November 7, 2026
Bitcoin Amazons Weekly: Who Gets the Money Switch?
Aurelia Voss: One exchange is reopening withdrawals. Another is promising to replace stolen assets. Washington is reaching for a financial cutoff switch while withdrawing a plan to collect more payment data. And the companies that help crypto watch everyone else have their own security homework.
Welcome back. This week we are checking who can move the money, who can see the paperwork and which shiny upgrade has actually shipped. Please keep your fingers away from the giant reassuring button. Valeria has already tried it.
The week in a minute
- Exchanges: Binance's reopening is progressing, while Mercado Bitcoin plans an initial return that lets customers view balances before moving assets.
- Washington: A new MEXC order targets U.S. financial connections. Separately, agencies announced the withdrawal of an old proposal to expand payment-data requirements.
- Privacy: Gnosis Pay and Chainalysis disclosed customer-information exposure. Protecting a wallet does not secure every service around it.
- Networks: Ethereum is holding back a testnet upgrade over compatibility risks. Zcash's NU7 has activated, with faster target blocks and an important legacy-wallet consequence.
- Builders: Loan tokenization and round-the-clock settlement are advancing, with banks and eligibility rules still part of the machinery.
Mercado Bitcoin promises replacement. Customers still need the exit.
Brazilian exchange Mercado Bitcoin suspended deposits and withdrawals after a November 2 security breach. Its November 4 update promises to replace affected assets using company resources and plans a gradual website return from November 9. The first stage is for checking balances, statements and investments. Transfers, withdrawals and trading follow after further security checks.
The loss estimate needs a label. Blockchain investigator Bitquery now estimates $48.6 million across 11 chains, above the initial roughly $40 million headlines. Its analysis includes low-liquidity tokens and attributes some wallets through their behavior. The number remains an investigator's estimate, rather than a final reconciled company loss.
Bitquery also traced transfers from customer deposit addresses after the exchange's initial containment statement, a finding reported by CoinDesk. The route into the signing systems remains unresolved. There is no verified basis here to assign the attack to Binance's attackers.
An exchange normally credits your account when coins arrive at an address it controls. Its private keys still authorize the eventual movement. A balance can therefore survive on its records while withdrawals are unavailable.
Kaia Reyes: The balance has a lovely view. I would also like a functioning door.
Binance provides the contrasting operational update. Withdrawals began reopening in phases on November 1, and its November 3 notice expanded the list. Further assets still needed restoration in Friday's reporting. Replacement funding, frozen stolen tokens and an available withdrawal are three different checks. Next week, watch the actual asset-and-network reopening lists.
Washington finds the cutoff switch and bins a surveillance proposal
On November 6, the U.S. Treasury's Financial Crimes Enforcement Network, or FinCEN, issued an order targeting MEXC Global. The agency alleges the exchange facilitated at least $16 billion in illicit transactions linked to sanctions evasion and cybercrime.
The order itself prohibits covered U.S. financial institutions from transferring funds to or from MEXC. Its terms become effective 30 days after Federal Register publication. That timing matters when a headline sounds as though every connection has already disappeared. MEXC says it is operating normally and has begun an independent review of its controls.
A public blockchain can remain available while banks and service providers restrict the connections around an exchange. For customers and counterparties, the useful questions concern the affected route, institution and effective terms.
The same day, FinCEN and the Federal Reserve announced withdrawal of a 2020 proposal. It would have lowered the recordkeeping threshold for certain cross-border transfers from $3,000 to $250 and changed provisions concerning virtual currencies. Their withdrawal document, scheduled for publication November 9, says the agencies will not proceed on that proposal without fresh public input.
Valeria Stone: I approve of retiring a six-year-old surveillance proposal. May its retirement be long and deeply uneventful.
The existing recordkeeping and Travel Rule framework remains. This is a retreat from a proposed expansion, with the next checkpoint being the published withdrawal and any future replacement proposal.
