I work for a classic bank in Europe in development.
To unlock my laptop - I need a boot password - then I need a finger print scan - after that a password, after that a 2fa app. Then I need to connect to a VPN .. 2fa again. My laptop locks within 1 minute of inactivity. 30% of my CPU and RAM get hogged by our security suit constantly. My USB ports are disabled for data. I understand it's windows and windows can get compromised - it's just very unlikely that it gets compromised to a level where you could actually cause damage.
absolutely not a nightmare but necessary in places that are serious about their shit. paying off ransomware isn’t an issue at all, if my bank got hacked I would pull money out pretty much the next
morning and same would be true for hoardes of others even though our money is fdic insured.
Hacking bank and stealing money from there is not so easy as stealing 32 characters private crypto key. Even if you steal some data from bank, using is is another challenge.
With crypto key you just use an open source client on your machine to move the crypto.
I work in german FinTech too and am very familiar with this game. Forcing developers to do 2FA for "every keystroke" while running ancient software on historic OS doesn't make much sense to me.
EDR software on the laptop controls what is and isn't allowed. It'll be disallowing USB removable storage devices etc, while still allowing standard HID (keyboard, mouse).
They can even block all but allow-list certain vendors and models, but because USB is an unauthenticated standard - an attacker can easily spoof any vendor or model. So best not to rely on that and instead block all of certain types of USB device.
Binance explicitly said it wasn't just the compromised laptop.
I'd be surprised if it were. Crypto exchanges have been targeted by hackers since forever, and Binance is one of the top. If it was so easy to exfiltrate crypto from them, I'd have expected a heist before now. (Unless controls have just gotten worse recently.)
Do you have a source? Because I've only been hearing about the laptop.
> Binance has said the incident was a “complex attack” that stemmed from multiple factors.
> Its initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions.
I know it says "multiple factors" here, but there are no other factors I've found.
Sure, but the vary fact that a DevOps engineer had single-person access to a component that enabled them to submit unauthorized withdrawal transactions is likely already an unintended situation brought on by a misconfiguration in their system.
> Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
That seems to be their most recent update on the matter afaik (30 Oct, 8:47am UTC)
World's most sophisticated hacker who happens to be in a jurisdiction who do not respond to provocations and operate out from behind the GFW illegally, and at the same time, never broke ranks even with the wealth and being in a remarkably well-resourced perch to defect.
The FBI and other federal agencies engaged in law enforcement routinely use appeals to authority and expertise they do not have and create set-piece situations that almost in every case involving more than one defendant sets up a circular firing squad situation where the most guilty is at an advantage of simply pleading guilty and cooperating first, or otherwise they'd dump it off via the AUSA down to the state level if they can, or blame China, Russia, NK, Iran, or Israel, countries that do not extradite their own citizens on request and rarely if ever do so unless it's done so on their terms. Blockchain tracing ultimately still needs the connection between the chain and off-chain ID and there's no surefire way to even ascertain with something that isn't a mere heuristic with an error rate unacceptable in criminal court and would fall apart if there's competent defense counsel, which the FBI have, in the one case where on-chain evidence was going to be used, actually went full Chewbacca and created a two year delay mid-trial and then pulled Chainanlysis' "expert" off before cross examination. The company has the balls to brag as if the courts have validated their method in whole, when in reality the court have long understood what clustering is and so that part is of course admissible evidence, but it also doesn't get you to the purported end - attribution. If one can use a strawman as a sales tactic, this would be exactly that. The attribution aspect have never been allowed to be properly examined in the criminal context. The "reactor" is merely a database, and in the small bit of direct examination the chainalysis employee claimed that every time he queried the database the correct rate was some absurd, Robert-Mugabe's-election-number figure that is higher than the DOJ's conviction rate when they were still credible and actually higher than the CCP's official conviction rate in a fake criminal justice system where due proceess doesn't exist and they give leeway because claiming to be 99% correct is absurd. Of course, they've never been tested in the same situation and still haven't, and if the industry mouthpiece is basically hiring sales and not legal, which is basically what every company in the Blockchain Association has been doing, rent-seeking to be Wall Street 2.0 on top of free merged pull requests and open source software. Tracing on chain is all well and good for shits and giggles but Department of Treasury went and sanctioned a smart contract thinking that it was an EOA address that belongs to a person as if etherscan was never checked beforehand tells you all you need to know.
They had a bad case against Tornado Cash since the ultimate demand would require the devs to somehow predict the actual identities of those that interact with their contracts - which in many cases isn't even a human. It's telling that when the 5th Circuit and the one judge in that circuit who knows anything about process and technology through sheer luck got on the panel and wrote a clear rebuke of how federal investigators failed at doing any due diligence, and for once, the feds did not attempt to do an end-run or even ask for en banc hearing of the issue, but simply made up a completely different issue to pursue (building the front end) which is not a crime. The feds can't match the IP/in house firms in renumeration and can't even match public interest or federal defenders in hiring out of tech competent law grads when it comes to having a moral high ground. They have so much resources so that they can hire contractors, but can't vet the contractors. Being able to fall back on coercion covers up a lot of incompetence. The Atomic Wallet 'hack' was almost certainly not a NK job as they have claimed, for example, and they relied on some dude on twitter's hunch (notably the first thing one learns that is never evidence if presented in court) and a post-hoc heuristic that is indistinguishable from a copycat or a third party's infrastructure to make the attribution. People with poorly thought out opinions are all over the place on Twitter, but this permission slip to "make mistakes". Also, they're part of the system of funding provided to your local police so they are better funded now than before 2020. Check their work under all circumstances, and plea bargains should not be considered as evidence of actual guilt since coercion and BS is as common as actual cases backed by properly collected evidence that builds a procedurally sound case.
I think your expectations are too high. The vast majority of criminals don't bother checking targets where there's not good evidence its easy or something has worked before.
Just going from what Binance PR must believe about a laptop it
seems unlikely to me that they've been tested in much depth by
anyone with mafia tactics.
The customers surely have standing to sue Binance. But to close the gap between what you feel should happen and what could actually happen… exactly what crime could they be prosecuted for?
Why should we believe Binance when they say all customers will be made whole, and how will they do that, with what money?
It seems very unlikely they have $3-6B lying around ready to repay customer deposits. At the very least this would be catastrophic for them if they do lose all that money.
Have they re-enabled withdrawals yet? If I were a customer I'd be taking everything out as soon as possible.
their stated plan, for what it’s worth, is that they have $6.34B of company funds set aside, most of it already in the same coins that were taken, plus the SAFU emergency fund at about $1B. around $3B of the stolen money is frozen at Tether, Circle and others, and CZ’s own post on X put the rest of the gap at about $2B.
withdrawals have been paused since Thursday night. binance says it will reopen them in stages from Sunday and publish proof of reserves by Monday, which is the thing that would actually answer your question.
They don't need need money. What was stolen was some sort of "digital assets". How are they going to cover that, I have no idea, but let's not equate crypto assets with money. If someone would have stolen my bike, i wouldn't be saying "they stole $1000". They stole a bike, which could or could not be recovered, and which was or wasn't covered by insurance.
And if thieves stole a bag of paper from you, that happen to have the number $100 and some other artwork written on them by the government, what then? It's not money, it's just some "paper asset"? You're just showing your own personal bias about what the definition of money is.
$3.5B stolen was "stable coins", which you could equate to a piece of paper with a dollar amount written on it.
Those are largely freezable by the issuer of the paper.
Then we have $2.4B in Bitcoin and ETH stolen. Those are not directly freezable.
However, if that does create a liquidity challenge for these exchanges, what if the price just so happens to drop by 60% after trading is restricted? That liability might shrink in actual value.
What if the bag of paper "money" is in a foreign currency? You'd still happily call it money, but then the distinctions you're trying to draw with crypto don't really apply. Think of crypto as a foreign currency, it still functions as money.
Crypto isn't foreign currency. The price may fluctuate wildly based on sentiment and action taken by exchanges such as Binance, which would directly impact their obligation here.
Comparing crypto to actual currency typically connected to large, real economies is not relevant here.
The crypto economy isn't real, it's a pointless wealth redistribution scheme.
Anyway, that and your question are hardly relevant to the fact that Binance and their cabal own the crypto exchanges and consequently could manipulate the price to reduce the size of their obligation denominated in crypto rather than currency or stable coins.
So like, three exchanges, one of which died? Even if we assume everyone in the group is willing to tank crypto values, that's not a very big power level increase beyond what Binance has by itself.
Believe whatever you want about Binance's influence.
I understand Binance alone accounts for a third of the market, and their ability to coordinate with other exchanges is hardly restricted to the participants we know were in that specific group chat.
I think the point stands that a liability in eg. USD is much different from one denominated in crypto.
This isn't about what I want to believe, it's that at the slightest requests for clarification/evidence you've gone from "the fact that Binance and their cabal own the crypto exchanges" to "ability to coordinate".
Yeah Binance itself is big but it'll take a lot more than one exchange, an exchange everyone is now handling with extra suspicion, to cause a crash.
> I think the point stands that a liability in eg. USD is much different from one denominated in crypto.
If course it's different but that's so much weaker of a point. And the foreign currency comparisons weren't to particularly stable currencies.
They still need to find buyers at that price. The price is what it is because there are no buyers below that price. If they artificially drop the price there won't be any buyers at the new price so they won't be able to buy any bitcoin so they won't be able to give it to the customers it was stolen from.
I wasn't thinking about some fake price they set on their own exchange, but actions that could tank the market, which I understand Binance alone makes up 30% of.
Crypto at it's current price has a market cap around $2.6T. Obviously the liquidity is questionable, and since crypto isn't connected to any mention worthy real economic activity, a change in sentiment can quickly crash the price and liquidate leveraged positions.
While that's of course true for other assets also, crypto not being connected to production of real value, combined with the comparative lack of regulation, makes it much easier to manipulate.
To me it's clear that crypto is worthless, so I don't see a point in such an action.
In my view their interest, which aligns with that of all other major owners of crypto, is to acquire as much real currency as possible.
Acquiring more crypto by decreasing its valuation is not furthering that.
Maintaining a high valuation and positive sentiment in order to convert buyer's real currency into profit to cash out is what I believe their strategy is.
Yes, and we could have a paper money system where a registry of stolen serial numbers is kept and they can’t be deposited at any bank or used to pay the government ever again.
Binance and its former CEO, Changpeng Zhao, were previously sued for willfully evading anti-money laundering (AML) controls. In that instance, the government ruled their compliance failures were not an accident, but a deliberate criminal enterprise. Binance paid $4.3 billion in fines and forfeitures to settle with the DOJ, CFTC, and FinCEN in November 2023.
Fines are paid out over time by taking loans against your very profitable business. Do you want to loan money to someone who just had one of the biggest thefts in history and has secondary obligations and risks.
It looks to me like Binance will be able to scrape together enough money to make their customers whole, so your probably right.
Next time this happens to Binance though they won't have an emergency fund and possibly they'll be in debt, and that's when the users will be very screwed.
Their terrible security certainly indicates to me that future of Binance is not going to be a pretty one unless they make some enormous changes.
In the U.S., a lawsuit can be either civil or criminal.
Only the government (e.g., federal, state, local) may bring a criminal suit.[1] But in both civil / criminal cases they are still a suit under the law seeking some form of ordered relief from the Court.
Essentially, you can think of "criminal" as a category of law and relief (e.g., prison) that is only accessible to the government.
Both the government and citizens may bring "civil" suits. Very generally, the remedies in civil suits are a court order to 1) stop doing a thing; 2) to do a thing required by law / agreement; 3) to transfer property, usually but not always money, from one party to another; or 4) to define a set of rules governing the parties going forward.
[1] There may be some obscure exception to this, but it is true for everything I've ever seen / heard of.
What negligence? They got their own money stolen. You do not get sued for being robbed of your money, normally. If they do not have the liquidity to let people withdraw money that is another issue, but it does not seem to be the case.
So I assume a random account holder doesn’t actually have assigned bitcoins etc — they are just accredited a claim against the crypto that Binance owns and managed keys for.
So this stolen crypto is off Binance own reserves. So it could be absorbed across current accounts as long as they aren’t drawn down to below $6B? And if crypto drops they can apply cash reserves to plug the hole more easily?
Yeah, temporarily. I doubt that being out of service for a few days gives enough grounds to sue, even merely due to ToS provisions. And that is indeed irrelevant as it is about being temporarily out of service, not having "lost customer money".
Again they cannot be charged for losing billions of their own money, and there is no way to somehow consider the lost funds as "customers' money". I am all for companies getting sued due to negligence when eg they fail to protect customer data, but this is just between binance and the hackers.
> Is this not exactly why banks have to deposit X amount outside their doors?
Sorry, what do you mean?
Basically, the historical origins of different bank regulations are quite complicated and also differ from place to place, and they were often put in place by (political) coalitions of people who already had not one single motivation but a whole spectrum of them.
And then in addition to historical reasons, you also need to ask why things are still in place. Inertia is one answer, but it's not the only one.
I think the person is most likely talking about minimum capital requirements (which are not a “deposit outside of their doors”) and doesn’t quite understand the system.
To understand the regulatory framework for banks, the best place to start is the BIS and Basel III. https://www.bis.org/committees/bcbs/standards
Generally speaking, international banks follow Basel III in addition to their domestic regulators’ capital requirements (which are probably also derived from Basel III, but have differences just to make things tedious).
However, BIS and Basel III (and the previous Basels) are just what's currently in force for most of the world. I suspect most people would be better served by more of an historical overview. But it also depends on what one is interested in.
Ah, fractional reserve banking. That hasn't been a thing for decades. Banks don't work like that. Money is just loans that haven't been paid back yet, mostly mortgages.
That's a misreading of the text. That pdf gets trotted out again and again.
But let's assume you understood the BoE right. My questions still stand:
> Do tell me, please: why do banks care about getting deposits? And why did Silicon Valley Bank get into trouble, when depositors left?
(And before you answer something about regulation: the regulators had willingly blessed SVB's damaged balance sheet for quite a while, and they only collapsed when depositors decided to leave.)
You might want to read the section of the pdf you linked that includes:
> So if a given bank financed all of its new loans in this way, it would soon run out of reserves.
I wish you would just write what you think. It would really help discussion. I assume you are not literally arguing that fractional reserve banking is how things work, but it's hard to tell what you are arguing.
I know about central bank reserves. It's not fractional reserve banking, though. It's basically just regulation, but regulation done in the language of money, which banks (and any 5 year old) can understand.
Banks have many reasons for attracting deposits. Not least of which to get customers "on board" such that they might buy other financial services. But yeah, they also need to stay on the right side of regulation, or not run out of central bank reserves, if you prefer to think of it that way.
Ultimately it's all fake. Whether you think of it as "reserves" (that don't really exist, of course), or regulation is up to you. It's ultimately just a bunch of IOUs but raised up about ten levels of abstraction.
Anyway, the whole thing is incredibly complex and nobody understands the whole thing. I did think the commenter was referring to fractional reserve banking, but they might have meant central bank reserves, I don't know.
I am not sure why this get thrown randomly as the solution to every problem. Bitfinex major hack was due to regulation. Banks and Crypto companies don't have the same attack surface and the one for crypto is way more complex due to permissionlessness.
Exchanges have to walk a fine line. If they make withdrawals too slow or difficult then people also get anxious about the safety of their funds (ironically).
Traditional banks and crypto exchanges alike rely on the carefully cultivated illusion that you can withdraw your money at any time.
$6B is probably several billion too large for a hot wallet but it's not completely obscene for an operation of Binance's size.
Honestly I wouldn’t expect anything to happen. At my company and all previous ones, everyone knows our CEO would never legitimately email or DM us on slack to ask us to real quick wire a few thousand/million/billion to the Caymans, or buy BTC, and he doesn’t have some global root on our servers either. Even people who have more technical access don’t tend to stay logged into elevated production accounts except at the exact time it’s needed.
Jamie Dimon does not have credentials to log into back office systems at JPMS. I’d be surprised if he even had access to execute wire/asset transfers via front-end tools.
Best a hacker could probably achieve is sending some sketchy emails or messages, but even there people are just going to confirm by verbally communicating with him.
Banks are actually the worst analogy for this sort of thing because there is a ridiculous amount of system federation and ultra-conservative system controls. It can take a month to get a simple route or firewall port opened on controlled networks (god I hate change committees).
they are covering all losses, so why would anyone sue? companies have done significantly worse and then just left you with a $6 class action lawsuit damage claim. What a sham to say to so disproportionately target the crypto company when you have public American companies that harbor criminals as employees still operating today.
talking about that thing. does it only apply to some business/org. ? when a big bank launders money for years they get fines and continue to business like nothing happened, this happens every few years.
Absolutely. That's why I stopped validating passwords and emails. Nobody votes with their wallets anyway, so I don't have to worry about losing customers, and regulations only go after the evil hacker testing whether 1234 might work as a password, not me for choosing not to check its hash against my database. Law-abiding citizens would never try to impersonate one another, so I'm sure fraud on my platform is low.
Can you give some examples where victims are criminally prosecuted? Do you think this is common to the extent where you would call it the general case?
I’m thinking they’re speaking of a different executive (Changpeng Zhao) pardoned by Trump. [2]
Last I heard he’s is now living in luxury in the United Arab Emirates. There was a profile on him in a paper.
I’m not sure Sam has enough cash to get a pardon.
“Mr. (Changpeng) Zhao has a long history of legal and regulatory problems. Binance pleaded guilty to money-laundering violations in 2023 and paid a $4.3 billion fine to the U.S. government. After serving a four-month prison sentence, Mr. Zhao was pardoned by Mr. Trump last year. Binance also forged a business relationship with World Liberty Financial, the Trump family’s crypto company.” [1]
Yes. Move fast and break things and forget governance... Cryptocurrency has always been dumb. You either con people out of their money or you lose yours.
I had someone approach me in 2017 or so because he wanted to do a rugpull coin operation. I said I was busy and didn't help, but I'd probably be much richer (and a piece of shit human) if I got involved.
Keep in mind banks are NOW regulated but the regulations came After the bad event not before.
Regulations probably help but they basically serve to keep evolutionary memory in place in a corporate ecosystem where companies can spawn from nothing.
Bad banks no longer exist but regulations, after an extinction event, perhaps try to make that evolutionary event permanent.
At least that is my mental model.
Regulations are very lagging. And they should be understood to create moats and friction. There is no free lunch. Regulations purposefully shrink or destroy markets. That is how markets work.
Something I wish tech folks would absorb more.
If it's not frustrating and stupid, (to you at the time) it's probably not really a regulation.
This is a funny take on things, and untrue. But traditional finance is way safer and better controlled than the crypto frontier. Someone like coffeezilla has to rely on patreon and ad revenue to do the sort of journalism that exposes how debased cryptocurrency finance is. There should be much more money in exposing the fraud, but our premier capitalists are complicit in the fraud. They are fraudsters at heart, which is why they have the money and influence they do.
> Regulations purposefully shrink or destroy markets.
Sometimes maybe, but that's a matter of corruption. Regulatory capture has been used to create regulation that protects monopolies, duopolies, and the broader oligarchy for a very long time. When politicians were representatives of their voters, things worked better. Post-citizens united, the incentives are broken and we have a congress full of duplicitous, self-interested idiots.
this is a company where the founder and original CEO was sent to prison for facilitating illicit money transfers and not having proper financial controls...then Trump pardoned the founder....so a fraudulent company that lacks financial controls lost the GDP of Fiji without any sort of check on it....lets blame devops rofl.
In the United States, individual bank accounts are insured by the government to $250k per account. The overall risk profile is extremely low, regardless of whether a bank collapses or is subject to a security breach. The general assumption is that it would require the US government to collapse for your checking account to vanish, in which case you'd probably have larger problems to worry about.
If you live in Argentina, I sympathize and I take your point.
>In the United States, individual bank accounts are insured by the government to $250k per account.
>The general assumption is that it would require the US government to collapse for your checking account to vanish, in which case you'd probably have larger problems to worry about.
See USSR-Russia transition in 1990-1992 for example.
Accounts didn't vanish, but all people's money where used to cover the deficit
To be fair, it's not even playing ground, security-wise. There is no mechanisim by which a bank can be compromised this quickly and completely, much more of the transfer process is permissioned.
Crypto 'banks' need orders of magnitude more security and it's not a trivial problem.
A bank could be hacked but the protocol around transferring funds and the paper trail that follows it is significantly different than an irreversible transfer to anonymous hash ID. Crypto bros act like “it takes a day for those funds to actually move out of your account” is a bad thing, or a technical limitation, when in reality it’s to mitigate abuses like this
The heist itself only took 20 minutes, but the preparation is a business that has gone on for years. Much like a heist movie, the exciting bit is just the conclusion after a long build-up where Danny gets the gang together, plans it, and executes it.
> But maybe it wouldn't be that exciting to see some guys sitting at a desk.
Let me introduce you to the TV show Industry which takes you into the world of London high finance where tense phone calls, compliance violations and financial crimes are the order of the day [1]
Not sure why they do this, anyone has an idea? Like, the Internet is just there, I can go and watch porn whenever I like. If I am watching your show, it's because I am interested in something that is not porn. Also, if your show has a lot of these scenes, I can't watch in many places (ie: cafe, plane, with other people, etc..)
>
Not sure why they do this, anyone has an idea? Like, the Internet is just there, I can go and watch porn whenever I like.
It's HBO. They are known for this. But they definitely went too far with Industry in my opinion.
The sex and drug scenes are much more toned down in the latter two seasons. Part of the reason why is the cast had more leverage and strong armed the writers / directors.
Great show but definitely would be better with 90% of the sex / drug scenes removed.
This is like medical series about ER, in real life it doesn't happen. In real life nobody cares, things slip trough, people die, finally someone receives a huge bill.
I imagine it would look like a bunch of North Korean guys (probably not starving like their countrymen, but probably not looking great either) sitting in something like a cross between a NK state prison and an American office.
There's a very good BBC podcast about the north Korean and Russian hacking teams by BBC, one in Lazarus and one on evil Corp or something. Shoudnlt be hard to search for if interested.
Plenty to film/story to tell - Binance team freaking about the operation, the users who find out funds are gone, and the thieves living it up on the stolen money.
