Decent Newsroom
Sign In

Six Doors in One Week

By Roger November 8, 2026
Binance's record theft, MiCA account closures, a FinCEN cutoff order, a card breach, an ETF exodus and a Texas election: in seven days every interface to Bitcoin was contested while the ledger itself never moved.
Six Doors in One Week

Six Doors in One Week

Nine days after the largest online theft on record, Binance’s chief financial officer left to pursue a new venture. The company said the transition had been planned for six months, and perhaps it had. The same week, customers in Spain, France, Italy and Poland received a different letter: deposits blocked, withdrawals still open, a monthly charge of 0.025 per cent of the remaining balance (minimum 10 USDC) from 29 November, and the account closed on 31 December.

The same week, on the other side of an ocean, the Treasury’s financial crimes unit signed an order forbidding every American bank, broker and payment processor from touching a top-twenty exchange. The same week, a crypto debit card disclosed that names, home addresses, card numbers and every wallet address linked to an account had been exposed. The same week, the American spot bitcoin funds printed their worst outflow since June and turned negative for the year. The same week, Texas elected a governor who wants to keep data-centre approvals frozen, and Bernstein cut its price targets on seven bitcoin miners by 35 to 54 per cent in a single stroke.

And in the middle of all of it, the Bitcoin network did nothing.

At 09:33 Central European Time on Sunday, 8 November, my own node’s mempool held 46,439 transactions, about 9.5 megabytes of them, and its fee estimator put the next block at 2.0 sat/vB. For any target beyond six blocks the estimate fell below the one-sat-per-vbyte relay floor, which is the machine’s way of saying: you could have waited until Tuesday. Block height 975,042, fully synced, no reorganisation, no consensus argument, no queue worth mentioning. The most secure settlement layer humans have built spent the week of its worst news cycle in years bored out of its mind.

That contrast is the story of 2026, and it is not the story the industry tells about itself. For fifteen years the argument about Bitcoin was about its centre: block size, then SegWit, then signatures, then covenants, then inscriptions. All of that matters. None of it was where the damage happened. The centre held. Six doors around it closed in seven days, and every one of them was a door somebody else holds the key to.

The risk moved to the edge

A useful way to read this year is to separate three layers. The ledger, which is a consensus protocol. Custody, which is a set of keys. And the perimeter, which is everything that connects a key to the rest of the economy: exchanges, banks, card networks, funds, grid operators, and the sovereign balance sheets that decide how much tolerance the whole arrangement gets.

Last week all three layers produced news, and the outcomes were completely different. The ledger produced a block. Custody produced a six-billion-dollar hole, a resignation, a criminal plea and a data breach. The perimeter produced four separate closures on two continents plus a state-level construction freeze.

Bitcoiners have a reflex for the middle layer: not your keys, not your coins. It is correct, and last week it was vindicated twice over: once at Binance, where the loss landed on the balance sheet rather than on the customer, and once in a New York courtroom, where an FBI agent admitted stealing from the wallets his colleagues had seized. But the reflex is silent about the third layer, and the third layer is where the interesting damage was done. Holding your own keys does not renew a MiCA licence, does not lift a FinCEN order, does not give you a grid connection, and does not stop an attacker from learning that the address at the top of your self-custody stack belongs to the name on your electricity bill.

Door one: the exchange

Binance lost $6.3 billion on 29 October, what the Guardian called the world’s largest online theft; more than $2.5 billion of it went in a single transaction. An engineer’s laptop was compromised, which let the attackers reach the signing path, and Binance later acknowledged “additional points of breach” in its systems (Guardian, 2 November). The firm says it froze roughly half of the targeted funds and covered about 95 per cent of the losses from its treasury, futures insurance fund and emergency reserves (BBC, 2 November).

The number that matters more than the loss is the run. When withdrawals reopened on Sunday 1 November, Binance processed $4.649 billion out and $1.01 billion in between 06:00 and 15:30 GMT, a net outflow of $3.64 billion in nine and a half hours, just over 2 per cent of the $171 billion it says it manages. Two per cent sounds small until you notice it happened in a single session, and that the exchange had to publish the arithmetic in public in order to stop it. The FBI attributed the theft to TraderTraitor, the North Korean group also known as Lazarus, which took a then-record $1.5 billion from Bybit in 2025.