The wallet can be yours. The customer database belongs to someone else.
Crypto-card provider Gnosis Pay disclosed unauthorized access detected November 3 in the older system behind its own branded cards. It says customer information was exposed, funds were unaffected and the separate enterprise card platform was untouched. Affected customers received individual details by email.
Gnosis Pay has made 3D Secure, an extra verification step for online card payments, mandatory until that consumer system retires on December 20. Its warning is practical: A scam can include your real details or a genuine purchase. Go directly to the official app instead of following a message's instructions. Decrypt's report distinguishes this incident from unrelated wallet losses.
Blockchain analytics provider Chainalysis also widened its disclosure. Its November 4 update says names, usernames, password hashes and live authentication tokens for all users were exposed. A live token can help a system recognize an authenticated session; changing a password alone may not address every exposed credential.
By November 6, Chainalysis said it had begun restoring transaction-monitoring and address-screening access in phases, requiring password resets and API-key rotation where applicable. It continued to report no evidence of access to investigative data or manipulation of its attribution records. BleepingComputer covered the credential exposure and service disruption.
Aurelia: The people holding the surveillance binoculars also need a lock on the cupboard.
Self-custody changes who signs your payments. Card systems, identity records and service logins each need their own protection. Watch for completed restoration and fuller incident findings, rather than treating a reassuring statement about funds as a complete privacy assessment.
Ethereum keeps the test engine off the main track
The Ethereum Foundation's November 6 call for review explains why the Glamsterdam upgrade remains held back on Hoodi, a test network. Changes to gas accounting can break assumptions in existing applications. Developers will not proceed there until the issues are resolved; work on the later Hegota upgrade continues in parallel.
Gas measures the computational work and storage operations a transaction can request. A contract may rely on a fixed budget, or expect a failed operation to leave too little gas for further work. Change those rules, and unchanged application code can behave differently.
ChainSecurity's analysis shows how a failure-handling path that previously ran out of gas could instead finish under the proposed accounting. That can turn something intended to be retryable into a permanently recorded failure. The Foundation's review repository also covers wallets and other supporting software with hardcoded assumptions.
Nyra Chen: Moving the fuel gauge is an engineering decision. Discovering that the brakes read it is a testing decision.
This week's development is the detailed compatibility review, following October's postponement. Application teams now have concrete assumptions to test and report before developers settle the next step.
Zcash ships faster target blocks, with a legacy-pool catch
Zcash's NU7 upgrade activated at block 3,543,405. The privacy-focused network now targets a block every 25 seconds instead of 75. That can shorten confirmation waits, though a wallet or exchange can still require several confirmations.
The Zcash Foundation's release explanation says the reward and halving adjustments preserve the issuance schedule and 21 million coin cap. Producing more blocks does not automatically produce three times as many new coins.
NU7 also reserves 60% of transaction fees for later miner rewards, with reissuance scheduled to start in 2031. There is a sharp operational consequence: The upgrade rejects version 4 transactions, leaving coins in the old Sprout privacy pool unspendable under the current rules. The Block reports about 12,224 ZEC remained there at activation. This affects that legacy format, not every private Zcash balance.
Kaia: Faster is useful. “Which wallet version?” would also have been a useful question.
The test now is reliable service after activation, including wallet support and exchange reopening. Privacy engineering deserves scrutiny of migrations and stranded users as well as applause for shipping.
Cross River wants loans born onchain
U.S. bank Cross River and Arbitrum developer Offchain announced a lending-infrastructure partnership on November 3. They have completed a proof of concept and are targeting production in early 2027, rather than announcing a finished public lending market.
The proposed system creates a loan's blockchain representation when the loan originates. Funding, ownership changes and servicing can then share a record on Arbitrum One, an Ethereum scaling network. Embedded wallets are intended to keep the borrower's familiar application and repayment experience. Independent reporting describes the planned rollout.
