$7B in Crypto Gone in Days as Circle Pushes SEC for Looser Rules

Crypto just had a brutal seven days, and the tab is enormous. As of Tuesday (Nov. 3), an independent blockchain investigation tied a string of transfers allegedly routed through Kraken to the loss of more than $130 million from an unidentified European institution — with the public ledger showing one operator behind more than a dozen withdrawals. A day earlier, Mercado Bitcoin got hit by a hack that cost $40 million, PYMNTS reported, citing Bloomberg. And on Sunday (Nov. 1), Bitcoin payments tool BTCPay Server told users to shut down their servers after word of an attack surfaced, PYMNTS reported, citing CoinDesk.

All of that landed days after the main event: a heist at Binance, the world's biggest exchange, in which criminals the FBI attributes to North Korea's TraderTraitor hacking group made off with a record $6.3 billion. Binance management says activity has mostly normalized and that it refilled 95% of the affected tokens from its own reserves and other resources. Users are being made whole on the front end. The stolen coins, and the laundering rails moving them, are a different story.

Blockchains are sold as traceable, and they are — every transaction is permanent and public. But seeing a transfer isn't the same as knowing who controls the wallet, let alone clawing the funds back. Once thieves split assets across wallets, swap them into other tokens and hop chains, investigators are rebuilding a web that keeps growing. Mixing services pile on another layer, blurring the link between sender and receiver with privacy-preserving cryptography. There are legitimate reasons for that privacy. The same tools also gum up ransomware, sanctions and theft probes — and tracing a wallet isn't the same as having the power to freeze it.

Into that mess steps Circle, which wants the Securities and Exchange Commission to keep its rules tech-neutral. In comments submitted Oct. 20 and made public Oct. 28, the stablecoin issuer urged the SEC to clarify how permissionless networks get treated under its proposed Regulation Crypto Assets framework. Circle pointed to infrastructure like its Arc Network, which pairs open participation with a known, permissioned set of validators — arguing that identifiable validators can add security and accountability without killing the upside of open access. Meanwhile, CFTC Chairman Michael Selig is using the Binance theft to press his case for putting offshore crypto exchanges under federal supervision.

Regulators are already experimenting. In September, the SEC handed out temporary, conditional exemptions letting certain permissioned venues trade tokenized securities through automated market makers — a sign it will accommodate blockchain innovation while keeping a hand on market structure. The pressure isn't letting up: PYMNTS Intelligence found in August that 57% of firms in payment-heavy industries are dealing with more fraud. And smaller exchanges simply can't match Binance's balance sheet when the bill comes due. Refunds don't solve what happens when stolen assets keep moving through the wider financial system.

The uncomfortable questions are stacking up. Who gets to intervene when something breaks? Who eats the losses? Does the infrastructure offer any real way to enforce the law? Circle's push for clarity and Binance's cleanup effort aren't working against each other — both are bids for institutional legitimacy. They also sketch out the price of getting it, especially as crypto infrastructure inches closer to the traditional system. Kraken, for one, holds a limited-purpose account with access to the U.S. Federal Reserve System.