The scales of cryptocurrency’s existential crisis regarding traditional finance and decentralized finance were always going to be tipped by crime. They’ve gotten a nearly $7 billion push since Friday (Oct. 30).
A mysterious series of transfers allegedly using the Kraken exchange resulted in the loss of over $130 million from a European institution as of Tuesday (Nov. 3), according to an independent investigation of the blockchain transactions. The institution has not been identified, but the public blockchain record confirms that one operator was behind over a dozen withdrawals.
A day earlier, Monday (Nov. 2), Mercado Bitcoin, a digital asset company, suffered a hack, which caused a $40 million loss, PYMNTS reported, citing Bloomberg.
And a day before that, Sunday (Nov. 1), Bitcoin payments tool BTCPay Server urged users to shut off their servers following word of an attack, PYMNTS reported, citing CoinDesk.
Each of these incidents came just days after Binance, the world’s largest crypto exchange, was the victim of a crypto heist in which criminals attributed by the FBI to be a part of North Korea’s TraderTraitor hacking group stole a record $6.3 billion. The theft threw the crypto space into relative disarray as attackers converted these assets and moved proceeds through laundering services.
Binance management said activity had largely normalized and the exchange had replenished 95% of affected tokens using its own reserves and other resources.
But while Binance users are being protected from their immediate losses, the underlying criminal proceeds and the infrastructure enabling their movement remain relatively untouched and their recovery uncertain.
Digital asset infrastructure is moving closer to the traditional financial system by the day. Kraken was approved for and holds a limited purpose account with access to the U.S. Federal Reserve System.
Read also: Crypto’s Biggest Theft Meets Blockchain’s Next Institutional Test With Binance Hack
The Problem With Tracking Digital Money That Doesn’t Stay Together
Crypto transactions are often described as traceable because public blockchains maintain permanent transaction records. However, visibility into transactions is not equivalent to identifying the people controlling the funds, much less recovering them. Once stolen assets are divided among wallets, exchanged into other tokens and transferred across blockchain networks, investigators must reconstruct an expanding web of transactions.
Mixing services add another layer of difficulty. These protocols combine or otherwise obscure transaction flows to weaken the connection between sending and receiving addresses. Some use privacy-preserving cryptography that makes conventional tracing more difficult. There are legitimate arguments for financial privacy, including protecting commercial transactions, sensitive holdings and individuals operating under surveillance. Not every mixer transaction is criminal.
But the same functionality can complicate investigations into ransomware, sanctions evasion and cryptocurrency theft. There is also a practical distinction between tracing and enforcement. Investigators may identify suspicious wallets without possessing the authority or technical ability to freeze their contents.
Asset recovery often depends on cooperation from exchanges, token issuers and authorities across jurisdictions. As funds become more fragmented, that coordination becomes harder.
See also: The Public Blockchain Debate is Already Obsolete for Banks
Against that backdrop, Circle’s latest appeal to the Securities and Exchange Commission highlights the difficult balance regulators are being asked to strike. In comments submitted Oct. 20 and publicized Oct. 28, Circle urged the SEC to preserve technology neutrality under its proposed Regulation Crypto Assets framework and clarify how permissionless networks should be treated.
Circle specifically pointed to infrastructure such as its Arc Network, which combines open participation with a known, permissioned validator set. The company said identifiable validators can provide additional security and accountability without eliminating the advantages of permissionless blockchain access.
The request brings a longstanding debate over decentralized finance into sharper focus. How should regulators oversee financial activity when the infrastructure is designed to operate without centralized gatekeepers?
The industry is asking authorities to recognize open blockchain infrastructure as suitable for increasingly important financial functions while investigators confront the difficulty of controlling illicit funds moving through decentralized networks.
The PYMNTS Intelligence report “Payment Protection: Why Firms Still Aren’t Real-Time Ready” found in August that 57% of firms in payment-heavy industries face more fraud.
Read also: The Stablecoin Sandwich Is Missing the Trust Layer
Regulators Face a Choice Between Access and Accountability
Permissionless infrastructure is not synonymous with anonymous transactions or mixing services. But the juxtaposition exposes a legitimate regulatory dilemma. Commodity Futures Trading Commission Chairman Michael Selig, for example, is using the Binance incident to make his case for bringing offshore cryptocurrency exchanges under federal supervision.
In September, the SEC granted temporary, conditional exemptions allowing certain permissioned venues to facilitate trading in tokenized securities using automated market makers. The framework demonstrates a willingness to accommodate blockchain innovation while retaining restrictions on participation and market structure.
Stablecoin issuers, exchanges, custodians, validators and privacy protocols do not exercise identical levels of control. Nor should their obligations necessarily be identical. Still, the number of recent thefts and their record-breaking values is creating pressure for more demanding answers about transaction monitoring, asset-freezing capabilities, incident reporting and coordination across networks.
Read also: Blockchain’s Institutional Custody Under Rising Scrutiny After Coldcard Bitcoin Hack
A central finding of “Scams Get Personal: Why Banks Pay More to Fight Fraud,” the September edition of PYMNTS Intelligence’s “The Fraud Economy,” is that banks have an opportunity to strengthen fraud protection by helping customers recognize when someone is persuading them to send money to a criminal.
Small exchanges cannot necessarily replicate Binance’s financial response. Reimbursement does little to address the potential downstream consequences of stolen assets moving through the financial system.
The harder questions concern who can intervene when something goes wrong, who bears the losses, and whether the infrastructure provides meaningful mechanisms for enforcing the law.
Circle’s push for regulatory clarity and Binance’s recovery efforts are not inherently contradictory. Both reflect an industry seeking greater institutional legitimacy. Together, however, they reveal the conditions that legitimacy may require.
