> ## Content Index
> Fetch the complete content index at: https://www.gregchew.ch/llms.txt
> Use this file to discover other available public pages before exploring further.
# Someone Answered For It
- URL: https://www.gregchew.ch/someone-answered-for-it/
- Published: 2026-10-31T05:05:00.000Z
- Updated: 2026-11-01T01:09:43.000Z
- Description: The night the largest crypto platform on earth was rescued by a button, and what that admission costs.
- Author: Greg Chew
- Tags: Blockchain, Binance, Crypto, Hack, Essays, Artificial Intelligence
At 20:24:23 on the evening of 29 October 2026, Greenwich time, [one transaction](https://etherscan.io/tx/0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3?ref=gregchew.ch) moved 167,464 ether, the currency of the Ethereum blockchain, out of a wallet publicly labelled [Binance 14](https://etherscan.io/address/0x28C6c06298d514Db089934071355E5743bf21d60?ref=gregchew.ch), and with it 1.615 billion Tether dollars, tokens meant to be worth a US dollar each, and sixty-two other kinds of token. All of it went to an address, the blockchain's equivalent of an account number, which anybody can create in a moment without giving a name, and this one had not existed that morning. Seconds later a second Binance wallet sent a further 28,005 ether to the same place. By the [count of the blockchain data firm Bitquery](https://www.bitquery.io/investigations/binance-hack?ref=gregchew.ch), seventeen of Binance's hot wallets, the online tills from which it pays its customers, were emptied across nine different blockchains between 20:04 and 23:56.
**Etherscan, the transaction of 20:24:23 UTC on 29 October 2026*
By Friday morning the scale was clear and the sources still disagreed about it. Binance put the loss at [about $6.3 billion](https://decrypt.co/382203/binance-finds-additional-points-of-breach-in-6-3b-hack?ref=gregchew.ch). TRM Labs, one of the firms that trace money across blockchains, counted [$6.36 billion across ten of them](https://www.helpnetsecurity.com/2026/10/30/binance-crypto-hack/?ref=gregchew.ch), and Arkham, another, $6.01 billion across nine. Every one of those figures makes it the largest theft in the history of this asset class, against the roughly $1.5 billion taken from Bybit, another exchange, in February 2025, [which the FBI attributed to North Korea](https://ic3.gov/psa/2025/psa250226?ref=gregchew.ch).
A blockchain, or 'chain' for short, is a ledger kept in public by many computers at once, so that anybody can read it, and no single company is meant to control it. Cryptocurrency or tokens on a chain sit in 'wallets', and a wallet answers to whoever holds its key, a long secret number used to sign instructions; the network checks the signature and never asks who made it, or why. Picture a bank that pays every cheque bearing the right signature and has no manager to ring when the signature is genuine and the cheque is not.
Nothing was broken to empty those wallets. No code was cracked, nobody rewrote the ledger, and no flaw in Ethereum or in any of the other networks was exploited.
Every instruction carried a valid signature, every check passed, and every blockchain involved did exactly what it was built to do, which is to obey the key.
Within the hour Tether, the company that issues the Tether dollar and promises to pay a US dollar for each one, reached for a switch. The program that runs its token lets Tether stop any address from moving the Tether dollars in it, whatever key that address answers to, and its chief executive announced that it had frozen more than 1.567 billion of them where they sat; Circle, which issues a dollar token of its own, followed with [more than 800 million](https://www.coindesk.com/business/2026/10/29/potential-multi-billion-binance-hack-hitting-crypto-markets?ref=gregchew.ch) of its dollars, and by Friday the frozen total stood at [about $3 billion](https://www.coindesk.com/business/2026/10/30/binance-arranges-usd6-34-billion-to-cover-losses-from-record-crypto-hack?ref=gregchew.ch). No court was asked. Two companies decided, on their own authority, which balances were still money and which were not, Circle by its own account and no other I could find claimed to do so [in coordination with law enforcement](https://x.com/jerallaire/status/2115916207463481846?ref=gregchew.ch), and the industry stood up and applauded.
