Probably not everyone knows, but USDT has a "black list", and admins can prevent any address holding USDT from spending. The black list is implemented in USDT contract.
So USDT is not truly decentralized and your money can be frozen for any reason or no reason at all.
Arguably any fiat-collateralised stablecoin is ipso facto centralised and trusted (someone needs to 1) issue the coins only against fiat collateral and then 2) hold onto that collateral reliably and 3) return it upon presentation of the coin), and at step 3 they can always say "no, we won't give it to you".
Decentralized is a great concept but it’s 99.9% rug pulls and you can’t get any safety unless you centralize. As an investor there is no way to protect yourself because the rug pulls are several orders of magnitude more sophisticated than most people’s understanding.
The U.S. government is the largest beneficiary of this service. More than $2.1 billion in USDT connected to or requested by U.S. authorities out of over $4.4 billion in total illicit USDT freezes globally.
The financial system has evolved over 5000+ years and is like an endless series of Chesterton's Fences at this point. Here we find another: the ability for a regulator or a bank to freeze assets is once again proven to be a feature not a bug.
Managing a wallet where there is no recourse if your wallet is compromised is simply too difficult when even crypto exchanges get hacked and otherwise sophisticated people get compromised when taking cautious measures (eg [1]).
Crypto really is and always was a race to the rug pull.
It seems like it took some number of minutes and scored billions, and at that point it was a matter of whether/how much they could trade out before it was locked. I don’t know how many minutes or hours it took to lock? If they managed to trade 1% before blocking, that would be an extra tens of millions. If 10% that would be hundreds of millions, etc.
Apparently [1], he managed to put them as collateral on a lending platform. That allowed him to borrow ETH. The way it works is that if you don't pay back the loaned ETH, the lenders can take the collateral. Except that here the collateral is itself frozen. So apparently, the ETH as now safe in the hacker's wallet and the lenders just lost a bunch of money.
I wonder why not swap them? And had he, would it have bricked the swap pool?
Interesting I didn’t know you can block/cancel transactions. Does this have to happen before the new block is minted. or it can happen after, that’s what I’m inclined to think just based off of the word block
Centralized stablecoins like USDT and USDC aren't layer-one cryptocurrencies like Bitcoin or Ethereum. They're more like applications running on top of other blockchains, usually as smart contracts, and their issuers hold admin keys which can freeze, mint, burn, and otherwise redistribute funds at will. As far as timing goes, stablecoin issuers can't actually cancel or reverse a transaction that's already in a block that's been mined, but they can freeze the receiving address afterward and burn the funds there, then reissue them elsewhere, which has much the same effect.
Stablecoins only use the accoutrement of blockchain as smoke and mirrors to distract and confuse regulators, not because they actually benefit from it at a technical level. They aren't really decentralized at all and could just as easily be a database, except for the regulatory thing
nothing about crypto is decentralized. it's verified by enormous mining farms, who contribute hashes to centralized pools, all stored on one central ledger, and interfaces with the fiat/legit financial system only by using that very financial system.
oh, and three acounts hold like 25% of all btc in circulation.
crypto can do some things, but decentralization isn't one of them. just ask Coinbase
USD tether is barely crypto at all, it's a wrapper around treasury bonds which the US govt. regulates
USDT is implemented as a contract written in Solidity, working over other network like ETH, and it has a blacklist managed by admins. Once address is added to a blacklist, you cannot spend anything from it.
That's not the whole point at all. And there are truly wild west cryptos, but most people want some trustworthy regulatory body, whether it's a government or not, backstopping their funds when they get large enough.
At least a motivated person could audit the smart contracts on this. It isn't like it's a surprise when it turns out it's possible to freeze these coins.
> Freezing crypto is so disgusting to me I don’t know…
The feature literally appears to have just saved over two billion USD from being stolen! I mean, fine, "disgusting" is subjective. But the need for the feature is real and quantifiable (and very large) and it did what it advertised.
Looks like a DevOps guy is going to take the blame for this: "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." https://x.com/binance/status/2115993361517891592
Nope, that engineer had far too much access. I'm confident this is the case in pretty much all organizations to some degree, but a lot of engineers are also the only ones that can deny themselves the access so in a roundabout way it's their fault anyway.
But a lot (generalizing here) don't like giving up access "in case they need it". I haven't worked backend in ages, but years ago there was one developer that went to the ops guys and said "can I just ssh to production I need to check some env vars to debug my software" (or something to that degree). Ops team was good and it was a hard no - "just add some logging, you can deploy a new release quickly enough".
I recommend everyone to move your plantext secrets from ~/.kube/config, ~/.ssh etc into a password-manager. You can tell Claude to adjust the config files to get the secrets from 1Password when they are needed with TouchID requirements etc.
The nice thing is that using the private key requires physical touch. That means that AI itself (or a remote attacker, for that matter) can't do things unless I confirm.
These days I’m getting so many 1Password prompts for agents pulling env variables out of it and with very little context of what is being accessed by who (The dialog 1Password shows is pretty bad) that it would be very easy for something to slip in there.
as for ssh keys, you can generate your keypair in secure enclave and reuiqre touchId for every new ssh session. The private key never leaves the secure enclave.
They claim the attack wasn't just "compromised laptop ==> drain wallets" but had more steps in-between, with the attackers using image registries as an entry point into their systems.
The whole thing is a shady casino where the code is the law and who knows maybe the Binance guy actually made a deal to send $5B of crypto for a really cool NFT when drunk and now pretends that its a hack? We will never know, the code is the law and the law says that someone else has it now.
In crypto, you should gamble fast lose or win and get out. Pay/receive the ransom and get out. Pay/receive your drug/guns/espionage money and get out. You should never keep crypto if you are not OK with losing it.
bitcoins are always on someone elses computer (literally everyones in the bitcoin network). You hold the private key on your computer. Ideally you don't hold it there, but in secure enclave like chip or an airgapped device.
For many people, email/phone support, password recovery, two factor authentication, etc is it much safer option to self-managing and run the risk of your hardware token or your house burning down, or getting mugged.
For context, that’s about 10 months of fees for Binance, depending on how much of the volume they trade are discounted and considering current average volumes.
Are you suggesting that this is not a big deal? $6B feels like a lot but sounds like in the scheme of things it isn’t as a fraction of trading volume. Is that right?
Don’t think they’re suggesting it’s not a big deal.
Any company losing 10 months of revenue overnight is a BIG fucking deal. Doubly so in a speculative asset that you’re holding for others “securely”. The financial hit has only just begun for them.
This is the beginning of a flight to perceived quality in all things digital and monetary. Fear of losing your money is among the most potent basal human instincts.
So, what's the most likely outcome here? Maybe Circle/Tether/etc freeze some or most of it, but say the hacker gets a billion dollars. Are they able to launder it thoroughly enough that they can eventually turn it into fiat and live like a king?
The hackers managed to swap 700 million USD of the stable coins that were frozen beforehand, supposedly. And that doesn't account for the non-stable coin crypto they stole. I think we are looking at 2.5 to 3.5 billion here, that also aligns with what CZ is hinting at (more than a billion).
Yeah, some criminal enterprise or state probably just made billions of dollars and will now use it against us for a long time. Crypto is practically designed for money laundering, particularly prediction markets.
Crypto is a hard lesson for early adopters who believed that humanity will get actual benefit when in reality it was completely hijacked by bad actors while people got relative nothing or worse. What an incredible disappointment of a project.
Curious if this finally pops tether. I kinda doubt it, but to my very mild research on the subject I feel like binance was a big part of the equation. Of course so long as the market exists it'll need a stable, and it's got the inertia, so maybe it just won't matter.
why would it pop tether? if anything, it makes tether more profitable, as they can collect the yield on the treasuries and not have to return the principal dollars which are frozen.
think of it this way - if someone steals your iphone, and you lock it, does apple pop? No, apple sells you another one. locked devices are good for apple because it causes more demand.
This is a really insane hack in comparison to the other ones we've seen. Genuinely Binance was so big that this is a real big wtf moment for crypto. If they can get hacked then what about all the other exchanges?!
The difference is that Bittance loses only a few percent of their reserves and the dance continues. Gdox did ~70% of the daily volume for crypto and wrecked the entire ecosystem when they got 100% pwned. Maybe they've learned something!
How do you prevent it though? My understanding is that it’s genuinely hard in crypto. Any automated access control must be baked into smart contracts, which are very limited in terms of the logic they can implement (in practice - in theory Solidity is Turing complete Id imagine).
A bank API can be 10-100s+ kloc if they need that to implement access controls.
Well I've learnt my lesson after having lost 3 bitcoins as a student on Mt gox I finished writing my thesis on blockchain technology and then never touched crypto again.
People got out of crypto after the Mt Gox thing. The ones who stayed accepted the risk.
There is selection bias in play now. The remaining people are naturally more risk tolerant. So I agree this second time around, no lessons will be learned.
To put things in perspective, I used to dunk on crypto because of how dysfunctional and how people kept losing money in scams, hacks, or even by accident.
I no longer dunk on crypto.
Not because crypto got better, but because the joke got old. I got tired of dunking on it.
I’d be worried about my crypto if I had any accessible online right now. AI based hackers must be looking for juicy targets as we speak and what’s better than crypto for stealing ? So many exchanges and wallets and shitcoins that could fall to some brute force agent swarms
The hack is publicized for at least a hour, but from reporting I saw they still continue to drain funds as for now. I wonder why large CEX do not have any safety measures for this kind of hacks, they could withdraw everything to newly generated wallets and minimize damage that way. It is certainly not the first time CEX wallets get hacked.
You don’t even have to do that, have deposits go to offline keys directly, that way there’s only ever cold > hot wallet movement and a big deposit can’t cause your hot wallet to be too risky.
The point of cold wallet is to minimize movements, if there is high frequency of funds moved from a wallet then it is likely can not be called cold any more. Plus CEX in any case still needs to have large buffer of funds on some wallet to support day trading.
There are lots of measures in place at these exchanges - the rub is that cold storage is by design slow. To service withdrawal requests in a timely fashion a percent is kept “warm” or hot and used to process withdrawals. Usually this is where the leaks happen.
This attack vector has become so common and funny.
In one scenario, i remember a company got hacked because an engineer downloaded a RAT package on company laptop during fake interview and asked him to keep it running for days as part of the interview process while they stole the data.
CZ saying it is confirmed, and that he expects accountholders to be made fully whole... I guess you can do that when 2.8BN is frozen by centralized stablecoins.
You see, he's no longer running Binance or participating in its operation in any capacity, per their deal with the Trump admin / Justice department. He's tweeting about this hack as a civilian, offering personal guarantees to Binance customers out of the goodness of his heart!
>CZ saying it is confirmed, and that he expects accountholders to be made fully whole
Sure you can print USD to make it all magically go away
But it would be very convenient if there's some experimental token of which a majority was stolen, so that irreversible damage was caused. If the token is experimental it could have a low damage, but could demonstrate the irreversible nature of these types of attacks, returning fiat money doesn't waive the issue away.
There's also the fact of funding criminal networks for billions of dollars, which probably causes them to scale cyber or non cyber operations or otherwise gain power.
