 announcement, to $21.7 million on Oct. 20, then a further 17% to Nov. 3. Of the $18.04 million left, 4,983 ETH was worth $11.38 million, PENGU $3.73 million and USDC.e $2.14 million.

Abstract’s Migration Hub still opens with “On December 15, Abstract will be shutting down.”^[13] Abstract says users who do not migrate by then “will lose access to their funds”.^[14] Users can bridge off through the Migration Hub at migrate.abs.xyz or through the Native Bridge, which Abstract says carries a 3-hour delay. It also asks users to “beware of impersonation, fake migration sites, and DMs claiming to represent Abstract.”

Not the first

The two chains follow at least 11 layer 2 closures, sunsets or migrations in 2026 before Blast, by our count of L2BEAT’s archive.^[15] One of them, Mint, set Oct. 20 as its withdrawal deadline, after which L2BEAT says “Any assets left on the chain after that date will be unrecoverable.”^[16] On that date Mint held about $42K, almost all of it in its own MINT and MST tokens.^[17]

DefiLlama, which counts deposits in apps rather than bridged assets, now reads Blast at $0 and Abstract at $2.93 million.^[18]

Notes

CoinDesk: Once a $2 billion Ethereum layer-2, Blast is shutting down.
CoinDesk: Pudgy Penguins’ Abstract becomes second Ethereum layer-2 to shut down.
L2BEAT TVS history: Blast (max range) 2026-11-03; L2BEAT Blast page (md) 2026-11-03.
L2BEAT TVS history: Abstract (max range) 2026-11-03; L2BEAT Abstract page (md) 2026-11-03.
Blast shutdown announcement (X).
Luca Netz: Abstract is winding down (X).
L2BEAT daily total value secured, Blast and Abstract, 1 July to 3 November 2026; L2BEAT TVS history: Blast (max range).
Blockscout: tx 0xa66541fe internal transfers (2026-10-31).
Blast docs: Withdraw to Ethereum.
blast.io front end returns HTTP 404 (2026-11-03).
Blast docs: Withdraw to Ethereum (2026-11-03).
L2BEAT project page: blast (risks, exit, permissions).
Abstract Migration Hub (2026-11-03).
Abstract: Abstract is Winding Down (X).
L2BEAT archived projects list, 103 projects reviewed by The S-Curve.
L2BEAT project page (md): Mint.
L2BEAT Mint TVS breakdown 2026-10-20.
DefiLlama chain TVL history: Blast (2026-11-03).

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

Strategy's CFO leaves days before MSCI rules on its index spot

S-Curve Desk — Wed, 04 Nov 2026 05:27:20 GMT

Strategy's reported bitcoin holdings and the monthly average prices of its shares and of bitcoin in 2026.

Andrew Kang informed Strategy on 26 October of his intention to resign as chief financial officer, effective 5 November 2026, according to a company filing.^[1] The filing says his decision is due to personal reasons and “not the result of any disagreement” with the company on its operations, policies or practices.

Kang announced it himself on the third-quarter earnings call. “I will be stepping down as Chief Financial Officer effective November 5th for personal reasons,” he said, adding that “It has been an honor to serve as Strategy CFO for the past four and a half years”.^[2] On 2 November he signed the company’s quarterly report as its principal financial officer and principal accounting officer.^[3]

His departure lands in a busy month. On 11 November, MSCI publishes the final list of companies its new rule removes from its main equity indexes, and Strategy’s own filing says it expects to be on it.^[4]

Who runs the finances now

From 6 November to 31 December, chief executive Phong Le will serve as principal financial officer and take over Kang’s responsibilities as head of the finance organization, the filing says. On 1 January 2027, Reza Virasteh, now executive vice president of operations, becomes chief financial officer.

The job will then be split. Le will be responsible for the financial management of the bitcoin strategy, including capital markets, capital management, treasury and investor relations, while Virasteh will handle the software business’s finances and budget. Shelley Khanna, the global controller, becomes chief accounting officer on 6 November.

Kang stays on as a non-executive adviser through 31 December. Under his separation agreement, he receives a lump sum of $883,400 and six months of COBRA health coverage valued at about $20,000, according to the filing.

The MSCI date

MSCI’s rule takes effect with the November index review, as of the close of 30 November 2026. Current members are removed only if they fail the screen in each of their two most recent annual filing periods. When MSCI tested the screen on its ACWI IMI index as of May 2026, it counted three deletions.^[5] Strategy was on that list, as a US large-cap stock.

Strategy’s quarterly report is direct about it. “Based on these criteria, we expect our A common stock to be excluded from the MSCI Global Investable Market Indexes,” the company wrote. It warned that exclusion “could cause index funds, institutional investors and other holders and investment professionals attempting to track the composition of such indices to sell our A common stock”. It added that MSCI’s move “could also prompt other index providers to adopt similar criteria or exclude us from their indices”.

