Crypto Today: November 6, 2026

Each fact links to the outlet that reported it: check the original before relying on it. Not investment advice.

Security and enforcement dominated the day: new estimates showed the Binance attackers had long access and still hold most of the stolen funds, while the US Treasury cut the exchange MEXC off from American banking. In policy, two crypto-related rules reached White House review and Greece passed a crypto tax law.

Markets snapshot

• BTC: $75,840.00 (+0.3% over 24 hours)
• ETH: $2,235.96 (+0.4% over 24 hours)
• SOL: $89.95 (+0.5% over 24 hours)

Prices as of Friday, November 6, 2026.

Security & Hacks

Binance hack: attackers had about 8 weeks of access, $3.1B still unlaundered, $2.85B frozen

Security Alliance estimates the Binance attackers were inside for roughly eight weeks before a $6.3B exploit. Elliptic says about $3.1B of the loot has not yet been laundered and $2.85B is frozen.

• Security Alliance estimated the attackers had about eight weeks of access before the $6.3B exploit, and said the multi-stage pattern resembles other big heists, including the $388M Bitget hack. (Cointelegraph)
• Elliptic, a blockchain analytics firm, said about $3.1B of the stolen crypto has not been laundered, with the bulk of the stolen ETH and Bitcoin untouched. (Decrypt)
• The attackers have so far used more than 20,000 wallets across 16 blockchains. (Decrypt)
• Elliptic said the hackers swapped stolen tokens for about $124M in bitcoin, and that little of the stolen crypto has likely been cashed out. (The Block)
• A separate swap of about $50M in XRP went mostly into bitcoin; bitcoin obtained from other stolen assets nearly doubled in a day to 1,650 BTC. (The Defiant)
• $2.85B of the stolen funds remains frozen, and Binance plans more withdrawal reopenings. (The Block)

Context: Binance is the world’s largest crypto exchange by volume. Laundering means moving stolen funds through many wallets and swaps to obscure their origin. Converting assets like XRP into bitcoin is a common step because those assets are harder to freeze.

Why it matters: The long dwell time suggests the breach was a prolonged intrusion rather than a single exploit, which matters for how exchanges defend themselves. With most funds unmoved, freezes and tracking can still limit what the attackers keep.

Disputed or unconfirmed: The eight-week access figure is an estimate from Security Alliance; the laundering and cash-out figures come from Elliptic’s tracing.

Watch next: Further Binance withdrawal reopenings and any movement of the large untouched ETH and bitcoin holdings.

Chainalysis breach widens: password hashes and live tokens exposed, tools reopening behind IP allowlists

Chainalysis said password hashes and live tokens for all its users were exposed, after earlier calling the accessed data non-sensitive. It began restoring some tools on Friday.

• An Oct. 30 email had described user IDs and email addresses as non-sensitive customer data. (Unchained)
• Late Wednesday, Chainalysis disclosed that password hashes and live tokens for all users had been exposed. (Unchained, Cointelegraph)
• On Friday it began reopening KYT and Address Screening tools in phases, requiring customers to send trusted IP addresses for allowlisting first. (Unchained)
• Every user must reset their password and rotate API keys where applicable. (Unchained)
• Reactor and Data Solutions remain offline with no return date. (Unchained)
• Chainalysis reports no evidence investigations data was accessed or attribution data manipulated. (Unchained)

Context: Chainalysis is a blockchain analytics firm whose tools are used by exchanges, banks and law enforcement for compliance and investigations. Password hashes are scrambled passwords; the company has not defined ‘live tokens’.

Why it matters: The firm’s clients rely on it for compliance monitoring, so the disruption and the revised scope of exposure affect trust in its security.

Disputed or unconfirmed: The claim of no investigations-data access is Chainalysis’s own; no user count has been given.

Watch next: The return of Reactor and Data Solutions and any disclosure of user counts.

Regulation & Policy

FinCEN cuts MEXC off from the US financial system over alleged $16B in Iran, North Korea and Russia-linked flows

The US Treasury’s FinCEN issued a final order barring US financial institutions from transfers to or from the exchange MEXC, alleging $16B in illicit flows. The ban starts 30 days after Federal Register publication, which had not yet happened.

• On Friday, Nov. 6, FinCEN issued an order finding MEXC a primary money laundering concern tied to Russian illicit finance, under the Combating Russian Money Laundering Act. (Bitcoin Magazine, Cointelegraph)
• Treasury alleges MEXC facilitated at least $16B in illicit flows from May 2021 to May 2026, including nearly $1.5B tied to Russian sanctions evasion and about $22M linked to Iran’s Central Bank and the IRGC’s Qods Force. (Bitcoin Magazine, Decrypt)
• Treasury says MEXC was still trading with sanctioned Garantex and its successor Grinex as recently as June 2026. (Bitcoin Magazine)
• The order covers MEXC Global and named affiliates in Seychelles, Estonia, Switzerland and the UK, plus successors; US institutions face civil or criminal penalties for willful violations. (Bitcoin Magazine)
• The 30-day clock has not started because the Federal Register notice was still pending Friday evening. (Bitcoin Magazine)
• Treasury framed the action as part of Operation Economic Outcast. (Decrypt, Bitcoin Magazine)

Context: FinCEN is the Treasury bureau that enforces anti-money-laundering rules. This is not an OFAC sanctions designation but a funds-transmittal ban. Per Bitcoin Magazine, MEXC already lists the US as a prohibited jurisdiction, and regulators in the UK, Hong Kong and Seychelles had previously warned about or acted against it.