Well, no. The locksmith paradox is where a skilled person can walk up to a novel problem and quickly solve it, irking the customer who paid a large sum for the results. Here the thieves almost certainly didn't trip over the Binance vulnerability and solve it in 20 minutes; they planned and researched this task for a long time before executing.
If you want to get that narrow, then why not dismiss my comment by saying that they are not literal locksmiths? The locksmith paradox is about underestimating the expertise behind a quick result, and that expertise can include extensive preparation.
The locksmith paradox is about paying a lot for a small amount of apparent work, right?
The paradox is resolved by considering the expertise, which took a long time and much effort to acquire.
With the heist, the analogous paradox is somewhat weakened. There is hidden effort, but it’s highly specific to the actual target task.
With the locksmith, the hidden work is done on entirely separate tasks and so on, which happen to provide the necessary skills for the current target task.
Interesting, when the Cryptsy founder stole millions via laundering coins in Coinbase exchange, the government, FBI, and CIA did jack sh!t to recover the lost funds!
He is still in China living with his girlfriend.
Miami, Florida – A 17-count indictment was unsealed in federal court in Miami, Florida charging Paul E. Vernon, 48, the founder, operator, and Chief Executive Officer (CEO) of Project Investors Inc., doing business as Cryptsy
An extradition treaty is just a formalized process for extradition, it doesn’t prevent countries from extraditing someone when they want to. China doesn’t extradite Chinese nationals as a matter of principle, but they’ll extradite other people to the US if it’s politically expedient.
China absolutely could do something if they wanted to. No treaty just means they aren't obligated to "do something", not that they can't. For example, if the US wanted to reinstate the $800 no tariff policy in exchange for Vernon, I guarantee you they'd arrest him and turn him over.
I can't find any reference to Vernon's citizenship, ie if he is a Chinese citizen or not. Which would change the math.
That was a huge difficult process for Canada to get them back. The US isn't going to waste that sort of diplomatic currency just to arrest a medium tier white collar criminal. They will wait it out to see if he ever tries to leave and nab him.
Absolutely. It would be insane for the US to offer my specific example. I'm just making the point that China (and Russia, but I didn't give an example) can do something. Their hands aren't tied.
Kinda wrong. The US and Russia have had a Mutual Legal Assistance Treaty since 2002 and the US and China have a similar agreement dating back to 2001.
Just recently, the US and China had repatriated fugitives to each other, despite having no extradition treaty. No extradition treaty does not mean transferring suspects is impossible.
The short duration of this crypto hack isn't particularly noteworthy. Of course it takes time to find or design the exploit, but execution is typically very quick for such events
I disagree. Assuming the start of the timer is when they first encountered Binance systems they moved very quickly to make the transfers. It suggests to me either some or all of this was automated or they had prepared in advance with some inside knowledge of Binance architecture.
>they had prepared in advance with some inside knowledge of Binance architecture
That is a safe bet 92% of the time, but they rushed getting the stolen coins into a tumbler service. The kind of people that do business in bitcoin, are not the class of folks you want finding these thieves first.
Yet, picking politically attractive proxy-scapegoats is a classic pro move. =3
They passed 6 billion through a tumbler service?? Like what bitcoin fog used to do, back in the day? You’d think a tumbler service would just exit scam with that kinda money.
Also I thought tumblers didn’t work anymore? Didn’t they figure out how to trace btc anyway?
In fact it would be far more interesting if it happened over the course of hours/days/months, because that would be an indication that they managed to remain undetected for a long period of time.
That's unlikely because Cursor (and VS Code) enforce a 12h delay for all extension updates by default. Malicious extension was only live for 11h so you shouldn't be affected unless you reduced it.
The supply chain attack had a software bug which raised error messages that were discovered by a security vendor. I don't think those people have the skills needed to elevate their initial access to a full binance compromise within a few hours.
In any case running an agent framework in anything but a strict environment like openshell or a VM with a non rooted container and with a firewall out side of that containment is the definition of stupidity.
And if you ingest patches in seconds, you now have an issue of checking that the patch is not poisonous. Many a modern outage comes from changes deployed too fast. Damned if you do, damned if you don't.
if a CVE drops at 23pm, attackers have at least 8 hours before someone in the office has a possibility to take a look at it. nowadays, that seems to be plenty.
I think "good security/engineering practices" still has a chance.
Things like--
* Minimizing attack surfaces by not running lots of software on the same server and not bloating feature sets beyond the minimum
* Limiting access so that most things can't be done by most users, there are *no* super-users, and escalating access is temporary ans requires multiple accounts to authorize
* Encrypting data at rest
All software has flaws and it's now easier than ever to find and exploit them, but this disproportionately hurts people who were only putting on a show of security and relying on a single layer or two of defense instead of developing a robust insider threat model (which helps with both insider threats and threats that get inside) and defense in depth.
Full zero trust internally. Both inbound and outbound proxies (different machines) to carefully limit access, and provide a place to mitigate attacks. Etc.
If your plan is to quickly apply upstream patches, your plan is bad.
I try so hard for this, but don't even get approval to change an internal site to use https instead of http.
I get we gotta keep the new features and workflows coming, but a single resource dedicated to low hanging fruit of security could fix a lot in a very short time.
It requires management buy-in, both to allow some number of engineers to be allocated to such "non-production" work, and also to allow the friction security creates to continue to exist and "slow down" the "real work", both by vetoing things that would weaken security and by forcing everyone to use more cumbersome workflows.
That usually doesn't happen unless the company has suffered a large financial or reputational loss as a result of poor security practices. Sometimes not even then, if the company doesn't get scared they'll start losing money or get in some sort of legal trouble.
Completely agree there is lots you can do to shut down exposed surface area.
Is encrypting data at rest useful when the app must have access to decrypt the data? What sort of scenarios do you use it for and where do the keys live?
Have on-call sysadmins or have them work in a three-shift schedule. That way there's always someone there to fix stuff as it happens, including deploying security patches or worst case taking affected systems offline until they can be patched
This used to be common before devops and cloud took over. Looks like it might make a comeback. Maybe with a new fancier job title
There's a really simple solution that people will hate: server goes offline at night.
I've seen this a few times, and it's pretty annoying as a user, but ultimately it's not that bad usually. If you are ordering something at 3am, the physical shipment still occurs during daylight hours. Many banking operations are not actually instantaneous, they settle in a batch job overnight.
And this doesn't have to be binary. Providing a read-only interface provides lots of value while having a reduced attack surface.
You can have guardrails and still ask for approval. There is a difference between a guy who just has to approve a CVE fix and someone that has to take the time to understand what's going on, etc.
Yeah. There's a huge difference between how a 5-10 person start up or a 50-100 person business can handle this, compared to a tech giant or hyperscaler who's already got 1000 engineers in a dozen or more timezones.
It's easy, if you already have teams in the US, UK, India, and Australia - it's always normal office hours in one of those location.
When seconds matter, it is impossible to patch if you haven't patched already. If you need to patch, or attempt to contain against an adversary who is prepared and sophisticated enough to succeed within minutes, you've already lost. Defenders need to win every time. Offense only needs to win once.
That's totally on me. I should have asked you before shutting down the subagents. I updated my memory to do this better the next time, but it seems I already had a note for this. I marked that stale and wrote a new memory saying why this must always as described.
Not saying this is the case, but the way this unfolded, and announcement reminded me of the crypto scams that were popular a few years ago (ponzy schemes), with the final rug-pull being "oh no, our platform was hacked, all your funds were lost, sorry!", i.e. "coscoin"[0][1] I know this is not the case here, but the way they announce the hack is funnily similar to how those fake platforms did their final announcement.
according to Binance's own account so far, the first statement said it “may involve a compromised DevOps engineer’s laptop” that gave the attacker access to a service container to submit withdrawals. then on Friday, Richard Teng said the attacker “did not simply use one engineer’s permissions”, that they’d found additional points of breach, and malware built to destroy itself and its traces.
they also say there’s no evidence any private key leaked yet their own signing system signed the transfers.
That doesnt mean the key leaked - its likely in an HSM for example, but there is an API to get it to sign stuff. Access to use keys is less bad in many ways than leaking keys, but still pretty useful.
I see a lot of focus on the "how" this happened, big deal.
Computer security is a farce.
Let's address the elephant. I find the accused to be very unlikely.
20 minutes?! $6.3B?!
Their APT groups have been classified as advanced but not elite, this suggests a huge jump for their groups.
"There will be signs".
There should be an influx of purchases right? Or at least a large number of imports perhaps through shell companies to further obscure the sources as this nation.
Based on what I am told and read about this nation they are poor, can't afford to feed their people, etc., etc. Additionally, the quality of education is reported to be low due to the isolation.
Where are the shipments into the country and where does that money lead? Until these signs occur I am skeptical.
That kind of money is what the FBI, Interpol and other investigators specialize in right?
I don't participate in any digital currency, but if I did I would think a worldwide investigation with collaboration amongst these agencies would be in order.
> There should be an influx of purchases right?
In general, I appreciate this rare and thoughtful comment.
Let's ask: Which nations are the best in cybersecurity?
France, China, USA, Israel is what comes to my mind.
I'm not sure if there's any other country with highly advanced cyber units.
Usually Israel is the one with the most advanced defense technologies.
These seem dated, >5 years, but don't seem to indicate a level of sophistication needed for the heist.
The reports do touch on laundering the coins, but that still wouldn't excuse the "there will be signs" related to a large influx of monetary resources right?
I think even using AI agent under sophisticated op-sec and the required compute and resources and expertise don't exist in NK to pull of this heist. It requires a sophistication that North Korea's simply isn't able to provide even the education for.
Even with advanced agent frameworks, this level of attack is beyond their capabilities. Stuxnet level sophistication was shown to be only possible for Israel and the USA in co-operation.
But why would a nation like the USA attack a company whose CEO they have just pardoned and that endorses crypto and crypto-stocks that much as of now?
Israel on the contrary needs new artillery and money to support their wars to be continued. The offensives they want to continue against all their neighbors cost a lot of money. But I want to be careful here, since there's proof required. The question now is howto follow the money? I think we need our hacker friends to watch the money-flow: Jim Browning, Pierogi/Scammer Payback, Ryan Montgomery/Zero Day. Curious who else would be best to doxx and find out the truth.
Dude, I'm german, that's so far stretched, it's more realistic you're sponsored, as I'm not hiding behind a new account. Also it's just deductions from knowns, nothing far stretched. Why be so sensitive about Israel? I don't care if Quatar, Saudi or whatever country is the actual Hacker behind, as long as it's evident and meaningful to catch them inflagranti.
Absoluter Humbug mein Freund.
> Israel has lasting peace with half its neighbours.
Ok, funny I just met an Isreali in person yesterday and he said they are in war. He's from Tel Aviv, guess a first hand source is more trustable than an anon defending israel and claiming they're in peace..
The conclusions made prior by OP are thoughtful and it strictly makes North Korea quite implausible as the "Binance Hacker". Leaves us with Isreal. Saudi and Quatar are so damn weak in Cybersec, I haven't even heard of any of those countries doing any meaningful operation ever in the media, but to be honest I don't follow what they do either.
I'm stunned that they had that much cryptocoin online to be stolen. Why didn't they put it in "cold storage" and only some information in the database which says how much each customer had?
OTOH I heard that the culprits didn't steal the private keys of the affected customers. If this is true the stolen cryptocoins are worthless.
Each customer's funds aren't keep in individual wallets. It's pooled into a wallet controlled by the exchange.
Exchanges do put most of the assets in a cold storage. Binance has $155B in assets and handles $14B of trade volume in 24 hours so not all of it are in a cold storage.
> OTOH I heard that the culprits didn't steal the private keys of the affected customers. If this is true the stolen cryptocoins are worthless.
You’re misunderstanding where these coins were taken from/are now. Of course they did not get access to customer private keys, because in an exchange there isn’t really such a thing. You’re trusting the exchange to hold the coins for you, and they get put into a shared wallet that they manage with the exchange’s key.
Even if they did not have access to the exchange’s private keys and only got access to some API that let them execute the transfers, it doesn’t matter anyway, as the attackers transferred the coins into new addresses with keys controlled by them, so they’re free to move them now.
…well, mostly, the stolen USDC and USDT coins got frozen by the issuers, but those are not really decentralized as much as they are built on top of decentralized infrastructure.
AFAIK they gained access to a DevOps guy's laptop with too many privileges and just made a bunch of withdrawals into their own wallets, so they have their keys.
The only hope is that most of it gets frozen in some way or another, but if even only 1% gets through they'll still have made about $65M
Most exchanges don't use a single wallet per user, but have a small pool of wallets that all their customers share, and they just do the bookkeeping of the balances of each account. That lets them group many transactions together into a single larger transaction, or avoid a transaction entirely if it's between two users on their exchange.
So that pool of wallets that stores all their customers funds needs to be managed by the exchange somehow, meaning there's going to be some sysadmins/devs/etc that have access to parts of the system that deal with those wallets, and possibly also the keys to those wallets (which it looks like was the case here).
It's unlikely an engineer would have direct access to anything. That should be at least behind multisig. But you never know, people do dumb shit and there might have been critical private keys mounted in some random container from a subsystem made 6 years ago that was never replaced or tracked because it never made noise.
I don't work at Binance, but having been in that exact situation (SRE @ Crypto company with lots of assets, attacked by North Koreans), I'm guessing DevOps guy gave access to some CI/CD, `kubectl exec` what have you which allowed attackers to play with APIs, some settlement mechanic, some smart contract update pipeline. You don't really have to attack wallets if something less secure controls them.
This really could stem from nothing, excessive permissions in a GitHub token can go very leveraged properly.
It's so crazy. As a user, you need to triple authenticate with all sorts of gates to withdraw money but here's a dev guy who can just magically, without any secondary authorizations (as far as I can tell), transfer billions. No devops/sys admin should have access to live wallets with real funds
Its more possible devops guys had access to something like AWS secrets or API tokens or some tool that generates API tokens or access to CI/CD which could grab access to one of the above
1) The coins belonged to customers, but were in Binance wallets (thus under control of Binance) - that's how exchanges work. You send them your coins, then you can trade.
2) You can't freeze Bitcoin transactions (well, the crypto bros running it could if their majority wanted to, but they don't want to), but some of the stolen coins were stablecoins like USDT and USDC.
And fiat-backed stablecoins are ipso facto centralised (someone needs to 1) take receipt of fiat and issue coins against that, 2) custody that fiat and hold on to it reliably, and 3) return the fiat when given back the coins). You can then with the private key send the coins back to the issuer, but the issuer can refuse to give you the fiat.
However, many stable coin smart contracts are even more powerful: they give the issuer an authorized control account that can add a wallet address to a blacklist. The contract checks that list whenever someone tries to move the token; if the address is blocked, it rejects the transfer. Then the balance can’t be moved.
There’s a small difference: USDC blocks transfers both to and from a blacklisted address. USDT generally blocks the address from sending USDT, though it may still receive USDT. Tether’s contract also has a separate function that can destroy tokens held at a blacklisted address; that is distinct from simply freezing them. Note that when they destroy tokens, Tether keeps the cash - so it's a transfer from the criminals (or whoever held the tokens) to Tether. (Tether can then re-issue the coins and hand them back to law enforcement or the victim, but that's a separate step.)
Lol, the title is so misleading. As more information is coming out, if the Cursor Claude extension really is the culprit here, these attack must have been in the works for god knows how long.
This level of targeting is really only something that nation state actors can pull off, who are also protected from actual law enforcement prosecution. Unless attackers are really in North Korea, they would 100% be caught within just few days.
Estimates are that over the past few years, more than a third of the DPRK's foreign exchange income came from crypto. The legal exports were less than $0.5 bn, the rest is from more murky sources, including $1-2bn of crypto hacks in recent years.
Reminds me of the time NK tried to steal 1bn from the new NY Federal Reserve Bank: https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery -- they only managed to steal 80mm due to human intervention from a single employee of pan asia bank
They were stealing from the Bangladesh Central Bank by gaining access the the Swift system terminal and that 80million is still getting chased down in the Philippines
Binance is probably worth at the very least $30 bil. They can get a loan to cover withdrawals if they need to. Crypto hedge funds would love to because a binance collapse is bad for everyone who is long crypto
I have absolutely no insight into their financials, but yeah, their incentives point entirely to saying the funds are safe, regardless of if they actually are or not. Either they are indeed safe, and it eases panic, or Binance folds, and lying didn't matter. It's do or die for them right now.
Right, but the flipside is that a lot of people also go "look how much money they're making, they couldn't possibly go bust". Whole lotta people said that about Mt. Gox, FTX, Gemini, etc. Making a ton of money doesn't prevent you from doing dumb things with it and having no liquidity when the reaper comes.
How is it possible that Binance doesn't have a system that disallows massive simultaneous withdrawals without some kind of two-key manual override or something?
As a former crypto proponent, after ~17 years I think we have to have a real discussion about the value crypto does or doesn't bring to the world.
Sure, it let's some people keep their savings safe from dictatorial countries. But it also fuels other dictators that are doing pretty nasty stuff to their own people. And crypto is facilitating that.
I am a regular guy but I just never understood the point of Crypto other than for scams and get rich quick schemes. Not to mention it still is tied to the dollar for value which defeats the entire purpose doesn't it ? I thought it was supposed to be an independent currency. And then you have companies like coinbase which are centralizing something that was supposed to be decentralized ? I just don't get it.
The decentralised mode never interested general public, even though it was mildly interesting as an idea to skip hierarchical trust. The established use of crypto is exclusively money laundering and investment scams, made usable for general public though use of centralised exchanges. The crypto isn’t important, it is just an excuse.
You are not wrong that secret ingredient is crime, but I think the single largest use of crypto out there is tax evasion. When traveling Asia in 2025 I've met several people who worked for western companies and got paid in tether. Western companies pay flat consulting that avoids payroll taxes / etc and employees skip taxation from whatever country they are in. On the trading side we have ETH wrapping everything and enabling trading of most financial assets.
Yea I just don't see any real benefit and it has been almost 20 years. This is why I immediately lose respect for anyone who still peddles crypto even though there were some well meaningful people in early days.
People in countries with crazy inflation can use usdc wallets to avoid the inflation. Plus pay for US goods like a Netflix subscription without losing 30% on the exchange.
Well as I got older I understood that what anarchy-libertarians are saying is not what they think.
When I was younger I thought they really are against hierarchy and that society should be equal in all aspects.
But as it turns out, they are against current hierarchy as they don’t have much to say in this setup. But once they would get to be “in” and calling shots that’s where their world views change.
Off the street you better have narcan ready. You'll still get dangerous stuff in pressies but last I read (old and sober these days) there is a glut of cheap high quality product when you get closer to the source. Supply path optimization ;0
My wealth may be decentralized, but my body is in one location and pretty vulnerable to the 5 dollar wrench. Putting some emergency money in a foreign bank account and a bag is a much better option if I wanted to flee a country.
these randoms assuming foreign banks accept every human is really funny, enjoy your bubble and ignorance. There are normal people that cant even have a bank account in their homeland.
> these randoms assuming foreign banks accept every human is really funny,
Did I imply that? Creating a bank account in my country is an adventure on its own. If I got 50 USD in my wallet, I can exchange it somewhere and pay for food and whatever. My crypto account requires a computer, an internet connection, and someone willing to take it (no one around here).
By giving cash to a shady backstreet exchange guy? Or maybe using a payment kiosk to top up a mobile phone / whatever other service the P2P seller can get the money out of.
But more likely scenario is they have friends who let them use their bank accounts (but don’t have friends who let them use their good overseas bank accounts, so not that useful).
Crypto was originally born during the Great Financial Crisis. It's not surprising that the idea of: "Hey, wouldn't it be neat if we didn't need any of that," seemed attractive back then, even though that is obviously far too simplistic a view of what the financial system actually does.
But the end result is that crypto currencies never really delivered on their promise, because they barely work in practice, and the only reason to engage with them is for gambling or crime. Anything else is just too slow, too expensive, too cumbersome, too error-prone, and just generally far too inconvenient. What's the point of a digital currency that is best stored on an air-gapped device that must never connect to any network?
The Bitcoin genesis block literally contains the message:
> The Times 03/Jan/2009 Chancellor on brink of second bailout for banks
I would've thought the implication was kind of obvious? And I'm not sure why you mention Dodd-Frank -- there were many bailouts throughout 2007-2010 and the point of Dodd-Frank was to put an end to that scheme.
At least initially, much of the "point" was to bypass Chinese currency controls. Buy mining hardware and electricity in yuan funny money. Mine cryptocurrency. Sell it for real fiat currency. Buy real estate in Vancouver.
It was easier than that. There was a premium for Bitcoin in China and South Korea (the "kimchi premium") for quite some time due to capital controls. People in those countries would buy Bitcoin domestically (driving up the price there), send them to exchanges abroad, and sell them there, thus having taken their money out.
If you wanted to run the arbitrage, you'd buy Bitcoin cheap abroad, send them to China or Korea, sell them expensive, and now you're stuck with fiat in China or Korea which you can't take out, either. BitMEX founder Arthur Hayes was closing the loop in the early days by frequently crossing the border from China to Hong Kong with a backpack full of cash. SBF and Alameda claimed to have made their early money similarly by finding a way to close the loop on the kimchi premium.
I’ve always shared this skepticism. First, crypto can be a poor store of value when its price is highly volatile and most goods and services are still priced in currencies like the U.S. dollar. Second, some crypto networks can make transfers slow or expensive, which limits their usefulness for everyday transactions. That said, it varies by asset and network—some are designed to make transfers faster or cheaper.
I’m also uneasy about the investment case. When you own crypto, you have a reason to want others to buy it too. That can create a cycle where demand pushes the price up, and the rising price attracts more buyers. That happens in other markets too, but productive businesses can also generate revenue and cash flow that help support their value. Many crypto assets don’t have that same kind of foundation, although some are tied to specific services or network activity.
Regular currencies have a more obvious role in everyday life (pay taxes, settle debts, and buy things). Their value is influenced by factors like monetary policy, confidence in the issuer, and the strength of the underlying economy. That doesn’t make them stable or valuable in the same way as productive assets, but it does give them a practical purpose that many crypto assets don’t have.