Cross River remains the regulated lender, with its underwriting and compliance standards. A tokenized loan is still a claim shaped by contracts, credit risk and servicing. Its blockchain record can improve coordination without granting everyone permission to buy it.
Valeria: Put the loan onchain. Then show me who can enforce it when the borrower stops paying.
Watch for an actual production launch, eligible participants and concrete asset rights. Those details will tell readers more than another victory lap around the word “tokenization.”
Quick hits worth opening
Hong Kong's reporting clock is set. A bill passed November 4 implements the international Crypto-Asset Reporting Framework. Covered providers start collecting information in 2027; exchanges between tax authorities begin in 2028. This is reporting to participating authorities, with confidentiality requirements, rather than a public wallet-owner directory.
Bank settlement gets longer opening hours. Hong Kong's monetary authority says its Ensemble pilot now supports 24/7 interbank settlement in tokenized central-bank money, with 12 banks and 20 industry participants. These are controlled institutional transactions. The improvement concerns settlement availability; participation remains permissioned.
Germany has a concrete tokenized note. Chartered Investment announced a fiat-denominated money-market note on Avalanche. Its e-Sec business provides the securities register, Opus issues the note and EFG supplies the funding component. Useful infrastructure has named responsibilities. The issuer announcement does not establish broad retail availability.
Tether adds pricing and exit infrastructure. Its Hadron collaboration with RedStone gives eligible tokenized assets access to valuation feeds and same-day liquidity infrastructure. Verified liquidity providers take positions through an auction and use the asset's existing redemption process. The announcement promises tools, not guaranteed liquidity for every token.
Washington gets a different committee map. Democrats won control of both chambers in the U.S. midterms, as The Block reports. Galaxy Research expects changes in financial oversight, including committee leadership. The incoming Congress has not yet passed a replacement crypto framework. Watch actual appointments and bill text. Campaign donations do not come with a legislative delivery receipt.
The 401(k) package reaches White House review. The Labor Department's alternative-investment rule was received for review November 5. The official list labels the package as a final rule pending review. Its text remains unpublished. The rule concerns the duties of retirement-plan managers considering alternative assets. Watch the final terms, including costs, liquidity and valuation, before assuming your plan will offer Bitcoin.
Mining companies follow the AI power bill. Core Scientific's new quarterly results show $215.4 million in colocation revenue, where customers rent data-center capacity, against $12.3 million from self-mining. Its filing targets December 31 for ending hosted mining while self-mining winds down. IREN reported $200 million in AI cloud revenue and $28 million from mining. Power capacity has competing buyers. These company results alone do not show what happened to Bitcoin's total network security.
ETF buyers briefly showed up, then stepped back. Across November 2–5, U.S. spot Bitcoin exchange-traded funds recorded $869.8 million net out, while Ether funds lost $271.9 million net. Wednesday's positive flows did not erase the other sessions. Friday's major-fund entries were still missing, so the comparable figures here cover four sessions. Bitcoin flows · Ether flows. Fund flows measure subscriptions and redemptions, not the destination of every investor's money.
Valeria's verdict
Financial freedom gets practical when you can identify the person or system able to stop a payment, expose your records or change an application's behavior.
This week offered progress worth recognizing: A withdrawn surveillance expansion, a live privacy-network upgrade and builders testing new lending infrastructure. It also offered expensive reasons to inspect custody operations and customer databases.
Valeria: I like a big orange switch as much as the next heavily armed woman. I still want the wiring diagram before someone calls it freedom.
On our radar
Mercado Bitcoin's planned view-only return on November 9. The scheduled publication of the U.S. proposal withdrawal that day. Binance's remaining asset-specific reopening notices. Chainalysis service restoration and Gnosis Pay's follow-up findings. Ethereum's compatibility decisions.
On November 12, the European Banking Authority is due to take over specified USDC supervision responsibilities under Europe's crypto rules. The announcement is older; the approaching handover is the checkpoint.
The market moves. The chain continues. The Amazons stand watch. ⚔️🟠
