Patrick Steven Yaroch, 37, worked on the FBI's counterintelligence side with access to bureau systems holding wallet credentials gathered during investigations. He has now pleaded guilty to wire fraud and money laundering in federal court in Alexandria, Virginia.

Starting no later than December 2024, Yaroch made about 100 fraudulent transfers using credentials from 35 separate FBI cases, draining wallets tied to investigation subjects, nation-state actors and at least one wallet the FBI created for an operation. He swapped and moved the funds to hide their origin, and parts went to credit cards and car loans.

About $2.47M in crypto was stolen across 35 FBI investigations.

Planning a move abroad, he asked ChatGPT where to live in the EU and then hired Portuguese lawyers to get a tax ID after it suggested a vineyard in Portugal. He self-reported in July, agents recovered about $925K (including funds parked in Sui lending protocol Suilend), and he faces up to 20 years at sentencing on March 4, 2027.

South Korean exchange Gopax, majority-owned by Binance since 2023, suspended deposits, withdrawals and trading at 2:55 p.m. local time on November 6 after receiving an email threatening a hack.

The exchange said it is moving all virtual assets from hot wallets to cold storage. Direct withdrawals through the website and app are unavailable; customers can still file withdrawal requests through support, which will be processed manually after internal verification.

Gopax said no actual breach or hacking attempt has been identified so far, calling the shutdown a preventive step taken in line with recommendations from financial authorities.

Upbit, Bithumb and DigitalX warned users about sending funds to Gopax and said they may restrict transfers to the exchange if the situation develops. The move comes weeks after Gopax apologized over an earlier breach disclosed by a regulator.

Solana's push into mainland China hit a wall after the People's Bank of China said it stopped Solana Accelerate China 2026 together with local financial, police and market regulators. The central bank will also investigate the entities and individuals behind the activities.

The trigger included Solana ads placed through a domestic entity on the facade of Citigroup Tower in Lujiazui, Shanghai's financial district. The official called this virtual currency marketing and said SOL issuance and technical services for USDT issuance and trading count as illegal financial activity.

Under the crypto notice issued by eight Chinese departments in February, promoting Solana is a violation.

The regulator said it will next target domestic crypto traders and local affiliates of offshore token issuers and trading platforms, signaling a wider crackdown on crypto business activity inside China.

Kalshi launched US stock perps, the first regulated US venue with this product. On launch day, Nov 5, it traded $880M and went straight to #3 in the market.

Only on-chain venues are ahead: trade xyz on Hyperliquid did $8.2B the same day, 9x more. Variational is second with $1.2B.

The launch hit a sell-off: Nasdaq fell 5.5% on Nov 5. Memory chips and SpaceX traded most: Micron, SanDisk, SK Hynix. For scale, trade xyz did $24M on its first day a year ago.

Railway, the cloud hosting platform used by many crypto teams, disclosed on October 21 that an unauthorized party may have accessed customer environment variables and decrypted some of them. Two weeks later, Carlos, growth lead at onchain trading platform Definitive, said an old hot wallet of his was drained and pointed to the Railway breach as the likely link.

About 96 wallets were emptied within roughly 70 minutes, all following the same pattern.

The transfers were signed with the victims' own private keys, which points to leaked keys or seed phrases rather than a smart contract bug. The attacker, operating as noble.base.eth, mainly used Relay to move funds out, and Relay has since blocked the addresses involved.

Total losses across chains have not been tallied yet. The Railway connection remains unconfirmed, but any team that stored wallet keys in hosted environment variables is advised to rotate them immediately.

The privacy coin's largest protocol overhaul in years went live on mainnet at block 3,543,405, after a September governance poll in which about 98.9% of participating ZEC holders backed the changes.

Target block spacing drops from 75 to 25 seconds, so three confirmations now take roughly 75 seconds instead of about 225.

A new Network Sustainability Mechanism removes 60% of the transaction fees in each block from circulation and starts paying them back to miners around February 2031, without lifting the 21 million ZEC cap. The upgrade also retires the original Sprout shielded pool: version 4 transactions are no longer valid and any remaining Sprout funds become unspendable.

Node operators and services had to move to the NU7-compatible releases, including Zebra 7.0.0, ahead of activation. Faster settlement is aimed at making shielded payments practical for everyday use.

The Trump family-backed DeFi project is turning to its own governance token after a recent price decline. World Liberty Financial is launching a buyback program for WLFI, funded by an initial allocation that could include revenue generated by the reserves backing its USD1 stablecoin.

The stated goal is to encourage active governance participation and concentrate voting power among long-term holders. The project describes the program as an ongoing part of its strategy, with scale and pace adjusting as the ecosystem grows, and says buyback activity will be reported publicly.

This is not the first round: in September 2025 holders approved, with 99.8% support, a proposal to route protocol-owned liquidity fees into WLFI buybacks, and one late-2025 purchase took about 59M WLFI off the market for roughly $10M.

Tying buybacks to stablecoin reserve income links WLFI demand to USD1 adoption: if the stablecoin grows, the buyback budget can grow with it, and if it stalls, the pace is likely to slow.

Cory Fields, a Bitcoin Core developer at MIT's Digital Currency Initiative, outlined a new quantum defense idea on the bitcoin-dev mailing list. The goal is to make anyone who cracks a wallet with a quantum computer risk their own coins first.

Under his example, moving 1 BTC from a quantum-vulnerable output would require another 1 BTC of collateral from a quantum-safe wallet, with both locked for a waiting period such as 30 days. Owners who prepared a hidden "landmine" with proof of ownership before Q-day could reveal it during that window, reclaim their coins and take the attacker's collateral.

An attacker cannot tell in advance which coins are guarded by a landmine, so every theft attempt risks losing the stake.

The scheme does not help coins believed lost, including Satoshi Nakamoto's, and honest holders moving vulnerable BTC would also need matching collateral. Fields called the ideas thought experiments that depend on quantum-safe wallets and enforcement rules that are not written yet.

Single stock perpetual futures, a product that has so far lived on offshore venues, now have a regulated US home. Kalshi rolled out single stock perps covering more than 50 companies listed on the NYSE and Nasdaq, including Meta, Palantir, McDonald's and SpaceX.

The contracts track stock prices without holding the shares and have no expiration date. Traders can go long or short with leverage, which Kalshi says is set under CFTC rules and sits well below offshore perp limits. The exchange charges a flat trading fee instead of payment for order flow.

Users traded over $300M in the first morning after the stealth launch, per co-founder and COO Luana Lopes Lara.

The product runs under joint CFTC and SEC oversight and follows Kalshi's crypto perps in May and gold and silver perps in September. Single stock perps already trade over $4.5T a year globally, almost all of it offshore.

Nasdaq-listed HYPE treasury Hyperliquid Strategies (PURR) disclosed in its Q3 2026 results that a subsidiary has applied to become a futures commission merchant (FCM) in the US.

If approved, the FCM would carry US client accounts for permissioned markets deployed on Hyperliquid under HIP-3, the upgrade that lets independent operators launch compliant markets on the chain. That would give American traders a regulated route into Hyperliquid perpetual futures. The company notes there is no assurance on timing or outcome of the application.

In Q3 the company deployed $785M to buy 9.1M HYPE, lifting its treasury to 38.5M tokens worth about $3.5B at quarter end, with zero debt.

As of October 28, holdings reached 38.9M HYPE at a blended cost of $56.35 per token, and the Hyperliquid Strategies x Unit validator is now the largest non-Foundation validator on the network.