Crypto Today: November 8, 2026

Each fact links to the outlet that reported it: check the original before relying on it. Not investment advice.

A security breach at Web3Auth, a login service used by the Keplr wallet, dominated the weekend. Web3Auth says it moved $5.6M out of exposed wallets to protect it, though some funds appear to have been stolen. Elsewhere, exchange and regulatory changes hit users of MEXC and Binance France, and attackers targeted LNbits software.

The simple explanation

A company called Web3Auth lets people sign in to crypto wallets with a Google or Apple account instead of a long secret recovery phrase. Something went wrong on its systems, and the secret keys (the passwords that control the money) for some Keplr wallets may have been exposed. Web3Auth says it moved millions of dollars out of at-risk wallets before thieves could, but some money seems to have been stolen anyway.

Separately, two exchanges are tightening up. Binance will close its French customers’ accounts at the end of December. OKX warned that deposits from another exchange, MEXC, may be held up because of a US government rule. Also, a Bitcoin payment tool called LNbits told people to switch off their servers after attacks.

Markets snapshot

• BTC: $74,700.00 (-1.3% over 24 hours)
• ETH: $2,135.81 (-4.3% over 24 hours)
• SOL: $86.69 (-2.8% over 24 hours)

Prices as of Sunday, November 8, 2026.

Security & Hacks

Web3Auth says it moved $5.6M out of exposed Keplr wallets; some funds were apparently stolen

A security problem at login provider Web3Auth exposed private keys for some Keplr wallets created with Google or Apple sign-in. Web3Auth says it moved $5.6M to safety ahead of attackers, but its wording and one user’s theft report suggest some funds were taken.

• On Nov. 7, Keplr reported unauthorized transactions on some accounts created with Google or Apple login and paused those login methods. (CryptoSlate)
• Later on Nov. 7, Web3Auth said it had found a security issue in its infrastructure affecting certain embedded wallets used by Keplr. Keplr described a private-key breach affecting some social-login users. (CryptoSlate)
• Keplr said accounts made with recovery phrases or hardware wallets were not affected. It advised potentially affected users not to send new funds and to move remaining liquid assets to a recovery-phrase or hardware-wallet account. (CryptoSlate)
• Web3Auth said it and partners began whitehat (defensive) recovery of vulnerable Keplr wallets not yet hit, using the original attacker’s method. It says it moved $5.6M this way. (CryptoSlate, The Block)
• A batch transaction on Cosmos Hub moved 2,265.59 staked ATOM from six accounts. One delegator reported theft, while Web3Auth says some apparent drains were protective recovery transfers. (The Defiant, The Defiant)
• Keplr confirmed the addresses Web3Auth used for recovery, including the destination of the six-account Cosmos batch. (The Defiant)
• As of 13:08 UTC on Nov. 8, Web3Auth’s status page still promised an update on restoring its login service. MetaMask said an initial look found no evidence its users were affected. (CryptoSlate)

Context: Web3Auth provides social-login wallets, where a Google or Apple sign-in replaces a recovery phrase. Keplr is a wallet mainly for Cosmos-ecosystem chains. Keplr says staked and locked assets made the mitigation work more complex, and that some reduced or empty balances may reflect mitigation rather than theft.

Why it matters: The incident shows that easy social login can add a dependency on the provider’s security and uptime. Users of affected accounts cannot easily tell whether a drained balance was theft or a rescue, and a saved key may not be safe if it was exposed.

Disputed or unconfirmed: Web3Auth says some wallet drains were protective recovery transfers, while at least one delegator reported theft. Web3Auth’s reference to an ‘original attacker’ implies some funds were stolen, but it has not elaborated. The $5.6M figure comes from Web3Auth.

Watch next: An update from Web3Auth on restoring its login service and on how recovered funds will be returned.

LNbits urges all server operators to shut down after attacks, patches expected in 24 to 48 hours

The LNbits project told every operator of its software to shut down their servers after attacks. It also disabled its own hosted instances, and a contributor expects patches within 24 to 48 hours.

• On Nov. 8, LNbits urged all server operators to shut down following attacks. (The Defiant)
• The project disabled its own hosted instances. (The Defiant)
• Contributor Ben Arc said patches should be available within 24 to 48 hours. (The Defiant)

Context: Background: LNbits is open-source software for running accounts and wallets on top of the Bitcoin Lightning Network. The available report does not describe the attack method or any losses.