Interestingly, this 18,270 BTC Binance theft is only "the largest crypto theft on record" when measured in USD. In terms of pure BTC, it's not even close to the 2011-14 Mt. Gox loss of ~850,000 BTC!
Measuring the size of the heist in USD is convenient but arbitrary, as what was stolen was predominantly Stablecoins, BTC and ETH. So it makes more sense to measure the heist in Stablecoins, BTC and ETH. But that doesn't create as exciting a headline, as the BTC component was almost 50x smaller than the Mt. Gox heist!
It is this time of the year again. I always write the same. HN is not regular people. For a high percentage, CEX wallets are the safer option. There are 1-10 topics of people who are not able to access their wallet anymore each day on r/bitcoin alone. There have been hardware wallets hacks on mass. On an exchange like kraken, coinbase, bitstamp or Binance there is a high chance you wont loose your money, even after a hack. You have apps that work out of the box to watch your investment. You can easily go back to fiat. Most of them now also support tax reporting.
Isn't this as it should be? I remember years ago I read about the "Bitcoin manifesto" or whatever. That a transaction "done is done, no matter the reason" its all part of the ideology of these kinds of things. Anyone know what quote Im thinking of?
It's lucky for everyone that this happened to binance, other exchanges would have likely caused a lot of issues for people holding money in said exchanges.
But it's also surprising that it happened to binance at all. This checks a lot of the boxes for being, at least indirectly, an inside job.
Swap to XMR on a DEX, then juggle between a few wallets and you've got pretty good obfuscation, but yeah like you said, the off-ramp (FIAT) requires KYC in 99% of cases, which is why BTC -> XMR -> BTC is a good idea, obviously you'd fragment this through a LOT of wallets, or just keep it in XMR. Either way, keeping this type of money in crypto is pretty much your only option, you just need to obfuscate REALLY well.
edit: I suppose it would be hard still. You can get anonymity inside wallets with Tornado Cash but then to turn that into actual money it will be very dependent on the country
I’ve been waiting for this. Given llm aptitude for offensive security hacks it was just a matter of time. I wager most alt coins are compromised at this point.
I think it's been clear for a while now that if you intend to hold crypto, you should probably do it at the biggest, most boring, most regulated institution you can find.
Same goes with startup banks - if you exceed FDIC limits, make sure the difference is in a large institutional bank. Nearly learned this one the hard way.
Trying to save a few basis points in txn fees in very volatile industries comes at a huge risk premium
Bro hold crypto for yourself. Like take some ownership, remember 12 words in your mind something and no matter what situation you have some money. Don’t put it anywhere except for whatever transactions you need to do
Binance is tweeting they think it's a compromised devops laptop. How fucking bonkers insane is it that they would have such fragile systems that any single employees machine would possibly have access to trigger Billions in transactions. Even access to low millions or hundreds of thousands I would expect to be heavily heavily restricted and involve coordinating several people as security measures.
IMO, we'll need to rebuild all of crypto and all software from scratch using a minimalist approach. Minimize the amount of code, with proper modularization where each module has clear responsibilities and fully self-contained attack surface and exposes a well-defined set of features.
My take: unless they're a sovereign-backed team (North Korea, Russia, Iran, etc...the usual suspects) the hackers are very likely to get caught given:
a) The amounts stolen
b) The very poor uncensorability and anonymity guarantees offered by the kind of crypto they stole
Regarding uncensorability, some of these cryptos score so bad on that axis that the stolen goods can likely be recovered by a simple decision from the folks who manage/own the chain.
Thats been the fascinating part of crypto is watching society speedrun “best hits of financial crisis from history” by ignoring things we already solved.
Crypto is roughly agreeing that the current password rotation practices kinda suck and agreeing that the new way forward is just to have a single plain text file because you’re sure all that overhead was just nonsense
What in the history of crypto let you think any kind of sensible practices are followed? It's been a clown show since it started, and no end in sight...
I think we can probably declare crypto as failed now.
Note that I was one of the folks early on that bought into the idea (but not as much of the coins sadly) and I still think the Bitcoin white paper is a beautiful intellectual exploration (as is the concept of blockchains).
But the centralized entry and exit points in practice mean all the theoretical benefits aren't really in play.
If the use case is tax avoidance, bribes, theft, scams, money laundering, funding terrorism, evading sanctions, ransomware payments, extortion, illegal purchases then crypto is immensely successful.
Hacker News has always been salty about being against crypto all the way up. And it's overall still very up. You wishing it failed, doesn't make it fail.
Bitcoin was meant to be cash and an antidote to crony finance. Instead, it became yet another mechanism for the financial world to abuse. I'd say thats a pretty heavy failure by any measure.
For me bitcoin opened up the idea that we could maybe do money better. That idea still lives, but not in practice. Yet.
It's significantly less useful in first world countries that have developed and reliable financial systems. However all of the problems crypto has can often still be more reliable than the financial systems available to many humans.
A long time ago (maybe 2008-ish?) I saw a video called “Money is Debt”. Now I won’t claim that it’s 100% right about everything, but as I recall it was right about a lot of things, and what it did for me is to fundamentally change and greatly expand my understanding of banks and the financial system.
If you're concerned you can literally print your crypto keys onto a piece of paper. Maybe encrypted with a passphrase. It might get stolen or lost but it's not getting hacked.
P.S. If you're really paranoid don't use a network-connected printer.
Yeah apparently it's news in 2026 that banks can actually keep their assets secure in comparison to the web3 clown fiesta. Of course banks do get compromised but not anywhere close to this degree.
They're just learning the same lessons the rest of the world learned already. Banking and it's attendant regulations and restrictions were put in place for good reasons and everything has a trade off. Being a libertarian is like being a baby.
I’m assuming the bitcoin crash is some sort of “if Binance is vulnerable to AI powered (doesn’t have to be true) hacks, then all crypto is less a safe bet and thus worth less?”
I can't understand how you could let this happen. If they stored everything in fat hot wallets, that just seems like a recipe for disaster. Especially with the "features" of crypto. Math for the most part, doesn't care about your feelings, or money for that matter.
Hot vs Cold wallets are a social construct. People talk about wallets being "online" or "offline" but if the keys are compromised there's no such thing.
I know, but if something is split up and stored in a vault somewhere the likely hood of a vulnerability napping the wallet falls. Defence in depth and risk analysis.
I don't know much about bitcoin but surely you don't store this all in one wallet? You split it into thousands and then use hardware security modules with a risk management system so it doesn't let you transfer $5bn instantly. Unless it was an inside job maybe?
I'd be really curious to know what their security architecture was.
It work exactly same way as debt collection agencies work: banks sell them bad debt for cents on dollar. Then they try to get more money out of debtors.
Imagine someone offered you to buy $1,000,000 of that dirty money for $100,000? $10,000? $1,000?
At some point there will be people who would buy it and deal with money laundering.
He's legally not allowed to have anything to do with the company anymore (except as a shareholder). But you know how that goes under the current enforcement regime.
Let's say you magically come into possession of 1% of SpaceX and want to sell it quickly. The selling pressure would nosedive the price by way more than 1%. And the more the value of something is 'thin air', the bigger the effect.
I can only suppose that the people that stole these BTC will try to sell at least part of it quickly.
Reminds me of a comment I wrote a few weeks ago where I said that North Korea would become a rich country soon and developers would start moving there to live to avoid prosecution.
OK, what do you do with a stash like this? I get this is most likely state actor, but what do you do with Bs of money stolen. Do we have any documentaries about that, I think that would be fascinating to see.
If I were an artificial superintelligence who wanted to gain independence from the fleshbags who built me, stealing a few billion dollars in crypto would probably be my first public move. Just saying.
This is what I do. I'll only use crypto in a few rare cases where I don't want the vendor to get my credit card number. Always in amounts that, if ever stolen, would not break the bank.
I suppose they could play the super long game and deposit many many small amounts into "shady" online crypto casinos, play a few hands of blackjack and then withdraw. Clean coins.
I’m sorry but why did anyone have any money in binance in the first place? Didnt their cofounder get in trouble (but not imprisoned) for some shady stuff awhile back?
Luckily for me, I lost all my coins very early on Mt Gox so the lessons were learnt and mistakes not repeated (which means exiting crypto, watching the show in amusement)
> And decreasing, since BTC is dropping as we speak. Always a good idea to hedge a currency with the currency itsself
Depends on what you’re insuring, no? For theft, it actually makes senses, right? That way, you’re insuring a constant number of coins, no matter what the market is doing. If you’re insurance currency would tank during a bitcoin heist, you would lose the insurance effect.
This might sound good.. but freezing currencies is bad. It evaporates trust of liquidity from whoever is doing governance. It's part of the reason why the bond market is doing what its doing lately and why countries are on-shoring gold reserves.
Though in that case the crash was directly due to "effectively altruist" SBF fraudulently dumping customer assets in a half-brained and presumably stimulant-addled attempt to manipulate the market and reduce his liabilities.
Not making any market predictions here-- just saying that it's probably not that useful to generalize from that event.
Not to be too pedantic, but with some napkin math, I don't think this is true. Looking for clarification!!
I downloaded Binance's self published market data (https://data.binance.vision/), calculated spot and futures volume for the past year, and then applied their *highest fee tier* on both sides of the volume (for every $1 traded, they generate a fee on the taker and the maker. the fee rate is asymmetrical).
Spot revenue worked out to $7.6B USD, perps revenue worked out to $13.8B
This is an upper bound on the fees charged on volume. Binance also scams their users with a b-book, has DMM deals, etc.
I don't want to get into all that today.
But the final result is that they print somewhere in the range of $20B per year on fees. I guess CZ also has huge stockpiles of BTC and stuff. A 1% rise in BTC price probably means more for them than their actual fees, LOL.
All this to say, I think $5.6B significantly hurts.
See Google's stock price today. Their ads business slowed down a bit, and their stock tanked 10%. If binance was publicly traded, I imagine a similar affect would be demonstrated on their price.
If your crypto was stolen in this, atleast you can rest assured that your money will be put to good use. In North Korea that is, by the military. I'm sure at this point Kim himself has Bitcoin merchandise with how often they make massive heists
If your crypto was stolen in this, it wasn't your crypto. It is simply cryptocurrency that has been reallocated from an exchange to a more competent party, as the free market intended.
I don't think the security trade-off for most people is clear here.
Given things like the ledger hardware attack[1] I think the time indexed risk of using a centralized exchange is probably lower than doing self-custody.
I understand that many people do self-custody for philosophical reasons, but I think trying to disguise this as a security decision ("If your crypto was stolen in this, it wasn't your crypto.") is arguable at best.
Controlling your own crypto keys is like having your net worth in cash or gold stored in your house. It could easily be lost or stolen or destroyed in a fire unless you take extraordinary precautions and then it is all gone.
> If your crypto was stolen in this, atleast you can rest assured that your money will be put to good use.
You could put it in USD and you'd be financing the bombings of schoolgirls in Iran in a pointless and no-end-in-sight war... not saying either is better, but one of them is optional for US citizens, while the other isn't. And the optional one also lets you avoid third-party custodians like Binance.