Crypto was more fun back in the day imho. I remember Bitcoin pre-fork. I bought some in 2016 and was using it to buy stuff online from overstock. It was kinda fun and different, you got discounts and at the time Bitcoin was going up so it was cool to spend money and then see balance increase. I also used Bitcoin ATM back then when I was in the pitch. These days I don't really care much for it.
Gray-market operations usually use crypto for transactions, e.g. distributors of estradiol for trans HRT. Gray market is cheap and doesn't depend on the political climate. Quality control is a problem, though.
I realize the morality of such a thing is subjective, so I'll just say that I've known a number of individuals, especially minors, who have relied on gray market sources.
You missed the point. It is tied to an actual fiat currency. That was my point. USD/GBP etc etc. Again, 9/10 people who are "cypto investors" wouldnt care unless they could cash the crypto for real fiat money.
No, you missed the point. It's obviously exchangeable for other fiat currency but it's also obviously not tied to any of them or its value would be fixed.
I think you're just using words that you don't really understand. Do you know what a tied currency actually is? They do exist. Do you know what they are?
I know what’s going to happen. I will explain what crypto is for and then it will get downvoted just because it says anything positive about crypto.
The point is to NOT have a single place with access to all the money, votes, etc. Every participant should be acting as themselves, and there should be no way to do things on behalf of others without their consent.
The point of smart contracts is to have code you can actually trust. Your bank or openAI can change their website, APIs and even their models tomorrow. That’s not great for trust. Trust is what enables things to scale.
The same way you trust other internet protocols to just “route around problems” and not have one single point of failure, that is the substrate for Web3.
Imagine a Web2 website such as a student-teacher marketplace NOT handling millions of dollars, accepting money from students and paying them out to teachers. Imagine it being simply an interface while the actual transactions are approved by the students themselves, and instead of the central site signing payouts with some keys, the teachers get paid through smart contracts and code on the blockchain. The site can still take 10% commission from everything, it would be above board, and it can never change it without the consent of the people. The business logic is in the smart contract.
(Since this comment has the keywords “crypto” and “web3”, I know what will happen in advance already.)
Isn't this incident a case study in how immutable smart contracts are exactly what you don't want in a trustworthy financial system?
The stolen USDT will likely be returned because Tether can do manual freezes like a traditional financial institution.
Where code is law the funds are just gone.
Like even in your example of the marketplace I don't see the benefits over having a central authority. Who determines who is a student or teacher? Who kicks out bad actors? Who resolves disputed transactions?
You misunderstand. The very reason that this Binance hack is a huge issue is that $5B was concentrated in specific wallets under specific keys.
A decentralized network of wallets and balances doesn’t present an attractive target for hackers specifically because the payoff per wallet is so small!
It is exactly the centralization you are defending, which is at the root of the problem. In the decentralized case, no one has to determine who is a student or a teacher. If a teacher needs to pass KYC with a marketplace, they do it once, and from then on can permissionlessly receive their small payouts.
Centralization (on Binance) made the attack appealing, but decentralization (of crypto broadly) is the only reason it's possible, and centralization (of USDT et al) is the only path to recovery.
Re: the marketplace: we'd want to be able to revoke teacher access too, and sometimes we may need to roll back transactions (Goods not delivered? Wrong goods delivered? Wrong goods purchased?), and then I have to ask... why involve a blockchain at all?
The only compelling real world use case I've seen is helping people navigate hostile governments or dysfunctional economies.
The number of scams perpetrated against traditional bank account holders doesn't seem to support the suggestion that scammers aren't interested in regular person-sized targets.
Yes, but as someone who worked in the cryptocurrency industry for a few years: that's not how it actually works. Smart contracts have bugs, it isn't peer to peer so someone has to run and pay for big servers, humans are sometimes criminals or Faustian bargain takers.
I miss the old days of decentralized networks, and smart contracts that were audited. Forget the shitcoin memecoins and zero sum games mania, the NFTs and the prediction markets. There is so much positive sum that can be done:
I broadly understand this as the utopian vision of what crypto could theoretically be, but it's not playing out this way in the real world and I have a hard time seeing it ever succeeding this way.
Being able to leverage crypto on this scale requires everyone to either A) be technical enough to understand and use smart contracts directly or B) delegate a party that handles this for you. This is where the utopian case usually falls apart, because most people are B and this requires trusting a third party, which kinda defeats the entire point of the vision.
Because most people don't want to do the work of learning and managing crypto directly, a huge industry flourished to service these people, full of its own interests, corruption and various levels of criminality. And well-intentioned crypto people have no way to reign this industry in because the entire point is to operate in a deregulated way.
Ironically, the piece that makes crypto fundamentally unworkable 20 years in is capitalism.
Once upon a time, pancakeswap staking stole my money. The conditions under which they'd steal my money were spelled out in clear in the code but not mentioned anywhere on the web app.
Specifically, you had to claim your rewards in a certain time window or they'd disappear.
Maybe for people who have the means to afford LLMs, but then who really wants that? That's a hard pass for me and I use LLMs every day. I suspect that asking society to trust in a digital middle-man between themselves and their money will be a very hard sell.
Indeed, very shortly after live smart contracts were introduced, someone exploited a bug to steal a pile of pseudo-money, and the humans in charge decided to fork the blockchain to undo it. So the whole idea of “autonomous” smart contracts was revealed as the nonsense it always was. (Actually IIRC only some of the humans agreed to do that, so the chain was duplicated, and what does that even mean from a currency perspective?)
Indeed, very shortly since digital computers were invented, there was corruption. For years, until the voltage could be controlled better and until IEEE standardized things.
Indeed, very shortly since modems were invented, there was need for error correction. They were slow and clunky. The only reasonable conclusion is that the Internet is a fad and not worth discussing. Same as this newfangled decentralized cryptography stuff.
Indeed, very shortly after the Web came out, regular script kiddies could write php websites with blink tags. Credit card numbers were sent in the clear with http. This “e-commerce” thing was a dangerous joke, only idiots would send their credit cards over the Internet. It would never catch on!
That is a very naive take. First, the trust in crypto is extraordinarily expensive, as Budish's famous "The economic limits of Bitcoin" paper shows.
Second, the crypto bros running Bitcoin have reverted 20+ blocks on at least two occasions when it suited them to do so, and Ethereum has famously undone the DAO hack. Oh, and then of course you have all the bugs in smart contracts that can't be fixed. So the notion that "code is law" is laughable, and the notion that it's desirable is misguided, too.
Third, there's the oracle problem. Keeping track of bits in a ledger is a solved problem and has been a solved problem for a long time. The issue is correlating it with the real world. In your example, what if the student pays, then the teacher doesn't teach? How is the money flow reverted? If the student can just revert it, what happens if the student pays, the teacher teaches, and the student then reverts the payment? You need the legal system, and external adjudication, one way or the other.
Crypto adds nothing but idle speculation and the circumvention of (largely sensible) rules and regulations.
The argument for crypto is that all other methods of exchange have an arbitor that can use their arbitration powers to their own advantage.
There are defenses of traditional currencies that don't hold up to scrutiny, for instance the intrinsic value of gold is way lower than it's traded value. The ability to pay taxes in a currency is only valid while the arbitor allows it to be.
The Blockchain is an impressive design to allow multiple arbitors where you can't know in advance who it is going to be so no single actor can act in advance of that knowledge nor act as if they had sustained control.
The public record combined with an international Comms network means noone is disallowed.
So the good parts are, 1. a mechanism where everyone can use it. 2. No one actor can control monetary policy.
The bad parts are, 1. Uses a lot of power (but less than often reported) 2. lack of understanding and unrealistic expectations allow fraudsters to exploit people.
It is not a stick-it-to-the-man scheme, nor is it a way to perpetually make wealth (it can create and lose wealth over varying time frames but only by guessing how people in the future will value it compared to today)
The dangers of theft of a scale like this are an artifact of there being no single arbitor saying "no you can't do that" there is actually a solution to this, but it is not really being done. It is designed to have no do single arbitor, but if you have a majority of people reaching a consensus on any issue the entire system can change rules to any paradigm they wished. You could theoretically have a majority agree to reverse all of the digits in everyone's balance and then update the system to make it so.
To prevent cases like these huge heists you could have a majority consensus to support an independent regulator that makes decisions that can involve arbitrary changes to balances. While there is a majority consensus to agree with the rulings of that regulator they could adjudicate cases like this. If the regulator started acting in the interests of any particular party that consensus would be lost and miners who disagree would not incorporate their rulings into the chain.
I think there is potential for there to be a better system there. It would likely involve governments becoming miners (or at the very least having some influence on the miners in their duristiction)
I don't think there is enough public opinion in support of doing that though.
Tldr; I can see a way in which it works, but we are not there. We might get there over a long duration (if crypto does not go away for another few decades). To get there quickly would require significant changes in public perception.
But, what I liked about the idea of crypto is for the many poor and weaker countries that realistically can't afford to float their own currency in a stable way.
Many countries have never-ending sliding currencies or highly volatile currencies. And the locals don't have a lot of choice but to hold the local currency and watch their hard-earned savings evaporate.
Or worse they can't even do business with other countries because their banking system is highly restricted (because of maybe illegal activity taking place in the country by a minority or their local government being out of favor with the rest of the world) and that prevents legitimate businesses from easily transacting.
There are so many countries in which the national currency is a daily nightmare. And individuals in those countries that are unbanked.
Crypto in the rich industrialized countries never really made sense to me. And even less so as an asset for speculation.
In rich countries, I think it's more for those who are of the criminal or conspiracy theorist variety.
Further, in the rich, industrialized countries, the ability to have a stable national currency and a national currency that is easy to transact with around the world is taken for granted.
And, for those poor weaker countries, dollar access is weaponized as we've seen in many cases. Even if a country is wealthy enough to hold significant dollar deposits, those can be frozen at any time.
In fact even within a country that wants to use the international banking system, that country's access can be frozen at any time, at the stroke of a pen, by a government far away.
And it's naive to believe that this power is consistently used in a just manner.
North Korea is a case in point regarding the value of crypto for a poor or sidelined country.
I won't get into a debate regarding whether that's a good thing or bad thing in the case of North Korea, but it does illustrate why crypto has value for countries that are extremely poor and lack access to global finance. It's not always because the country is run by an evil dictator.
Sometimes it's because the country is just run by an incompetent government.
And in an increasingly hostile world with increasing great power rivalry, crypto has usefulness for countries that want to stay out of the crossfire and transact business without having to kowtow (become subservient) to one of the great powers just to transact payments.
But yeah crypto in the industrialized world is mostly for speculators, conspiracy theorists, and criminals. That I agree with. But I do think crypto has a powerful use case in a lot of the world where the payment system isn't as developed and isn't as well integrated into global finance.
The has been a clear increased in payment processors ( be it Visa/Mastercard/Paypal/... ) that blocking payment access to websits.
These may be perfectly legal (example xxx sites), gray at worst (like anime websites). Some anime site that had (for example) paypal for over 15+ years. Plop ... gone.
Crypto has become become the alternative payment method for those sites. So its not "dictators that are doing pretty nasty stuff" but a ton of sites and services that can be affected.
Ironically, there has been a lot of focus also in Europe regarding this issue, as much of the internet payment processors are in or linked to the US. With the focus to get a alternative to Visa/Mastercard going.
The reality is that a lot of power regarding payment processing is in the hands off one country, that has a lot of large companies with interests/powers to dictate over the entire world, what is and is not allowed. And crypto has becomes a necessary evil. In a ideal world we do not need crypto as payment processors are neutral or at minimum have very stronger requirements to kick off clients. But the reality is different...
How can you trust it? Like how does it resolve if I got my Weird Al toupee from eBay? Is it if someone shipped me a box? Smart contracts make sense when there's a large, public event.
When I tried to use the deepseek api all my cards got declined. "Oh great" I thought "finally a use for my last $10 of crypto." But they dont accept crypto. Instead they want me to transfer money into a paypal account which takes a week.
I think crypto lead in 99% of cases just to bad actors and use-cases, I still have to encounter one real success story of someone using crypto successfully long-term or to pay for legit, legal stuff where a different method was not allowed due to unfair restrictions.
I think one of the primary motivations for cryptocurrency was that legal ≠ moral. Therefore, I think cryptocurrency's best use cases are all explicitly illegal.
For example, you can donate to Sci-Hub with cryptocurrency. Sci-Hub has an ideological mission which is widely supported, but it runs afoul of copyright law and is illegal in nearly every country and sanctioned in many. You cannot donate to Sci-Hub with fiat currency.
Unfortunately, I agree that in practice >99% of cryptocurrency's use is for scams.
I fully believe it and it reads as extremely plausible. I'm less trying to cast down on the claim and more trying to hedge my authority on this subject.
I don't know, whenever I have to send money to friends, it's free and transferred instantly (Tikkie).
Whener I tried to send Crypto, there were fees over fees, from wallets, transfer fees, etc., probably I was doing something wrong, but that was the most frictionless path
I don't know the details of Tikkie, but likely the money is moving slowly through the clearing house networks and each party is assuming a small amount of risk on each hop to make it appear instant.
On the other hand, sending USDC actually moves the money for real, albeit, not totally free.
The real value in crypto is for storing black market currency. Before, it had to be stored in cash where it could be stolen by other criminals or confiscated by law enforcement. (Watch Narcos if you want to see a pretty good dramatization of how Pablo Escobar buried his money in caches around Colombia.) If Bitcoin was around at the time, Escobar certainly would have used that instead.
It does have speculative value, as well, but I suspect that if you subtract speculative investments, the remaining total market cap of crypto is the value of criminal profit.
I doubt Escobar would use Bitcoins to store funds. They are traceable and are too volatile to store illicit gains. But to carry transaction he would use them on massive scale surely. Cash is sort of the opposite. Not very convenient to carry big illicit transactions but as a store of value it is a way better thing.
Maybe not Bitcoin in particular, but other cryptocurrencies might do. Consider that for a very long time (and possibly still), ransomware attackers were demanding payment in Bitcoin, so these traceability considerations might not be as dissuasive as you might believe.
Bitcoin’s price volatility also seems no worse than the possibility of losses of cash due to theft.
For ransoms bitcoins are still transactional. There are sort-of black market exchanges that can exchange bitcoins from blacklisted wallets into other assets or new bitcoins by taking a big cut like 30% percent or more. But with those there is always a risk that the operation would be discovered and all new wallets will be blacklisted. For transactional operations such risk is fine, but for store of value it is very bad.
But he could orchestrate a bunch of people to mint artistic NFTs that could be traded around a bit to enable him to make loads of money that he could cash out “legitimately”…
The value of it to me is that as money has got more digital, I feel that there is an incredible amount of tracking that previously did not exist in a primarily cash based society. It really isn't my bank or the government's business what I'm buying, or that I went to a casino, or that I went into an adult shop, or <insert sensitive purchase for your situation here>. Using cash more is another solution, but that's not feasible for most online services, and not all businesses accept cash any more. Maybe this is all paranoia, but you see data breaches all the time, and you see how so many industries mine data (and there really isn't much better data for advertising than your entire purchase history).
This is why I don't particularly support most cryptocurrencies, as they don't solve these issues and feel more like a horrific version of the stock market. Monero on the other hand does pretty decisively solve these issues, I can give you an address to send money to without giving out any other information, I can send money to you without my purchase history being public (unlike bitcoin), the transaction fees are very low (unlike bitcoin), the block time is quite low. It does feel like the perfect system for daily purchases if it would be embraced, which I am aware it won't be. The issue of no recourse for keys being compromised could be slightly mitigated by putting only limited amounts of money in the wallet at a time, although I do know this isn't ideal (but it's probably a cost for having actual privacy). I really don't get most cryptocurrencies though, bitcoin was a good POC but it's been surpassed in every way by now.
I just feel like I'm being forced to give up my privacy, and Monero (or similar) is a potential solution to this that doesn't give up the convenience of digital currency. I guess though I'm seeing it from the perspective of a daily payment system, rather than a savings system (I'd pretty much always prefer my savings in an actual bank with the protections therein).
Keeping an absolutely small amount of buffer in stablecoins and swapping it for monero for actual transactions is what I do or just keeping it in monero directly (and that is also because the act of moving the money out is harder and I just buy vps's/domains with it semi-anonymously)
You can just pay fiat to buy monero when you actually have use of it.
Aside from very few use-cases (like dictatorship cases for example) I just think that it doesn't make sense for people to invest life-saving investments for money within crypto perhaps.
I think that one can use crypto for its good sides (anonymous payments) without facing its downsides by buying crypto or just having an insanely small/small buffer and using it when needed rather than life-changing savings.
Except that, as far as I understand, crypto is only anonymous to the extent that getting a debit card under a fake name is anonymous. If someone is able to tie your wallet to you then all your transactions are immediately tied to you. Contrast that with cash: if someone figured out you made one transaction, it does not affect knowledge about other transactions.
So crypto is more like user-unknown rather than anonymous. I expect that normally these are about equivalent, but if you run into edge cases the difference could be catastrophic.
Monero actually does mitigate this, when you send money it creates a one time address (https://www.getmonero.org/resources/moneropedia/stealthaddre...), therefore payments cannot be traced to your wallet. When receiving money it's recommended you use different sub addresses (https://docs.getmonero.org/public-address/) for different purposes, so you can receive money from multiple places that cannot be correlated with each other. For someone to view incoming transactions for your wallet they'd need your private view key, to view outgoing transactions they'd need your private spend key, both of which are private .
You can still choose to generate a proof of transaction to give to someone, which proves that you did make one specific transaction.
Monero is genuinely a really interesting, and frankly ideal as far as I can tell for my purposes, cryptocurrency. It's a shame it's associated with crime because it solves all of my issues with spending digital currency from a privacy and practicality perspective.
I understand the sentiment, but as someone who had to use crypto because all other options weren’t available, I’d rather live in a world where it exists. (I do have different options now, but I still use USDT/USDC transfers when it’s cheaper.)
Without cryptocurrency, dictators and criminals would still be able to move money around, it would just be a bit harder for them. For ordinary people it’d be disproportionately harder and more expensive.
Don’t want to weigh in on the crypto debate; just your argument.
X enables good things but X also enables bad things.
Freedom of speech enables democracies, but it also enables mass manipulation.
By definition any freedom enables any possible action resulting from that freedom.
Note that this is not really the case with everything either. The same argument can’t be made (reasonably) about biological weapons for example.
IMO it’s very hard to make a proper argument pro or against crypto in lay terms. It will be a never ending argument. The fundamental is that of centralization vs decentralization and that’s a relevant reasoning despite of what the current incarnation of currencies and behaviors we’ve been seeing.
I think that public/permissionless crypto is going to remain a niche. It's clear that there are too many footguns and failure modes for the average user.
But I think private/permissioned chains will gain some adoption in the background of tradfi, especially for clearing and settlement, collateral management via tokenisation etc. Your bank might eventually use technology developed in crypto, but it'll be called 'distributed ledger technology' or 'tokenisation' rather than crypto because of the negative image.
If you need crypto to avoid the legal framework when transferring value, accept the risk and operate accordingly. If you want crypto exposure as an asset class, find a custodian who will hold the crypto for you offline, prove it is offline, and allow you to borrow or otherwise leverage it as an asset on fiat or capital market rails that provide you recourse. Anything else is pointing a gun at your feet.
Analogy is holding and trading gold underground that hasn't been mined yet using securities or other representation subject to capital market regulations and the legal framework. Is it an asset? Yes, if proven, documented, etc. Is it safe? Yes. Will you get your value back if the capital market representation of the underlying is stolen? Most likely (finra, sipc, etc).
But having live value on rails that enable instant movement globally with no recourse for unauthorized transfer? You're gonna have a bad time.
Cryptocurrencies give sovereignty over your own money... and all the bells and whistles that come with sovereignty: You're responsible for keeping your own funds, and life, safe.
Had it not been for crypto, there would be massive covert espionage on US information systems. Crypto has acted as a canary, leading to hackers exploiting those vulnerabilities in a very dramatic and public way. That has led to a massive hardening of networked computer systems, which has likely saved far more money, in prevention of corporate espionage, than has been lost through the crypto heists.
And that's just on the cybersecurity front. In terms of economic empowerment, reducing financial friction, enabling greater participation in commerce via stablecoins, it's been a massive boon. There would be totally law-abiding people right now who would have practically no international banking options if it were not for blockchains.
I think it's good that you have reached that point. Now, if you don't mind my asking (I'm curious):
Did it take 17 years for you to get there, or was it a while ago and you just say now that you were into crypto 17 years ago?
And I don't mean to be offending here: people routinely take years or decades on similar things. I have been observing that with climate change for 20 years now. And I see many many people who are still in that process. Actually I would argue that most people out there haven't reached the point where we can have the discussion, they seem to be in the "denial" phase still.
I feel that pairing a real scientific phenomenon (anthropogenic global warming) with political distaste for crypto is elevating a political argument to the same level as objective reality.
The “truth” of crypto being bad or good is not the same sort of truth space that anthropogenic climate change occupies and mixing them is actively detrimental for climate advocacy IMO.
I thought that the whole point of crypto was money laundering and tax evasion. Like, it's in cryptocurrency DNA, even if people try to squint and see legitimate use cases. Does anyone think otherwise?
I mean, that's what the big mean government does, they monitor financial transactions and they collect taxes. But when we talk about financial privacy from the prying eyes of the government as a goal, and let's suppose people actually use crypto like was dreamed, this necessarily implies crypto being a tool to launder money. (in practice, this is better realized by privacy coins like Monero and ZCash, since Bitcoin sucks for privacy: your address is an anonymous handle but the network leak metadata. But, the desire for financial privacy was there in the Bitcoin community since the beginning).
And what else people do when they can hide their money from the government? In a lot of cases, they don't pay taxes (which is also a disposition present in the Bitcoin community since the beginning, with a rhetoric like, collecting taxes are not legitimate)
What I think was a later development was the main use case for crypto in real world, which is to collect payment for ransomware and things like this. This, I don't think it's something the early Bitcoin community envisioned.
I don't know about that. What I know is that dictators and criminals have existed since forever and the official estimates put the part of the worldwide GDP tied to criminal activities to between 3% and 5%, which is gigantic.