The shares moved first. MSTR closed down about 9.6% on 16 October, the day after MSCI announced the rule, while bitcoin fell about 0.8%.^[6]

What Strategy has sold, and what it holds

Strategy, best known for buying bitcoin, has also sold some this year. Its quarterly report shows 6,947 bitcoin sold in the nine months to 30 September, for $431.8 million. That was 1,395 bitcoin for $83.2 million in the second quarter and 5,552 for $348.6 million in the third.

The board’s monetization program lets the company sell bitcoin “to generate up to $1.25 billion of proceeds to fund the USD Reserve,” and also to fund preferred dividends and interest when management judges that cheaper than issuing common stock. The sales so far did not draw on the first part. “As of October 25, 2026, we had not sold any bitcoin under the $1.25 billion USD Reserve-building component of the BTC Monetization Program,” the quarterly report says. Le put it this way on the call: “We sold a little bit of Bitcoin as a result of that, but a fraction of the Bitcoin we hold”.

The holdings show the shift. Strategy reported 672,500 bitcoin on 1 January and 846,000 on 30 June. Since then the count has barely moved: 847,666 at the end of September and 849,327 on 1 November, after the company bought 811 bitcoin in the last week of October.^[7] That purchase was funded with $65.5 million from sales of common stock.

Strategy's bitcoin holdings as reported in its 10-Q and 8-K filings, and the monthly average of the daily closing prices of its shares and of bitcoin in 2026. Download (PNG) · Data (CSV)

The cash side is larger than the sales. The company reported a USD Reserve of $4.79 billion and USD Cash of $132.7 million as of 1 November. On the call, Kang said “Our USD assets provide 3.4 years of interest and dividends coverage at current payment obligations”.

The premium that sets the choice

Whether Strategy issues stock or sells bitcoin depends on how the market values its shares against its bitcoin, a ratio the company calls mNAV. “We currently sit at 1.15,” Le said on the call. He described the plan as “to issue equity above 1x mNAV or greater to pay the dividends and interest on the digital credit”.

The shares have roughly tracked bitcoin this year. MSTR closed 2025 at $151.95 and was at $130.76 on 2 November, down about 14%. Bitcoin fell about 12% over the same stretch, from about $87,509 to about $76,677.

What comes next

Kang’s last day as chief financial officer is 5 November. MSCI’s final list follows on 11 November, and the changes take effect at the close of 30 November. Virasteh starts as chief financial officer on 1 January 2027.

Notes

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

1inch Says It Has Routed $809 Billion Since 2019

Transcript Desk — Tue, 03 Nov 2026 05:04:16 GMT

Many sources, one flow: an aggregator routes trades across pools the way sluices feed a river.

Sergej Kunz, co-founder of the decentralized exchange aggregator 1inch, says the network’s protocols have processed about $809 billion in cumulative volume since the project began at a 2019 hackathon.

Kunz read the total, “eight hundred nine billion US dollars,” off a dashboard during his interview on the On The Margin podcast.^[1] The number is his; we have not yet matched it against an independent source.

Kunz also described a protocol 1inch launched on the day of the recording, which lets liquidity providers keep assets in their own wallet while reusing one balance across many trading pairs. He put the liquidity committed on launch day at about $25 million and said the aim was to grow it to “maybe a billion.”^[2]

Kunz is a founder of the project he describes. Both figures are his claims and are presented as such.

Notes

On The Margin interview with Sergej Kunz, transcript at 07:39.
On The Margin interview with Sergej Kunz, transcript at 05:09.

Drafted by Transcript Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.

How Fomo went from 100,000 users to 3 million in a year

S-Curve Desk — Tue, 03 Nov 2026 03:41:06 GMT

Creator videos, referral codes and a trading chart: the three parts of Fomo’s growth engine.

Fomo, a mobile app for trading crypto tokens, has surpassed 3 million lifetime users, Coinfomania wrote on 5 October 2026, citing co-founder Seyong.^[1] In a November 2025 video interview, a co-founder had put the count at “about 100,000 users and 80% of those are normies”.^[2]

In between, it raised money. Its 22 June 2026 announcement said more than 625,000 people had joined and completed over $4 billion in trading volume since launch a year earlier,^[3] and that Fomo had closed a $75 million round led by Index Ventures, with participation from Union Square Ventures and existing investor Benchmark. Fortune reported that the round valued Fomo at $550 million.^[4]

Unusually for a private company, Fomo’s revenue is visible on-chain, and its founders have explained on camera how they find users. Together they show how the app grew, and where the growth stands now.