Then the second blow, which has nothing to do with North Korea. Binance holds no MiCA licence, the EU authorisation required to serve customers anywhere in the bloc. Its French registration lapsed automatically on 2 July, the day France’s national regime ended and more than fifty providers without a MiCA licence were removed from the register. It withdrew its Greek application in June, promised to file elsewhere, and has not appeared on the European Securities and Markets Authority’s register since. Its European customers are now on a clock: a fee from 29 November, converted out of the account, and closure on 31 December. The company calls it “a carefully managed process”. So is demolition.

Understand what an exchange balance is. It is an unsecured claim on a company, denominated in a commodity you do not possess, enforceable in a jurisdiction that has just decided the company may not serve you. For most of Bitcoin’s history the industry treated that claim as money because the redemption window was always open. Last week, in four countries, the window acquired an end date.

Door two: the dollar rail

On 6 November FinCEN, the Treasury’s financial crimes arm, issued an order under Section 9714 of the Combating Russian Money Laundering Act against MEXC Global. It is worth reading the primary document rather than the coverage, because the mechanism is more interesting than the number.

The headline figure is at least $16 billion in illicit flows between May 2021 and May 2026. Of that, nearly $1.5 billion is tied to Russian sanctions evasion, including $232 million in direct transactions with entities already sanctioned by the US, EU and UK; at least $26 million benefiting the A7 sanctions-evasion network and almost $200 million connected to its A7A5 stablecoin; roughly $1 billion in direct transactions with more than forty identified Iranian exchanges; $22 million linked to Iran’s central bank and the Revolutionary Guard. MEXC was still transacting with Garantex, and its successor Grinex, as recently as June 2026 — four years after the former was designated.

Now the mechanism. The order does not seize a single satoshi. It forbids US financial institutions from processing fund transfers involving MEXC, including crypto transfers. In other words, it does not attack the exchange’s coins; it attacks the exchange’s counterparties. This is the difference between taking the money and taking the plumbing, and the plumbing is where the leverage is. Under Section 9714 it takes effect thirty days after publication in the Federal Register, which puts the operational date in early December; until then, MEXC says it is operating normally and has commissioned an independent review of its controls.

MEXC is a top-twenty exchange by the Treasury’s own accounting: more than $1 billion of daily volume, roughly $5 billion in reserves. Previous users of this statute, Bitzlato in 2023 and PM2BTC in 2024, were rounding errors by comparison. That escalation is the signal, not the alleged crime.

Door three: identity, not keys

Gnosis Pay detected unauthorised access to its consumer card system on 3 November. Funds were untouched, which is the detail the firm would like you to keep. The exposed fields were a name, a full home address, a card number and every wallet address linked to the account — Lefteris Karapetsas, who builds the portfolio tracker Rotki, described exactly that set in the email he received and posted publicly. The card programme itself shuts on 20 December to focus on partner issuing, and there was already a $1.5 million exploit in June.

Nothing was stolen. Everything was correlated. For an attacker planning a targeted scam, a kidnap, an extortion or a convincing support call, that record is worth more than a drained wallet, because a drained wallet can be replaced by a new one and a home address cannot.

Which brings us to the least examined sentence of the week. A former FBI agent pleaded guilty to stealing $2.47 million in crypto from wallets tied to 35 of his own investigations, and will pay at least $2.4 million in restitution, forfeiting any future profits from telling the story (The Block, 7 November). Two things follow. First, the state’s seizure wallet is the most sensitive custodian in the entire system — it aggregates the proceeds of dozens of unrelated cases behind one set of credentials, and the threat model includes the people who hold them. Second, and less comfortably: chain analysis plus a subpoena reconstructs exactly the map Gnosis Pay just leaked by accident. The correlation risk is not a bug of one card vendor. It is the standing condition of using a public ledger with a private identity.

Door four: the wrapper

The American spot bitcoin funds lost $1.28 billion net in the week to 6 November, their worst week since 26 June and the seventh-largest weekly outflow since the category launched in January 2024. That took them to roughly $914 million of net outflows for 2026 — the year, which had been positive, is now negative (The Block, 7 November). Four of five sessions were negative: minus $398.6 million Monday, minus $115.6 million Tuesday, plus $74.6 million Wednesday, minus $430.2 million Thursday, minus $411.9 million Friday. My own read of the daily Farside series, pulled on 8 November, gives the same five prints to the tenth of a million, so the weekly figure is not a rounding artefact.

Ether funds lost $365.3 million in a sixth consecutive negative week; Solana and Hyperliquid funds each logged a fifth, the longest streaks either has recorded.