**Jeremy Allaire, chief executive of Circle, 21:18 UTC, 29 October 2026, with a reply at 21:46 UTC*
The theft is a crime, and crimes happen. The applause is a confession. From its first day this industry has argued that its money needs no company, bank or court behind it: nobody can freeze it, reverse it or take it from you, because the network obeys the key and nothing else. On Thursday night two companies froze billions of dollars of it with a switch, and the people best placed to know what that meant cheered them for it. What they confessed is that the protection that worked on Thursday night was the one their industry claims to have abolished: somebody with the power to stop your money.
---
## A trusted third party
On 31 October 2008, eighteen years ago this week, nine pages published under the name Satoshi Nakamoto [set out what was needed](https://bitcoin.org/bitcoin.pdf?ref=gregchew.ch): "an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party." The object of a blockchain is very simple: to be able to trust the message, not the messenger, securely and at scale, and I hold anything that calls itself one to that test. Decentralisation is what makes it possible, because when no single company controls the ledger you do not rely upon an intermediary to transact, to operate or to communicate.
That design is what the 'crypto' industry promised: that a record everybody can check could be trusted where people and companies could not, and that nobody would need to stand between you and your money. As my readers will know, I draw as thick a line between blockchain and crypto as the demilitarised zone that divides the two Koreas.
Binance, [the largest cryptocurrency exchange in the world](https://www.cnn.com/2026/10/30/tech/binance-crypto-heist-hnk-intl?ref=gregchew.ch), stands between you and your money all the same, and it does not stand there alone. [Coinbase’s terms](https://www.coinbase.com/legal/user%5Fagreement/united%5Fstates?ref=gregchew.ch) say that it “shall retain control over electronic private keys” for the addresses holding its customers’ coins, and both Coinbase and [Kraken](https://www.kraken.com/legal/global-terms?ref=gregchew.ch) may keep those coins on shared blockchain addresses they control, alongside their own. Every one of them is a trusted third party of exactly the kind those nine pages were written to do away with.
---
## What a block explorer called it
On Thursday night anyone could look at Binance's own hot wallet. Every address on Ethereum is public, and websites called block explorers, Etherscan among them, give each one a page of its own showing its balance, its history and, where they know it, a label saying whose it is. On the page for Binance 14, beside the label that said "Binance" and the label that said "Exchange", sat a word that was doing more work than anybody on that page intended.
**Etherscan, Binance 14, read at 23:00 UTC on 29 October 2026*
The label read "Authority", and beside it, "Delegated to: 0x63e842B0...73e9c6fAe", the address of a contract the attacker had placed on the chain that afternoon. Here a contract means a 'smart contract' , a program that lives on the blockchain itself and moves money exactly as its code says, whenever it is called. The balance beneath it stood at 0.96 ether, less than one coin in a wallet that had sent out 167,464 that evening.
The mechanism is a feature of Ethereum called [EIP-7702](https://eips.ethereum.org/EIPS/eip-7702?ref=gregchew.ch), one of the changes to the network's rules that went live in an upgrade called [Pectra on 7 May 2025](https://blog.ethereum.org/2025/04/23/pectra-mainnet?ref=gregchew.ch). It lets an ordinary wallet hand its control to a contract, so that the contract can thereafter move the wallet's funds without any further signature. It works as a power of attorney does: the holder signs once, with the wallet's own key, and from that moment the attorney acts on everything in the wallet and the holder is not consulted again.
The security firm Blockaid found that the attacker had bundled [fifty of these authorisations into a single transaction](https://cointelegraph.com/news/binance-hack-may-involve-private-key-misuse-not-theft-blockaid-ceo?ref=gregchew.ch) aimed at Binance 14, and TRM Labs found that all fifty had been signed in advance, with the wallet's own key. Each authorisation carries a sequence number, and a wallet accepts only the one bearing the next number in its own sequence. One of the fifty carried that number, so that one was accepted, and the account was handed to a contract whose source code had never been published for anyone to read, built to empty it. The delegation took effect at 20:20:59 and the sweep followed [three and a half minutes later](https://cryptoticker.io/en/binance-hack-hot-wallet-drained/?ref=gregchew.ch).