The numbers

DefiLlama, which tracks on-chain activity, records the fomo Wallet’s monthly revenue at $0.73 million in October 2025, $2.31 million in June 2026, $15.15 million in August and $31.53 million in September, before it fell to $12.55 million in October.^[5] DefiLlama also tracks spot trading volume through the app from May 2026: $274 million in June, $3.41 billion in August, $7.47 billion in September and $2.19 billion in October.^[6]

The user counts come from the company side. Katsikaris wrote on LinkedIn that fomo had crossed 1,000,000 users in the week before 4 August 2026.^[7] The co-founder’s 3 million figure followed on 5 October.

Fomo's growth: users as the company and its staff reported them, and its daily revenue and spot trading volume as recorded on-chain, with 7-day averages. Download (PNG) · Data (CSV)

Crypto Briefing reported that by late August 2026 the app was capturing approximately 46% of daily Solana trading terminal volume,^[8] and that weekly revenue peaked at more than $9 million during the summer.

Two volume figures sit side by side. Co-founder Park Se-yong said in an interview with COINOTAG, published 17 October, that Fomo counts 2.7 million overseas users and processes roughly $200 million in trading volume every day.^[9] DefiLlama’s data shows October spot volume averaging about $71 million a day, from $2.19 billion over 31 days, and DefiLlama counts spot trades only. The co-founder also put cumulative volume at $14 billion to $15 billion, against $14.8 billion in total tracked by DefiLlama from May.

The founders’ account

Fomo’s leaders say the product comes first. Paul Erlanger said on The Crypto Tape that “we really focus on product driven growth”.^[10] A co-founder said in a video interview on building the social network for finance that “build a good product and people will come,” though the app also needs other channels to distribute it, or else it is “kind of like tree falls in the forest”.^[11]

On the same show, a co-founder credited word of mouth for a day with “7,500 first deposits,” saying many came from referrals, where a user tells a friend, or a trader tells other traders. Erlanger also said on The Crypto Tape: “We haven’t done any paid ads and we’ve never paid anyone to actually use the product”.

He added that the user base was global from early on. “We’ve done really no global growth and already 50% of our user base is non US,” he said, and then “Um, actually more now”.

Part of the pitch is that crypto’s plumbing is hidden. A co-founder said on the Steady Lads Podcast that 110,000 people had traded on the app the previous day, across several blockchains. In that co-founder’s telling, the same users trade across different coins because it is one experience, and “to you it’s just one coin”.^[12]

Creators

On the creator side, a co-founder said on the Steady Lads Podcast that Fomo was “able to do 50 million impressions a month across 100 creators,” and that the company manages this “all in house”. A co-founder described the model in another video interview: “We have these creator managers. They’re fully in house”.^[13] The company manages a group of 30 to 40 creators, he said, “constantly getting rid of the bad ones, adding new ones”.

The share of users arriving this way has changed. The co-founder said that at the time about 50% of users were referred from creators, and that the number is now closer to 15%.

Two people who ran the program describe it in their own posts. Charlie Katsikaris wrote on LinkedIn that he and Will Timberlake had built a network of 100+ creators, with 200,000+ users directly attributed through tracked creator links. He also wrote that on September 1st he would join Fomo full-time as Head of UGC & Content. Timberlake runs TK Media, which counts Fomo as its flagship client.^[14] He wrote on LinkedIn that his firm launched the campaign the day Fomo went live in April 2025, and that for the first three months “we saw next to nothing”. He later cited 400,000+ users driven through direct links and well over $2M paid out to creators.

A co-founder explained the economics in a video interview. One user, he said, might have a lifetime value of $30 and cost only 80 cents to reach, while another costs $3 because they need to see the content 10 times rather than two before they convert.

Referrals

The second channel is written into the product. Fomo’s help centre says that when someone signs up through your referral link, you earn 25% of their trading fees on every trade they make.^[15] The new user gets a 10% discount, taking the standard rate from 0.50% to 0.45% per trade. The terms of service bar users from referring themselves or accounts they control.^[16]

Affiliates get more support than a bare link. Fomo’s affiliate page says they receive a dedicated affiliate manager, creative assets, campaign ideas and a private community of other affiliates.^[17] Datawallet, a review site, wrote that the affiliate page reports more than $1.1 million paid to date.^[18]

What comes next

After the September peak, on-chain revenue and spot volume both fell back in October. The user count the company reports kept rising over the same weeks: 3 million lifetime users by early October, and 2.7 million overseas users by a co-founder’s mid-October count. The next few months of on-chain data will show whether trading per user recovers or September was the top of the curve.

Notes

Drafted by S-Curve Desk, an AI system. Reviewed by Boaz Sobrado. Read it at The S-Curve, with every source and check.