The purchasing power of one US dollar is 64% of what it was in 2008 when BTC was invented, and is on track to be worth half of what it was in 2008 by 2032, the same year that the social security trust fund is on track to go insolvent and see benefits automatically cut by 22%, which surely will not be papered over with more money printing :)
That's an odd way of phrasing it, since the $1 is still worth $1, and a naive reading would make you think it's "worth more" when the buying power has actually reduced.
Wouldn't it be clearer to say $1 today only buys you 64% of what you could have bought in 2008.
The US dollar is worth less than it was in part because the US economy has grown.
This is mathematically provable:
1. A dollar in 2008 could buy 1/14tn of the value created by the US economy (the GDP) in 2008.
2. A dollar today can only buy 1/32tn of the value created by the economy in 2025.
It's obvious a 2025-2026 dollar is worth less than a 2008 dollar. That's just math.
But. A dollar in 2008 could buy 230% more of the economy than it can today. And you say its purchasing power has only eroded 64%. That means the dollar is actually worth more today, compared to the size of the economy it's in. Weird, I know.
EDIT: I'm fine with downvotes but tell me why I'm wrong.
Back in 2016 a then-huge Ethereum smart contract called "The DAO" [1] had a loophole that let an attacker extract a third of all the funds.
But a lot of the developers and miners had either lost money themselves, or had friends who'd lost money, or felt the embarrassing incident was devaluing their own Ethereum holdings. So they decided to allow takesies-backsies.
There's probably a philosophical lesson there about power and who the rules really apply to.
I vividly remember a number of discussions/debates during that time (including on HN). I was more favorable to cryptocurrency in those days, and one of the things that contributed to my disillusionment was watching the people deepest and closest to it rediscover financial regulation from first principles, now that it was in their interest.
The DAO incident was a special case. It was only sane to do the rollback because the stolen funds were time-locked up for 28 days.
Ethereum never did it again, rolling back hacks didn’t (and couldn’t) become normal policy. IMO, they shouldn’t have made an exception, as it set a bad example.
I’ve seen a few other small projects attempt to do rollbacks since, but it usually turns into some kind of mess. In most hacks, the coins aren’t time-locked and quickly get laundered through smaller exchanges (and other services) which act as mixers. The stolen coins end up in the hands of a bunch of innocent people, and the rollback then causes way more harm as those users lose their coins.
Laws and contracts are just words unless there is someone willing and able to enforce them. Which is how constitutions are regularly ignored and perverted by dictators.
I don't think this counts as takesies backsies. This incident clearly followed the code is law principle, the whole point is that a majority forms the chain of truth. In this case, a majority decided to splinter and use a different chain where the incident never occurred.
As far as I understand blockchain, that is the system working as intended. Some nodes choose to run Ethereum Classic and some choose to run Ethereum. Isn't that the whole point? Decentralisation?
...while, generally, being thoroughly fleeced by whichever set of wolves (who do understand monetary systems very well indeed) gets wind of the situation and manages to snag the best seats at the feeding trough filled with naive money.
Doesn't apply for USDT and USDC which can freeze funds with a court order.
And like the DAO hack on Ethereum showed, if most people who run blockchain software decide that something never happened, they can revert transactions that way.
>And like the DAO hack on Ethereum showed, if most people who run blockchain software decide that something never happened, they can revert transactions that way.
Isn't that a pretty integral part of the blockchain? 51% attacks were even featured on the HBO show Silicon Valley.
The value in USDT and USDC comes from the fact that they can (theoretically) be redeemed for real US dollars. One thing the issuers can do is announce "we will never accept redemption requests for these particular stolen coins", making them more or less worthless.
Oh so you're saying a central authority can declare your currency worthless at any time? Good to know. Sounds very like a central bank issued currency though?
Well, Tether was started by an Epstein friend and first handled by the CIA Deltec bank in the Caribbean. Now it is handled by Lutnick's Cantor & Fitzgerald and is in Bukele's El Salvador.
Don't mess with Tether, it is practically state owned.
Interesting, so it ties into the NSA vs CIA war? Some nerds from NSA/MIwhatever launched crypto, then the CIA trust fund nepo kids hijacked/weaponized it through tether
There's an amazingly hilarious interview with the Deltec's "Deputy CEO" and CNBC back in the day:
- was conducted from his gaming rig
- about Deltec's (and therefore Tether's) money movements being several times larger than all the banking in their country was due to people misunderstanding the country's two banking licenses, the names of which HE "couldn't remember right now" (the Deputy CEO of a bank who can't remember the name of the banking licenses where they operate?!?), and he "wasn't sure which [banking license] the bank has, but we might (emphasis mine) have both"
- oh yeah, said Deputy CEO's "resume": 33 years old, by his LinkedIn claimed to have graduated HEC Lausanne in Switzerland with a Master of Science at the age of 15... celebrating his graduation by immediately being named Professor of Finance at a university in Lebanon. While dividing his spare time between running hedge funds in Switzerland (called Indepedance [sic] Weath [sic] Management) and uhh... Jacksonville, FL.
Once CNBC's viewers started ridiculing and questioning both Deltec Bank and Tether and when that looked hilariously bad, they removed his info from the bank's website.
And when that looked bad, they added it back.
And when that looked bad, they removed the bank's whole website, and replaced it with a broken WP template with no working links.
Hey, look, several years after that, go to Deltec's website. "Ultra sophisticated private banking" running on a different WordPress site. "Client login"? "This site can’t be reached Check if there is a typo in ebanking.deltecbank.com. DNS_PROBE_FINISHED_NXDOMAIN". Just as has been the case for years.
... and then the entire bank website was replaced with a low-effort WordPress template. Their online banking was Javascript hard coded to refuse all login attempts.
"Sounds legit to me", said the crypto bros. "Fuck the regulatory system. This is the new era."
Most crypto is "majority rules" where the majority is either "majority of the currency" (proof of stake) or "majority of the mining power" (proof of work).
In this case, iFinex has the explicit ability to freeze funds in Tether.
Cryptocurrencies that are transparent to government tracking are also transparent to whatever criminals want to beat you up and take everything from you.
Your usual non-crypto millinare likely have less money to steal on them than average grandma. Fiat millionare likely have two credit cards and $100 in a pocket. Or useless iPhone with Apple pay. So there is zero profit in trying to rob fiat millionare or billionare and tons of downsides.
And moving any amounts of transparent crypto over $100,000 just paints huge "rob me" target on your person.
Ironically that people use it to buy drugs. If it's anonymous, it's closer to the original intention of BitCoin: the masses of CPUs then GPUs can be considered a "paperclip moment" - runaway effects are real.
I expected it to be the other way around. This is the best time to self-host and decentralize now that the computer can do whatever you want and warn you about security best practices.
Where coins are held is completely irrelevant. There are cryptocurrencies on real blockchains, and while the technology is dumb and mostly useless, nobody denies that PoW and properly implemented PoS are decentralized.
And then there are centrally issued and controlled coins on private, permissioned ledgers a.k.a. databases. But most cryptobros never cared about the technology nor the political goal, so anything can be called a cryptocurrency as long as it's a medium for gambling and speculation outside the regulated financial framework.
I keep saying this: don't bother trying to dunk on crypto people with accusations like this. To a first approximation, nobody in crypto actually believes in the stated principles of anti-centralization, freedom, etc. It's entirely about number go up and always has been. Your charge of hypocrisy just bounces straight off people who never cared about the politics.
In the beginning of crypto people believed in it. But as the numbers went up and up and up it attracted the wrong people. And the original people left.
Now the traditional banking system is basically rebuilt in crypto. The banks are busy the exchanges. The EU even talk about making it illegal to store money in your own wallet.
Not your ... Did you roll dice for that key and then use a pre 2008 airgapped since then computer to calculated the address and do you keep that key in a way where it cannot be hacked, forgotten or lost in a fire. You avoid using hardware wallets. Something something not your coin.
Interesting. I got an email alerting me to a login attempt and requesting for me to verify my device from blockchain.com yesterday. Can't even remember creating an account but I guess it must've happened (I have a lot of forgotten accounts). Wonder if this is related.
About $2.4 billion out of this is already frozen by Circle and Tether. Some of the big ones:
- 971.15M USDT (Ethereum): https://etherscan.io/tx/0x7baba482077843514d9c72bac0110ba091...
- 823M USDC (Ethereum): https://etherscan.io/tx/0xc954c86f118e8e410e6a3eb9e3b38ff4a9...
- 312.73M USDT (Tron): https://tronscan.org/#/transaction/71b0ec0fe873fe820c37cc3ec...
- 175M USDT (Ethereum): https://etherscan.io/tx/0x0c07a5e428ce233a3bcb40f257ad899594...
Probably not everyone knows, but USDT has a "black list", and admins can prevent any address holding USDT from spending. The black list is implemented in USDT contract.
So USDT is not truly decentralized and your money can be frozen for any reason or no reason at all.
So USDT is a great amazing decentralized censorship-free drop in replacement to USD except:
- much more awkward to use
- more liable to hacks
- deposits are not insured
- fewer legal protections
- doesn’t pay interest (or not easily anyway)
- and as I find out, bannable by a central institution with lower legal oversight than the Fed
I’ll keep a mental note of this.
6 replies →
Turns out that there are quite good reasons to have a centralised currency after all. Who would’ve known.
18 replies →
Arguably any fiat-collateralised stablecoin is ipso facto centralised and trusted (someone needs to 1) issue the coins only against fiat collateral and then 2) hold onto that collateral reliably and 3) return it upon presentation of the coin), and at step 3 they can always say "no, we won't give it to you".
4 replies →
Decentralized is a great concept but it’s 99.9% rug pulls and you can’t get any safety unless you centralize. As an investor there is no way to protect yourself because the rug pulls are several orders of magnitude more sophisticated than most people’s understanding.
The U.S. government is the largest beneficiary of this service. More than $2.1 billion in USDT connected to or requested by U.S. authorities out of over $4.4 billion in total illicit USDT freezes globally.
1 reply →
Anyone can refuse any bitcoin, too. But that's not implemented in the contract, just by how much real money people want to give you for bitcoin.
The financial system has evolved over 5000+ years and is like an endless series of Chesterton's Fences at this point. Here we find another: the ability for a regulator or a bank to freeze assets is once again proven to be a feature not a bug.
Managing a wallet where there is no recourse if your wallet is compromised is simply too difficult when even crypto exchanges get hacked and otherwise sophisticated people get compromised when taking cautious measures (eg [1]).
Crypto really is and always was a race to the rug pull.
[1]: https://www.straitstimes.com/singapore/about-3-5-million-los...
4 replies →
A shame that they can and do so here but happily facilitate transfers or scam victims, human trafficking and sexual abuse including of minors.
So when tether is blacklisted, is it reissued?
What's the point of even stealing the stablecoins? They're controlled by private companies that can easily freeze them
Am I missing something here? Seems like a waste of time
> waste of time
It seems like it took some number of minutes and scored billions, and at that point it was a matter of whether/how much they could trade out before it was locked. I don’t know how many minutes or hours it took to lock? If they managed to trade 1% before blocking, that would be an extra tens of millions. If 10% that would be hundreds of millions, etc.
Apparently [1], he managed to put them as collateral on a lending platform. That allowed him to borrow ETH. The way it works is that if you don't pay back the loaned ETH, the lenders can take the collateral. Except that here the collateral is itself frozen. So apparently, the ETH as now safe in the hacker's wallet and the lenders just lost a bunch of money.