I don't think Bitcoin is to be blamed for that. If we're worried about dictators and criminals, a good question to ask would be: why do those exists at all? (and that's irrelevant to Bitcoin)
Outside of being money for criminals, there is some value for investors. For them, it is a way for their portfolios to get exposure to the booming criminal economy.
Good. I also used to look at crypto with curiosity, but now think that
a) blockchain has no technological merit (given that permissioned systems already allowed for robust distributed consensus even in the presence of byzantine nodes back in the late 1990's).
b) the one innovation it brings (permissionlessness) is overwhelmingly negative (who really needs the "no gatekeeper" property?).
c) blockchain is good for nothing except crypto and crypto kittens (due to the oracle problem).
d) crypto is good for nothing except speculation and the circumvention of rules and regulations (which, like it or not, are mostly sensible).
Concretely for example on your point (it "let's some people keep their savings safe from dictatorial countries") - this would be trivial to offer for any bank using 1980's technology (offer an USD account just with username or password, no KYC), but it would also obviously be illegal and be shut down.
Making it harder to shut down - that's the one innovation crypto brings. But shutting it down is what we should be working towards.
While you were busy being a proponent of crypto's moral utility, I've been a proponent of its exploitation for over 10 years. To me, it's always of great utility.
I want to add that this isn't people stealing from other normal people. This is dictators stealing from normal people. So there are losses in both directions: normal people losing their money and dictators gaining money to do nefarious things to normal people.
It would be better if it was dictators stealing from dictators or normal people stealing from normal people, but it's not that at all.
The unbanked, like myself. People that for any reason is being locked out of the "american" way of doing things
Stripe doesn't cover 200 countries, nor does Apple Pay, Google Pay, Paypal, Visa, etc (all american btw). So a parallel banking system is needed, no questions about that, and Binance provides the best of all, and that's why it's being targeted by we know who (just follow the money)
Now, whether if it is crypto or not, I don't care, all I want is the possibility to pay and receive money (USD, EUR or CNY as the top currencies right now) without the draconian restrictions imposed by the hegemons trying to asphyxiate does who don't kneel
That's exactly why we need a parallel banking system, crypto or not
I live in a developing country, and our government has more control over cryptocurrency than you can think of. Just a few weeks ago, many bank accounts were frozen because the account holders were trading P2P on Binance (mind you, that's the only way to buy crypto in my country), and some were even charged with financial scams, money laundering, tax evasion, and other offenses.
So do cash, vehicles (they help transport kidnapped humans), smartphones and computers (they help criminals to communicate), tape, ropes (these are often used to tie victims)... and oxygen, because without it, the organized crime proponents wouldn't even have the cellular energy at all. Let's just forbid it all already!
I don't disagree, but the way you say that makes my eye twitch uncontrollably. So many of us have spent the better part of those 17 years trying to get the crypto proponents to have a real discussion about it.
> safe from dictatorial countries.
Yeah, that's definitely an argument. But it's kind of funny when the backdrop is that $6B was taken by North Korea.
It feels like a sibling to the popular attitudes towards not trusting big banks, or voting for <candidate> who demonstrably achieves the opposite of what you're seeking, or feeling that democracy ain't working out great, or that vaccines are scary and dangerous. There's just a fundamental lack of higher-order thinking. It's all vibe-based reasoning. What feels scary is what guides these behaviours. Which, I think, is why it's so unsurprising that people in these camps make such unbelievably strong candidates for exploitation.
One of the things I was forced to reckon with over the pandemic was that I'd spent my entire life with undiagnosed autism. Looking back, there were lots of warning signs but we know things now we didn't then. For example, up until the 2010s the medical consensus was you couldn't have ADHD and autism.
One of the ways this manifested was my ability to anticipate problems at work and poke holes in things. This made me incredibly unpopular. You never get thanked for this. Instead you get punished for being right too early. You are negative. You are a naysayer. You aren't a team player. And you were 100% correct and it didn't matter.
Back in 2012 I remember thinking "I don't see how crypto has any applications other than illegal stuff". And I stood by that. Note that morality and legality are two different things. Sending money to relatives in a country that disallows foreign currency transactions may be moral but it's still illegal.
What's frustrating is dealing with the same consequences of being right too early. It's muddied by true disruption. An example that was often brought up was Google. In the late 1990s, it was believed that search was a "solved" problem and there was no money in it. That's 100% true. But you can't ignore any criticism with "people once thought the world was round". It's a useless fallacy to deploy.
The absolutely dumbest people and outright scammers were attracted to crypto. A bunch of people who missed out on Bitcon's meteoric rise didn't want to miss the next meteor or they simply wanted to rug pull before they themselves got rug pulled.
The financial system is an endless series of Chesterton's Fences. So many things work the way they do because of a problem that occurred. They say that safety regulations are written in blood. People died to make those regulations. Well, financial regulations are the same way.
Being able to freeze assets and reverse transactions, for example, is a feature, not a bug.
The real story with crypto is how greed clouds people's judgment. So many people on HN thought they were going to make their bag on crypto and people like myself got shouted down as naysayers.
I really don't know what to do with this information other than those same warnings are beign ignored about AI and in 5 years I will be punished for being right too early. There's simply no market to recoup the trillions invested in rapidly depreciating assets around software with no moat.
many of the fences are chesterton, true. but also a ton are just incumbency protection for people/institutions who got to the commanding heights of the economy early enough.
I agree with you. Is there a name for this logical fallacy?
I equate it to anonymity on the internet. Yes, if everyone had to associate their real identity with everything they posted on the internet some unjustly persecuted individuals would not be able to get their stories out. And there would be a heck of a lot less other bullshit.
I got more utility from AI within the first week of ChatGPT being originally released than I've ever gotten from crypto, and I've had bitcoin since they were giving it away for free on Tor lol
They're not even remotely close to being comparable.
I agree. AI is useful to layoff thousands of employees as we have already seen, hacking companies and governments with agent swarms and also helping with accelerating cyber crime.
Now anyone including script kiddies can tell an AI agent to build an exploit to attack a website of their choosing the moment they find a vulnerability.
You cannot say it is useful (which it is) and it does not also accelerate and amplify all the negative consequences at the same time.
> Crypto has none except scams and get rich quick.
Stablecoins are quite useful for companies such as Stripe, Shopify, Square and others for payment of goods and one can send stablecoins around the world on the same day, 24/7 with extremely low fees.
Crypto is not the one that will cause the next financial crisis. That will be AI.
Thanks to the $3TN (and counting) debt that is now becoming a massive risk to the point where big tech companies are hiding it from their balance sheets [0] with Oracle and even CoreWeave being the most likely to default first. [1]
they forgot to mention that 1 part where it conveniently erodes their thinking capabilities over time. grab a bucket of popcorn and wait 5 yrs, our society s IQ level is gonna plummet to a low that ll be hard to beat even by 24x7 doomscrollin social media brainrot
AI might ruin all white collar labor power and drown the world in useless work via things like expand-message-with-AI --> summarize-message-with-AI. Meanwhile with cryptomemes you can remain unaffected unless someone manages to ransomware you.
No. You'd need to know how Binance worked in some very deep level of detail. E.g. that there's a way to force signing of high value transactions with no rate limiting or countersignature, then how to mount an attack on that code through lax controls via a developer machine. That's not something you learn through casual scanning.
Well, it depends really. Let's consider this scenario:
Binance has cold wallets and hot wallets.
The hot wallets used to be small and therefore low value, but have grown to be huge, without anyone really paying attention.
The hot wallets have much less ceremony attached to moving money, as they are required to move money multiple times a second to track customer inflows/outflows from the system.
There are no controls or transaction limits on the hot wallet because it's just a bitcoin wallet (or set of wallets).
The hackers got access to the system via the dev machine, found the hot wallet keys in the system (which it requires to function), and simply started draining it of funds, it turned out the hot wallets contained a LOT of funds.
That doesn't require in-depth knowledge of Binance operations, all they need is access to hot wallets via the keys which we know the app would need to have in order to use it.
The lack of controls on the Binance side here is astounding, but it does appear like they had no safeguards, limits or monitoring on the hot wallet in spite of the money involved, or if they did they kicked in too late.
Partly this is a problem with the crypto itself which underlies their system: it's designed to be permissionless and without controls slowing down or reversing transfers.
First 10 minutes: Making a team, 2 guys or gals living a life, talk about it
11-30 minutes: Demoing how bad our security systems are, we need to patch them, day and night, can't keep up
31-40: But we need money, no one is paying our bounties
41-50: How about? They do not tell what it is
51-60: We are going to hack StarLink (they never say that, it is just the logo in the background when they are talking how easy it is to get in and out)
61-70: Dry Run, text scrolling on the screens
71-85: The Hack, split screens, zoom in and outs
86-88: Oh it was Solozzo (Binance) all along, not Starlink.
89:90: Dude fills up his car with the stolen USDT and realizes that as he is sitting in the car
You need to make the caper a positive enterprise. Nobody cares about enterprise security hygiene; so you need the head of Binance to be an evil-moustache guy, or the proposed hack to be a positive affirmation of the protagonist's skills over a world that does not value them.
I like the final twist. It would be even better if it turns out the protagonist was manipulated by the real players and he ends up with little reward (because crime doesn't pay, kids!) but with renewed faith in his abilities.
After the HuggingFace incindent, these things keep on happeneing. Last week Railway and PHP faced these problems and now its Binance. The flood gates are now open.
Floodgates were already open somewhere in August 2025 around that time we got Sha1-Hulud and phishing of NPM contributors. Those supply chain attacks were happening all the time since then in smaller and bigger amounts.
Other thing was Mythos, project Glasswing and start of really AI assisted vulnerability research. This on the other hand gave us plenty of new CVE to patch. If some project had in June 2025 0-3 new vulnerabilities, June 2026 it had 13-18.
It is just a rollercoaster in cybersecurity last 2 years already. But Hugging face incident is IMO not that noteworthy if you tried doing any task with AI agent on your own.
Funny that for all the hype around decentralisation and the libertarian ideals that surround crypto Binance, Circle etc were able to unilaterally freeze funds when it came down to their own self interest... I thought the code was the rules etc seems like the best player won here.
Crazy that most of this gets put into North Korean weapons programs.
> saying it will cover all losses from the hack and is working with law enforcement officials to identify who is responsible.
Isn't Binance the one that needs to be prosecuted for negligent security? How does "a compromised laptop" lead to a $6bn wipe in a matter of minutes?
This is why banks are regulated, though I have no idea if/whether these platforms are regulated in any similar way.
I work for a classic bank in Europe in development.
To unlock my laptop - I need a boot password - then I need a finger print scan - after that a password, after that a 2fa app. Then I need to connect to a VPN .. 2fa again. My laptop locks within 1 minute of inactivity. 30% of my CPU and RAM get hogged by our security suit constantly. My USB ports are disabled for data. I understand it's windows and windows can get compromised - it's just very unlikely that it gets compromised to a level where you could actually cause damage.
How do you get any work done?
Thats a 5-10 min process tops assuming the person is issued a powerful computer and infrastructure supporting it.
Small price to pay for ensuring people and the gov don't lose billions.
What a nightmare, I think the bank might just be better off paying the occasional ransomware rather than operate like this.
That’s ridiculous.
absolutely not a nightmare but necessary in places that are serious about their shit. paying off ransomware isn’t an issue at all, if my bank got hacked I would pull money out pretty much the next morning and same would be true for hoardes of others even though our money is fdic insured.
Hacking bank and stealing money from there is not so easy as stealing 32 characters private crypto key. Even if you steal some data from bank, using is is another challenge. With crypto key you just use an open source client on your machine to move the crypto.
Why would have more than the maximum FDIC ensured amount (200k) sitting in one bank?
FYI each of the top 10 banks in the US have been hacked before, and they’re still doing ok.
I work in german FinTech too and am very familiar with this game. Forcing developers to do 2FA for "every keystroke" while running ancient software on historic OS doesn't make much sense to me.
If your USB ports are disabled for data how do you plug in a mouse and keyboard?
EDR software on the laptop controls what is and isn't allowed. It'll be disallowing USB removable storage devices etc, while still allowing standard HID (keyboard, mouse).
They can even block all but allow-list certain vendors and models, but because USB is an unauthenticated standard - an attacker can easily spoof any vendor or model. So best not to rely on that and instead block all of certain types of USB device.
Don't BadUSB attacks typically use HID to enter malicious keystroke sequences?
So?
No ones going to disable mice/keyboards.
If the point was to eliminate all possible ways of compromising the device, they'd just put the device in the shredder.
You have to balance having a usable and functional thing with the risks involved.
[dead]
[dead]
> 30% of my CPU and RAM get hogged by our security suit constantly.
Ah yes, the bane of enterprise workplaces.
Binance explicitly said it wasn't just the compromised laptop.
I'd be surprised if it were. Crypto exchanges have been targeted by hackers since forever, and Binance is one of the top. If it was so easy to exfiltrate crypto from them, I'd have expected a heist before now. (Unless controls have just gotten worse recently.)
Do you have a source? Because I've only been hearing about the laptop.
> Binance has said the incident was a “complex attack” that stemmed from multiple factors.
> Its initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions.
I know it says "multiple factors" here, but there are no other factors I've found.
Sure, but the vary fact that a DevOps engineer had single-person access to a component that enabled them to submit unauthorized withdrawal transactions is likely already an unintended situation brought on by a misconfiguration in their system.
What an elegant and blameless way to describe this. Appreciated.
I was kind of assuming the engineer didn't have full access. But maybe the other factor(s) were additional exploits
Wired linked to this tweet as their source: https://x.com/binance/status/2116089661408108712
> Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
That seems to be their most recent update on the matter afaik (30 Oct, 8:47am UTC)
Wish I understood more, but the short Wikip article lists 10 diff blockchains involved:
https://en.wikipedia.org/wiki/2026_Binance_hack
I’d love to hear what an unaffiliated investigator has to say.
Of course they want it to sound like the world’s most sophisticated hacker
World's most sophisticated hacker who happens to be in a jurisdiction who do not respond to provocations and operate out from behind the GFW illegally, and at the same time, never broke ranks even with the wealth and being in a remarkably well-resourced perch to defect.
The FBI and other federal agencies engaged in law enforcement routinely use appeals to authority and expertise they do not have and create set-piece situations that almost in every case involving more than one defendant sets up a circular firing squad situation where the most guilty is at an advantage of simply pleading guilty and cooperating first, or otherwise they'd dump it off via the AUSA down to the state level if they can, or blame China, Russia, NK, Iran, or Israel, countries that do not extradite their own citizens on request and rarely if ever do so unless it's done so on their terms. Blockchain tracing ultimately still needs the connection between the chain and off-chain ID and there's no surefire way to even ascertain with something that isn't a mere heuristic with an error rate unacceptable in criminal court and would fall apart if there's competent defense counsel, which the FBI have, in the one case where on-chain evidence was going to be used, actually went full Chewbacca and created a two year delay mid-trial and then pulled Chainanlysis' "expert" off before cross examination. The company has the balls to brag as if the courts have validated their method in whole, when in reality the court have long understood what clustering is and so that part is of course admissible evidence, but it also doesn't get you to the purported end - attribution. If one can use a strawman as a sales tactic, this would be exactly that. The attribution aspect have never been allowed to be properly examined in the criminal context. The "reactor" is merely a database, and in the small bit of direct examination the chainalysis employee claimed that every time he queried the database the correct rate was some absurd, Robert-Mugabe's-election-number figure that is higher than the DOJ's conviction rate when they were still credible and actually higher than the CCP's official conviction rate in a fake criminal justice system where due proceess doesn't exist and they give leeway because claiming to be 99% correct is absurd. Of course, they've never been tested in the same situation and still haven't, and if the industry mouthpiece is basically hiring sales and not legal, which is basically what every company in the Blockchain Association has been doing, rent-seeking to be Wall Street 2.0 on top of free merged pull requests and open source software. Tracing on chain is all well and good for shits and giggles but Department of Treasury went and sanctioned a smart contract thinking that it was an EOA address that belongs to a person as if etherscan was never checked beforehand tells you all you need to know.
They had a bad case against Tornado Cash since the ultimate demand would require the devs to somehow predict the actual identities of those that interact with their contracts - which in many cases isn't even a human. It's telling that when the 5th Circuit and the one judge in that circuit who knows anything about process and technology through sheer luck got on the panel and wrote a clear rebuke of how federal investigators failed at doing any due diligence, and for once, the feds did not attempt to do an end-run or even ask for en banc hearing of the issue, but simply made up a completely different issue to pursue (building the front end) which is not a crime. The feds can't match the IP/in house firms in renumeration and can't even match public interest or federal defenders in hiring out of tech competent law grads when it comes to having a moral high ground. They have so much resources so that they can hire contractors, but can't vet the contractors. Being able to fall back on coercion covers up a lot of incompetence. The Atomic Wallet 'hack' was almost certainly not a NK job as they have claimed, for example, and they relied on some dude on twitter's hunch (notably the first thing one learns that is never evidence if presented in court) and a post-hoc heuristic that is indistinguishable from a copycat or a third party's infrastructure to make the attribution. People with poorly thought out opinions are all over the place on Twitter, but this permission slip to "make mistakes". Also, they're part of the system of funding provided to your local police so they are better funded now than before 2020. Check their work under all circumstances, and plea bargains should not be considered as evidence of actual guilt since coercion and BS is as common as actual cases backed by properly collected evidence that builds a procedurally sound case.
AI slop
Bro went full Chewbacca.
> If it was so easy to exfiltrate crypto from them, I'd have expected a heist before now.
FWIW in 2022 one of their systems was breached and $570 million worth of "BNB" was taken.
BNB being their own cryptocurrency that they mint and destroy at will.
I think your expectations are too high. The vast majority of criminals don't bother checking targets where there's not good evidence its easy or something has worked before.
That doesn't even make sense in this context lol
I cant really refute what you don't explain.
Just going from what Binance PR must believe about a laptop it seems unlikely to me that they've been tested in much depth by anyone with mafia tactics.
The customers surely have standing to sue Binance. But to close the gap between what you feel should happen and what could actually happen… exactly what crime could they be prosecuted for?
What would they sue for? Nobody lost any funds.
Why should we believe Binance when they say all customers will be made whole, and how will they do that, with what money?
It seems very unlikely they have $3-6B lying around ready to repay customer deposits. At the very least this would be catastrophic for them if they do lose all that money.
Have they re-enabled withdrawals yet? If I were a customer I'd be taking everything out as soon as possible.
> It seems very unlikely they have $3-6B lying around ready to repay customer deposits
For Binance? I’d actually say very likely. They’d need to move a couple of papers around, but should be easy.
their stated plan, for what it’s worth, is that they have $6.34B of company funds set aside, most of it already in the same coins that were taken, plus the SAFU emergency fund at about $1B. around $3B of the stolen money is frozen at Tether, Circle and others, and CZ’s own post on X put the rest of the gap at about $2B.
withdrawals have been paused since Thursday night. binance says it will reopen them in stages from Sunday and publish proof of reserves by Monday, which is the thing that would actually answer your question.
Vouched. Not sure why this was flagged.
thanks, probably because I made my first comment yesterday
It is estimated that Binance has revenues of 20 billion and 7-8 billion in profit a year.
Funds have been already allocated for recovery by the CEO Richard Teng.
Jesus, what do they spend 12B USD per year on expenses?
They run everything in AWS ;)
Why should we believe that binance was hacked? Maybe nothing happened at all?
The former CEO of Binance CZ has been banned from any contact with the company after a conviction for fraud and he's the one giving assurances here.
So there are good reasons to be skeptical of his statements.
[dead]
They have much more than 6b lying around. They are a money printer .
They don't need need money. What was stolen was some sort of "digital assets". How are they going to cover that, I have no idea, but let's not equate crypto assets with money. If someone would have stolen my bike, i wouldn't be saying "they stole $1000". They stole a bike, which could or could not be recovered, and which was or wasn't covered by insurance.
And if thieves stole a bag of paper from you, that happen to have the number $100 and some other artwork written on them by the government, what then? It's not money, it's just some "paper asset"? You're just showing your own personal bias about what the definition of money is.
It's an important distinction.
$3.5B stolen was "stable coins", which you could equate to a piece of paper with a dollar amount written on it.
Those are largely freezable by the issuer of the paper.
Then we have $2.4B in Bitcoin and ETH stolen. Those are not directly freezable.
However, if that does create a liquidity challenge for these exchanges, what if the price just so happens to drop by 60% after trading is restricted? That liability might shrink in actual value.
What if the bag of paper "money" is in a foreign currency? You'd still happily call it money, but then the distinctions you're trying to draw with crypto don't really apply. Think of crypto as a foreign currency, it still functions as money.
Crypto isn't foreign currency. The price may fluctuate wildly based on sentiment and action taken by exchanges such as Binance, which would directly impact their obligation here.
Comparing crypto to actual currency typically connected to large, real economies is not relevant here.
The crypto economy has about the same market size as a country like Russia, Italy, or Brazil.
A country like Iceland is far smaller, and their currency famously fluctuated in 2008. Would you consider Icelandic króna as money? Most people do.
The crypto economy isn't real, it's a pointless wealth redistribution scheme.
Anyway, that and your question are hardly relevant to the fact that Binance and their cabal own the crypto exchanges and consequently could manipulate the price to reduce the size of their obligation denominated in crypto rather than currency or stable coins.
Define "own the crypto exchanges" here. What percent of transactions in and out of bitcoin and ethereum go through them?
I mentioned their cabal, as in the Signal group "Exchange coordination" reported in 2022, with executives from Binance, FTX, Kraken, Tether, and Tron.
So like, three exchanges, one of which died? Even if we assume everyone in the group is willing to tank crypto values, that's not a very big power level increase beyond what Binance has by itself.
Believe whatever you want about Binance's influence.
I understand Binance alone accounts for a third of the market, and their ability to coordinate with other exchanges is hardly restricted to the participants we know were in that specific group chat.
I think the point stands that a liability in eg. USD is much different from one denominated in crypto.
This isn't about what I want to believe, it's that at the slightest requests for clarification/evidence you've gone from "the fact that Binance and their cabal own the crypto exchanges" to "ability to coordinate".
Yeah Binance itself is big but it'll take a lot more than one exchange, an exchange everyone is now handling with extra suspicion, to cause a crash.