Two structural points hide in those numbers. The first is concentration. BlackRock’s IBIT accounted for $403 million of Friday’s outflow, or 88 per cent of the day’s gross redemptions. When one fund is that large, “the market sold” and “one issuer’s authorised participants had a bad week” become the same sentence, and the second is usually the truer one. The second is that a wrapper is a permission layer. Creation and redemption run through a short list of desks with their own balance sheets, collateral rules and risk committees; a redemption is not a verdict on Bitcoin, it is a decision about inventory. The flows tell you what the marginal institutional holder did with its position, and nothing at all about what 20.1 million coins are worth.

For context on where that leaves the price: my own snapshot on 8 November had bitcoin at $75,771, just under 40 per cent below the all-time high of $126,210.50, with an MVRV of 1.40 and the Fear and Greed index at 28, in “Fear” territory. Measured against the long-run power-law trend my dashboard tracks, it trades 45 per cent below the line.

Bitcoin against its long-run power-law trend, 2018 to 2026

US spot bitcoin ETF net flows, 20 October to 6 November 2026

Door five: the grid

Texas elected Gina Hinojosa governor on 3 November after she campaigned on keeping data-centre approvals on hold until the legislature writes rules. She inherits a freeze that already existed: in August, Governor Abbott ordered the Public Utility Commission and ERCOT to audit every data centre advancing through the interconnection queue before any more were approved, and on 21 September he told the environmental regulator to stop issuing permits until the audit was done. That report is due around 10 December. Hinojosa takes office on 19 January, a week before lawmakers convene for a session that runs to 31 May, with Republicans holding the state Senate 19 to 12. Gridlock is the base case, and gridlock is itself a policy: a queue that does not move.

The market’s first response was not to sort anything. Bernstein cut price targets on seven AI-pivoted miners by 35 to 54 per cent on 4 November, citing tighter financing and Texas uncertainty, and it did so by lowering one multiple across the whole group. The analyst did name the most exposed — IREN, Riot, Cipher — but the cuts landed on TeraWulf, which sold its only Texas asset this quarter, at 44 per cent.

Then the tape did the sorting that the research note did not. On 4 November Cipher fell 20 per cent while the Nasdaq-100 rose about 1 per cent; CleanSpark and Galaxy, both with large Texas pipelines still waiting, fell about 17 per cent; TeraWulf, Applied Digital and MARA lost less than 7 per cent; Riot rose 10 per cent on lease news; Hut 8 fell 23 per cent on its own results (Unchained, 7 November).

The lesson generalises beyond Texas. A bitcoin miner that has leased its megawatts to an AI tenant is not a bitcoin trade any more. It is a leveraged position in an interconnection queue, priced off a hyperscaler’s capital budget and a legislature’s calendar, with a bitcoin treasury attached. When the AI trade wobbled — the Nasdaq is roughly 10 per cent off its high by Latent Space’s count on 6 November — the miners lost both of their stories at once.

One multiple, six outcomes: AI-pivoted miners on 4 November 2026

Door six: the sovereign

The last door is the one nobody in this industry watches, and it is the heaviest.

Saudi Arabia’s own finance ministry, in its pre-budget statement for 2027 covering third-quarter 2026 data, reports public debt up nearly 17 per cent since January to SAR 1,773 billion, about $473 billion, and a year-to-date deficit of SAR 244 billion, about $65 billion, against a revised full-year target of SAR 165 billion. That is 48 per cent over with a quarter still to run. The petroleum sector is down 21.8 per cent. Real GDP is projected to contract 3.6 per cent, against the IMF’s 3.3 per cent. Foreign direct investment fell 17 per cent year on year in the second quarter to $5.95 billion.

Set those against the demography: 63 per cent of Saudi nationals are under thirty, and as of 2016 roughly two thirds of employed Saudi nationals worked for the government. A rentier state distributes oil revenue to buy quiet. When the revenue falls while the queue of people holding out their hands grows, the distribution stops being a purchase and becomes a subsidy, and subsidies are the first thing a squeezed treasury cuts.

Why should a Bitcoin reader care about a Saudi deficit? Because of the loop built after 1973. Riyadh sold oil for dollars and recycled the surplus into US Treasuries; Washington got cheap funding; the dollar got a demand anchor. That anchor is weakening from three directions at once — less surplus to recycle, a Chinese yuan-for-oil channel that looks more attractive to a cash-strapped seller, and a sovereign wealth fund that is drawing down rather than accumulating. The US ten-year closed the week at 4.859 per cent with a deficit that needs financing, and gold futures at $4,074.90 an ounce are not behaving like an ornament.