I set out the general form of this failure a week before it happened, in the short 'TLDR Notes' for [The Web's Y2K Moment](https://www.gregchew.ch/the-webs-y2k-moment-the-tldr-notes/). The full document has been written over the last six months and I hope to have it published in full on this site by 1st November. A credential, whether a password, a key or the token a website leaves in your browser once you have logged in, does two very distinct jobs as if they are one. The first is access, being let in. The second is authority, the right to act once inside. The web fuses them into one string of characters, so that presence is taken as proof of the right to act for everything that follows, for as long as the string lives.
What happened to Binance is that fusion laid bare: a mandate signed once and spent by a party who was never asked again, on a chain that had no way to ask.
The block explorer called it Authority. It was right. That is exactly what was taken, and it was never stolen in the ordinary sense, because it was handed over by a key that was entitled to hand it over. Everything after 20:20:59 that evening was the system working.
---
## A laptop
In the early hours of Friday Binance published its first finding. The incident, the company said, [may involve "a compromised DevOps engineer's laptop", which "allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions"](https://www.helpnetsecurity.com/2026/10/30/binance-crypto-hack/?ref=gregchew.ch): somebody had taken over the computer of one of the engineers who run Binance's systems, used it to get inside one of the company's own internal services, and had that service send out withdrawals nobody had authorised. It said it had found ["no evidence of any wallet private key leak"](https://decrypt.co/382203/binance-finds-additional-points-of-breach-in-6-3b-hack?ref=gregchew.ch), meaning that the secret keys themselves had not been copied. Later that morning it added that "our subsequent investigation has uncovered additional points of breach", and its co-chief executive, Richard Teng, said the attacker "did not simply use one engineer's permissions", calling it "a more complex attack process".
**Richard Teng, co-chief executive of Binance, on LinkedIn, 30 October 2026*
Set that against what the firms tracing the money found. TRM Labs observed that wallets on ten different blockchains, each with its own kind of key and its own way of signing, all produced valid signatures for the attacker inside about half an hour, which no single stolen key could do. TRM's conclusion is "a compromise of Binance's hot wallet signing infrastructure", meaning the systems that hold the company's keys and sign its outgoing payments. Blockaid's chief executive, Ido Ben-Natan, put it in plainer words: "It seems to be... a compromise of signing infrastructure. We don't think a key was leaked."
So the keys were never taken. The machine that holds them was made to use them.
Had the keys been stolen, the industry would have reached for its usual answers: guard them better, keep them in stronger hardware, change them more often, put a second code on every login. Each of those lowers the odds of a theft without removing the reason for it, and on Thursday night none of them was even in play.
Set Binance’s own account beside the five routes to authority [I set out last week](https://www.gregchew.ch/the-webs-y2k-moment-the-tldr-notes/), and the night ran on four of them:
**Route 1 - Taken -** The engineer’s credential was taken, which put the attacker inside Binance’s own estate.
**Route 2 - Granted -** On Ethereum, Binance 14 itself granted standing authority over everything in it to a contract the attacker had placed on the chain that afternoon, the delegation the block explorer labelled Authority, and from then on that contract needed no further signature to move what the wallet held.
**Route 4 - Obeyed -** The signing service obeyed, turning whatever request reached it into a signature the blockchain would honour, with no means of asking whether anybody entitled to decide had decided, like a clerk who keeps the company seal in hand and presses it on every paper that reaches the desk.
**Route 5 - Believed -** Every chain the money left believed: each one checked each signature, every signature was genuine, and every check proved only that the key had signed, never that anybody had chosen to empty the wallet.
The incident is the symptom, and the laptop was the tool. The disease is that a credential stands in for authority: whatever holds the key, a person, a laptop or a signing machine, is taken to have the right to act, for as long as it holds it and on anything it is asked to do. Everything the cybersecurity industry sells works on the symptom, making the credential harder to take, and leaves untouched the machine that acts on whatever reaches it and the check that proves the key and never the decision. Better secrets would not have saved Binance on Thursday night, nor the extra code your bank sends to your phone, nor a stronger vault, because nothing was ever taken out of one.