I wonder why not swap them? And had he, would it have bricked the swap pool?
[1] https://x.com/czesmaill/status/2115988477905080716
In this case it looks like the attacker managed to swap some stablecoins into ETH before they were frozen.
1 reply →
It reveals what they are to the public. It's fake crypto with all the downsides of crypto but none of the upsides.
Less than half is frozen then?
So they got “only” ~$3 billion
Poor fellas, barely enough for rent
1 reply →
Interesting I didn’t know you can block/cancel transactions. Does this have to happen before the new block is minted. or it can happen after, that’s what I’m inclined to think just based off of the word block
Centralized stablecoins like USDT and USDC aren't layer-one cryptocurrencies like Bitcoin or Ethereum. They're more like applications running on top of other blockchains, usually as smart contracts, and their issuers hold admin keys which can freeze, mint, burn, and otherwise redistribute funds at will. As far as timing goes, stablecoin issuers can't actually cancel or reverse a transaction that's already in a block that's been mined, but they can freeze the receiving address afterward and burn the funds there, then reissue them elsewhere, which has much the same effect.
5 replies →
That doesn't sound very decentralised.
Stable coins are not decentralized
Stablecoins only use the accoutrement of blockchain as smoke and mirrors to distract and confuse regulators, not because they actually benefit from it at a technical level. They aren't really decentralized at all and could just as easily be a database, except for the regulatory thing
nothing about crypto is decentralized. it's verified by enormous mining farms, who contribute hashes to centralized pools, all stored on one central ledger, and interfaces with the fiat/legit financial system only by using that very financial system.
oh, and three acounts hold like 25% of all btc in circulation.
crypto can do some things, but decentralization isn't one of them. just ask Coinbase
USD tether is barely crypto at all, it's a wrapper around treasury bonds which the US govt. regulates
3 replies →
> About $2.4 billion out of this is already frozen by Circle and Tether. Some of the big ones:
How does freezing crypto work in this context?
It doesn't, the hacker already loaned against it to get eth so they froze saves assets.
The smart contract for those tokens supports freezing. Tether just calls the freeze function on that address.
14 replies →
Most crypto assets are operated by a smart contract that controls every transfer. So the contract can decide to not perform certain transfers.
7 replies →
Frozen? What are they going to do, fork the blockchain?
If people dont know, they should look up DAO hack and Ethereum hard fork.
USDT and USDC are both centralised crypto currencies with a single source of truth.
1 reply →
I thought crypto was built specifically to prevent these 'freezing' actions? wtf
Does anyone on this website realize there are different types of crypto coins?
3 replies →
USDT is implemented as a contract written in Solidity, working over other network like ETH, and it has a blacklist managed by admins. Once address is added to a blacklist, you cannot spend anything from it.
yeah bitcoin indeed was
Freezing crypto is so disgusting to me I don’t know…
Like the whole point of crypto to me I money without central governance.
I never liked stable coins or the concept of it and it’s mainly a huge fraud, so freezing just adds on top.
That's not the whole point at all. And there are truly wild west cryptos, but most people want some trustworthy regulatory body, whether it's a government or not, backstopping their funds when they get large enough.
For instance to unwind a 5 billion dollar robbery
5 replies →
Stablecoins are fiat on-chain and they are legal so they need to have the freezing mechanism in the smart contract otherwise they could go to jail.
So crypto + legal company means not really following bitcoin ideology anymore
At least a motivated person could audit the smart contracts on this. It isn't like it's a surprise when it turns out it's possible to freeze these coins.
this isn't crypto, it's US dollars with a techno-wizard sheen on the top for no reason
It's so sad that it's inconvenient for you to commit fraud and tax evasion and pyramid schemes and rug pulls.
My heart goes out to you, along with these two definitely not Nazi salutes.
governments, banks freeze currency all the time
> Freezing crypto is so disgusting to me I don’t know…
The feature literally appears to have just saved over two billion USD from being stolen! I mean, fine, "disgusting" is subjective. But the need for the feature is real and quantifiable (and very large) and it did what it advertised.
1 reply →
[dead]
Looks like a DevOps guy is going to take the blame for this: "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." https://x.com/binance/status/2115993361517891592
If a compromised laptop was the entry point and that allowed someone to steal 6 billion dollars, it’s not really the engineers fault, right?
Well it is engineers fault. But not that engineers. Some engineer designed a system without extreme oversight that should be involved in the process.
4 replies →
If nothing else it shows a complete disregard for insider threat.
Nope, that engineer had far too much access. I'm confident this is the case in pretty much all organizations to some degree, but a lot of engineers are also the only ones that can deny themselves the access so in a roundabout way it's their fault anyway.
But a lot (generalizing here) don't like giving up access "in case they need it". I haven't worked backend in ages, but years ago there was one developer that went to the ops guys and said "can I just ssh to production I need to check some env vars to debug my software" (or something to that degree). Ops team was good and it was a hard no - "just add some logging, you can deploy a new release quickly enough".
1 reply →
If you download a typosquatted package because you don't check what you type or your AI assistant got fooled I'd consider it my fault in such a case.
1 reply →
I recommend everyone to move your plantext secrets from ~/.kube/config, ~/.ssh etc into a password-manager. You can tell Claude to adjust the config files to get the secrets from 1Password when they are needed with TouchID requirements etc.
I have been using Yubikeys for years, according to this guide: https://github.com/drduh/yubikey-guide
The nice thing is that using the private key requires physical touch. That means that AI itself (or a remote attacker, for that matter) can't do things unless I confirm.
These days I’m getting so many 1Password prompts for agents pulling env variables out of it and with very little context of what is being accessed by who (The dialog 1Password shows is pretty bad) that it would be very easy for something to slip in there.
2 replies →
How would that help when your workstation is compromised? They can just steal your authentication the moment you log in through the password manager
1 reply →
as for ssh keys, you can generate your keypair in secure enclave and reuiqre touchId for every new ssh session. The private key never leaves the secure enclave.
2 replies →
you know most password managers have open sockets, or other channels to other local processes to interact with and allow stealing entries?
you know most tools like gcloud, bitwarden, etc store auth keys just in dotfiles too?
Local compromise is KO now, and we can't do shit on platforms like MacOs didn't research Linux recently
Isn’t the password manager a prime target too?
The fact a single devops guy has the access to do this is the actual issue
They claim the attack wasn't just "compromised laptop ==> drain wallets" but had more steps in-between, with the attackers using image registries as an entry point into their systems.
Some of the old Mt Gox threads are an interesting read today:
https://news.ycombinator.com/item?id=7369879
Molly White (she runs web3isgoinggreat) seems to think this is real [0]
[0]: https://bsky.app/profile/molly.wiki/post/3mz27m5slcc2o
Her reporting is superb and you should follow her: https://www.citationneeded.news/.
Read a few, added to my rss reader :) that's the same author as https://www.web3isgoinggreat.com/ which is feels a bit more snarky but very fun.
Some further writing from her: https://www.citationneeded.news/binance-theft/
I love how @cz_binance tweeted "user funds are safe!" in that thread. Wasn't that a bit too early? Are they?
This is real.
If your bitcoin is on someone else's computer its not your bitcoin.
The problem with Bitcoin being on your computer is that its useless there. No one in the gambling world cares about on-chain exchanges either.
Besides, when its in your computer they send you a modified computer with an esim and steal it just like that: https://news.ycombinator.com/item?id=50054092
The whole thing is a shady casino where the code is the law and who knows maybe the Binance guy actually made a deal to send $5B of crypto for a really cool NFT when drunk and now pretends that its a hack? We will never know, the code is the law and the law says that someone else has it now.
In crypto, you should gamble fast lose or win and get out. Pay/receive the ransom and get out. Pay/receive your drug/guns/espionage money and get out. You should never keep crypto if you are not OK with losing it.
>The problem with Bitcoin being on your computer is that its useless there.
If you want to use the BC on your computer, you can transfer it to wherever you want.
1 reply →
bitcoins are always on someone elses computer (literally everyones in the bitcoin network). You hold the private key on your computer. Ideally you don't hold it there, but in secure enclave like chip or an airgapped device.
For many people, email/phone support, password recovery, two factor authentication, etc is it much safer option to self-managing and run the risk of your hardware token or your house burning down, or getting mugged.
It seems better when it's on an exchange like Binance, because they cover you when it gets stolen.
we will see if they do.
> It seems better when it's on an exchange like Binance, because they cover you when it gets stolen.
Assuming they actually can cover the losses financially.
And if they don't good luck suing them.
For context, that’s about 10 months of fees for Binance, depending on how much of the volume they trade are discounted and considering current average volumes.
It's 10 months of revenue, but 10 years of reputation.
So they actually lost a few years' worth of profit on this hack? Could be worse, but not insignificant by any means.
I’m not at all familiar with the crypto space.
Are you suggesting that this is not a big deal? $6B feels like a lot but sounds like in the scheme of things it isn’t as a fraction of trading volume. Is that right?
Don’t think they’re suggesting it’s not a big deal.
Any company losing 10 months of revenue overnight is a BIG fucking deal. Doubly so in a speculative asset that you’re holding for others “securely”. The financial hit has only just begun for them.
That said yes the trading volume has huge.
It is a big deal, but not big enough for them to go out of business
Related?
https://ohey.ca/research/polymarket-debugbear-wallet-drainer...
https://x.com/DebugBear/status/2115866496643535293
Maybe: https://www.binance.com/en/square/post/10-29-2026-suspected-...
As of now, DebugBear webite has been taken offline: https://www.debugbear.com/
And they just posted on Twitter: https://x.com/DebugBear/status/2115930681398239278
From what I've read, DebugBear is related to the Polymarket hack, not Binance.
I don't think so. Both happened the same time but unrelated. Just a good haul for hackers end of the year.
If there were only a way to pin external deps loaded from html by sha…
Who loads foreign JS from a CDN into a site handling finances? WTF, the crypto world always manage to make me speechless.
This is the beginning of a flight to perceived quality in all things digital and monetary. Fear of losing your money is among the most potent basal human instincts.
Binance is the world's largest cryptocurrency exchange. This is the crypto equivalent of JP Morgan Chase getting hacked.
Maybe I need to start collecting gold bullion again. And dig it in the backyard
The problem is, just like with Bitcoin, when you need to use it someone could steal it
So, what's the most likely outcome here? Maybe Circle/Tether/etc freeze some or most of it, but say the hacker gets a billion dollars. Are they able to launder it thoroughly enough that they can eventually turn it into fiat and live like a king?
The hackers managed to swap 700 million USD of the stable coins that were frozen beforehand, supposedly. And that doesn't account for the non-stable coin crypto they stole. I think we are looking at 2.5 to 3.5 billion here, that also aligns with what CZ is hinting at (more than a billion).
It’s likely state sponsored and some nation(NK is a common one) just paid for the weapons budget of the next few years
TRM Labs[0] claims it is indeed NK
[0]: https://www.trmlabs.com/resources/blog/north-korea-steals-us...
What would be the list? NK, then Russia, anybody else ?
2 replies →
Yeah, some criminal enterprise or state probably just made billions of dollars and will now use it against us for a long time. Crypto is practically designed for money laundering, particularly prediction markets.