> I think the point stands that a liability in eg. USD is much different from one denominated in crypto.
If course it's different but that's so much weaker of a point. And the foreign currency comparisons weren't to particularly stable currencies.
Seems to me that it's entirely about what you want to believe, what I claimed is clear:
Binance obviously has influence on crypto prices, potentially affecting a liability denominated in crypto.
I quoted what you claimed, it was much more than "has influence".
And I'm sure they have nonzero influence but anything significant needs more evidence than a signal call that has Kraken in it.
They still need to find buyers at that price. The price is what it is because there are no buyers below that price. If they artificially drop the price there won't be any buyers at the new price so they won't be able to buy any bitcoin so they won't be able to give it to the customers it was stolen from.
I wasn't thinking about some fake price they set on their own exchange, but actions that could tank the market, which I understand Binance alone makes up 30% of.
Crypto at it's current price has a market cap around $2.6T. Obviously the liquidity is questionable, and since crypto isn't connected to any mention worthy real economic activity, a change in sentiment can quickly crash the price and liquidate leveraged positions.
While that's of course true for other assets also, crypto not being connected to production of real value, combined with the comparative lack of regulation, makes it much easier to manipulate.
They could also do it at any other time to increase their bitcoin holdings, then.
To me it's clear that crypto is worthless, so I don't see a point in such an action.
In my view their interest, which aligns with that of all other major owners of crypto, is to acquire as much real currency as possible.
Acquiring more crypto by decreasing its valuation is not furthering that.
Maintaining a high valuation and positive sentiment in order to convert buyer's real currency into profit to cash out is what I believe their strategy is.
The point of increasing your bitcoin holdings is to have more bitcoin you can sell to people for money.
Presumably the hypothetical price change is reversible or there would be no point. So lower price, buy, raise price, sell, repeat. A dump-n-pump.
I'm assuming they already have an abundance of crypto that they're working on turning into cash. Otherwise your idea makes sense.
Why would they want to sell at a lower price?
Interested to understand how this would work in a decentralised accounting mechanism.
Stable coins are normally just minted by the issuer, so I think they can just issue and transfer replacements for the stolen tokens.
Yes, and we could have a paper money system where a registry of stolen serial numbers is kept and they can’t be deposited at any bank or used to pay the government ever again.
It's not personal bias. Most laws around the world do not classify crypto currencies as "money".
Criminal Negligence. They have a history of that.
Binance and its former CEO, Changpeng Zhao, were previously sued for willfully evading anti-money laundering (AML) controls. In that instance, the government ruled their compliance failures were not an accident, but a deliberate criminal enterprise. Binance paid $4.3 billion in fines and forfeitures to settle with the DOJ, CFTC, and FinCEN in November 2023.
This is very reassuring. It means they almost certainly have the $6b available. It’s the same order of magnitude as fines they have already paid.
Fines are paid out over time by taking loans against your very profitable business. Do you want to loan money to someone who just had one of the biggest thefts in history and has secondary obligations and risks.
It looks to me like Binance will be able to scrape together enough money to make their customers whole, so your probably right.
Next time this happens to Binance though they won't have an emergency fund and possibly they'll be in debt, and that's when the users will be very screwed.
Their terrible security certainly indicates to me that future of Binance is not going to be a pretty one unless they make some enormous changes.
I’m sure they could go get some insurance, it’s cost would be a good motivation
Insurance has limits especially in cyber. Eg it could be topped out at $200M.
Basically they didn’t insure themselves against there actual risks and will likely have further fines placed against them for being underinsured.
> exactly what crime could they be prosecuted for?
Note that “crime” has a specific definition in law. You don’t have to be a criminal (commit a crime) to be rightfully sued, civil suits are a thing.
Anyway, your parent comment already answered the question, they would be sued by negligence.
In the U.S., a lawsuit can be either civil or criminal.
Only the government (e.g., federal, state, local) may bring a criminal suit.[1] But in both civil / criminal cases they are still a suit under the law seeking some form of ordered relief from the Court.
Essentially, you can think of "criminal" as a category of law and relief (e.g., prison) that is only accessible to the government.
Both the government and citizens may bring "civil" suits. Very generally, the remedies in civil suits are a court order to 1) stop doing a thing; 2) to do a thing required by law / agreement; 3) to transfer property, usually but not always money, from one party to another; or 4) to define a set of rules governing the parties going forward.
[1] There may be some obscure exception to this, but it is true for everything I've ever seen / heard of.
I think it’s the mixed terminology that’s causing confusion. Prosecution is for criminal offenses. Lawsuits are for civil cases.
You are correct that I mixed those up. In any case, my point still stands modulo my incorrect use of terminology.
What negligence? They got their own money stolen. You do not get sued for being robbed of your money, normally. If they do not have the liquidity to let people withdraw money that is another issue, but it does not seem to be the case.
So I assume a random account holder doesn’t actually have assigned bitcoins etc — they are just accredited a claim against the crypto that Binance owns and managed keys for.
So this stolen crypto is off Binance own reserves. So it could be absorbed across current accounts as long as they aren’t drawn down to below $6B? And if crypto drops they can apply cash reserves to plug the hole more easily?
Withdrawals are still blocked.
Telling us nothing.
I was responding to:
> If they do not have the liquidity to let people withdraw money that is another issue, but it does not seem to be the case.
Yeah, temporarily. I doubt that being out of service for a few days gives enough grounds to sue, even merely due to ToS provisions. And that is indeed irrelevant as it is about being temporarily out of service, not having "lost customer money".
Again they cannot be charged for losing billions of their own money, and there is no way to somehow consider the lost funds as "customers' money". I am all for companies getting sued due to negligence when eg they fail to protect customer data, but this is just between binance and the hackers.
It’s their money, that they are borrowing against everyone else’s money that is locked in accounts. The copium with these people is real.
The distinction between civil vs. criminal was the core of my comment. Sure they can be sued. But what exactly would they be prosecuted for?
Not just regulated. This is why banks are banks. This is why everything is slow!
When everything goes wrong the only defense is to be slow enough to fix it.
This idea that there are shortcuts that you can be decentralised and fast at any size is wrong.
I would assume binance is more like a bad bank but without the internal friction to make stuff like this hard.
They (folks who work at a place like binance) look at banks with contempt for that speed. And I don’t entirely disagree with them.
But you’re absolutely right, it’s hard to compromise something that moves at such an absolutely glacial pace.
> This is why banks are regulated, [...]
No, it's not. At least not historically.
Help us out. Is this not exactly why banks have to deposit X amount outside their doors?
> Is this not exactly why banks have to deposit X amount outside their doors?
Sorry, what do you mean?
Basically, the historical origins of different bank regulations are quite complicated and also differ from place to place, and they were often put in place by (political) coalitions of people who already had not one single motivation but a whole spectrum of them.
And then in addition to historical reasons, you also need to ask why things are still in place. Inertia is one answer, but it's not the only one.
I think the person is most likely talking about minimum capital requirements (which are not a “deposit outside of their doors”) and doesn’t quite understand the system.
To understand the regulatory framework for banks, the best place to start is the BIS and Basel III. https://www.bis.org/committees/bcbs/standards Generally speaking, international banks follow Basel III in addition to their domestic regulators’ capital requirements (which are probably also derived from Basel III, but have differences just to make things tedious).
Not a bad place to start, yes.
However, BIS and Basel III (and the previous Basels) are just what's currently in force for most of the world. I suspect most people would be better served by more of an historical overview. But it also depends on what one is interested in.
> Is this not exactly why banks have to deposit X amount outside their doors?
Sorry, what do you mean?
-- think that's referring to bank deposit insurance schemes...
In Europe there are CoCo bonds used to meet capital requirements - various ways of providing layers of protection in case things go wrong.
US banks tend to meet AT1 requirements by issuing preferred shares.
Binance's approach seems to be based on vibes and a vague promise
Where did you get this idea?
The Great Depression. Except I said “outside their doors” when what I meant was “money they can’t lend”. My very bad.
Ah, fractional reserve banking. That hasn't been a thing for decades. Banks don't work like that. Money is just loans that haven't been paid back yet, mostly mortgages.
That's certainly an opinion.
Do tell me, please: why do banks care about getting deposits? And why did Silicon Valley Bank get into trouble, when depositors left?
Well, it's an opinion held by the Bank of England as well: https://www.bankofengland.co.uk/-/media/boe/files/quarterly-...
That's a misreading of the text. That pdf gets trotted out again and again.
But let's assume you understood the BoE right. My questions still stand:
> Do tell me, please: why do banks care about getting deposits? And why did Silicon Valley Bank get into trouble, when depositors left?
(And before you answer something about regulation: the regulators had willingly blessed SVB's damaged balance sheet for quite a while, and they only collapsed when depositors decided to leave.)
You might want to read the section of the pdf you linked that includes:
> So if a given bank financed all of its new loans in this way, it would soon run out of reserves.
I wish you would just write what you think. It would really help discussion. I assume you are not literally arguing that fractional reserve banking is how things work, but it's hard to tell what you are arguing.
I know about central bank reserves. It's not fractional reserve banking, though. It's basically just regulation, but regulation done in the language of money, which banks (and any 5 year old) can understand.
Banks have many reasons for attracting deposits. Not least of which to get customers "on board" such that they might buy other financial services. But yeah, they also need to stay on the right side of regulation, or not run out of central bank reserves, if you prefer to think of it that way.
Ultimately it's all fake. Whether you think of it as "reserves" (that don't really exist, of course), or regulation is up to you. It's ultimately just a bunch of IOUs but raised up about ten levels of abstraction.
Anyway, the whole thing is incredibly complex and nobody understands the whole thing. I did think the commenter was referring to fractional reserve banking, but they might have meant central bank reserves, I don't know.
> This is why banks are regulated
I am not sure why this get thrown randomly as the solution to every problem. Bitfinex major hack was due to regulation. Banks and Crypto companies don't have the same attack surface and the one for crypto is way more complex due to permissionlessness.
Yeah, why is there $6bn in hot wallets in the first place ..
Makes me think traditional banks have solved this from the start. You can't steal the backing of an unbacked currency.
Exchanges have to walk a fine line. If they make withdrawals too slow or difficult then people also get anxious about the safety of their funds (ironically).
Traditional banks and crypto exchanges alike rely on the carefully cultivated illusion that you can withdraw your money at any time.
$6B is probably several billion too large for a hot wallet but it's not completely obscene for an operation of Binance's size.
> How does "a compromised laptop" lead to a $6bn wipe in a matter of minutes?
I wonder what could happen if somebody compromised Jamie Dimon's laptop?
Honestly I wouldn’t expect anything to happen. At my company and all previous ones, everyone knows our CEO would never legitimately email or DM us on slack to ask us to real quick wire a few thousand/million/billion to the Caymans, or buy BTC, and he doesn’t have some global root on our servers either. Even people who have more technical access don’t tend to stay logged into elevated production accounts except at the exact time it’s needed.
Jamie Dimon does not have credentials to log into back office systems at JPMS. I’d be surprised if he even had access to execute wire/asset transfers via front-end tools.
Best a hacker could probably achieve is sending some sketchy emails or messages, but even there people are just going to confirm by verbally communicating with him.
Banks are actually the worst analogy for this sort of thing because there is a ridiculous amount of system federation and ultra-conservative system controls. It can take a month to get a simple route or firewall port opened on controlled networks (god I hate change committees).
they are covering all losses, so why would anyone sue? companies have done significantly worse and then just left you with a $6 class action lawsuit damage claim. What a sham to say to so disproportionately target the crypto company when you have public American companies that harbor criminals as employees still operating today.
Generally it's the people who have intent to break the law who are prosecuted, not their victims.
Criminal negligence is a thing.
talking about that thing. does it only apply to some business/org. ? when a big bank launders money for years they get fines and continue to business like nothing happened, this happens every few years.
Criminal negligence usually involves bodily harm or serious risk of bodily harm.
It also requires a significant degree of willfull negligence. So in this case the criminal would be anyone who had deposited funds in Binance.
A thing that doesn’t apply to information security
Absolutely. That's why I stopped validating passwords and emails. Nobody votes with their wallets anyway, so I don't have to worry about losing customers, and regulations only go after the evil hacker testing whether 1234 might work as a password, not me for choosing not to check its hash against my database. Law-abiding citizens would never try to impersonate one another, so I'm sure fraud on my platform is low.
Some think it was North Korea ;)
This is absolutely false. But I understand why someone would believe that in this joke of an industry where all the liability often falls on the user.
Can you give some examples where victims are criminally prosecuted? Do you think this is common to the extent where you would call it the general case?
Oh right, now they want government to get involved with their make believe 'currency'...
CEO still in jail or has Donny given him leniency?
Are you thinking of Sam Bankman-Fried and FTX?
I’m thinking they’re speaking of a different executive (Changpeng Zhao) pardoned by Trump. [2]
Last I heard he’s is now living in luxury in the United Arab Emirates. There was a profile on him in a paper.
I’m not sure Sam has enough cash to get a pardon.
“Mr. (Changpeng) Zhao has a long history of legal and regulatory problems. Binance pleaded guilty to money-laundering violations in 2023 and paid a $4.3 billion fine to the U.S. government. After serving a four-month prison sentence, Mr. Zhao was pardoned by Mr. Trump last year. Binance also forged a business relationship with World Liberty Financial, the Trump family’s crypto company.” [1]
[1]
https://www.nytimes.com/2026/10/30/technology/binance-hack-a...
[2] https://www.nytimes.com/2025/10/23/technology/trump-pardons-...
I am not one to performatively hate Trump, but my goodness it's humiliating to live under his administration.
> This is why banks are regulated
Yes. Move fast and break things and forget governance... Cryptocurrency has always been dumb. You either con people out of their money or you lose yours.
I had someone approach me in 2017 or so because he wanted to do a rugpull coin operation. I said I was busy and didn't help, but I'd probably be much richer (and a piece of shit human) if I got involved.
Keep in mind banks are NOW regulated but the regulations came After the bad event not before.
Regulations probably help but they basically serve to keep evolutionary memory in place in a corporate ecosystem where companies can spawn from nothing.
Bad banks no longer exist but regulations, after an extinction event, perhaps try to make that evolutionary event permanent.
At least that is my mental model.
Regulations are very lagging. And they should be understood to create moats and friction. There is no free lunch. Regulations purposefully shrink or destroy markets. That is how markets work.
Something I wish tech folks would absorb more.
If it's not frustrating and stupid, (to you at the time) it's probably not really a regulation.
> Bad banks no longer exist
This is a funny take on things, and untrue. But traditional finance is way safer and better controlled than the crypto frontier. Someone like coffeezilla has to rely on patreon and ad revenue to do the sort of journalism that exposes how debased cryptocurrency finance is. There should be much more money in exposing the fraud, but our premier capitalists are complicit in the fraud. They are fraudsters at heart, which is why they have the money and influence they do.
> Regulations purposefully shrink or destroy markets.
Sometimes maybe, but that's a matter of corruption. Regulatory capture has been used to create regulation that protects monopolies, duopolies, and the broader oligarchy for a very long time. When politicians were representatives of their voters, things worked better. Post-citizens united, the incentives are broken and we have a congress full of duplicitous, self-interested idiots.
> Cryptocurrency has always been dumb.
What happens when the US govt tells others not to do business with you?
this is a company where the founder and original CEO was sent to prison for facilitating illicit money transfers and not having proper financial controls...then Trump pardoned the founder....so a fraudulent company that lacks financial controls lost the GDP of Fiji without any sort of check on it....lets blame devops rofl.
"This is why banks are regulated, though I have no idea if/whether these platforms are regulated in any similar way."
Yep... that's why banks have never been robbed, never been hacked, and neer lost money! ;)
Wasn't it even a central bank that was hacked into a couple of months ago?
Thank god for regulation!
> This is why banks are regulated
I can't imagine thinking that banks won't lose your money. You live in a complete fantasy world.
In the United States, individual bank accounts are insured by the government to $250k per account. The overall risk profile is extremely low, regardless of whether a bank collapses or is subject to a security breach. The general assumption is that it would require the US government to collapse for your checking account to vanish, in which case you'd probably have larger problems to worry about.
If you live in Argentina, I sympathize and I take your point.
Alas, (effectively) government deposit insurance encourages a lot of risk taking by banks. Which then begets more regulation.
People who essentially want government guarantees for their money should just buy government bonds.
> encourages a lot of risk taking by banks. Which then begets more regulation.
Not with simple account deposits, no
Basel rules are still a thing
Hence my "Which then begets more regulation."
Customers stop monitoring their bank, when deposits are insured.
>In the United States, individual bank accounts are insured by the government to $250k per account.
>The general assumption is that it would require the US government to collapse for your checking account to vanish, in which case you'd probably have larger problems to worry about.
See USSR-Russia transition in 1990-1992 for example.
Accounts didn't vanish, but all people's money where used to cover the deficit
To be fair, it's not even playing ground, security-wise. There is no mechanisim by which a bank can be compromised this quickly and completely, much more of the transfer process is permissioned.
Crypto 'banks' need orders of magnitude more security and it's not a trivial problem.
Yeah, that already happened, that's why the regulations and FDIC.
My grandfather lost his tuition money he had saved to become a dentist, in the great depression.
Instead he worked his whole life in a factory for GE.
In America, banks don’t lose deposits, and we have a financial and legal system set up to ensure that.
banks have FDIC, magical token storage companies have nothing
Isn't USD a magical token too? Just printed endlessly by the us government.
Bank don't loose USD because it can printed at will the the holding country like they bailed banks in 2008.
it's the magic token you have to use to pay taxes. In the end that is its value.
A bank could be hacked but the protocol around transferring funds and the paper trail that follows it is significantly different than an irreversible transfer to anonymous hash ID. Crypto bros act like “it takes a day for those funds to actually move out of your account” is a bad thing, or a technical limitation, when in reality it’s to mitigate abuses like this
[flagged]
The heist itself only took 20 minutes, but the preparation is a business that has gone on for years. Much like a heist movie, the exciting bit is just the conclusion after a long build-up where Danny gets the gang together, plans it, and executes it.
I wish I could watch a Ocean's Eleven-style movie about this heist.
But maybe it wouldn't be that exciting to see some guys sitting at a desk.
> But maybe it wouldn't be that exciting to see some guys sitting at a desk.
Let me introduce you to the TV show Industry which takes you into the world of London high finance where tense phone calls, compliance violations and financial crimes are the order of the day [1]
[1] https://www.youtube.com/watch?v=_1bQETWAKLY
Industry is more soft porn than a show about heists
tried to watch the latest season, was put off by this and gave up.
Not sure why they do this, anyone has an idea? Like, the Internet is just there, I can go and watch porn whenever I like. If I am watching your show, it's because I am interested in something that is not porn. Also, if your show has a lot of these scenes, I can't watch in many places (ie: cafe, plane, with other people, etc..)
> Not sure why they do this, anyone has an idea? Like, the Internet is just there, I can go and watch porn whenever I like.
It's HBO. They are known for this. But they definitely went too far with Industry in my opinion.
The sex and drug scenes are much more toned down in the latter two seasons. Part of the reason why is the cast had more leverage and strong armed the writers / directors.
Great show but definitely would be better with 90% of the sex / drug scenes removed.
Did you tell Rick and Morty this
More like "Steal"[1] with Sophie Turner.
[1] https://www.imdb.com/title/tt32499731
It's a horribly inaccurate show too
> [1] https://www.youtube.com/watch?v=_1bQETWAKLY
This is like medical series about ER, in real life it doesn't happen. In real life nobody cares, things slip trough, people die, finally someone receives a huge bill.
I am not uncertain.
I imagine it would look like a bunch of North Korean guys (probably not starving like their countrymen, but probably not looking great either) sitting in something like a cross between a NK state prison and an American office.
So yeah, really not exciting ... just sad.
Maybe they are looking great though, crisp uniforms absolutely dripping with medals.
Wake up comrade, new model just dropped!
Now you make me want a North Korean version of The Office
Not sure if I want it written and developed by North Korea or its enemies…
It could be a "Severance" type of show
Much more likely to resemble the latter office environment.
They're not in NK, though their family is.
I'm thinking more like:
https://www.youtube.com/watch?v=T6fJzSgM6x4
Maybe similarly cringe as the Russian cartoon movie about the first dogs in space. I think it was called Space Dogs.
That sounds like it could be pretty exciting.
They clicked the "pi" symbol on the Binance homepage [1].
[1] - https://www.youtube.com/watch?v=pXPXMxsXT28
You might enjoy the BBC podcast cyberhack, about another very elaborate financial hacking operation: https://www.bbc.com/audio/series/w27vqd03
There's a very good BBC podcast about the north Korean and Russian hacking teams by BBC, one in Lazarus and one on evil Corp or something. Shoudnlt be hard to search for if interested.
But what if they’re getting a blowjob while they’re sitting at their desk?
That was the solution that the movie Swordfish came up with to solve this tricky problem.
If it's dumb and it works, then it's not dumb.
True, but it depends on what you mean by “works”.
[flagged]
Plenty to film/story to tell - Binance team freaking about the operation, the users who find out funds are gone, and the thieves living it up on the stolen money.
I felt the same way about the Ledger wallet heist. The amount of planning that must have gone into that is insane.
AI removed the fun even to this.
[dead]
And almost certainly an inside job given the knowledge of Binance systems required.
Literally the locksmith paradox
Well, no. The locksmith paradox is where a skilled person can walk up to a novel problem and quickly solve it, irking the customer who paid a large sum for the results. Here the thieves almost certainly didn't trip over the Binance vulnerability and solve it in 20 minutes; they planned and researched this task for a long time before executing.
If you want to get that narrow, then why not dismiss my comment by saying that they are not literal locksmiths? The locksmith paradox is about underestimating the expertise behind a quick result, and that expertise can include extensive preparation.
The locksmith paradox is about paying a lot for a small amount of apparent work, right?
The paradox is resolved by considering the expertise, which took a long time and much effort to acquire.
With the heist, the analogous paradox is somewhat weakened. There is hidden effort, but it’s highly specific to the actual target task.
With the locksmith, the hidden work is done on entirely separate tasks and so on, which happen to provide the necessary skills for the current target task.