It has been done this way before. The February 2025 theft of $1.5 billion from Bybit ran through [a compromised developer’s machine at Safe](https://www.bleepingcomputer.com/news/security/lazarus-hacked-bybit-via-breached-safe-wallet-developer-machine/?ref=gregchew.ch), the company whose wallet software Bybit used to approve its transfers, and in Bybit’s own words the attack “altered the smart contract logic and masked the signing interface”, after which the people holding the keys signed what their screens showed them, which was not what they were signing. TRM attributes Thursday night, with high confidence, to TraderTraitor, the North Korean group the FBI blamed for Bybit, and the chief executive of Chainalysis, another of the tracing firms, reached the same attribution. Binance has attributed responsibility to nobody.
Look at the engineer’s laptop, because the weakness in it is everybody’s, and crypto has built its assets on top of it.
There is nothing cryptographic about a developer’s machine: it is an ordinary computer. It runs a browser, a build pipeline that assembles and ships the company’s software, and a package manager, the tool that fetches the ready-made blocks of code that modern software is built from. Those blocks are written by thousands of strangers, and they arrive automatically, update automatically, and are read by nobody. In September 2025 eighteen of them, published on npm, the registry most such code comes from, and [downloaded more than two billion times a week](https://www.bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack/?ref=gregchew.ch) between them, were compromised. The way in was the developer who maintained them, who received an email from an address dressed to look like npm’s own, telling him that his two-factor credentials, the extra layer that guards an account beyond its password, were out of date and that his account would be locked. He entered them. The code the attackers then published in his name ran in other people’s browsers and was built to swap the destination of their cryptocurrency payments for addresses the attackers controlled.
My friends Craig Everett, Ulf Wiger (respectively QPQ Chief Product Officer and QPQ Chief Technology Officer) and I spent a session going through that attack line by line, and it is [on YouTube](https://youtu.be/tw6oofOTxT0?ref=gregchew.ch) for anyone who wants the long version. The mechanism we described then is the mechanism Binance described on Friday: a credential on a developer’s machine, a pipeline that acts on whatever reaches it, and everything downstream of it unable to tell the difference between an instruction and a decision.
In March 2016 a developer named Azer Koçulu fell out with npm after it took the name of one of his packages from him at a company’s request, and he withdrew everything he had ever published there. One of those packages was left-pad, eleven lines of code that add spaces to the start of a piece of text. Other packages relied on it and further packages relied on those, so that it sat underneath React, Babel and Ember, tools a great many websites are built with, and its disappearance [broke builds by the hundred within moments](https://lwn.net/Articles/681410/?ref=gregchew.ch). npm’s answer was a new rule: after twenty-four hours an author may no longer withdraw their own work without asking npm, which first checks whether anybody else depends on it. The registry looked at a system nobody could audit and decided the problem was that somebody had been allowed to leave.
Crypto is the most exposed industry on the web, bar none, and it chose every part of that exposure for itself. It pooled its customers’ coins in 'hot wallets' reachable from an engineer’s laptop and signed for them with machines that sign whatever reaches them; it added to Ethereum, in May 2025, a way for a wallet to hand its whole authority to a contract with a single signature; and it put the asset itself in the browser. The 'wallets' it hands its customers are, for the most part, browser plugins, and the phone versions are the same web code wrapped to look like an app, which is what Craig found when he and his team took them apart. MetaMask, the best known of them, is assembled from the same JavaScript package system that was hijacked in September 2025, and [one contributor’s build log](https://github.com/MetaMask/metamask-extension/issues/5728?ref=gregchew.ch) from 2018 shows the package tool auditing 212,620 packages to put it together, code that nobody has read and nobody could. When researchers [tested thirty-nine of the most widely used browser wallets](https://arxiv.org/abs/2504.11735?ref=gregchew.ch), they could abuse every single one of them to take its users’ assets. MetaMask’s answer to all that unread code was [LavaMoat](https://github.com/LavaMoat/LavaMoat?ref=gregchew.ch), a sandbox written in JavaScript to contain JavaScript, and researchers at OtterSec [found two ways out of it](https://osec.io/blog/supply-chain-attacks-a-new-era/?ref=gregchew.ch) that together let a compromised dependency bypass it completely.