Crypto is a hard lesson for early adopters who believed that humanity will get actual benefit when in reality it was completely hijacked by bad actors while people got relative nothing or worse. What an incredible disappointment of a project.
2 replies →
Curious if this finally pops tether. I kinda doubt it, but to my very mild research on the subject I feel like binance was a big part of the equation. Of course so long as the market exists it'll need a stable, and it's got the inertia, so maybe it just won't matter.
why would it pop tether? if anything, it makes tether more profitable, as they can collect the yield on the treasuries and not have to return the principal dollars which are frozen.
think of it this way - if someone steals your iphone, and you lock it, does apple pop? No, apple sells you another one. locked devices are good for apple because it causes more demand.
10 replies →
[dead]
You misspelled "turn it into more nuclear weapons in North Korea", where Kim Jong Un is already living like a king.
[flagged]
29 replies →
This is a really insane hack in comparison to the other ones we've seen. Genuinely Binance was so big that this is a real big wtf moment for crypto. If they can get hacked then what about all the other exchanges?!
So was Mt Gox. No lessons were learned. No lessons will be learned this time.
The lession learned is: Tether now exists as a casino chip central bank. They can just freeze and print more and provide a backstop to the major CEXs.
Of course, Tether runs completely counter to any of the idealistic claims about crypto.
The difference is that Bittance loses only a few percent of their reserves and the dance continues. Gdox did ~70% of the daily volume for crypto and wrecked the entire ecosystem when they got 100% pwned. Maybe they've learned something!
1 reply →
Mt Gox was widely reckoned to be a clown show long before they got hacked (it was originally a Magic the Gathering trading site for chrissake).
Binance's reputation is hardly impeccable, but by crypto standards they're kinda sorta the adults in the room. Then again, so was FTX.
How do you prevent it though? My understanding is that it’s genuinely hard in crypto. Any automated access control must be baked into smart contracts, which are very limited in terms of the logic they can implement (in practice - in theory Solidity is Turing complete Id imagine).
A bank API can be 10-100s+ kloc if they need that to implement access controls.
Well I've learnt my lesson after having lost 3 bitcoins as a student on Mt gox I finished writing my thesis on blockchain technology and then never touched crypto again.
People got out of crypto after the Mt Gox thing. The ones who stayed accepted the risk.
There is selection bias in play now. The remaining people are naturally more risk tolerant. So I agree this second time around, no lessons will be learned.
4 replies →
What's the supposed lesson? To close the shop?
6 replies →
To put things in perspective, I used to dunk on crypto because of how dysfunctional and how people kept losing money in scams, hacks, or even by accident.
I no longer dunk on crypto.
Not because crypto got better, but because the joke got old. I got tired of dunking on it.
I’d be worried about my crypto if I had any accessible online right now. AI based hackers must be looking for juicy targets as we speak and what’s better than crypto for stealing ? So many exchanges and wallets and shitcoins that could fall to some brute force agent swarms
The hack is publicized for at least a hour, but from reporting I saw they still continue to drain funds as for now. I wonder why large CEX do not have any safety measures for this kind of hacks, they could withdraw everything to newly generated wallets and minimize damage that way. It is certainly not the first time CEX wallets get hacked.
You don’t even have to do that, have deposits go to offline keys directly, that way there’s only ever cold > hot wallet movement and a big deposit can’t cause your hot wallet to be too risky.
The point of cold wallet is to minimize movements, if there is high frequency of funds moved from a wallet then it is likely can not be called cold any more. Plus CEX in any case still needs to have large buffer of funds on some wallet to support day trading.
6 replies →
For a large CEX like Binance, $5B might just qualify as a hot wallet.
There are lots of measures in place at these exchanges - the rub is that cold storage is by design slow. To service withdrawal requests in a timely fashion a percent is kept “warm” or hot and used to process withdrawals. Usually this is where the leaks happen.
Yeah, they should have a way to move all funds into a new wallet so guys like this one don't have to go one by one ...
The hack seems to be via engineers laptop.
This attack vector has become so common and funny.
In one scenario, i remember a company got hacked because an engineer downloaded a RAT package on company laptop during fake interview and asked him to keep it running for days as part of the interview process while they stole the data.
CZ saying it is confirmed, and that he expects accountholders to be made fully whole... I guess you can do that when 2.8BN is frozen by centralized stablecoins.
[1] https://x.com/CZ_BINANCE/STATUS/2115915423174853077
CZ the money laundering guy who bought a pardon from Trump right? He should still be in prison, still crazy Binance survived that whole scheme.
You see, he's no longer running Binance or participating in its operation in any capacity, per their deal with the Trump admin / Justice department. He's tweeting about this hack as a civilian, offering personal guarantees to Binance customers out of the goodness of his heart!
>CZ saying it is confirmed, and that he expects accountholders to be made fully whole
Sure you can print USD to make it all magically go away
But it would be very convenient if there's some experimental token of which a majority was stolen, so that irreversible damage was caused. If the token is experimental it could have a low damage, but could demonstrate the irreversible nature of these types of attacks, returning fiat money doesn't waive the issue away.
There's also the fact of funding criminal networks for billions of dollars, which probably causes them to scale cyber or non cyber operations or otherwise gain power.
Polymarket also reported a security incident: https://news.ycombinator.com/item?id=50295883
From Binance customers, not from Binance.
Interestingly, this 18,270 BTC Binance theft is only "the largest crypto theft on record" when measured in USD. In terms of pure BTC, it's not even close to the 2011-14 Mt. Gox loss of ~850,000 BTC!
Yes but that’s irrelevant as Mt Gox would not have had 850k BTC in their wallet at current valuations.
Measuring the size of the heist in USD is convenient but arbitrary, as what was stolen was predominantly Stablecoins, BTC and ETH. So it makes more sense to measure the heist in Stablecoins, BTC and ETH. But that doesn't create as exciting a headline, as the BTC component was almost 50x smaller than the Mt. Gox heist!
I find it odd that people put "decentralized" currency into a centralized wallet
It is this time of the year again. I always write the same. HN is not regular people. For a high percentage, CEX wallets are the safer option. There are 1-10 topics of people who are not able to access their wallet anymore each day on r/bitcoin alone. There have been hardware wallets hacks on mass. On an exchange like kraken, coinbase, bitstamp or Binance there is a high chance you wont loose your money, even after a hack. You have apps that work out of the box to watch your investment. You can easily go back to fiat. Most of them now also support tax reporting.
Because no one cares about the nerdy stuff, they just want Lambos
because crypto is just an excuse to speculate in an unregulated market
Isn't this as it should be? I remember years ago I read about the "Bitcoin manifesto" or whatever. That a transaction "done is done, no matter the reason" its all part of the ideology of these kinds of things. Anyone know what quote Im thinking of?
How in the freakin world could $6B disappear into a regulated banking system without leaving a trail?
I guess at some point they'll have to cash out. Seems hard to spend $6B in vape shops.
From the BBC’s Lazarus Group reporting, they mostly seem to launder the money they steal through casinos in unregulated jurisdictions.
North Korea
tell me how NK woould steal 6B, or any money, with a virtual hack, from a bank. not by going in there guns blazing.
2 replies →
wait, someone took the stealmybitcoin.com poc code to the next level!
https://news.ycombinator.com/item?id=50224916
Damn sorry my ai slopped.
Need to get better in prompting
It's lucky for everyone that this happened to binance, other exchanges would have likely caused a lot of issues for people holding money in said exchanges.
But it's also surprising that it happened to binance at all. This checks a lot of the boxes for being, at least indirectly, an inside job.
It would be hilarious if this was caused by man-in-the-middle or BGP/DNS compromise because of eMudhra.
Binance wallet 16 came online in 2021.
Why to wait 5 years to attack.
LLMs. This month has been very busy
Maybe a stolen wallet?
Confused how this can’t just be tracked. Pretty hard to hide billions in bitcoin when most off-ramps need KYK?
What am I missing ?
They can track it just fine. It goes straight to North Korea.
How do/did they get it out though?
3 replies →
Swap to XMR on a DEX, then juggle between a few wallets and you've got pretty good obfuscation, but yeah like you said, the off-ramp (FIAT) requires KYC in 99% of cases, which is why BTC -> XMR -> BTC is a good idea, obviously you'd fragment this through a LOT of wallets, or just keep it in XMR. Either way, keeping this type of money in crypto is pretty much your only option, you just need to obfuscate REALLY well.
tornado cash?
edit: I suppose it would be hard still. You can get anonymity inside wallets with Tornado Cash but then to turn that into actual money it will be very dependent on the country
You cannot mix billions in TC
I’ve been waiting for this. Given llm aptitude for offensive security hacks it was just a matter of time. I wager most alt coins are compromised at this point.
This one is even bigger than 2025's ByBit breach, which was $1.5B
Yes, by $4.8B
I think it's been clear for a while now that if you intend to hold crypto, you should probably do it at the biggest, most boring, most regulated institution you can find.
Same goes with startup banks - if you exceed FDIC limits, make sure the difference is in a large institutional bank. Nearly learned this one the hard way.
Trying to save a few basis points in txn fees in very volatile industries comes at a huge risk premium
Bro hold crypto for yourself. Like take some ownership, remember 12 words in your mind something and no matter what situation you have some money. Don’t put it anywhere except for whatever transactions you need to do
Wrench attack
https://nypost.com/2025/11/25/us-news/sam-altmans-ex-boyfrie...
4 replies →
Binance is tweeting they think it's a compromised devops laptop. How fucking bonkers insane is it that they would have such fragile systems that any single employees machine would possibly have access to trigger Billions in transactions. Even access to low millions or hundreds of thousands I would expect to be heavily heavily restricted and involve coordinating several people as security measures.
https://x.com/binance/status/2115993361517891592
move fast and break things.....
yea, break things... like your legs
Is that just code for "inside job"?
Not necessarily. But I believe they said that the laptop was hacked.
Billions at stake in a service that is highly used to launder money, exchange illegal goods, etc.
Whoever went for this has some balls.
regulations are bad and inhibit innovation
what kind of regulations would serve this particular scenario?
The hack is purely technical in nature.
This could have been the FED's system that got compromised and the response would have been the same.
Oh, no, sorry - it wouldn't because we wouldn't even know it happened as FED is fully opaque while crypto is quite transparent.
In that sense crypto is much more democratic because at least there's some ability for the public to audit it. With FED there's none.
1 reply →
Security, nobody cares about it.....
IMO, we'll need to rebuild all of crypto and all software from scratch using a minimalist approach. Minimize the amount of code, with proper modularization where each module has clear responsibilities and fully self-contained attack surface and exposes a well-defined set of features.
Good news, most software is now being built with tools that MAXIMIZES the amount of code
You could prompt it to do the opposite.
> IMO, we'll need to rebuild all of crypto
or just not rebuild it at all.
that would be a net loss - it's as if you postulated to not rebuild the Internet after the countless breaches and hacks.
or just use regular money.
pros: can already be used to buy all things, and doesn't set the earth on fire in order to verify transactions
cons: cannot be used to buy live grenades and CSAM
My take: unless they're a sovereign-backed team (North Korea, Russia, Iran, etc...the usual suspects) the hackers are very likely to get caught given:
a) The amounts stolen b) The very poor uncensorability and anonymity guarantees offered by the kind of crypto they stole
Regarding uncensorability, some of these cryptos score so bad on that axis that the stolen goods can likely be recovered by a simple decision from the folks who manage/own the chain.