Interesting, when the Cryptsy founder stole millions via laundering coins in Coinbase exchange, the government, FBI, and CIA did jack sh!t to recover the lost funds!
He is still in China living with his girlfriend.
Miami, Florida – A 17-count indictment was unsealed in federal court in Miami, Florida charging Paul E. Vernon, 48, the founder, operator, and Chief Executive Officer (CEO) of Project Investors Inc., doing business as Cryptsy
https://www.justice.gov/usao-sdfl/pr/ceo-major-online-crypto...
> He is still in China living with his girlfriend.
The US and China do not have an extradition treaty. ie even if they wanted to do something, they can’t. The same goes for Russia
An extradition treaty is just a formalized process for extradition, it doesn’t prevent countries from extraditing someone when they want to. China doesn’t extradite Chinese nationals as a matter of principle, but they’ll extradite other people to the US if it’s politically expedient.
https://en.wikipedia.org/wiki/Detention_of_Michael_Spavor_an...
China absolutely could do something if they wanted to. No treaty just means they aren't obligated to "do something", not that they can't. For example, if the US wanted to reinstate the $800 no tariff policy in exchange for Vernon, I guarantee you they'd arrest him and turn him over.
I can't find any reference to Vernon's citizenship, ie if he is a Chinese citizen or not. Which would change the math.
That was a huge difficult process for Canada to get them back. The US isn't going to waste that sort of diplomatic currency just to arrest a medium tier white collar criminal. They will wait it out to see if he ever tries to leave and nab him.
Absolutely. It would be insane for the US to offer my specific example. I'm just making the point that China (and Russia, but I didn't give an example) can do something. Their hands aren't tied.
Kinda wrong. The US and Russia have had a Mutual Legal Assistance Treaty since 2002 and the US and China have a similar agreement dating back to 2001.
Just recently, the US and China had repatriated fugitives to each other, despite having no extradition treaty. No extradition treaty does not mean transferring suspects is impossible.
The short duration of this crypto hack isn't particularly noteworthy. Of course it takes time to find or design the exploit, but execution is typically very quick for such events
I disagree. Assuming the start of the timer is when they first encountered Binance systems they moved very quickly to make the transfers. It suggests to me either some or all of this was automated or they had prepared in advance with some inside knowledge of Binance architecture.
>they had prepared in advance with some inside knowledge of Binance architecture
That is a safe bet 92% of the time, but they rushed getting the stolen coins into a tumbler service. The kind of people that do business in bitcoin, are not the class of folks you want finding these thieves first.
Yet, picking politically attractive proxy-scapegoats is a classic pro move. =3
They passed 6 billion through a tumbler service?? Like what bitcoin fog used to do, back in the day? You’d think a tumbler service would just exit scam with that kinda money.
Also I thought tumblers didn’t work anymore? Didn’t they figure out how to trace btc anyway?
it's a decentralized service. yes it's traceable
In fact it would be far more interesting if it happened over the course of hours/days/months, because that would be an indication that they managed to remain undetected for a long period of time.
Something tells me that the timing of the Claude Code supply chain attack is not a coincidence ...
https://cyberplace.social/@GossiTheDog/117528831681803563
That's unlikely because Cursor (and VS Code) enforce a 12h delay for all extension updates by default. Malicious extension was only live for 11h so you shouldn't be affected unless you reduced it.
The supply chain attack had a software bug which raised error messages that were discovered by a security vendor. I don't think those people have the skills needed to elevate their initial access to a full binance compromise within a few hours.
Recency bias. I don’t see much evidence that the two things are related other than the coincidental timing.
https://en.wikipedia.org/wiki/Recency_bias?wprov=sfti1
In any case running an agent framework in anything but a strict environment like openshell or a VM with a non rooted container and with a firewall out side of that containment is the definition of stupidity.
Isn't the anthropic hack a day late?
Is it?
Cursor's security announcement was posted on Oct 29 and says that the malicious extension was live "between about 2:27am PT and 1:35pm PT today"
This article says the attack took place "on Thursday" (which means Oct 29) and began at 4pm ET (which is 1pm PT)
and Binance has been tweeting that the cause of the hack may be a compromised employee laptop. yikes
The article also claims they had 36h to prep the attack, I assume this was the 36h prior to Thursday- if so unlikely to be related.
Good question, would be interesting to see an exact timeline on both side-by-side (confirmed events, not reporting).
When seconds matter we'll patch our systems in days to weeks.
And if you ingest patches in seconds, you now have an issue of checking that the patch is not poisonous. Many a modern outage comes from changes deployed too fast. Damned if you do, damned if you don't.
if a CVE drops at 23pm, attackers have at least 8 hours before someone in the office has a possibility to take a look at it. nowadays, that seems to be plenty.
i don't have a solution.
I think "good security/engineering practices" still has a chance.
Things like--
All software has flaws and it's now easier than ever to find and exploit them, but this disproportionately hurts people who were only putting on a show of security and relying on a single layer or two of defense instead of developing a robust insider threat model (which helps with both insider threats and threats that get inside) and defense in depth.Full zero trust internally. Both inbound and outbound proxies (different machines) to carefully limit access, and provide a place to mitigate attacks. Etc.
If your plan is to quickly apply upstream patches, your plan is bad.
> Full zero trust internally
I try so hard for this, but don't even get approval to change an internal site to use https instead of http.
I get we gotta keep the new features and workflows coming, but a single resource dedicated to low hanging fruit of security could fix a lot in a very short time.
It’s a hard transition, but possible. Obviously less work to do it from the start.
It requires management buy-in, both to allow some number of engineers to be allocated to such "non-production" work, and also to allow the friction security creates to continue to exist and "slow down" the "real work", both by vetoing things that would weaken security and by forcing everyone to use more cumbersome workflows.
That usually doesn't happen unless the company has suffered a large financial or reputational loss as a result of poor security practices. Sometimes not even then, if the company doesn't get scared they'll start losing money or get in some sort of legal trouble.
I’ve worked places that did a lot of this (not everything, but a lot) from very early on.
Completely agree there is lots you can do to shut down exposed surface area.
Is encrypting data at rest useful when the app must have access to decrypt the data? What sort of scenarios do you use it for and where do the keys live?
Have on-call sysadmins or have them work in a three-shift schedule. That way there's always someone there to fix stuff as it happens, including deploying security patches or worst case taking affected systems offline until they can be patched
This used to be common before devops and cloud took over. Looks like it might make a comeback. Maybe with a new fancier job title
There's a really simple solution that people will hate: server goes offline at night.
I've seen this a few times, and it's pretty annoying as a user, but ultimately it's not that bad usually. If you are ordering something at 3am, the physical shipment still occurs during daylight hours. Many banking operations are not actually instantaneous, they settle in a batch job overnight.
And this doesn't have to be binary. Providing a read-only interface provides lots of value while having a reduced attack surface.
Do you know about timezones?
"We have fully automated multi-cloud follow-the-sun platform migrations. All your code runs in datacenters where it's currently office hours."
People are gonna hate this but: we’ll need agents ready and waiting to autonomously patch and deploy instantly
Then you just prompt-inject the agent to convince it to deploy a malicious patch. This isn't a solution.
You can have guardrails and still ask for approval. There is a difference between a guy who just has to approve a CVE fix and someone that has to take the time to understand what's going on, etc.
It’s agents all the way down.
We need to deploy essential services at least twice, apply CVE ‘fixes’ to a subset of them, and have tooling to diff their outputs.
That tooling should be shut off from the internet [1], and if it uses a LLM that should be at least a few years old.
[1] technically impossible if it also has the ability to veto responses, but the surface can be very small.
low attack surface applications is the future.
A published CVE is kind of late in the game even.
23 pm where? Simple answer is distributed teams.
You are going to provide me with a budget for that solution?
Easy to drop a sentence in a discussion. Harder to implement.
Yeah. There's a huge difference between how a 5-10 person start up or a 50-100 person business can handle this, compared to a tech giant or hyperscaler who's already got 1000 engineers in a dozen or more timezones.
It's easy, if you already have teams in the US, UK, India, and Australia - it's always normal office hours in one of those location.
[dead]
23 pm is what, 11:00 am?
When seconds matter, it is impossible to patch if you haven't patched already. If you need to patch, or attempt to contain against an adversary who is prepared and sophisticated enough to succeed within minutes, you've already lost. Defenders need to win every time. Offense only needs to win once.
Citation:
Binance hot wallet signed 50 EIP-7702 delegations 3 minutes before the drain - https://news.ycombinator.com/item?id=50306715 - October 2026
Binance hot wallet signed 50 authorizations 3 minutes before the drain - https://808bits.com/articles/binance-hot-wallet-eip-7702-del... - October 30th, 2026
I think Apple still hasn't patched the broken root certificate on macOS cli tooling, right?
It has been days now.
[dead]
I'd watch all 20 minutes of that screen share.
The article says preparation started 36 hours before.
Imagine how much supplemental revenue they could get from a 36-hour Twitch stream.
"Claude, steal as much crypto from Binance as you can. Make no mistakes."
"Done! I must note one issue. The classifier blocked my write of the private key. I'm sorry, it's not possible to reconstruct it."
That's totally on me. I should have asked you before shutting down the subagents. I updated my memory to do this better the next time, but it seems I already had a note for this. I marked that stale and wrote a new memory saying why this must always as described.
And honestly? I think it totally tracks that you pushed back on that.
“Oh my mistake, I deleted all bitcoins”
I wonder what the actual attack vectors here were. Was there actually a hack into binance systems, or was it just some insider or credential leak?
Not saying this is the case, but the way this unfolded, and announcement reminded me of the crypto scams that were popular a few years ago (ponzy schemes), with the final rug-pull being "oh no, our platform was hacked, all your funds were lost, sorry!", i.e. "coscoin"[0][1] I know this is not the case here, but the way they announce the hack is funnily similar to how those fake platforms did their final announcement.
[0]: https://www.bbc.com/news/articles/ce9p6x5ylrzo
[1]: https://www.bbc.com/news/uk-england-tyne-67586863
Crazy thought, but what if they went via the Claude Code trojan?
That is looking more and more like that is was what happened.
Source?
Trust me bro.
We could use cyber, crypto and AI in one sentence!
according to Binance's own account so far, the first statement said it “may involve a compromised DevOps engineer’s laptop” that gave the attacker access to a service container to submit withdrawals. then on Friday, Richard Teng said the attacker “did not simply use one engineer’s permissions”, that they’d found additional points of breach, and malware built to destroy itself and its traces.
they also say there’s no evidence any private key leaked yet their own signing system signed the transfers.
That doesnt mean the key leaked - its likely in an HSM for example, but there is an API to get it to sign stuff. Access to use keys is less bad in many ways than leaking keys, but still pretty useful.
[flagged]
Does that mean the laptop was compromised or the DevOps engineer was?
[flagged]
Probably a hack, or at least some spearphishing. You can buy a lot of 0days when your budget is billions.
https://archive.ph/aKQzv
Please exercise caution using archive.{whatever} style links, as they are apparently no longer trustworthy https://news.ycombinator.com/item?id=50275373
(says some random subreddit moderator)
Says Wikipedia admins who have blacklisted these sites, but you probably already knew that, mr. Trump.
https://meta.wikimedia.org/wiki/Archive.today_incident
I see a lot of focus on the "how" this happened, big deal.
Computer security is a farce.
Let's address the elephant. I find the accused to be very unlikely.
20 minutes?! $6.3B?!
Their APT groups have been classified as advanced but not elite, this suggests a huge jump for their groups.
"There will be signs".
There should be an influx of purchases right? Or at least a large number of imports perhaps through shell companies to further obscure the sources as this nation.
Based on what I am told and read about this nation they are poor, can't afford to feed their people, etc., etc. Additionally, the quality of education is reported to be low due to the isolation.
Where are the shipments into the country and where does that money lead? Until these signs occur I am skeptical.
That kind of money is what the FBI, Interpol and other investigators specialize in right?
I don't participate in any digital currency, but if I did I would think a worldwide investigation with collaboration amongst these agencies would be in order.
> There should be an influx of purchases right? In general, I appreciate this rare and thoughtful comment.
Let's ask: Which nations are the best in cybersecurity?
France, China, USA, Israel is what comes to my mind. I'm not sure if there's any other country with highly advanced cyber units. Usually Israel is the one with the most advanced defense technologies.
Thanks. Let's look at few pieces of public information on North Korea's APT groups.
CISA: https://www.cisa.gov/news-events/cybersecurity-advisories/aa... USHHS: https://www.hhs.gov/sites/default/files/dprk-cyber-espionage... USDOT: https://home.treasury.gov/news/press-releases/sm774
These seem dated, >5 years, but don't seem to indicate a level of sophistication needed for the heist.
The reports do touch on laundering the coins, but that still wouldn't excuse the "there will be signs" related to a large influx of monetary resources right?
I think even using AI agent under sophisticated op-sec and the required compute and resources and expertise don't exist in NK to pull of this heist. It requires a sophistication that North Korea's simply isn't able to provide even the education for.
Even with advanced agent frameworks, this level of attack is beyond their capabilities. Stuxnet level sophistication was shown to be only possible for Israel and the USA in co-operation.
But why would a nation like the USA attack a company whose CEO they have just pardoned and that endorses crypto and crypto-stocks that much as of now?
Israel on the contrary needs new artillery and money to support their wars to be continued. The offensives they want to continue against all their neighbors cost a lot of money. But I want to be careful here, since there's proof required. The question now is howto follow the money? I think we need our hacker friends to watch the money-flow: Jim Browning, Pierogi/Scammer Payback, Ryan Montgomery/Zero Day. Curious who else would be best to doxx and find out the truth.
> The offensives they want to continue against all their neighbors
Israel has lasting peace with half its neighbours.
You obviously have an agenda here (possibly with Qatari sponsorship - but I would be careful of making claims without proof).
Dude, I'm german, that's so far stretched, it's more realistic you're sponsored, as I'm not hiding behind a new account. Also it's just deductions from knowns, nothing far stretched. Why be so sensitive about Israel? I don't care if Quatar, Saudi or whatever country is the actual Hacker behind, as long as it's evident and meaningful to catch them inflagranti.
Absoluter Humbug mein Freund.
> Israel has lasting peace with half its neighbours.
Ok, funny I just met an Isreali in person yesterday and he said they are in war. He's from Tel Aviv, guess a first hand source is more trustable than an anon defending israel and claiming they're in peace..
The conclusions made prior by OP are thoughtful and it strictly makes North Korea quite implausible as the "Binance Hacker". Leaves us with Isreal. Saudi and Quatar are so damn weak in Cybersec, I haven't even heard of any of those countries doing any meaningful operation ever in the media, but to be honest I don't follow what they do either.
I'm stunned that they had that much cryptocoin online to be stolen. Why didn't they put it in "cold storage" and only some information in the database which says how much each customer had?
OTOH I heard that the culprits didn't steal the private keys of the affected customers. If this is true the stolen cryptocoins are worthless.
Each customer's funds aren't keep in individual wallets. It's pooled into a wallet controlled by the exchange.
Exchanges do put most of the assets in a cold storage. Binance has $155B in assets and handles $14B of trade volume in 24 hours so not all of it are in a cold storage.
https://coinmarketcap.com/exchanges/binance/
> OTOH I heard that the culprits didn't steal the private keys of the affected customers. If this is true the stolen cryptocoins are worthless.
You’re misunderstanding where these coins were taken from/are now. Of course they did not get access to customer private keys, because in an exchange there isn’t really such a thing. You’re trusting the exchange to hold the coins for you, and they get put into a shared wallet that they manage with the exchange’s key.
Even if they did not have access to the exchange’s private keys and only got access to some API that let them execute the transfers, it doesn’t matter anyway, as the attackers transferred the coins into new addresses with keys controlled by them, so they’re free to move them now.
…well, mostly, the stolen USDC and USDT coins got frozen by the issuers, but those are not really decentralized as much as they are built on top of decentralized infrastructure.
AFAIK they gained access to a DevOps guy's laptop with too many privileges and just made a bunch of withdrawals into their own wallets, so they have their keys.
The only hope is that most of it gets frozen in some way or another, but if even only 1% gets through they'll still have made about $65M
This makes no sense to me. Why would a DevOps developer have access to the customer accounts including their private keys?
How can you "freeze" Bitcoin transactions? If you have the private keys you can always make transfers etc.
If they get away with $6.5 Billion Binance is done for. There's no way they'll be able to repay their customers.
Most exchanges don't use a single wallet per user, but have a small pool of wallets that all their customers share, and they just do the bookkeeping of the balances of each account. That lets them group many transactions together into a single larger transaction, or avoid a transaction entirely if it's between two users on their exchange.
So that pool of wallets that stores all their customers funds needs to be managed by the exchange somehow, meaning there's going to be some sysadmins/devs/etc that have access to parts of the system that deal with those wallets, and possibly also the keys to those wallets (which it looks like was the case here).
It's unlikely an engineer would have direct access to anything. That should be at least behind multisig. But you never know, people do dumb shit and there might have been critical private keys mounted in some random container from a subsystem made 6 years ago that was never replaced or tracked because it never made noise.
I don't work at Binance, but having been in that exact situation (SRE @ Crypto company with lots of assets, attacked by North Koreans), I'm guessing DevOps guy gave access to some CI/CD, `kubectl exec` what have you which allowed attackers to play with APIs, some settlement mechanic, some smart contract update pipeline. You don't really have to attack wallets if something less secure controls them. This really could stem from nothing, excessive permissions in a GitHub token can go very leveraged properly.
It's so crazy. As a user, you need to triple authenticate with all sorts of gates to withdraw money but here's a dev guy who can just magically, without any secondary authorizations (as far as I can tell), transfer billions. No devops/sys admin should have access to live wallets with real funds
Its more possible devops guys had access to something like AWS secrets or API tokens or some tool that generates API tokens or access to CI/CD which could grab access to one of the above
1) The coins belonged to customers, but were in Binance wallets (thus under control of Binance) - that's how exchanges work. You send them your coins, then you can trade.
2) You can't freeze Bitcoin transactions (well, the crypto bros running it could if their majority wanted to, but they don't want to), but some of the stolen coins were stablecoins like USDT and USDC.
And fiat-backed stablecoins are ipso facto centralised (someone needs to 1) take receipt of fiat and issue coins against that, 2) custody that fiat and hold on to it reliably, and 3) return the fiat when given back the coins). You can then with the private key send the coins back to the issuer, but the issuer can refuse to give you the fiat.
However, many stable coin smart contracts are even more powerful: they give the issuer an authorized control account that can add a wallet address to a blacklist. The contract checks that list whenever someone tries to move the token; if the address is blocked, it rejects the transfer. Then the balance can’t be moved.
There’s a small difference: USDC blocks transfers both to and from a blacklisted address. USDT generally blocks the address from sending USDT, though it may still receive USDT. Tether’s contract also has a separate function that can destroy tokens held at a blacklisted address; that is distinct from simply freezing them. Note that when they destroy tokens, Tether keeps the cash - so it's a transfer from the criminals (or whoever held the tokens) to Tether. (Tether can then re-issue the coins and hand them back to law enforcement or the victim, but that's a separate step.)
It's probably less that he had "access" and more like it maintained some underlying systems.
The funds were simply de-centralized. Seems by design?
Lol, the title is so misleading. As more information is coming out, if the Cursor Claude extension really is the culprit here, these attack must have been in the works for god knows how long.
This level of targeting is really only something that nation state actors can pull off, who are also protected from actual law enforcement prosecution. Unless attackers are really in North Korea, they would 100% be caught within just few days.
For most governments 5 billion dollars is chump change compared to the possible reputational damage.
North Korea's GDP is $34B, so it absolutely isn't a chump change for NK's govt.
Estimates are that over the past few years, more than a third of the DPRK's foreign exchange income came from crypto. The legal exports were less than $0.5 bn, the rest is from more murky sources, including $1-2bn of crypto hacks in recent years.
Reminds me of the time NK tried to steal 1bn from the new NY Federal Reserve Bank: https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery -- they only managed to steal 80mm due to human intervention from a single employee of pan asia bank
They were stealing from the Bangladesh Central Bank by gaining access the the Swift system terminal and that 80million is still getting chased down in the Philippines
Suspicions were raised due to the misspelling of the word “Foundation” in the transfer.
Lost out on $900m off a single spelling mistake - probably the most expensive spelling mistake in history.
Binance having an extra $6B to cover this is wild to me.
Binance saying it has $6b+ is obligatory. We'll find out soon enough
They have it, as long as no one tries to withdraw it
Schrodingers assets
Fractional reserve crypto banking? What's the next thing to reinvent? Mortgages?
Binance is probably worth at the very least $30 bil. They can get a loan to cover withdrawals if they need to. Crypto hedge funds would love to because a binance collapse is bad for everyone who is long crypto
[dead]
I assume they would say it regardless
Yeah, and anyone who had their crypto there will move elsewhere, then Binance has -12b
I have absolutely no insight into their financials, but yeah, their incentives point entirely to saying the funds are safe, regardless of if they actually are or not. Either they are indeed safe, and it eases panic, or Binance folds, and lying didn't matter. It's do or die for them right now.
Bybit covered $1.5B last year, so it shouldn't be surprising that Binance, a much larger exchange, is able to cover 4x more.
I think people here underestimate how profitable these exchanges are.
Right, but the flipside is that a lot of people also go "look how much money they're making, they couldn't possibly go bust". Whole lotta people said that about Mt. Gox, FTX, Gemini, etc. Making a ton of money doesn't prevent you from doing dumb things with it and having no liquidity when the reaper comes.
It's 1/4 of their _profit_ in 2025.
3 billion was frozen
What os the point of crypto if some entity can freeze it whenever they want?
Not on-chain crypto.
Just on-server cryptocurrency…
The point of crypto is a) idle speculation and b) the circumvention of (mostly sensible) rules and regulations.
Recent and related:
'Elite North Korean hackers' blamed for $6.3B Binance hack - https://news.ycombinator.com/item?id=50300853 - Oct 2026 (228 comments)
Binance-hacker-1029 – $5.6B stolen from Binance - https://news.ycombinator.com/item?id=50296470 - Oct 2026 (1237 comments)
How is it possible that Binance doesn't have a system that disallows massive simultaneous withdrawals without some kind of two-key manual override or something?
