The Indian exchange first froze its custody accounts on November 6, yet outgoing transactions later appeared from one of its ETH addresses at BitGo. A 13 November update to its incident report says the transfers were signed and broadcast on-chain directly, without BitGo's platform or involvement.

BitGo's investigation found that the November 6 freeze worked as intended. Unocoin believes the backup mechanism of BitGo multisig wallets, which lets a client recover funds if BitGo itself goes offline, was exploited instead. The exchange has not disclosed the amount lost or a root cause.

More than 90% of customer crypto is held in cold storage, the exchange says.

Unocoin suspended all services on November 9 after further unauthorized activity and is rebuilding its server infrastructure from scratch, a process it expects to take 4 to 5 working days. The breach shows how a compromised client environment can bypass a custodian's account freeze.

The Winklevoss-founded exchange posted its third-quarter results on Nov. 12, showing how hard the retail slowdown has hit its core business. Total trading volume fell to $4.5B from $16.4B a year earlier, and exchange revenue dropped 47% to $13.4M.

Total revenue came in at $40.9M, down 19% year over year and 10% from Q2, while the net loss narrowed to $58.6M from $159.5M.

Cost cuts did most of the work: operating expenses fell 30% to $119.9M, the third straight quarterly decline. Credit card revenue grew 82% year over year to $15.5M, and prediction markets revenue rose 52% from Q2 to $0.8M.

The card business also carries the main risk. Charge-offs rose to $11.5M from $3.4M, largely tied to a fraud event disclosed in Q1, and 30-plus-day delinquency edged up to 3.4%.

Two weeks after the record Binance breach, the Justice Department announced coordinated actions against North Korea's crypto theft operations. On or about Oct. 29, North Korean military hackers tracked by the FBI as TraderTraitor stole more than $6B in virtual assets from the exchange.

Joint efforts by US agencies and crypto service providers have frozen more than $2.7B of the stolen funds, and the DOJ has court authorization to seize or restrain over $1.2B of that amount.

Separately, the FBI took down cloud infrastructure behind FaceStealer, a scheme that lures Web3 workers into fake video calls using recorded clips of trusted contacts and deepfakes, then installs malware via a fake technical fix. It is linked to more than $400M in thefts over the last 18 months, and agents seized over 900 webcam videos of victims.

Tracing continues as TraderTraitor keeps laundering the remaining Binance funds through bridges, mixers and exchanges. The FBI warns FaceStealer is now also targeting open-source developers, raising the risk of software supply-chain attacks.

Louisiana Attorney General Liz Murrill has filed a state court lawsuit against five prediction market operators: Kalshi, Polymarket, Robinhood, Coinbase and Gemini. The state alleges their event contracts on sports, awards and elections break Louisiana gambling and sports wagering laws.

The suit seeks an immediate temporary restraining order and an injunction that would stop the platforms from offering those contracts in the state. It is the first time Louisiana has targeted a broad group of prediction market platforms in a single filing.

Kalshi sued the state preemptively in federal court on October 23, and Polymarket has also filed a federal case, both arguing the Commodity Exchange Act preempts state law. Kalshi is now seeking an emergency court order against the state.

No final rulings have been issued in any of the Louisiana cases. Similar enforcement actions are active in at least 12 other states, and naming Coinbase and Gemini signals that states are not separating crypto exchanges from dedicated prediction market operators.

Pearl, a layer-1 network where GPU mining is produced as a side effect of AI training and inference, is heading to the largest US crypto exchange. Coinbase Assets confirmed that spot trading for PEARL goes live on November 13, 2026.

The PEARL-USD pair opens on or after 9AM PT, if liquidity conditions are met, and only in regions where trading is supported.

Pearl uses a proof-of-useful-work design built on matrix multiplication, the core GPU operation, so the same compute secures the chain and serves AI workloads. The token currently ranks around #100 by market capitalization.

A Coinbase listing opens PEARL to US retail flow, but the start of trading remains conditional on order-book liquidity at launch.

The two largest US prediction markets no longer share an adviser. Kalshi has ended its advisory contract with Donald Trump Jr. after his venture firm 1789 Capital increased its stake in rival Polymarket.

Kalshi described the split as mutual and said talks to end the role began in August, once 1789 led Polymarket's latest funding round. The company credited Trump Jr. with helping it market Kalshi to more customers.

That round raised $1B at a reported $21B valuation, with 1789 Capital contributing about $300M on top of a roughly $200M earlier investment.

The exit removes a direct conflict of interest as Kalshi and Polymarket compete for the same US users.

Two weeks after the largest crypto heist on record, which the FBI attributed to North Korea, the exchange has completed coverage of all affected user assets and released a fresh Proof of Reserves snapshot.

Binance committed more than $6.34 billion in company funds to cover the losses, buying back affected tokens through market and OTC channels.

The money came from a partial deployment of the SAFU fund, part of the Futures insurance fund above its required level, and the corporate treasury. Binance says it will replenish SAFU back to roughly $1 billion.

The new snapshot, taken on November 12 at 00:00 UTC, covers 198 tokens. The full zero-knowledge proof needs 40 to 50 hours to generate, after which holders can verify 1:1 backing. Withdrawals keep reopening in phases.

Between March 2025 and April 2026, a flaw in the plugin SafePal used to track orders exposed the names, emails and home addresses of nearly 40,000 hardware wallet buyers. That data is now being used in physical phishing letters sent to Italian SafePal customers.

The letters are printed on quality paper and claim a firmware security issue was found in already shipped wallets. A QR code at the bottom leads through an Arweave link to a fake SafePal site, which shows each victim's real name, address and order details.

Every link in the letters is personalized with the recipient's order data, making the scam far harder to spot than generic phishing.

SafePal has confirmed that phishing attempts using the leaked data have been ongoing for some time. Nothing in the letters is genuine: recipients should discard them and report the attempt to SafePal and the police.

A hardware implant first reported in October in a Trezor Safe 5 sold by reseller CryptoBilis has now been traced to more devices, per Trezor's update on the CryptoBilis investigation. Of 48 buyers who came forward, three had wallets with the implant, all bought between 20 August and 23 September 2026 via CryptoBilis's Tokopedia and Shopee stores or directly.

The implant is an extra circuit board fitted between the main board and the screen. It copies everything displayed, recognizes recovery words and passphrases, encrypts them and sends them over the mobile network to an attacker-controlled server, retrying until it connects. It never touches the firmware or the Secure Element.

Firmware 2.13.1, released on 11 November, stops the known implants from capturing anything, and Trezor cut its reseller network by about 80% under stricter supply-chain rules.

No customer has reported losing funds, and no implants were found in other resellers' devices or other Trezor models. CryptoBilis buyers are still told to move funds to a new wallet with a new seed, since the update cannot protect a backup captured earlier. Anyone who bought from CryptoBilis since March 2026 can get a replacement device.

Anchorage Digital Bank, the federally chartered crypto bank that issues USDPT for Western Union, is partnering with Visa to support its stablecoins as native settlement assets on the Visa network.

Visa and eligible partners can now use USDPT to settle their VisaNet obligations. USDPT is the first Anchorage-issued token supported, and the deal sets a framework to add more stablecoins later. Anchorage also issues USAT (Tether), USDtb (Ethena Labs), fUSD (Falcon Finance) and ZLUSD (Zelle).

USDPT launched on Solana in May, with Fireblocks providing wallet and settlement infrastructure. Western Union rolled it out first in the Philippines and Bolivia, with plans for 24/7 settlement across its network of more than 200 countries.

The move gives Visa partners another bank-issued stablecoin option for settlement, alongside Anchorage's Atlas network for counterparty settlement.