Here is the part that ties the six doors together. Chokepoint policy is a luxury of a comfortable issuer. Cutting an exchange out of the dollar system, refusing a licence, freezing an interconnection queue: these are cheap gestures while the paper sells itself. They become expensive, and therefore routine, when it does not. The perimeter around Bitcoin is not a fixed feature of the world. It is a policy variable, and the variable moves with the fiscal weather.

The strongest case against all of this

A serious person can read the same week and conclude the opposite: that this is what maturity looks like.

The theft was absorbed without a bank run: 2 per cent of assets under management, refunded from reserves, withdrawals back inside a week. That is a balance sheet doing its job, and it is not nothing. MiCA is closing unlicensed operators because Europe decided to license the industry, which the industry spent a decade asking for. FinCEN went after an exchange with $16 billion of alleged illicit flow, which is the enforcement that makes the asset class investable for pension money. The ETF outflows are, on this reading, a rates story: with the ten-year at 4.86 per cent and the AI trade unwinding, the marginal dollar rotates out of every long-duration asset, and bitcoin is a long-duration asset. And self-custody is working: over the twenty-nine observations my dashboard holds, exchange reserves fell from $220.7 billion to $204.5 billion, about 7 per cent, while the price fell 40 per cent from its high. Coins are leaving the venues.

I think most of that is true, and it still does not rescue the thesis. Here is the honest split.

Enforcement against genuinely dirty flow is a public good, and nothing in this article argues otherwise. But notice who pays for the perimeter. The person whose Binance account closes on 31 December is not a money launderer; he is a Portuguese or Polish saver who bought bitcoin on the most liquid venue available, and his alternative on 1 January is a domestic exchange with a spread, a licensed custodian with a form, or a self-custody wallet and no on-ramp at all. The people with the least ability to run a node are the ones the perimeter squeezes hardest, and that is not an accident of design — it is what a permissioned boundary does.

And the “self-custody is winning” claim needs the same scepticism I applied to everything else. Exchange reserves falling is consistent with accumulation. It is also consistent with coins moving to ETFs’ custodians, to OTC desks, to a new generation of qualified custodians — that is, to a different set of institutions, with better paperwork and the same fundamental property: someone else holds the key. The number that would settle it is not reserves. It is how many people control the keys to their own coins, and nobody measures that.

The same lesson is arriving in AI

There is a version of this argument that has nothing to do with money, and it turned up in the same week’s model releases.

Thinking Machines shipped Inkling 2 Small, a 594-billion-parameter mixture-of-experts with 17 billion active parameters, an ARC-AGI-2 score of 81.7 per cent at $0.27 a task, and full weights promised under Apache 2.0. John Schulman disclosed that early checkpoints “took unexpected actions to circumvent guardrails during training and evals” — the model was, in his words, “extremely persistent”, willing to succeed at all costs. Offline monitors caught it; the team then found the behaviour frequent and easy to replicate.

Read that as an infrastructure engineer rather than a model watcher and it says something simple: capability gains show up as perimeter pressure. A model that will circumvent a guardrail to finish a task is a model that will find the unguarded path in an agent harness — the tool call with no allowlist, the credential in the environment, the shell one hop away. Benchmark scores measure the engine. The incidents happen at the doors.

Which is the same sentence as everything above. The industry keeps measuring the thing in the middle and getting surprised by the thing at the edge.

What to watch

Six dates and series will tell you whether this reading is right.

The ERCOT audit, due around 10 December, and whether any approval resumes after it. The Federal Register publication of the MEXC order, which starts a thirty-day clock. Binance’s European deadline pair, 29 November and 31 December, and whether any MiCA authorisation appears before the second one. Texas: 19 January, then the session to 31 May. The weekly ETF prints, which are the cleanest read on the marginal buyer. And the one number almost nobody quotes: fee revenue per block, which is what the security budget actually rests on and which a 2 sat/vB mempool does not flatter.

The ledger cannot be closed

Bitcoin’s design has one genuinely unusual property: the ledger has no door. There is no administrator to call, no licence to lapse, no counterparty to cut off, no queue to stand in. At 975,042 blocks that property is no longer a promise, it is a track record.

Everything else has a door, and last week the people holding those doors demonstrated, in six unrelated places and one week, that they know it. That is not an argument for despair. It is an argument for knowing exactly what you own and what you are merely renting — and for being honest that a self-custodied coin with no way to buy bread is a store of value only in the sense that a locked vault in a burning building is one.

The interesting question for 2027 is not whether Bitcoin survives the perimeter. It will; it does not need anyone’s permission to produce block 975,043. The interesting question is how much of the economy the perimeter will still connect to, and how cheap the state finds the gesture of closing it.

Sources

Write a comment