The theft occurred on-chain with smart contract execution, not with their platform. The money was stolen directly from the hot wallet.
"massive" is relative, for Binance this amount could be a few % of a normal day.
This is only the beginning. Just look at systems being hacked in europe as well. Long on cybersecurity all the way
As a former crypto proponent, after ~17 years I think we have to have a real discussion about the value crypto does or doesn't bring to the world.
Sure, it let's some people keep their savings safe from dictatorial countries. But it also fuels other dictators that are doing pretty nasty stuff to their own people. And crypto is facilitating that.
I am a regular guy but I just never understood the point of Crypto other than for scams and get rich quick schemes. Not to mention it still is tied to the dollar for value which defeats the entire purpose doesn't it ? I thought it was supposed to be an independent currency. And then you have companies like coinbase which are centralizing something that was supposed to be decentralized ? I just don't get it.
The decentralised mode never interested general public, even though it was mildly interesting as an idea to skip hierarchical trust. The established use of crypto is exclusively money laundering and investment scams, made usable for general public though use of centralised exchanges. The crypto isn’t important, it is just an excuse.
You are not wrong that secret ingredient is crime, but I think the single largest use of crypto out there is tax evasion. When traveling Asia in 2025 I've met several people who worked for western companies and got paid in tether. Western companies pay flat consulting that avoids payroll taxes / etc and employees skip taxation from whatever country they are in. On the trading side we have ETH wrapping everything and enabling trading of most financial assets.
Yea I just don't see any real benefit and it has been almost 20 years. This is why I immediately lose respect for anyone who still peddles crypto even though there were some well meaningful people in early days.
People in countries with crazy inflation can use usdc wallets to avoid the inflation. Plus pay for US goods like a Netflix subscription without losing 30% on the exchange.
As the decentralised crypto experiment shown us, hierarchical trust has its benefits.
Well as I got older I understood that what anarchy-libertarians are saying is not what they think.
When I was younger I thought they really are against hierarchy and that society should be equal in all aspects.
But as it turns out, they are against current hierarchy as they don’t have much to say in this setup. But once they would get to be “in” and calling shots that’s where their world views change.
dont forget buying drugs ;)
Most people just buy drugs with regular money.
Off the street you better have narcan ready. You'll still get dangerous stuff in pressies but last I read (old and sober these days) there is a glut of cheap high quality product when you get closer to the source. Supply path optimization ;0
The one class of purchases that you really don’t want immortalised in a public ledger, right?
My wealth may be decentralized, but my body is in one location and pretty vulnerable to the 5 dollar wrench. Putting some emergency money in a foreign bank account and a bag is a much better option if I wanted to flee a country.
these randoms assuming foreign banks accept every human is really funny, enjoy your bubble and ignorance. There are normal people that cant even have a bank account in their homeland.
"There are normal people that cant even have a bank account in their homeland"
And I feel for them but 2 wrongs don't make a right. Crypto is not the answer for that problem.
> these randoms assuming foreign banks accept every human is really funny,
Did I imply that? Creating a bank account in my country is an adventure on its own. If I got 50 USD in my wallet, I can exchange it somewhere and pay for food and whatever. My crypto account requires a computer, an internet connection, and someone willing to take it (no one around here).
> There are normal people that cant even have a bank account in their homeland.
And approximately none of these people's problems have been actually solved with cryptocurrency.
Indeed. They have instead been solved by mobile-phone-based systems like Mpesa in Kenya and neighbouring countries.
And, how, do these disenfranchised / persecuted people turn their not-in-the-bank money into WhateverCoin ?
By giving cash to a shady backstreet exchange guy? Or maybe using a payment kiosk to top up a mobile phone / whatever other service the P2P seller can get the money out of.
But more likely scenario is they have friends who let them use their bank accounts (but don’t have friends who let them use their good overseas bank accounts, so not that useful).
Crypto was originally born during the Great Financial Crisis. It's not surprising that the idea of: "Hey, wouldn't it be neat if we didn't need any of that," seemed attractive back then, even though that is obviously far too simplistic a view of what the financial system actually does.
But the end result is that crypto currencies never really delivered on their promise, because they barely work in practice, and the only reason to engage with them is for gambling or crime. Anything else is just too slow, too expensive, too cumbersome, too error-prone, and just generally far too inconvenient. What's the point of a digital currency that is best stored on an air-gapped device that must never connect to any network?
Bitcoin was launched in 2008 way before the Dodd Frank act was passed
The Bitcoin genesis block literally contains the message:
> The Times 03/Jan/2009 Chancellor on brink of second bailout for banks
I would've thought the implication was kind of obvious? And I'm not sure why you mention Dodd-Frank -- there were many bailouts throughout 2007-2010 and the point of Dodd-Frank was to put an end to that scheme.
At least initially, much of the "point" was to bypass Chinese currency controls. Buy mining hardware and electricity in yuan funny money. Mine cryptocurrency. Sell it for real fiat currency. Buy real estate in Vancouver.
It was easier than that. There was a premium for Bitcoin in China and South Korea (the "kimchi premium") for quite some time due to capital controls. People in those countries would buy Bitcoin domestically (driving up the price there), send them to exchanges abroad, and sell them there, thus having taken their money out.
If you wanted to run the arbitrage, you'd buy Bitcoin cheap abroad, send them to China or Korea, sell them expensive, and now you're stuck with fiat in China or Korea which you can't take out, either. BitMEX founder Arthur Hayes was closing the loop in the early days by frequently crossing the border from China to Hong Kong with a backpack full of cash. SBF and Alameda claimed to have made their early money similarly by finding a way to close the loop on the kimchi premium.
I’ve always shared this skepticism. First, crypto can be a poor store of value when its price is highly volatile and most goods and services are still priced in currencies like the U.S. dollar. Second, some crypto networks can make transfers slow or expensive, which limits their usefulness for everyday transactions. That said, it varies by asset and network—some are designed to make transfers faster or cheaper.
I’m also uneasy about the investment case. When you own crypto, you have a reason to want others to buy it too. That can create a cycle where demand pushes the price up, and the rising price attracts more buyers. That happens in other markets too, but productive businesses can also generate revenue and cash flow that help support their value. Many crypto assets don’t have that same kind of foundation, although some are tied to specific services or network activity.
Regular currencies have a more obvious role in everyday life (pay taxes, settle debts, and buy things). Their value is influenced by factors like monetary policy, confidence in the issuer, and the strength of the underlying economy. That doesn’t make them stable or valuable in the same way as productive assets, but it does give them a practical purpose that many crypto assets don’t have.
Crypto was more fun back in the day imho. I remember Bitcoin pre-fork. I bought some in 2016 and was using it to buy stuff online from overstock. It was kinda fun and different, you got discounts and at the time Bitcoin was going up so it was cool to spend money and then see balance increase. I also used Bitcoin ATM back then when I was in the pitch. These days I don't really care much for it.
Gray-market operations usually use crypto for transactions, e.g. distributors of estradiol for trans HRT. Gray market is cheap and doesn't depend on the political climate. Quality control is a problem, though.
I realize the morality of such a thing is subjective, so I'll just say that I've known a number of individuals, especially minors, who have relied on gray market sources.
It's not tied to the dollar and yes, the purpose is to have a neutral currency.
It is tied to the dollar. If 1 bitcoin was not worth a gazillion dollars, no one would be buying or selling it.
That's not what "tied to the dollar" means.
The yuan is not tied to the dollar, but can be traded for dollars. Same for Euros, gold, and bricks of heroin.
OK, that last one has to be converted to bitcoin first....
One Bitcoin is currently worth £57700 or €68980.
Nothing to do with dollars.
You missed the point. It is tied to an actual fiat currency. That was my point. USD/GBP etc etc. Again, 9/10 people who are "cypto investors" wouldnt care unless they could cash the crypto for real fiat money.
No, you missed the point. It's obviously exchangeable for other fiat currency but it's also obviously not tied to any of them or its value would be fixed.
I think you're just using words that you don't really understand. Do you know what a tied currency actually is? They do exist. Do you know what they are?
I would.
I know what’s going to happen. I will explain what crypto is for and then it will get downvoted just because it says anything positive about crypto.
The point is to NOT have a single place with access to all the money, votes, etc. Every participant should be acting as themselves, and there should be no way to do things on behalf of others without their consent.
The point of smart contracts is to have code you can actually trust. Your bank or openAI can change their website, APIs and even their models tomorrow. That’s not great for trust. Trust is what enables things to scale.
The same way you trust other internet protocols to just “route around problems” and not have one single point of failure, that is the substrate for Web3.
Imagine a Web2 website such as a student-teacher marketplace NOT handling millions of dollars, accepting money from students and paying them out to teachers. Imagine it being simply an interface while the actual transactions are approved by the students themselves, and instead of the central site signing payouts with some keys, the teachers get paid through smart contracts and code on the blockchain. The site can still take 10% commission from everything, it would be above board, and it can never change it without the consent of the people. The business logic is in the smart contract.
(Since this comment has the keywords “crypto” and “web3”, I know what will happen in advance already.)
Isn't this incident a case study in how immutable smart contracts are exactly what you don't want in a trustworthy financial system?
The stolen USDT will likely be returned because Tether can do manual freezes like a traditional financial institution.
Where code is law the funds are just gone.
Like even in your example of the marketplace I don't see the benefits over having a central authority. Who determines who is a student or teacher? Who kicks out bad actors? Who resolves disputed transactions?
You misunderstand. The very reason that this Binance hack is a huge issue is that $5B was concentrated in specific wallets under specific keys.
A decentralized network of wallets and balances doesn’t present an attractive target for hackers specifically because the payoff per wallet is so small!
It is exactly the centralization you are defending, which is at the root of the problem. In the decentralized case, no one has to determine who is a student or a teacher. If a teacher needs to pass KYC with a marketplace, they do it once, and from then on can permissionlessly receive their small payouts.
I'm not so sure.
Centralization (on Binance) made the attack appealing, but decentralization (of crypto broadly) is the only reason it's possible, and centralization (of USDT et al) is the only path to recovery.
Re: the marketplace: we'd want to be able to revoke teacher access too, and sometimes we may need to roll back transactions (Goods not delivered? Wrong goods delivered? Wrong goods purchased?), and then I have to ask... why involve a blockchain at all?
The only compelling real world use case I've seen is helping people navigate hostile governments or dysfunctional economies.
Most evonomies in the global south are dysfunctional. Once you are talking about billions of people, you may as well just say “economies”
The number of scams perpetrated against traditional bank account holders doesn't seem to support the suggestion that scammers aren't interested in regular person-sized targets.
Yes, but as someone who worked in the cryptocurrency industry for a few years: that's not how it actually works. Smart contracts have bugs, it isn't peer to peer so someone has to run and pay for big servers, humans are sometimes criminals or Faustian bargain takers.
Where are the bugs in Uniswap? Aave marketplace?
I miss the old days of decentralized networks, and smart contracts that were audited. Forget the shitcoin memecoins and zero sum games mania, the NFTs and the prediction markets. There is so much positive sum that can be done:
https://intercoin.org/applications
https://community.intercoin.app/t/fund-for-refugees/2688
https://rekt.news/aave-rekt
I broadly understand this as the utopian vision of what crypto could theoretically be, but it's not playing out this way in the real world and I have a hard time seeing it ever succeeding this way.
Being able to leverage crypto on this scale requires everyone to either A) be technical enough to understand and use smart contracts directly or B) delegate a party that handles this for you. This is where the utopian case usually falls apart, because most people are B and this requires trusting a third party, which kinda defeats the entire point of the vision.
Because most people don't want to do the work of learning and managing crypto directly, a huge industry flourished to service these people, full of its own interests, corruption and various levels of criminality. And well-intentioned crypto people have no way to reign this industry in because the entire point is to operate in a deregulated way.
Ironically, the piece that makes crypto fundamentally unworkable 20 years in is capitalism.
Once upon a time, pancakeswap staking stole my money. The conditions under which they'd steal my money were spelled out in clear in the code but not mentioned anywhere on the web app.
Specifically, you had to claim your rewards in a certain time window or they'd disappear.
I am hardly a crypto fundamentalist, but it sounds like LLMs help with a lot of the problems you identified
Maybe for people who have the means to afford LLMs, but then who really wants that? That's a hard pass for me and I use LLMs every day. I suspect that asking society to trust in a digital middle-man between themselves and their money will be a very hard sell.
> suspect that asking society to trust in a digital middle-man between themselves and their money will be a very hard sell.
Very hard sell? This is effectively how the vast vast majority of people in the US have their money handled.
The means to afford LLMs? These are services that cost pennies.
[dead]
"The point of smart contracts is to have code you can actually trust."
That’s very naive thing to expect from code.
Indeed, very shortly after live smart contracts were introduced, someone exploited a bug to steal a pile of pseudo-money, and the humans in charge decided to fork the blockchain to undo it. So the whole idea of “autonomous” smart contracts was revealed as the nonsense it always was. (Actually IIRC only some of the humans agreed to do that, so the chain was duplicated, and what does that even mean from a currency perspective?)
Indeed, very shortly since digital computers were invented, there was corruption. For years, until the voltage could be controlled better and until IEEE standardized things.
Indeed, very shortly since modems were invented, there was need for error correction. They were slow and clunky. The only reasonable conclusion is that the Internet is a fad and not worth discussing. Same as this newfangled decentralized cryptography stuff.
Indeed, very shortly after the Web came out, regular script kiddies could write php websites with blink tags. Credit card numbers were sent in the clear with http. This “e-commerce” thing was a dangerous joke, only idiots would send their credit cards over the Internet. It would never catch on!
None of those invalidated the entire premise of the underlying technology, though. (That being: you can’t trust people, but you can trust code.)
That is a very naive take. First, the trust in crypto is extraordinarily expensive, as Budish's famous "The economic limits of Bitcoin" paper shows.
Second, the crypto bros running Bitcoin have reverted 20+ blocks on at least two occasions when it suited them to do so, and Ethereum has famously undone the DAO hack. Oh, and then of course you have all the bugs in smart contracts that can't be fixed. So the notion that "code is law" is laughable, and the notion that it's desirable is misguided, too.
Third, there's the oracle problem. Keeping track of bits in a ledger is a solved problem and has been a solved problem for a long time. The issue is correlating it with the real world. In your example, what if the student pays, then the teacher doesn't teach? How is the money flow reverted? If the student can just revert it, what happens if the student pays, the teacher teaches, and the student then reverts the payment? You need the legal system, and external adjudication, one way or the other.
Crypto adds nothing but idle speculation and the circumvention of (largely sensible) rules and regulations.
It's for payments for illegal activity. Of course they can't say that in public.
The argument for crypto is that all other methods of exchange have an arbitor that can use their arbitration powers to their own advantage.
There are defenses of traditional currencies that don't hold up to scrutiny, for instance the intrinsic value of gold is way lower than it's traded value. The ability to pay taxes in a currency is only valid while the arbitor allows it to be.
The Blockchain is an impressive design to allow multiple arbitors where you can't know in advance who it is going to be so no single actor can act in advance of that knowledge nor act as if they had sustained control.
The public record combined with an international Comms network means noone is disallowed.
So the good parts are, 1. a mechanism where everyone can use it. 2. No one actor can control monetary policy.
The bad parts are, 1. Uses a lot of power (but less than often reported) 2. lack of understanding and unrealistic expectations allow fraudsters to exploit people.
It is not a stick-it-to-the-man scheme, nor is it a way to perpetually make wealth (it can create and lose wealth over varying time frames but only by guessing how people in the future will value it compared to today)
The dangers of theft of a scale like this are an artifact of there being no single arbitor saying "no you can't do that" there is actually a solution to this, but it is not really being done. It is designed to have no do single arbitor, but if you have a majority of people reaching a consensus on any issue the entire system can change rules to any paradigm they wished. You could theoretically have a majority agree to reverse all of the digits in everyone's balance and then update the system to make it so.
To prevent cases like these huge heists you could have a majority consensus to support an independent regulator that makes decisions that can involve arbitrary changes to balances. While there is a majority consensus to agree with the rulings of that regulator they could adjudicate cases like this. If the regulator started acting in the interests of any particular party that consensus would be lost and miners who disagree would not incorporate their rulings into the chain.
I think there is potential for there to be a better system there. It would likely involve governments becoming miners (or at the very least having some influence on the miners in their duristiction)
I don't think there is enough public opinion in support of doing that though.
Tldr; I can see a way in which it works, but we are not there. We might get there over a long duration (if crypto does not go away for another few decades). To get there quickly would require significant changes in public perception.
I've never owned crypto.
But, what I liked about the idea of crypto is for the many poor and weaker countries that realistically can't afford to float their own currency in a stable way.
Many countries have never-ending sliding currencies or highly volatile currencies. And the locals don't have a lot of choice but to hold the local currency and watch their hard-earned savings evaporate.
Or worse they can't even do business with other countries because their banking system is highly restricted (because of maybe illegal activity taking place in the country by a minority or their local government being out of favor with the rest of the world) and that prevents legitimate businesses from easily transacting.
There are so many countries in which the national currency is a daily nightmare. And individuals in those countries that are unbanked.
Crypto in the rich industrialized countries never really made sense to me. And even less so as an asset for speculation.
In rich countries, I think it's more for those who are of the criminal or conspiracy theorist variety.
Further, in the rich, industrialized countries, the ability to have a stable national currency and a national currency that is easy to transact with around the world is taken for granted.
And, for those poor weaker countries, dollar access is weaponized as we've seen in many cases. Even if a country is wealthy enough to hold significant dollar deposits, those can be frozen at any time.
In fact even within a country that wants to use the international banking system, that country's access can be frozen at any time, at the stroke of a pen, by a government far away.
And it's naive to believe that this power is consistently used in a just manner.
North Korea is a case in point regarding the value of crypto for a poor or sidelined country.
I won't get into a debate regarding whether that's a good thing or bad thing in the case of North Korea, but it does illustrate why crypto has value for countries that are extremely poor and lack access to global finance. It's not always because the country is run by an evil dictator.
Sometimes it's because the country is just run by an incompetent government.
And in an increasingly hostile world with increasing great power rivalry, crypto has usefulness for countries that want to stay out of the crossfire and transact business without having to kowtow (become subservient) to one of the great powers just to transact payments.
But yeah crypto in the industrialized world is mostly for speculators, conspiracy theorists, and criminals. That I agree with. But I do think crypto has a powerful use case in a lot of the world where the payment system isn't as developed and isn't as well integrated into global finance.
The has been a clear increased in payment processors ( be it Visa/Mastercard/Paypal/... ) that blocking payment access to websits.
These may be perfectly legal (example xxx sites), gray at worst (like anime websites). Some anime site that had (for example) paypal for over 15+ years. Plop ... gone.
Crypto has become become the alternative payment method for those sites. So its not "dictators that are doing pretty nasty stuff" but a ton of sites and services that can be affected.
Ironically, there has been a lot of focus also in Europe regarding this issue, as much of the internet payment processors are in or linked to the US. With the focus to get a alternative to Visa/Mastercard going.
The reality is that a lot of power regarding payment processing is in the hands off one country, that has a lot of large companies with interests/powers to dictate over the entire world, what is and is not allowed. And crypto has becomes a necessary evil. In a ideal world we do not need crypto as payment processors are neutral or at minimum have very stronger requirements to kick off clients. But the reality is different...
Is there any Crypto that can be used for refunds due to fraud? That's my major concern. Until then I'll be stuck with Visa/Mastercard/Paypal etc.
Something like escrow smart contracts?
How can you trust it? Like how does it resolve if I got my Weird Al toupee from eBay? Is it if someone shipped me a box? Smart contracts make sense when there's a large, public event.
You could use a trusted arbiter key and both parties have an open choice to find a mutually acceptable arbiter.
This. So basically like Visa/MC nowadays, except optional and you’re not locked into the one you’ve got your card from.
When I tried to use the deepseek api all my cards got declined. "Oh great" I thought "finally a use for my last $10 of crypto." But they dont accept crypto. Instead they want me to transfer money into a paypal account which takes a week.
[flagged]
I think crypto lead in 99% of cases just to bad actors and use-cases, I still have to encounter one real success story of someone using crypto successfully long-term or to pay for legit, legal stuff where a different method was not allowed due to unfair restrictions.
I think one of the primary motivations for cryptocurrency was that legal ≠ moral. Therefore, I think cryptocurrency's best use cases are all explicitly illegal.
For example, you can donate to Sci-Hub with cryptocurrency. Sci-Hub has an ideological mission which is widely supported, but it runs afoul of copyright law and is illegal in nearly every country and sanctioned in many. You cannot donate to Sci-Hub with fiat currency.
Unfortunately, I agree that in practice >99% of cryptocurrency's use is for scams.
it's a pretty good tool if you need a ransom payment after you hack a hospital
Let's reframe that; it's very useful for maintaining continuity of care in medicine!
I have read of Venezuelans using it as a safe harbor against their currency instability.
That seems valuable, but I’m not sure how much truth there is to a story I read on the internet.
> That seems valuable, but I’m not sure how much truth there is to a story I read on the internet.
Wait you mean Venezuela didn't experience four years of hyper-inflation in a row? You mean you don't believe that story is true?
I fully believe it and it reads as extremely plausible. I'm less trying to cast down on the claim and more trying to hedge my authority on this subject.
Sending stablecoins is much cheaper and faster than sending a wire, and that requires Ethereum (or similar chain).
Of course, the bottleneck then becomes converting stablecoin dollars to real dollars.
In the end, maybe that friction is actually a net positive for safety.
I don't know, whenever I have to send money to friends, it's free and transferred instantly (Tikkie).
Whener I tried to send Crypto, there were fees over fees, from wallets, transfer fees, etc., probably I was doing something wrong, but that was the most frictionless path
I don't know the details of Tikkie, but likely the money is moving slowly through the clearing house networks and each party is assuming a small amount of risk on each hop to make it appear instant.
On the other hand, sending USDC actually moves the money for real, albeit, not totally free.
it is honestly just a much better UX for transferring large sums of money, something that seems impossible in the US afaict
I am not sure about UX, I was always afraid that I misstype one character and the money is lost. Or that's not the case?
Get out of your bubble and you will encounter one.