Why it matters: Because MEXC already excludes US users, the effect falls mainly on remaining dollar rails, banking partners and counterparties that touch US institutions.

Disputed or unconfirmed: The $16B and sanctions-linkage figures are Treasury’s allegations; no MEXC response appears in the articles.

Watch next: Federal Register publication of the order, which starts the 30-day countdown.

Crypto-in-401(k) rule and SEC broker-dealer draft both reach White House review

A final Labor Department rule easing alternative assets, including crypto, into 401(k) plans reached White House review on Nov. 5. A separate SEC draft on how broker-dealer rules apply to crypto entered review on Nov. 3.

• The SEC draft, ‘Amendments to Broker-Dealer Financial Responsibility and Recordkeeping and Reporting Rules Regarding Crypto Assets’, was logged by the White House regulatory review office (OIRA) on Nov. 3 as an economically significant proposed rule. (Unchained)
• The SEC draft’s text is unreleased; the agency’s agenda says it considers amending rules 15c3-1, 15c3-3, 17a-3 and 17a-4 for crypto. (Unchained)
• On Nov. 5, OIRA logged the Labor Department’s final rule ‘Fiduciary Duties In Selecting Designated Investment Alternatives’ (RIN 1210-AC38). (Bitcoin Magazine)
• The Labor proposal, unveiled March 30, would give plan fiduciaries who follow a documented process, weighing six factors, a legal safe harbor under ERISA when adding private assets. (Bitcoin Magazine, The Defiant)
• The safe harbor does not force plans to offer crypto; it lowers litigation risk for employers that choose to. (Bitcoin Magazine)
• Sens. Sanders and Warren pressed Labor to abandon the crypto-friendly path. (Bitcoin Magazine)

Context: The Labor rule implements President Trump’s Aug. 7, 2025 executive order on alternative assets in 401(k)s; Labor rescinded its 2022 ‘extreme care’ crypto guidance in May 2025. Per Unchained, SEC Chair Paul Atkins said in September the agency would write crypto rules under existing authority after the Clarity Act stalled in the Senate.

Why it matters: OIRA review is typically the last step before publication, so both could soon clarify how crypto can reach retirement plans and brokerage firms. Final texts are still unknown.

Watch next: OIRA clearing the Labor rule and publication of the final text and effective date; release of the SEC proposal text.

Greece approves 10% crypto gains tax and 15% levy on staking and DeFi income

Greek parliament passed its first comprehensive crypto tax framework on Nov. 5, effective Jan. 1, 2027. It taxes gains at 10% and staking and DeFi income at 15%.

• Parliament passed the law on Nov. 5, with rules taking effect Jan. 1, 2027. (CryptoSlate, Cointelegraph)
• Annual crypto gains up to €500 are exempt. (CryptoSlate, Cointelegraph)
• Staking, lending and DeFi liquidity rewards face a 15% tax as interest income. (CryptoSlate, Decrypt)
• Qualifying losses can be carried forward five years. (CryptoSlate)
• Investors get 12 months to declare past gains without late-filing penalties or interest. (CoinDesk, CryptoSlate)
• Treatment of crypto-to-crypto swaps remains unresolved over wording concerns. (Decrypt, CryptoSlate)

Context: Per CryptoSlate, a finance ministry official said revenue can’t be estimated because most Greek investors use foreign exchanges. Background figures it cites show Italy at 33% and Cyprus at 8%.

Why it matters: It ends years of uncertainty for Greek investors, though enforcement over offshore platforms looks difficult.

Watch next: Further directives on transparency requirements and tax audits expected in coming weeks.

Quick hits

• Gnosis Pay disclosed unauthorized access to its legacy debit card system on Nov. 3, exposing customer information; funds were not affected. (The Block)
• The CFTC said regulated exchanges cannot block customers state by state, a position that clashes with court orders requiring firms like Kalshi to do so. (CoinDesk)
• Treasury withdrew a proposal that would have expanded ‘travel rule’ requirements for crypto transactions. (The Block)
• Former FBI agent Patrick Yaroch pleaded guilty on Nov. 5 to wire fraud and money laundering over about $2.47M in crypto taken from wallets tied to 35 FBI investigations; sentencing is March 4, 2027. (Unchained)
• Nigeria’s central bank rules, effective Nov. 5, require stablecoin issuers to be locally incorporated and licensed and ban algorithmic stablecoins. (Unchained)
• Zcash’s NU7 upgrade went live, cutting block time threefold and removing 60% of each block’s fees from circulation. (The Block)