Binance is emailing users in some European countries and asking them to withdraw their crypto before November 29, when monthly fees begin. Accounts close on December 31, 2026, because the company does not yet have a MiCA license. The same day, Binance also announced the departure of its chief financial officer, nine days after the $6.3 billion hack.
Monthly fees and account closures in Europe
According to CoinDesk, the emails are reaching users in Spain, France, Italy and Poland. Deposits are blocked, while withdrawals remain available. From November 29, Binance will charge 0.025% of the crypto balance each month or 10 USDC, whichever is higher. The first charge will come within three days of November 29 and the second after December 24. Anyone whose balance is smaller than the fee will lose the entire amount.
On December 31 the accounts close, and any crypto left is treated as inactive and can be converted or transferred. A Binance spokesperson tied the move to the end of MiCA's transition period and said the company is "gradually limiting certain services." The spokesperson added that its commitment to Europe is unchanged and that it is going through the licensing process.
In Greece, Binance withdrew its application in June and plans a new one in another member state, which it has not named. France's AMF says Binance France's registration expired on July 2. The company had already warned users in France, Spain, Italy and Poland to withdraw funds in June. Portuguese users have not been named, but they fall under the wider EU restrictions.
In the episode we read this as Binance's official exit from Europe. The fee works as an incentive: whoever does not move in time pays, and whoever has a small balance loses it. Anyone considering a switch to another exchange should finish the transfer before November 29.
Binance CFO Kaiser Ng leaves nine days after the hack
Co-CEO Yi He announced on November 7, 2026 that chief financial officer Kaiser Ng is leaving for a "new venture" after more than five years at the company. Justin Yek, a former finance executive at Airwallex, takes over the role. Ng had been CFO since January 2022 and had worked at Kraken. The announcement does not say when his departure takes effect or what he will do next.
According to the announcement, the transition plan was six months old. The hack took place on October 29, and the FBI attributed it to North Korea's TraderTraitor group. By November 2, Binance had replaced about 95% of the affected assets with its own funds, completed a proof-of-reserves snapshot and begun restoring withdrawals. Elliptic reports that the attackers have swapped stolen tokens for bitcoin worth $124 million.
In the episode we found the planned-transition explanation plausible, though the two events landed very close together.
Fake Teams invitation attack on SignalPlus
On Thursday, November 5, Binance and Deribit revoked the API keys of the trading platform SignalPlus as a precaution. Both exchanges said their own systems were not affected. Deribit said trading, monitoring and automation through SignalPlus have stopped for its clients.
According to SignalPlus, the attackers took over the Telegram account of a contact at a third-party technology vendor and sent one of the company's engineers a fake Microsoft Teams meeting invitation. The engineer's computer was compromised, and the attacker stayed dormant until targeting the internal network early on Wednesday morning. Losses were under $82,000, and the company said it will fully compensate users. It also admitted that it did not require IP whitelisting for API access to the exchanges and committed to tightening its controls. Services will return within the next few days.
Yi He urged third-party platforms connected to Binance to review their security measures. According to Cointelegraph, Binance said it detected and stopped 57 suspicious threats linked to North Korea in 2026.
Attacks on BTCPay Server hot wallets
BTCPay Server, a free open-source tool for Bitcoin (BTC) payments, asked operators on Sunday, November 1 to shut down their servers. There were reports of attackers draining the hot wallets connected to them. Founder Nicolas Dorier said the attackers had logged into the affected servers with administrator rights.
The investigation found an attack path in versions 2.4.1 (released on July 23) or older. There are no credible reports of losses among users of the latest version, 2.4.7. That version was released on Thursday, October 29 as an urgent update for one critical and several medium-severity vulnerabilities. The project has not said whether the attacks exploited those vulnerabilities. Some hosting providers, such as LunaNode, automatically shut down old installations. It has not been announced how many servers were affected or how much Bitcoin was stolen.
Because BTCPay is self-hosted, no central party can switch it off, and each merchant has to act on their own. A hot wallet keeps the seed on a server connected to the internet, and BTCPay's documentation labels it "DANGER." In August the project had warned of a critical, actively exploited vulnerability in versions before 2.4.2.
In brief
Pi Network Ecosystem Summit: Pi Network's first Ecosystem Summit runs online from November 17 to 19, streamed on YouTube, with founders Chengdiao Fan and Nicolas Kokkalis taking part. The first day covers the developer platform and the second, November 18, covers AI. On November 19 the Pi Next competition begins, with a prize of 200,000 USDT. The team has not said what exactly will be presented on AI day. PI ranked in CoinGecko's top three trending and trades more than 97% below its February 2025 high, while earlier presentations did not move the price. In the episode we noted that the price did not react to the announcement and that it will depend on what is shown at the event.
The market
Bitcoin is trading around $75,000 as of November 8. After the large candles of recent days and the liquidations, the market has calmed down, and Bitcoin now looks like a stablecoin because it is barely moving.