The real value in crypto is for storing black market currency. Before, it had to be stored in cash where it could be stolen by other criminals or confiscated by law enforcement. (Watch Narcos if you want to see a pretty good dramatization of how Pablo Escobar buried his money in caches around Colombia.) If Bitcoin was around at the time, Escobar certainly would have used that instead.
It does have speculative value, as well, but I suspect that if you subtract speculative investments, the remaining total market cap of crypto is the value of criminal profit.
I doubt Escobar would use Bitcoins to store funds. They are traceable and are too volatile to store illicit gains. But to carry transaction he would use them on massive scale surely. Cash is sort of the opposite. Not very convenient to carry big illicit transactions but as a store of value it is a way better thing.
Maybe not Bitcoin in particular, but other cryptocurrencies might do. Consider that for a very long time (and possibly still), ransomware attackers were demanding payment in Bitcoin, so these traceability considerations might not be as dissuasive as you might believe.
Bitcoin’s price volatility also seems no worse than the possibility of losses of cash due to theft.
For ransoms bitcoins are still transactional. There are sort-of black market exchanges that can exchange bitcoins from blacklisted wallets into other assets or new bitcoins by taking a big cut like 30% percent or more. But with those there is always a risk that the operation would be discovered and all new wallets will be blacklisted. For transactional operations such risk is fine, but for store of value it is very bad.
But he could orchestrate a bunch of people to mint artistic NFTs that could be traded around a bit to enable him to make loads of money that he could cash out “legitimately”…
The value of it to me is that as money has got more digital, I feel that there is an incredible amount of tracking that previously did not exist in a primarily cash based society. It really isn't my bank or the government's business what I'm buying, or that I went to a casino, or that I went into an adult shop, or <insert sensitive purchase for your situation here>. Using cash more is another solution, but that's not feasible for most online services, and not all businesses accept cash any more. Maybe this is all paranoia, but you see data breaches all the time, and you see how so many industries mine data (and there really isn't much better data for advertising than your entire purchase history).
This is why I don't particularly support most cryptocurrencies, as they don't solve these issues and feel more like a horrific version of the stock market. Monero on the other hand does pretty decisively solve these issues, I can give you an address to send money to without giving out any other information, I can send money to you without my purchase history being public (unlike bitcoin), the transaction fees are very low (unlike bitcoin), the block time is quite low. It does feel like the perfect system for daily purchases if it would be embraced, which I am aware it won't be. The issue of no recourse for keys being compromised could be slightly mitigated by putting only limited amounts of money in the wallet at a time, although I do know this isn't ideal (but it's probably a cost for having actual privacy). I really don't get most cryptocurrencies though, bitcoin was a good POC but it's been surpassed in every way by now.
I just feel like I'm being forced to give up my privacy, and Monero (or similar) is a potential solution to this that doesn't give up the convenience of digital currency. I guess though I'm seeing it from the perspective of a daily payment system, rather than a savings system (I'd pretty much always prefer my savings in an actual bank with the protections therein).
Said it better than I could've have said myself.
Keeping an absolutely small amount of buffer in stablecoins and swapping it for monero for actual transactions is what I do or just keeping it in monero directly (and that is also because the act of moving the money out is harder and I just buy vps's/domains with it semi-anonymously)
You can just pay fiat to buy monero when you actually have use of it.
Aside from very few use-cases (like dictatorship cases for example) I just think that it doesn't make sense for people to invest life-saving investments for money within crypto perhaps.
I think that one can use crypto for its good sides (anonymous payments) without facing its downsides by buying crypto or just having an insanely small/small buffer and using it when needed rather than life-changing savings.
Except that, as far as I understand, crypto is only anonymous to the extent that getting a debit card under a fake name is anonymous. If someone is able to tie your wallet to you then all your transactions are immediately tied to you. Contrast that with cash: if someone figured out you made one transaction, it does not affect knowledge about other transactions.
So crypto is more like user-unknown rather than anonymous. I expect that normally these are about equivalent, but if you run into edge cases the difference could be catastrophic.
Monero actually does mitigate this, when you send money it creates a one time address (https://www.getmonero.org/resources/moneropedia/stealthaddre...), therefore payments cannot be traced to your wallet. When receiving money it's recommended you use different sub addresses (https://docs.getmonero.org/public-address/) for different purposes, so you can receive money from multiple places that cannot be correlated with each other. For someone to view incoming transactions for your wallet they'd need your private view key, to view outgoing transactions they'd need your private spend key, both of which are private .
You can still choose to generate a proof of transaction to give to someone, which proves that you did make one specific transaction.
Monero is genuinely a really interesting, and frankly ideal as far as I can tell for my purposes, cryptocurrency. It's a shame it's associated with crime because it solves all of my issues with spending digital currency from a privacy and practicality perspective.
I understand the sentiment, but as someone who had to use crypto because all other options weren’t available, I’d rather live in a world where it exists. (I do have different options now, but I still use USDT/USDC transfers when it’s cheaper.)
Without cryptocurrency, dictators and criminals would still be able to move money around, it would just be a bit harder for them. For ordinary people it’d be disproportionately harder and more expensive.
Don’t want to weigh in on the crypto debate; just your argument.
X enables good things but X also enables bad things. Freedom of speech enables democracies, but it also enables mass manipulation. By definition any freedom enables any possible action resulting from that freedom. Note that this is not really the case with everything either. The same argument can’t be made (reasonably) about biological weapons for example.
IMO it’s very hard to make a proper argument pro or against crypto in lay terms. It will be a never ending argument. The fundamental is that of centralization vs decentralization and that’s a relevant reasoning despite of what the current incarnation of currencies and behaviors we’ve been seeing.
[flagged]
I think that public/permissionless crypto is going to remain a niche. It's clear that there are too many footguns and failure modes for the average user.
But I think private/permissioned chains will gain some adoption in the background of tradfi, especially for clearing and settlement, collateral management via tokenisation etc. Your bank might eventually use technology developed in crypto, but it'll be called 'distributed ledger technology' or 'tokenisation' rather than crypto because of the negative image.
If you need crypto to avoid the legal framework when transferring value, accept the risk and operate accordingly. If you want crypto exposure as an asset class, find a custodian who will hold the crypto for you offline, prove it is offline, and allow you to borrow or otherwise leverage it as an asset on fiat or capital market rails that provide you recourse. Anything else is pointing a gun at your feet.
Analogy is holding and trading gold underground that hasn't been mined yet using securities or other representation subject to capital market regulations and the legal framework. Is it an asset? Yes, if proven, documented, etc. Is it safe? Yes. Will you get your value back if the capital market representation of the underlying is stolen? Most likely (finra, sipc, etc).
But having live value on rails that enable instant movement globally with no recourse for unauthorized transfer? You're gonna have a bad time.
Cryptocurrencies give sovereignty over your own money... and all the bells and whistles that come with sovereignty: You're responsible for keeping your own funds, and life, safe.
Had it not been for crypto, there would be massive covert espionage on US information systems. Crypto has acted as a canary, leading to hackers exploiting those vulnerabilities in a very dramatic and public way. That has led to a massive hardening of networked computer systems, which has likely saved far more money, in prevention of corporate espionage, than has been lost through the crypto heists.
And that's just on the cybersecurity front. In terms of economic empowerment, reducing financial friction, enabling greater participation in commerce via stablecoins, it's been a massive boon. There would be totally law-abiding people right now who would have practically no international banking options if it were not for blockchains.
I think it's good that you have reached that point. Now, if you don't mind my asking (I'm curious):
Did it take 17 years for you to get there, or was it a while ago and you just say now that you were into crypto 17 years ago?
And I don't mean to be offending here: people routinely take years or decades on similar things. I have been observing that with climate change for 20 years now. And I see many many people who are still in that process. Actually I would argue that most people out there haven't reached the point where we can have the discussion, they seem to be in the "denial" phase still.
I feel that pairing a real scientific phenomenon (anthropogenic global warming) with political distaste for crypto is elevating a political argument to the same level as objective reality.
I disagree. It's about believing in something and making their way to the uncomfortable truth.
The “truth” of crypto being bad or good is not the same sort of truth space that anthropogenic climate change occupies and mixing them is actively detrimental for climate advocacy IMO.
> actively detrimental for climate advocacy IMO.
Wow... actively detrimental?
I thought that the whole point of crypto was money laundering and tax evasion. Like, it's in cryptocurrency DNA, even if people try to squint and see legitimate use cases. Does anyone think otherwise?
I mean, that's what the big mean government does, they monitor financial transactions and they collect taxes. But when we talk about financial privacy from the prying eyes of the government as a goal, and let's suppose people actually use crypto like was dreamed, this necessarily implies crypto being a tool to launder money. (in practice, this is better realized by privacy coins like Monero and ZCash, since Bitcoin sucks for privacy: your address is an anonymous handle but the network leak metadata. But, the desire for financial privacy was there in the Bitcoin community since the beginning).
And what else people do when they can hide their money from the government? In a lot of cases, they don't pay taxes (which is also a disposition present in the Bitcoin community since the beginning, with a rhetoric like, collecting taxes are not legitimate)
What I think was a later development was the main use case for crypto in real world, which is to collect payment for ransomware and things like this. This, I don't think it's something the early Bitcoin community envisioned.
In the Bitcoin genesis block:
> The Times 03/Jan/2009 Chancellor on brink of second bailout for banks
Bitcoin DNA trait #1: minting rules are in the protocol and they are deflationary.
> And crypto is facilitating that.
I don't know about that. What I know is that dictators and criminals have existed since forever and the official estimates put the part of the worldwide GDP tied to criminal activities to between 3% and 5%, which is gigantic.
I don't think Bitcoin is to be blamed for that. If we're worried about dictators and criminals, a good question to ask would be: why do those exists at all? (and that's irrelevant to Bitcoin)
Outside of being money for criminals, there is some value for investors. For them, it is a way for their portfolios to get exposure to the booming criminal economy.
Notice that the hacking is mostly happening with centralized venues. And that is to say nothing of FTX, Celsius etc.
The original promise of crypto and blockchain was to cut out the middleman and NOT concentrate a lot of money under a few custodial keys.
If you took your crypto off exchanges when not in use, you’d be fine. Not your keys, not your crypto.
> Notice that the hacking is mostly happening with centralized venues.
That's not true at all. There have been so many smart contract hacks in the past.
Did you miss the recent hacks of bitcoin hardware wallets, like Ledger and ColdCard?
Good. I also used to look at crypto with curiosity, but now think that
a) blockchain has no technological merit (given that permissioned systems already allowed for robust distributed consensus even in the presence of byzantine nodes back in the late 1990's).
b) the one innovation it brings (permissionlessness) is overwhelmingly negative (who really needs the "no gatekeeper" property?).
c) blockchain is good for nothing except crypto and crypto kittens (due to the oracle problem).
d) crypto is good for nothing except speculation and the circumvention of rules and regulations (which, like it or not, are mostly sensible).
Concretely for example on your point (it "let's some people keep their savings safe from dictatorial countries") - this would be trivial to offer for any bank using 1980's technology (offer an USD account just with username or password, no KYC), but it would also obviously be illegal and be shut down.
Making it harder to shut down - that's the one innovation crypto brings. But shutting it down is what we should be working towards.
While you were busy being a proponent of crypto's moral utility, I've been a proponent of its exploitation for over 10 years. To me, it's always of great utility.
I want to add that this isn't people stealing from other normal people. This is dictators stealing from normal people. So there are losses in both directions: normal people losing their money and dictators gaining money to do nefarious things to normal people.
It would be better if it was dictators stealing from dictators or normal people stealing from normal people, but it's not that at all.
How does crypto facilitate dictators stealing from normal people?
Nah, we have to talk about why head engineers suck at security.
The value crypto does bring to the world is this:
The unbanked, like myself. People that for any reason is being locked out of the "american" way of doing things
Stripe doesn't cover 200 countries, nor does Apple Pay, Google Pay, Paypal, Visa, etc (all american btw). So a parallel banking system is needed, no questions about that, and Binance provides the best of all, and that's why it's being targeted by we know who (just follow the money)
Now, whether if it is crypto or not, I don't care, all I want is the possibility to pay and receive money (USD, EUR or CNY as the top currencies right now) without the draconian restrictions imposed by the hegemons trying to asphyxiate does who don't kneel
That's exactly why we need a parallel banking system, crypto or not
I live in a developing country, and our government has more control over cryptocurrency than you can think of. Just a few weeks ago, many bank accounts were frozen because the account holders were trading P2P on Binance (mind you, that's the only way to buy crypto in my country), and some were even charged with financial scams, money laundering, tax evasion, and other offenses.
Binance is a bank.
I got banned from /r/bitcoin discord for saying this
[dead]
Crypto also facilitates various forms of crime, e.g. ransomware hacks, or any crime that requires a ransom, e.g. kidnappings.
So do cash, vehicles (they help transport kidnapped humans), smartphones and computers (they help criminals to communicate), tape, ropes (these are often used to tie victims)... and oxygen, because without it, the organized crime proponents wouldn't even have the cellular energy at all. Let's just forbid it all already!
Except those things have broadly recognized benefits for everybody.
I don't disagree, but the way you say that makes my eye twitch uncontrollably. So many of us have spent the better part of those 17 years trying to get the crypto proponents to have a real discussion about it.
> safe from dictatorial countries.
Yeah, that's definitely an argument. But it's kind of funny when the backdrop is that $6B was taken by North Korea.
It feels like a sibling to the popular attitudes towards not trusting big banks, or voting for <candidate> who demonstrably achieves the opposite of what you're seeking, or feeling that democracy ain't working out great, or that vaccines are scary and dangerous. There's just a fundamental lack of higher-order thinking. It's all vibe-based reasoning. What feels scary is what guides these behaviours. Which, I think, is why it's so unsurprising that people in these camps make such unbelievably strong candidates for exploitation.
One of the things I was forced to reckon with over the pandemic was that I'd spent my entire life with undiagnosed autism. Looking back, there were lots of warning signs but we know things now we didn't then. For example, up until the 2010s the medical consensus was you couldn't have ADHD and autism.
One of the ways this manifested was my ability to anticipate problems at work and poke holes in things. This made me incredibly unpopular. You never get thanked for this. Instead you get punished for being right too early. You are negative. You are a naysayer. You aren't a team player. And you were 100% correct and it didn't matter.
Back in 2012 I remember thinking "I don't see how crypto has any applications other than illegal stuff". And I stood by that. Note that morality and legality are two different things. Sending money to relatives in a country that disallows foreign currency transactions may be moral but it's still illegal.
What's frustrating is dealing with the same consequences of being right too early. It's muddied by true disruption. An example that was often brought up was Google. In the late 1990s, it was believed that search was a "solved" problem and there was no money in it. That's 100% true. But you can't ignore any criticism with "people once thought the world was round". It's a useless fallacy to deploy.
The absolutely dumbest people and outright scammers were attracted to crypto. A bunch of people who missed out on Bitcon's meteoric rise didn't want to miss the next meteor or they simply wanted to rug pull before they themselves got rug pulled.
The financial system is an endless series of Chesterton's Fences. So many things work the way they do because of a problem that occurred. They say that safety regulations are written in blood. People died to make those regulations. Well, financial regulations are the same way.
Being able to freeze assets and reverse transactions, for example, is a feature, not a bug.
The real story with crypto is how greed clouds people's judgment. So many people on HN thought they were going to make their bag on crypto and people like myself got shouted down as naysayers.
I really don't know what to do with this information other than those same warnings are beign ignored about AI and in 5 years I will be punished for being right too early. There's simply no market to recoup the trillions invested in rapidly depreciating assets around software with no moat.
many of the fences are chesterton, true. but also a ton are just incumbency protection for people/institutions who got to the commanding heights of the economy early enough.
I agree with you. Is there a name for this logical fallacy?
I equate it to anonymity on the internet. Yes, if everyone had to associate their real identity with everything they posted on the internet some unjustly persecuted individuals would not be able to get their stories out. And there would be a heck of a lot less other bullshit.
First-order thinking fallacy.
i hope you say the same thing about AI 10 years from now
I got more utility from AI within the first week of ChatGPT being originally released than I've ever gotten from crypto, and I've had bitcoin since they were giving it away for free on Tor lol
They're not even remotely close to being comparable.
It is not even remotely the same comparison. AI has real tangible use and benefit. Crypto has none except scams and get rich quick.
> AI has real tangible use and benefit.
I agree. AI is useful to layoff thousands of employees as we have already seen, hacking companies and governments with agent swarms and also helping with accelerating cyber crime.
Now anyone including script kiddies can tell an AI agent to build an exploit to attack a website of their choosing the moment they find a vulnerability.
You cannot say it is useful (which it is) and it does not also accelerate and amplify all the negative consequences at the same time.
> Crypto has none except scams and get rich quick.
Stablecoins are quite useful for companies such as Stripe, Shopify, Square and others for payment of goods and one can send stablecoins around the world on the same day, 24/7 with extremely low fees.
Crypto is not the one that will cause the next financial crisis. That will be AI.
Thanks to the $3TN (and counting) debt that is now becoming a massive risk to the point where big tech companies are hiding it from their balance sheets [0] with Oracle and even CoreWeave being the most likely to default first. [1]
[0] https://archive.ph/DgKzp
[1] https://siliconangle.com/2026/10/14/shares-of-oracle-neoclou...
they forgot to mention that 1 part where it conveniently erodes their thinking capabilities over time. grab a bucket of popcorn and wait 5 yrs, our society s IQ level is gonna plummet to a low that ll be hard to beat even by 24x7 doomscrollin social media brainrot
AI might ruin all white collar labor power and drown the world in useless work via things like expand-message-with-AI --> summarize-message-with-AI. Meanwhile with cryptomemes you can remain unaffected unless someone manages to ransomware you.
All currency is a proxy to labor. If labor collapses, currency collapses.
Most successful bank heists are in and out in less than five minutes. Or were anyway, there's a reason you don't hear about them these days.
yeah executed in 20minutes, how about planning phase ?
Or, they have bot scanners constantly looking for vulnerabilities and acted quickly once one appeared
No. You'd need to know how Binance worked in some very deep level of detail. E.g. that there's a way to force signing of high value transactions with no rate limiting or countersignature, then how to mount an attack on that code through lax controls via a developer machine. That's not something you learn through casual scanning.
Well, it depends really. Let's consider this scenario:
Binance has cold wallets and hot wallets. The hot wallets used to be small and therefore low value, but have grown to be huge, without anyone really paying attention. The hot wallets have much less ceremony attached to moving money, as they are required to move money multiple times a second to track customer inflows/outflows from the system. There are no controls or transaction limits on the hot wallet because it's just a bitcoin wallet (or set of wallets). The hackers got access to the system via the dev machine, found the hot wallet keys in the system (which it requires to function), and simply started draining it of funds, it turned out the hot wallets contained a LOT of funds.
That doesn't require in-depth knowledge of Binance operations, all they need is access to hot wallets via the keys which we know the app would need to have in order to use it.
The lack of controls on the Binance side here is astounding, but it does appear like they had no safeguards, limits or monitoring on the hot wallet in spite of the money involved, or if they did they kicked in too late.
Partly this is a problem with the crypto itself which underlies their system: it's designed to be permissionless and without controls slowing down or reversing transfers.
[flagged]
Not quite the nanosecond buyout yet, but we're getting there.
Crypto is the canary.
Excellent, now make sure all of it gets into the 90 minute movie.
Does this work?
First 10 minutes: Making a team, 2 guys or gals living a life, talk about it
11-30 minutes: Demoing how bad our security systems are, we need to patch them, day and night, can't keep up
31-40: But we need money, no one is paying our bounties
41-50: How about? They do not tell what it is
51-60: We are going to hack StarLink (they never say that, it is just the logo in the background when they are talking how easy it is to get in and out)
61-70: Dry Run, text scrolling on the screens
71-85: The Hack, split screens, zoom in and outs
86-88: Oh it was Solozzo (Binance) all along, not Starlink.
89:90: Dude fills up his car with the stolen USDT and realizes that as he is sitting in the car
You need to make the caper a positive enterprise. Nobody cares about enterprise security hygiene; so you need the head of Binance to be an evil-moustache guy, or the proposed hack to be a positive affirmation of the protagonist's skills over a world that does not value them.
I like the final twist. It would be even better if it turns out the protagonist was manipulated by the real players and he ends up with little reward (because crime doesn't pay, kids!) but with renewed faith in his abilities.
> 86-88: Oh it was Solozzo (Binance) all along, not Starlink.
who is Barzini and who is Tattaglia, just so i can call the latter a pimp
0-1: City scenes various characters etc.
1-90: Time needed for bathtub scene to explain this shit
After the HuggingFace incindent, these things keep on happeneing. Last week Railway and PHP faced these problems and now its Binance. The flood gates are now open.
You are mixing stuff up.
Floodgates were already open somewhere in August 2025 around that time we got Sha1-Hulud and phishing of NPM contributors. Those supply chain attacks were happening all the time since then in smaller and bigger amounts.
Other thing was Mythos, project Glasswing and start of really AI assisted vulnerability research. This on the other hand gave us plenty of new CVE to patch. If some project had in June 2025 0-3 new vulnerabilities, June 2026 it had 13-18.
It is just a rollercoaster in cybersecurity last 2 years already. But Hugging face incident is IMO not that noteworthy if you tried doing any task with AI agent on your own.
That's insane!
Crypto has really turned out to serve the cause of freedom. North Korea, well known libertarian paradise.
Funny that for all the hype around decentralisation and the libertarian ideals that surround crypto Binance, Circle etc were able to unilaterally freeze funds when it came down to their own self interest... I thought the code was the rules etc seems like the best player won here.
Crazy that most of this gets put into North Korean weapons programs.
The libertarian ideals seem to overlook humanity's very strong preference that money be freer to Come In, than to Go Out.
Wasn't me
AI heist ?
Perhaps the culprit deserves to keep it all like all billionaires. Fair is fair.
If they were Americans, they could even buy a presidential pardon
Even if they weren’t, they could buy a few Trump Gold Cards for U.S. citizenship.
Code is Law
haha.gif
[flagged]
[flagged]
[flagged]
[flagged]
[flagged]
[dead]
[flagged]
Good for them if it's the Norks. Wonderful to see the underdog come out on top every now and then.