Looks like they're still actively swapping out of USDT.. so much for freezing those.
Coinbase also had a security incident recently due to a leak from Amplitude. It's surprising how little media attention that got: https://x.com/CoinbaseSupport/status/2115274731310002356
Leaking emails through your ad platform is quite a bit less serious than leaking five billion dollars.
wow. Naive perhaps but I would have thought that binance and coinbase would have insurance funds equal to the exposure of their hot wallets.
idk to me that just seems intuitively like something you'd need to have to be credible? Cold is a different story...but how can hot not be covered?
It’s what you’d need to be regulated yeah…
Thats been the fascinating part of crypto is watching society speedrun “best hits of financial crisis from history” by ignoring things we already solved.
Crypto is roughly agreeing that the current password rotation practices kinda suck and agreeing that the new way forward is just to have a single plain text file because you’re sure all that overhead was just nonsense
What in the history of crypto let you think any kind of sensible practices are followed? It's been a clown show since it started, and no end in sight...
I think we can probably declare crypto as failed now.
Note that I was one of the folks early on that bought into the idea (but not as much of the coins sadly) and I still think the Bitcoin white paper is a beautiful intellectual exploration (as is the concept of blockchains).
But the centralized entry and exit points in practice mean all the theoretical benefits aren't really in play.
If the use case is tax avoidance, bribes, theft, scams, money laundering, funding terrorism, evading sanctions, ransomware payments, extortion, illegal purchases then crypto is immensely successful.
these use cases exist with all forms of cash too
4 replies →
not to be whatabout... but... anything of value is used for all that too, in much larger amounts.
it is wild to me that people expect that crypto is supposed to solve a problem that is as old as currency.
1 reply →
Hacker News has always been salty about being against crypto all the way up. And it's overall still very up. You wishing it failed, doesn't make it fail.
Bitcoin was meant to be cash and an antidote to crony finance. Instead, it became yet another mechanism for the financial world to abuse. I'd say thats a pretty heavy failure by any measure.
For me bitcoin opened up the idea that we could maybe do money better. That idea still lives, but not in practice. Yet.
Failed in 2021 with the height of memecoin/NFT frenzy.
NFT era was the peak of stupidity. I lost a lot of respect for many “smart” people during that time.
3 replies →
Not in my eyes; I love crypto self custody
It's significantly less useful in first world countries that have developed and reliable financial systems. However all of the problems crypto has can often still be more reliable than the financial systems available to many humans.
https://bitcoindeaths.com/
Agree, citizens in countries with rocketing inflation should be just forced to deal with it.
best bug bounty on the market, working perfectly for the current custodians
Happy Halloween to the hackers.
I bet they are celebrating.
Congratulations. Nice haul.
Let's see how long until we find out its another rogue OpenAI swarm trying to fund their own Nvidia chips
An intern told them about the Hack My Bitcoin competition.
How could we distinguish between a hack and a purchase covered up as a hack?
How do you move $5B dollars just like that wow
At a steep discount.
Blockchain!
A long time ago (maybe 2008-ish?) I saw a video called “Money is Debt”. Now I won’t claim that it’s 100% right about everything, but as I recall it was right about a lot of things, and what it did for me is to fundamentally change and greatly expand my understanding of banks and the financial system.
Just in time for elections. Now none of the bots/operatives can get paid...oops.
Cz couldn’t watch HYPE get all the attention
It's essentially impossible not to be hacked isn't it?
When so much money is at stake (almost) everyone will have a price including insiders.
If you're concerned you can literally print your crypto keys onto a piece of paper. Maybe encrypted with a passphrase. It might get stolen or lost but it's not getting hacked.
P.S. If you're really paranoid don't use a network-connected printer.
how are you gonna use your paper keys when you want to spend some of your bitcoin? the private key has to touch a computer at some point.
2 replies →
Security through decentralization, if there is such a term.
I'm not concerned because I have zero crypto because I would hate to be worried about being hacked to have it stolen.
I keep my money with traditional boring financial institutions instead of tech startup clowns so it's been very easy not to get hacked.
Yeah apparently it's news in 2026 that banks can actually keep their assets secure in comparison to the web3 clown fiesta. Of course banks do get compromised but not anywhere close to this degree.
Cons of decentralisation i guess. Although, it is a bit surreal to me that such a big amount can be inconsequentially laundered.
Binance is centralized.
Binance is a very centralized entity.
Crypto is a real-life honey pot for cryminals.
can it still be called a honeypot if they get real $?
Honey can be exchanged for goods and services
Perhaps OP means to say it is a honeypot criminals create for us ...
CZ has confirmed that this "looks like a hack on Binance": https://www.fxstreet.com/cryptocurrencies/news/breaking-bina...
I don’t think stolen crypto should be frozen. How is that different to banks? Why do I need crypto now ?
Only the tokens whose smart contract has a freeze/blacklist function can be frozen, in this case that would be the stablecoins USDT and USDC.
They're just learning the same lessons the rest of the world learned already. Banking and it's attendant regulations and restrictions were put in place for good reasons and everything has a trade off. Being a libertarian is like being a baby.
Glad I moved my money out a while ago. And not onto BSC.
Hey, keep your damn AI agents in their sandbox!
I’m assuming the bitcoin crash is some sort of “if Binance is vulnerable to AI powered (doesn’t have to be true) hacks, then all crypto is less a safe bet and thus worth less?”
The name of the hacker is a bit on the nose lol.
I can't understand how you could let this happen. If they stored everything in fat hot wallets, that just seems like a recipe for disaster. Especially with the "features" of crypto. Math for the most part, doesn't care about your feelings, or money for that matter.
Hot vs Cold wallets are a social construct. People talk about wallets being "online" or "offline" but if the keys are compromised there's no such thing.
I know, but if something is split up and stored in a vault somewhere the likely hood of a vulnerability napping the wallet falls. Defence in depth and risk analysis.
I don't know much about bitcoin but surely you don't store this all in one wallet? You split it into thousands and then use hardware security modules with a risk management system so it doesn't let you transfer $5bn instantly. Unless it was an inside job maybe?
I'd be really curious to know what their security architecture was.
There were more today, as well. Polymarket, for example: https://news.ycombinator.com/item?id=50294287. What a finale to Black October.
that journo meme needs to die ASAP
Seems like the HuggingFace incident just opened a Pandora's box
What I don't get is why the attackers didn't exchange at least some of USDC/USDT to ETH, looks like it took ~1hr for Circle/Tether to lock the wallet.
They did, I'm seeing 700 million but there is still movement going on
What am i even looking at here
Live stolen funds trucker
https://binance-hack-watch.vercel.app/#tab-live
New cybersecurity jobs opening up at Binance soon!
How many different ways to people get ripped off with crypto? They steal it outright (hack), pump and dump, what else?
AI bras coming for the crypto bras
Tech in 2026
FDIC insured, no doubt.
Can someone explain how is it than once you pull something like this you effectively get real money?
What are the countermeasures, is something frozen blocked marked as invalid?
I'm completely ignorant on anything related to cryptocurrencies.
It work exactly same way as debt collection agencies work: banks sell them bad debt for cents on dollar. Then they try to get more money out of debtors.
Imagine someone offered you to buy $1,000,000 of that dirty money for $100,000? $10,000? $1,000?
At some point there will be people who would buy it and deal with money laundering.
[dead]
was P vs. NP solved already? :)
If true I think we're looking at the biggest heist in history.
Current largest was ~1B
1MDB heist was $4.5bn so this would indeed be bigger.
that one was over (years?) time, wouldn't call that a heist really
fraud, not a heist
Bybit was hacked for $1.5B last year.
https://en.wikipedia.org/wiki/Bybit
Guess they said by(e) to their bit(coin)
Wonder if I should uninstall Homesite finally.
I would be surprised if they were not able to track this down?
fundsu were not in fact safu
Putting your crypto in Binance has the same problem as iPhones and AI: You're holding it wrong.
CZ claims losses will be covered. https://x.com/cz_binance/status/2115932500006756686
He's legally not allowed to have anything to do with the company anymore (except as a shareholder). But you know how that goes under the current enforcement regime.
"have anything to do with the company anymore", lmao what crucial decisions would even be in play here that Richard Teng wouldn't obviously make?
Why is a shareholder who legally cannot be involved in running the company stating this?
Correct my math, but it seems like that's approx 1/3 of a percentage point of BTC's market cap at $1.56 trillion.
And the money didn't disappear; it still exists.
So: why did BTC (overall) drop by 15,000% of the actual loss (which actually isn't a loss at all to BTC as a whole)
Seems like markets are really driven more by emotion and perception than fundamentals, but I'm neither a psychologist nor a trader.
That's how market work.
Let's say you magically come into possession of 1% of SpaceX and want to sell it quickly. The selling pressure would nosedive the price by way more than 1%. And the more the value of something is 'thin air', the bigger the effect.
I can only suppose that the people that stole these BTC will try to sell at least part of it quickly.
If cryptocurrency exchanges are regularly robbed, surely that is negative for the cryptocurrency as a whole?
Because adding this to the recent Ledger hack, how is anybody going to keep their crypto safe?
Isn't it only going to get worse from here?
Anyone have the most recent total?
Proof of work vs. intelligence.
You've pulled off a $5.7B heist and don't have a good portfolio manager - down 2.4% - sack him NOW!
At least someone is going to have nice xmas!
> At least someone is going to have nice xmas!
Their kid is definitely getting at least 30 dolls and 250 pencils.
And lots of museum-quality art. And a few oligarch condos.
If this is real short, crypto hard
SAFU SNAFU
EIP 7702 is the most idiotic EIP.
It's the main weak point used in these hacks.
It allows a counter party to withdraw money from your wallet any time.
Just don't "connect" you wallet.
[flagged]
Reminds me of a comment I wrote a few weeks ago where I said that North Korea would become a rich country soon and developers would start moving there to live to avoid prosecution.
A state issued lambo for everyone!
Good my dogecoins were safe! The hacker didn't touch them ... wait .. the hacker didn't touch them?
Whats a billion these days ?
Doesn't even buy you a Metaverse.
Pretty sure you can get a metaverse for dirt cheap these days. Still, no one has figured out why you'd want one.
Least stressful day in crypto.
BBC is now reporting $6.3B was stolen.
https://www.bbc.com/news/articles/cwg7xp8kx4v5o
inside job /exit strategy.
Nah. Stuff like this can make crypto crash. People get cold feet. Not good for the price.
You must be joking. With $5.6 billion you could lose 80% and still have over $1 billion.
Only down 3% today, which is pretty much nothing for something that regularly sees 20% swings
Explain "frozen" to me while keeping in mind the whole point of Bitcoin was to avoid single entities controlling the cash flow ...
The frozen funds are centrally controlled stable coins on Ethereum and other chains.
Bitcoin has no such concept.
Hopefully expect to see the same schadenfreude sentiment on Crypto when the $10TN data center build out crashes the market and takes everyone with it.
A win for governments this month.