A bank in Japan, where Craig lives, will not let a business near its online banking until it has installed the bank’s own browser, stripped of plugins, and carries a physical key card. Crypto takes the one environment serious finance refuses to trust with money and puts the money in it, and when a signature comes out at the far end, the chain reverses nothing.
If these assets were worth what their holders say, nobody would run them like this, and there is no financial institution on earth that would let this infrastructure past its own technology review. You cannot tell the world a token is worth a fortune and guard it with a laptop running code that nobody has read. The way this industry guards its assets is the most honest valuation it has ever published.
Now set that beside what the rest of the web is facing. In April Anthropic reported that its newest model had [taken full control of ten separate, fully patched targets](https://red.anthropic.com/2026/mythos-preview/?ref=gregchew.ch), against one apiece for the generation before it, and in June the heads of the Five Eyes cyber security agencies told the world that [“the timeline is not years, it is months”](https://www.cyber.gc.ca/en/news-events/five-eyes-cyber-security-agencies-statement-ai-shift-cyber-risk-why-leaders-must-act-now?ref=gregchew.ch) to address the risk that this posed. Since then the AI companies have said, in their own words, where those months lead. In August OpenAI said it [could not rule out](https://openai.com/index/responding-next-frontier-critical-cyber-capabilities/?ref=gregchew.ch) that a model it had yet to release had reached the level it calls Critical: able, with no human involved, to find previously unknown flaws in many hardened, real-world critical systems and build working attacks on them. In September Anthropic's chief executive, Dario Amodei, wrote that he worries a swarm of AI agents could, within six to twelve months, be capable of [taking over the entire internet with a persistent botnet](https://darioamodei.com/post/we-must-pace-the-frontier?ref=gregchew.ch). My own reckoning, [set out last week,](https://www.gregchew.ch/the-webs-y2k-moment-the-executive-summary/) is six months, or eighteen for anyone prepared to spend heavily on deferring the inevitable. That is the clock for banks, governments and every operator whose systems patch, monitor and mitigate as a matter of routine, and the mitigations they rely on are exactly what the clock is running down. Crypto has none of that to lose. It will be the first to fall, and fall most often, because it is the softest target holding the most liquid prize, and Thursday was the first night of it. There will be more, and no amount of applause for whoever reaches the switch fastest will hold them off.
The cure is to make access and the right to act separate things, so that getting in confers nothing and every act of authority needs a fresh signature over that instruction, from a key that is not in the pipeline and cannot be put there. An instruction carrying no such signature carries no authority, whatever machine it reaches, and a machine can move only what a named person has signed it to move. That is what my colleagues and I have built, it is operational, and the wallet that goes with it was written from scratch, without npm, for exactly these reasons. None of it is closed to anybody else. Any chain can become an Associate Chain on Groot, the governance-free resource layer at the base of the Gajumaru, and use the tools of the Internet of Economics without giving up anything except the claim to be the one ring to rule them all. That claim, and not the engineering, is what stands in the way, because it is what their tokens are priced on.
For five years, and for the last two above all, I have been told that nobody cares about decentralisation any more: that the chains decentralised in their marketing and nowhere else have won, and that our work is irrelevant because decentralisation does not matter.
Here is what the 'winners' built:
- Seventeen hot wallets at the largest exchange on earth were emptied, starting from one engineer’s laptop, by a machine that signs whatever it is handed;
- Coinbase and Kraken hold their customers’ coins the same way;
- The alternative the industry sells you is a browser plugin made of code that nobody has read; and
- What stopped any of the money was companies and committees reaching into the ledger with switches.
All of it is trust, and the only accountability on offer is goodwill. Decentralisation never stopped mattering; they simply never did it, and on Thursday night the bill came in.