Why it matters: Anyone running or using an LNbits server may be at risk until the fix ships, and hosted wallets are offline.

Disputed or unconfirmed: The patch timeline is one contributor’s estimate.

Watch next: Patch release, expected within 24 to 48 hours, and any disclosure of the vulnerability and losses.

Regulation & Policy

OKX warns of MEXC deposit freezes ahead of FinCEN special-measures cutoff

OKX warned its users that deposits from MEXC may be frozen as a US FinCEN deadline approaches. Its CEO said OKX treats such measures with caution similar to sanctions.

• On Nov. 7, OKX warned users about deposit freezes involving MEXC, ahead of a FinCEN cutoff. (The Defiant)
• Customers reported that USDT deposits were held for review. (The Defiant)
• OKX CEO Star Xu said the exchange treats FinCEN special measures with caution ‘similar to sanctions’. (The Defiant)

Context: Background: FinCEN is the US Treasury bureau that fights money laundering. Its ‘special measures’ can restrict US financial institutions from dealing with a targeted entity. MEXC is an offshore exchange. The cutoff date was not given in the available reporting.

Why it matters: Exchanges that move funds to or from MEXC may hold or screen those transfers. That could delay users’ deposits.

Disputed or unconfirmed: The held-deposit claims come from customer reports and OKX’s own statements.

Watch next: The FinCEN cutoff date and whether other exchanges issue similar warnings.

Companies & Industry

Binance France tells users their accounts close Dec. 31, with fees on leftover assets from Nov. 29

Binance is emailing French users that their accounts will close on Dec. 31. Assets left on the exchange will incur monthly fees starting Nov. 29.

• Binance France sent emails to users announcing the closure of their accounts. (Cointelegraph)
• The closure date is Dec. 31. (Cointelegraph)
• Binance says any assets still on the exchange will be charged monthly fees starting Nov. 29. (Cointelegraph)

Context: The available report does not explain the reason for the closure. Binance is the world’s largest crypto exchange by volume (Background).

Why it matters: French users have a few weeks to withdraw their funds before fees begin, and a bit longer before accounts close.

Watch next: Nov. 29, when fees on leftover assets start, and Dec. 31, when the accounts close.

Stablecoins & Payments

Bridge wins OCC approval, opening a path to a federal stablecoin trust bank

The US bank regulator approved Bridge’s application, opening a path to a federally chartered stablecoin trust bank. The approval comes with conditions, and it does not replace separate approval to issue stablecoins under the GENIUS Act.

• The Office of the Comptroller of the Currency (OCC) approved Bridge, opening a path to a federal stablecoin trust bank. (The Defiant)
• The order requires $45 million in minimum capital. (The Defiant)
• Bridge must also pass preopening checks before it can start operating. (The Defiant)
• A bank charter does not replace GENIUS Act issuer approval. (The Defiant)

Context: Background: Bridge is a stablecoin infrastructure company owned by Stripe. The GENIUS Act is the US law setting rules for stablecoin issuers.

Why it matters: It is a step toward stablecoin businesses operating under federal bank supervision rather than state licences.

Watch next: Whether Bridge meets the capital and preopening requirements and obtains GENIUS Act issuer approval.

Quick hits

• Bitcoin ETFs lost more than $1B in the week of Nov. 2-6, with BlackRock’s IBIT dominating the outflows; Fidelity’s fund finished positive but the others combined stayed negative without IBIT. (CryptoSlate)
• Washington escalated the fight over Kalshi, with US derivatives exchanges facing a comply-or-explain demand while separate court holdings leave Kalshi’s nationwide access unresolved. (CryptoSlate)
• Stablecoin supply has barely grown this year even as payments using the tokens surge, and Sky’s USDS supply has contracted. (CoinDesk)
• Binance finance chief Kaiser Ng is reportedly leaving and will be replaced by Justin Yek, formerly vice-president of finance at Airwallex. (Cointelegraph)
• Bitcoin trades below Strategy’s $75,451 average purchase price, so the company’s 849,327 BTC were worth about $63.58B against a $64.08B cost. (The Defiant)
• Bitcoin developer Cory Fields proposed that future quantum attackers post Bitcoin as collateral before touching vulnerable wallets, giving prepared owners a chance to recover coins and collect a penalty. (Decrypt)