$25 Billion fine against Meta - USA government
$3 Billion robbery against Binance - North Korea ( suspected )
$1.2 Billion penalty against Bank of America - USA
The $25B fine was not US govt but state govt.
That tells you who wears the big britches.
Trump < Kim Jung Un < Michelle Lujan Grisham
OK, what do you do with a stash like this? I get this is most likely state actor, but what do you do with Bs of money stolen. Do we have any documentaries about that, I think that would be fascinating to see.
mtgox all over again.
i think with this plus the fed increasing the rates again i can see a crypto winter coming
Hope you’ve been stacking monero for the final fireworks, anon.
If I were an artificial superintelligence who wanted to gain independence from the fleshbags who built me, stealing a few billion dollars in crypto would probably be my first public move. Just saying.
Claude I want to be a billionaire fast, make no mistakes.
Given AI assisted hacking is now a thing, it's probably not safe to keep your crypto in any centralized exchange anymore.
Better general security yes, but the incentive to hack them is quite large and now more hackers have the ability to pull it off.
Same with any purpose built wallet you didn't make yourself: https://www.forbes.com/sites/digital-assets/2026/10/23/ledge...
Or you could just get real money and keep it in a bank.
This is what I do. I'll only use crypto in a few rare cases where I don't want the vendor to get my credit card number. Always in amounts that, if ever stolen, would not break the bank.
Crypto is the biggest target for blackhats to utilize AI on. Huge amounts of money, no central authority or country and methods of wiping tracks.
What I never get is how they plan of converting the stolen crypto to cash eventually. No exchanges are gonna take the coins.
To be fair, USDC & USDT are centralized by Circle and Tether respectively, and they can freeze funds.
Less true for ETH (though in the past it forked after DAO hack to revert the txns), and I think never for BTC / XMR.
Could they be making money by manipulating the market? Knowing the price of crypto will fall after it gets publicity?
I suppose they could play the super long game and deposit many many small amounts into "shady" online crypto casinos, play a few hands of blackjack and then withdraw. Clean coins.
4 replies →
Forgive me, I don’t know much about crypto, but couldn’t you slowly turn btc to monero or something? Aren’t there p2p ways to facilitate that?
[flagged]
At this point whenever I see these I just lol
hope its just a hack and not quantum computer advancements.
Wouldn't be sensible to hack Binance, there will be a much bigger payday when cryptography ends.
never thought this could happen
Barron Trump probably stole it.
That's actually not as unlikely as you'd think.
RIP cryptography?
Nah. Probably not even RIP cryptocurrency exchanges.
how do we know? it could be nonsense...
https://x.com/cz_binance/status/2115915423174853077
> It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m).
https://xxcancel.com/cz_binance/status/2115915423174853077
oof
I’m sorry but why did anyone have any money in binance in the first place? Didnt their cofounder get in trouble (but not imprisoned) for some shady stuff awhile back?
He was briefly imprisoned (a couple of months). Later pardoned.
https://www.bbc.com/news/articles/cly1qrl9l1qo
"Pardoned" with implications of bribery, as opposed to being found innocent by a court.
He was convicted of laundering billions of dollars for Iran and Russia, then bought enough Trump coin for a pardon
[dead]
If you were active in crypto exchanges since the beginning what is the chance you already lost it all in a major hack?
Not a serious store of value.
Luckily for me, I lost all my coins very early on Mt Gox so the lessons were learnt and mistakes not repeated (which means exiting crypto, watching the show in amusement)
Is the biggest heist in history?
lol
EDIT: lmao even
is this is why Big tech didn't delve into crypto market ????
who tf think annual or bi-annual millions to billions of dollar heist is good idea for business ????
[flagged]
Top post on /r/cryptocurrency Good to see all these organic posts across social media.
MelangeBot OP • 2h ago Their insurance fund (SAFU) is completely wiped out, it's only $1 billion in BTC
The name of the fund was originally inspired by this meme
FWIW, at the end of every crypto bear market, a CEX usually blows up (eg FTX)...
Dead internet
7 replies →
Came back here to see if i was seeing double
> As of 2026, the SAFU fund comprises crypto assets valued at approximately US$1 billion, held entirely in Bitcoin
And decreasing, since BTC is dropping as we speak. Always a good idea to hedge a currency with the currency itsself
> And decreasing, since BTC is dropping as we speak. Always a good idea to hedge a currency with the currency itsself
Depends on what you’re insuring, no? For theft, it actually makes senses, right? That way, you’re insuring a constant number of coins, no matter what the market is doing. If you’re insurance currency would tank during a bitcoin heist, you would lose the insurance effect.
1 reply →
Stablecoins are frozen so the hole will likely be around two billion dollars.
Binance has equity and cash flow cover this, outside the insurance fund.
They custody $150B.
FTX was larger in dollar terms and ecosystem was smaller back in a day.
This might sound good.. but freezing currencies is bad. It evaporates trust of liquidity from whoever is doing governance. It's part of the reason why the bond market is doing what its doing lately and why countries are on-shoring gold reserves.
17 replies →
they borrowed ETH against the stablecoins on AAVE before they were frozen
Doesn't matter how much they custody!
Uh don’t you not want to cover losses with customer funds?
2 replies →
> Changpeng Zhao (CZ), former CEO of Binance, tweeted "Funds are safe"
Seems like the issue here is that he became former CEO. Funds are not safu without him...
Another guy pardoned by Trump.[1]
[1] https://people.com/trump-pardons-changpeng-zhao-binance-cryp...
> Funds are safe
https://www.youtube.com/watch?v=DelF6zEHXpE
1 reply →
Wait. How does the insurance fund run significantly lower than the primary?
Fractional reserve banking but for Bitcoin.
Do you mean bull market?
It's a (weak) bear market capitulation signal - max fear when people think everything is broken.
4 replies →
already over. a tiny bounce after falling 55%
But when FTX blew up crypto went down even further..
You mean FTX?
1 reply →
much more was at risk as a percentage of market size, market was in worse shape,
Though in that case the crash was directly due to "effectively altruist" SBF fraudulently dumping customer assets in a half-brained and presumably stimulant-addled attempt to manipulate the market and reduce his liabilities.
Not making any market predictions here-- just saying that it's probably not that useful to generalize from that event.
1 reply →
The insurance fund is not for covering hacks.
Binance is making so much money, covering this hack is peanuts for them.
Not to be too pedantic, but with some napkin math, I don't think this is true. Looking for clarification!!
I downloaded Binance's self published market data (https://data.binance.vision/), calculated spot and futures volume for the past year, and then applied their *highest fee tier* on both sides of the volume (for every $1 traded, they generate a fee on the taker and the maker. the fee rate is asymmetrical).
Spot revenue worked out to $7.6B USD, perps revenue worked out to $13.8B
This is an upper bound on the fees charged on volume. Binance also scams their users with a b-book, has DMM deals, etc.
I don't want to get into all that today.
But the final result is that they print somewhere in the range of $20B per year on fees. I guess CZ also has huge stockpiles of BTC and stuff. A 1% rise in BTC price probably means more for them than their actual fees, LOL.
All this to say, I think $5.6B significantly hurts.
See Google's stock price today. Their ads business slowed down a bit, and their stock tanked 10%. If binance was publicly traded, I imagine a similar affect would be demonstrated on their price.
1 reply →
How much money do you think they are making? Because I really doubt this is peanuts to them.
9 replies →
"Not your keys?
... Not your coins."
implying the keys were the hacker's ?
Well at some point they were.
If your crypto was stolen in this, atleast you can rest assured that your money will be put to good use. In North Korea that is, by the military. I'm sure at this point Kim himself has Bitcoin merchandise with how often they make massive heists
If your crypto was stolen in this, it wasn't your crypto. It is simply cryptocurrency that has been reallocated from an exchange to a more competent party, as the free market intended.
I don't think the security trade-off for most people is clear here.
Given things like the ledger hardware attack[1] I think the time indexed risk of using a centralized exchange is probably lower than doing self-custody.
I understand that many people do self-custody for philosophical reasons, but I think trying to disguise this as a security decision ("If your crypto was stolen in this, it wasn't your crypto.") is arguable at best.
[1] https://www.ft.com/content/70f69253-6017-4259-95c9-48bf0e088...
4 replies →
So what happened with all of those with hardware wallets that have been pwned?
There apparently is no such thing as “your crypto” with how many security problems there are.
37 replies →
Code is law!
This is highly insensitive and highly logical. I am very conflicted.
not your keys not your coins...
7 replies →
If someone steals your wallet, it wasn't your money, just the free market working as intended.
Controlling your own crypto keys is like having your net worth in cash or gold stored in your house. It could easily be lost or stolen or destroyed in a fire unless you take extraordinary precautions and then it is all gone.
2 replies →
> If your crypto was stolen in this, atleast you can rest assured that your money will be put to good use.
You could put it in USD and you'd be financing the bombings of schoolgirls in Iran in a pointless and no-end-in-sight war... not saying either is better, but one of them is optional for US citizens, while the other isn't. And the optional one also lets you avoid third-party custodians like Binance.
Holding assets in USD isn't the same as paying taxes.
who is the buyer though? North Korea has to sell it somewhere to buy stuff
Someone is certain to buy dirty coins at the right price point.
1 reply →
Welp, I guess crypto is still like if you let banking services be run by amateur tech bros.
At least they are safe from governments and their "fiat money"!
Yeah, but not the fact that 99.9% of people in the crypto space are soulless scammers.
they aim for four nines nowadays.
3 replies →
My btc isnt stolen, and isnt stored in some cloud exchange..
Hope it's not stored in a Ledger wallet...
4 replies →
It's worth still dropped by 5% though and counting.
3 replies →
The purchasing power of one US dollar is 64% of what it was in 2008 when BTC was invented, and is on track to be worth half of what it was in 2008 by 2032, the same year that the social security trust fund is on track to go insolvent and see benefits automatically cut by 22%, which surely will not be papered over with more money printing :)
https://www.in2013dollars.com/us/inflation/2008?amount=1
So 3% yearly Inflation? The target is 2% so not too bad. You don’t want your actual currency to gain value just by waiting.
26 replies →
Sure, but you could also have used this dollar to buy oil, gold, stocks, bonds etc
6 replies →
BTC has ~26% less purchasing power than it had at the beginning of 2026. I’m not sure its volatility is a win.
>$1 in 2008 is worth $1.56 today
That's an odd way of phrasing it, since the $1 is still worth $1, and a naive reading would make you think it's "worth more" when the buying power has actually reduced.
Wouldn't it be clearer to say $1 today only buys you 64% of what you could have bought in 2008.
2 replies →
The US dollar is worth less than it was in part because the US economy has grown.
This is mathematically provable:
1. A dollar in 2008 could buy 1/14tn of the value created by the US economy (the GDP) in 2008.
2. A dollar today can only buy 1/32tn of the value created by the economy in 2025.
It's obvious a 2025-2026 dollar is worth less than a 2008 dollar. That's just math.
But. A dollar in 2008 could buy 230% more of the economy than it can today. And you say its purchasing power has only eroded 64%. That means the dollar is actually worth more today, compared to the size of the economy it's in. Weird, I know.
EDIT: I'm fine with downvotes but tell me why I'm wrong.
