One exchange cleared a federal banking hurdle this weekend while two security failures and a billion-dollar liquidation cascade showed what that oversight is for. Here is what moved in the past 48 hours, and what it means in practice.
Coinbase Clears the OCC, With Conditions Attached
Coinbase announced on November 9 that the Office of the Comptroller of the Currency has completed the chartering of Coinbase National Trust Company, with OCC records dating the charter to November 6. This is a fiduciary custody charter for institutional clients, not a commercial bank license.
The conditions matter more than the headline. No retail deposits, no traditional lending, no direct stablecoin issuance, no automatic access to Federal Reserve payment systems. Coinbase must hold at least $60 million in Tier 1 capital plus 180 days of operating liquidity for three years, and existing custody business migrates from its New York-regulated entity. The Independent Community Bankers of America objected that assets under a national trust charter lack the safeguards customers associate with bank deposits, worth remembering before anyone markets this as FDIC-equivalent.
A Four-Day-Old Deposit Drains Ankr's Bridge
Between 3:09 and 3:12 a.m. Eastern on November 9, an attacker pushed five unauthorized withdrawals through Ankr's Ethereum cross-chain bridge. Blockaid first estimated the loss near $292,000; later analysis put it above $303,000. The attacker referenced a 0.0044 ankrETH deposit made through Optimism on November 3 and already redeemed that day, then submitted receipts altering the recipient, amounts, and tokens. Those requests passed the bridge's authorization checks. Records do not yet show how valid authorization was obtained, or whether the failure sat in signing or in receipt validation. The bridge's pause flag reportedly still read false at 3:49 a.m. ET.
Gnosis Pay Breach Exposes Home Addresses and Linked Wallets
Gnosis Pay disclosed on November 7 that attackers reached its legacy consumer card system, exposing customer home addresses, card numbers, and every crypto wallet address linked to affected accounts. It detected the access on November 3, contained it within about two hours, and patched the flaw, but has not said how many customers were involved. No funds were taken, which makes this a data case rather than a theft case, and arguably worse: a record pairing a legal name and street address with on-chain holdings is a targeting kit, useful for phishing and for physical coercion. Notification deadlines turn on where each customer resides, which a multi-jurisdiction card program is least equipped to answer quickly.
Bitcoin Slips Below $74,000 as Leveraged Longs Unwind
Bitcoin traded near $73,855 on the morning of November 9, down about 2.5% on the day, with Ethereum off 6.56% near $2,086. CoinGlass put market-wide liquidations at roughly $1.11 billion, including about $492 million in Ethereum and $298 million in Bitcoin, with longs making up some 92% of forced closures in both. No single trigger has been confirmed; reporting points to post-midterm uncertainty over market-structure legislation, fallout from Binance's reported breach, and expectations of a December rate increase. For leveraged accounts, the legal questions after a cascade concern disclosure, margin terms, and liquidation mechanics, not the price move.
How to Protect Yourself
If you hold a Gnosis Pay card, assume your address and linked wallets are in circulation: treat any message referencing your card or holdings as hostile until verified through a channel you initiated, request a reissue, and move meaningful balances off those addresses. The Ankr incident is a reminder that funds parked in a bridge contract are exposed to that contract's authorization logic, not just your key hygiene, so treat bridges as transit rather than storage.
Your legal position depends on how the loss happened. Data breach claims turn on notification timing and the adequacy of safeguards, and each customer's residency decides which statute applies and how fast the clock runs. Protocol losses are harder, but documentation preserves options: transaction hashes, timestamps, wallet addresses, screenshots of status pages and pause flags, and every communication from the operator. Report theft to the FBI's IC3 and to the operator in writing.
At Coin Counsel, we work with individuals and businesses navigating the legal fallout of crypto fraud — whether you're a victim seeking recovery, a company facing regulatory scrutiny, or a project working to stay compliant in an increasingly complex legal landscape. The rules are evolving fast, and the cost of getting it wrong has never been higher. Contact us at coin-counsel.com to speak with a crypto-focused attorney today.
Disclaimer
This blog post is for informational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship between you and Coin Counsel or Franco Law PLLC. The legal landscape surrounding cryptocurrency is rapidly evolving and varies by jurisdiction. Do not act or refrain from acting based on information in this post without first consulting a qualified attorney. If you believe you have been the victim of crypto fraud, contact us at coin-counsel.com for a consultation.