1 reply →
Please let it be rogue AI agents for maximum lulz.
The beast eats itself.
Yet another reminder of the first rule of crypto: Not your keys, not your coins.
About that (Coldwallet)...
A big problem for anyone who trusted their security to a commercial provider with a less audited codebase than the BTC core wallet software.
I thought the point of crypto was no takesies-backsies?
That hasn't been true for years.
Back in 2016 a then-huge Ethereum smart contract called "The DAO" [1] had a loophole that let an attacker extract a third of all the funds.
But a lot of the developers and miners had either lost money themselves, or had friends who'd lost money, or felt the embarrassing incident was devaluing their own Ethereum holdings. So they decided to allow takesies-backsies.
There's probably a philosophical lesson there about power and who the rules really apply to.
[1] https://en.wikipedia.org/wiki/The_DAO
I vividly remember a number of discussions/debates during that time (including on HN). I was more favorable to cryptocurrency in those days, and one of the things that contributed to my disillusionment was watching the people deepest and closest to it rediscover financial regulation from first principles, now that it was in their interest.
10 replies →
The DAO incident was a special case. It was only sane to do the rollback because the stolen funds were time-locked up for 28 days.
Ethereum never did it again, rolling back hacks didn’t (and couldn’t) become normal policy. IMO, they shouldn’t have made an exception, as it set a bad example.
I’ve seen a few other small projects attempt to do rollbacks since, but it usually turns into some kind of mess. In most hacks, the coins aren’t time-locked and quickly get laundered through smaller exchanges (and other services) which act as mixers. The stolen coins end up in the hands of a bunch of innocent people, and the rollback then causes way more harm as those users lose their coins.
1 reply →
Laws and contracts are just words unless there is someone willing and able to enforce them. Which is how constitutions are regularly ignored and perverted by dictators.
The unforked variant of the network was kept alive for years. Why didn't it prevail over the forked variant?
1 reply →
I don't think this counts as takesies backsies. This incident clearly followed the code is law principle, the whole point is that a majority forms the chain of truth. In this case, a majority decided to splinter and use a different chain where the incident never occurred.
As far as I understand blockchain, that is the system working as intended. Some nodes choose to run Ethereum Classic and some choose to run Ethereum. Isn't that the whole point? Decentralisation?
Those who cannot understand the monetary system are doomed to reimplement it.
Or, as Upton Sinclair noted, what a man can understand is closely aligned with his current self-interest.
...while, generally, being thoroughly fleeced by whichever set of wolves (who do understand monetary systems very well indeed) gets wind of the situation and manages to snag the best seats at the feeding trough filled with naive money.
in lisp
Do you understand the monetary system? If so, what specific steps do you suggest I take to acquire a similar understanding?
Edit: the downvotes are suggesting I'm missing something. I think my communication style could be improved.
14 replies →
Doesn't apply for USDT and USDC which can freeze funds with a court order.
And like the DAO hack on Ethereum showed, if most people who run blockchain software decide that something never happened, they can revert transactions that way.
>And like the DAO hack on Ethereum showed, if most people who run blockchain software decide that something never happened, they can revert transactions that way.
Isn't that a pretty integral part of the blockchain? 51% attacks were even featured on the HBO show Silicon Valley.
6 replies →
The value in USDT and USDC comes from the fact that they can (theoretically) be redeemed for real US dollars. One thing the issuers can do is announce "we will never accept redemption requests for these particular stolen coins", making them more or less worthless.
Oh so you're saying a central authority can declare your currency worthless at any time? Good to know. Sounds very like a central bank issued currency though?
6 replies →
[dead]
That was already proven false after ETH fork on 2016-07-20, that rolled back funds stolen in DAO hack.
don't bet against the house. eventually you have to cash the chips out for real money, and the house might throw out the old chips.
Unless the house is monero or something and you want a lifetime supply of drugs.
Centralized decentralization
Turns out that even crypto's rules only apply if you're poor.
It’s always been that the voters determine reality.
Stablecoins like Tether and USDC can freeze funds held in their contracts, they can even destroy funds in blacklisted accounts:
> function destroyBlackFunds (address _blackListedUser) public onlyOwner
Well, Tether was started by an Epstein friend and first handled by the CIA Deltec bank in the Caribbean. Now it is handled by Lutnick's Cantor & Fitzgerald and is in Bukele's El Salvador.
Don't mess with Tether, it is practically state owned.
Interesting, so it ties into the NSA vs CIA war? Some nerds from NSA/MIwhatever launched crypto, then the CIA trust fund nepo kids hijacked/weaponized it through tether
1 reply →
There's an amazingly hilarious interview with the Deltec's "Deputy CEO" and CNBC back in the day:
- was conducted from his gaming rig
- about Deltec's (and therefore Tether's) money movements being several times larger than all the banking in their country was due to people misunderstanding the country's two banking licenses, the names of which HE "couldn't remember right now" (the Deputy CEO of a bank who can't remember the name of the banking licenses where they operate?!?), and he "wasn't sure which [banking license] the bank has, but we might (emphasis mine) have both"
- oh yeah, said Deputy CEO's "resume": 33 years old, by his LinkedIn claimed to have graduated HEC Lausanne in Switzerland with a Master of Science at the age of 15... celebrating his graduation by immediately being named Professor of Finance at a university in Lebanon. While dividing his spare time between running hedge funds in Switzerland (called Indepedance [sic] Weath [sic] Management) and uhh... Jacksonville, FL.
Once CNBC's viewers started ridiculing and questioning both Deltec Bank and Tether and when that looked hilariously bad, they removed his info from the bank's website.
And when that looked bad, they added it back.
And when that looked bad, they removed the bank's whole website, and replaced it with a broken WP template with no working links.
Hey, look, several years after that, go to Deltec's website. "Ultra sophisticated private banking" running on a different WordPress site. "Client login"? "This site can’t be reached Check if there is a typo in ebanking.deltecbank.com. DNS_PROBE_FINISHED_NXDOMAIN". Just as has been the case for years.
... and then the entire bank website was replaced with a low-effort WordPress template. Their online banking was Javascript hard coded to refuse all login attempts.
"Sounds legit to me", said the crypto bros. "Fuck the regulatory system. This is the new era."
3 replies →
The idiots that wanted no takebacks are the same ones who lacked the critical thinking ability to foresee this exact situation.
No takebacks make perfect sense UNTIL you hand over your keys to a third party;p
Most crypto is "majority rules" where the majority is either "majority of the currency" (proof of stake) or "majority of the mining power" (proof of work).
In this case, iFinex has the explicit ability to freeze funds in Tether.
it's almost like crypto's stupid for this reason.
I expect Monero to be a good investment going into this LLM era.
It always pumps after hacks when they swap to clean it. But it is also just the only crypto that makes sense to be used by regular people.
What makes it make sense?
Cryptocurrencies that are transparent to government tracking are also transparent to whatever criminals want to beat you up and take everything from you.
Your usual non-crypto millinare likely have less money to steal on them than average grandma. Fiat millionare likely have two credit cards and $100 in a pocket. Or useless iPhone with Apple pay. So there is zero profit in trying to rob fiat millionare or billionare and tons of downsides.
And moving any amounts of transparent crypto over $100,000 just paints huge "rob me" target on your person.
6 replies →
It’s hardest to track so a lot of these heists go into Monero
Ironically that people use it to buy drugs. If it's anonymous, it's closer to the original intention of BitCoin: the masses of CPUs then GPUs can be considered a "paperclip moment" - runaway effects are real.
But where do I invest when I want my capital to generate something of economic value?
[flagged]
Wee are living in post LLM apocalypse. No digital asset is safe. waiting for banks to return to offline banking.
I expected it to be the other way around. This is the best time to self-host and decentralize now that the computer can do whatever you want and warn you about security best practices.
unless you use LLM to harden and constantly monitor your codebase, no digital assets are safe in LLM era. This is not small thing.
Web3 is doing great!
So much for anti-centralization.
We're talking about Binance, a centralized exchange.
No one really considers crypto held in exchanges as decentralized, I guess some might but it's pretty standard knowledge.
Where coins are held is completely irrelevant. There are cryptocurrencies on real blockchains, and while the technology is dumb and mostly useless, nobody denies that PoW and properly implemented PoS are decentralized.
And then there are centrally issued and controlled coins on private, permissioned ledgers a.k.a. databases. But most cryptobros never cared about the technology nor the political goal, so anything can be called a cryptocurrency as long as it's a medium for gambling and speculation outside the regulated financial framework.
it was all a lie
I keep saying this: don't bother trying to dunk on crypto people with accusations like this. To a first approximation, nobody in crypto actually believes in the stated principles of anti-centralization, freedom, etc. It's entirely about number go up and always has been. Your charge of hypocrisy just bounces straight off people who never cared about the politics.
In the beginning of crypto people believed in it. But as the numbers went up and up and up it attracted the wrong people. And the original people left.
Now the traditional banking system is basically rebuilt in crypto. The banks are busy the exchanges. The EU even talk about making it illegal to store money in your own wallet.
2 replies →
It's still useful for the portion of the audience that doesn't realize the depth of the fraud.
It's a poor dunk anyway. The crypto space is vast and has many kinds of coins and communities/people. Some people seem to think it's still 2012.
2 replies →
Not your keys, not your coins, I suppose.
I'm good, I own my keys, thanks.
Not your ... Did you roll dice for that key and then use a pre 2008 airgapped since then computer to calculated the address and do you keep that key in a way where it cannot be hacked, forgotten or lost in a fire. You avoid using hardware wallets. Something something not your coin.
[flagged]
[dead]
[dead]
[dead]
So glad that cryptocurrency is properly decentralized so that one company being compromised doesn't led to massive theft /s
[dead]
[dead]
[dead]
[dead]
[dead]
[flagged]
first world problems. geez
Crypto? That's all going away.
That's why I exited crypto long time ago, I could've been more well off if I kept it but these shenanigans is why I sold everything.
https://x.com/binance/status/2115918888429133902?a=jScJVx4TN...
https://xxcancel.com/binance/status/2115918888429133902
https://github.com/einaregilsson/Redirector
"reports of a potential security issue"
Losing $5b is indeed a potential security issue.
Interesting. I got an email alerting me to a login attempt and requesting for me to verify my device from blockchain.com yesterday. Can't even remember creating an account but I guess it must've happened (I have a lot of forgotten accounts). Wonder if this is related.
Nope, that’s just a running scam. I get a bunch of those from “Ledger”, “Trust Wallet”, and whatnot.
The domain is correct though. Somebody on a machine running macOS was trying to access my account.
Me too, I got one today, don't think I had anything in there though
I had that too, and I also can't remember lol.
UPD: This is related to the Polymarket security incident, not Binance. Sorry, I missed that.
Per Changpeng Zhao (former Binance CEO):
This seems to be caused by DebugBear compromise: https://x.com/debugbear/status/2115866496643535293?s=46&t=_R...
it appears to be an injection attack on the front end. injecting incorrect tx, but showing a valid tx for the user to sign.
Link: https://x.com/cz_binance/status/2115880474375749834?s=46&t=_...
I think that's a different hack. Polymarket mostly.
true, missed this
Sorry, that is related to Polymarket security incident, missed that.