---
## The thief left through the cash-out window
In June I wrote [Someone to Answer For It](https://www.gregchew.ch/someone-to-answer-for-it/), and its argument was that the dollar token, the stablecoin as the industry calls it, is not a way of paying for things at all. The Crypto industry is a casino, its tokens are the chips, and the dollar stand-in token is the cashier's window, where winnings are booked in dollars without ever leaving the blockchain for a bank. It exists because Bitcoin failed at being money and the chips had to come to rest somewhere.
Watch what the thief did with the $1.6 billion of Tether dollars. Before the freezes landed, [$729 million of them](https://www.bitquery.io/investigations/binance-hack?ref=gregchew.ch) had already gone [through Uniswap and other automated exchanges](https://financefeeds.com/binance-hack-3-3b-hot-wallets-drained-tether-circle-freeze/?ref=gregchew.ch), where software swaps one token for another and asks nobody's name, into ether and into TRX, the currency of a 'blockchain' (in truth, another BIMBO) called Tron. The thief did not want the dollar token. A dollar its issuer can freeze is no use to anyone the issuer is chasing, so they went back through the cashier's window the wrong way, out of the dollars and into currencies no issuer can freeze.
The thief also went to Aave, a lending service that runs as software on the blockchain, a protocol in the industry's word, with no loan officer and no application form. The crypto news site [CoinDesk reported](https://www.coindesk.com/business/2026/10/29/potential-multi-billion-binance-hack-hitting-crypto-markets?ref=gregchew.ch) that they borrowed at least 20,000 wrapped ether, a form of ether packaged for use in services like it, worth around $44 million, by pledging stolen Tether dollars as security: a loan, taken out by a thief, from a lending protocol, secured on money just stolen, and granted because the protocol had no means of asking who was borrowing or where the security came from. Aave [froze its markets on Avalanche](https://cryptobriefing.com/aave-freezes-avalanche-markets-binance-hacker/?ref=gregchew.ch), another blockchain, once roughly 1.81 million of that chain's own currency, AVAX, and 8.4 million of the stolen dollars landed there.
You will forgive me asking you to hold that beside what Aave is sold as. A protocol that, allegedly, nobody controls took an emergency decision by committee within an hour, and not for the first time this year: in April it had [done the same](https://www.forbes.com/sites/digital-assets/2026/04/18/withdraw-now-inside-aaves-sudden-200m-bad-debt-crisis/?ref=gregchew.ch) when tokens pledged to it as security turned out to be backed by nothing, leaving an estimated $177 million to $200 million of bad debt, loans that would never be repaid, in the pool of ether it lends out. Its own contracts were not exploited on either occasion. What was wrong both times arrived from outside, and both times the answer was a small number of people acting quickly, which is the answer a bank gives. Except a bank offers accountability and oversight for the trust it asks of you.
---
## Two companies, one button
At one minute past five, New York time, 21:01 in Greenwich, Tether [put the receiving address on its blacklist](https://unchainedcrypto.com/binance-says-user-funds-are-completely-safe-after-3-5-billion-drains-from-its-hot-wallets/?ref=gregchew.ch), which leaves every Tether dollar held there unable to move. Circle did the same with its own tokens, and Tether blacklisted seven further wallets the money had already moved on to. [Before the night was out](https://www.tradingview.com/news/cointelegraph:3a8f5c45b094b:0-live-updates-binance-6-3b-hack-linked-to-north-korea-s-tradertraitor/?ref=gregchew.ch) three smaller issuers, First Digital, Ripple and World Liberty Financial, had done the same with dollar tokens of their own.
**Etherscan, Tether's blacklisting of the receiving address, 21:01:35 UTC on 29 October 2026*
My objection is not to what Tether did on Thursday night. The freeze was right. It kept roughly half of what was taken within reach of somebody who could give it back, and Binance's customers are better off tonight than they would have been had nobody moved. Paolo Ardoino, Tether's chief executive, did the correct thing, he did it in minutes, and in his position (had I sold a sufficiency of my soul to the God of money to be in his position, that is) I would have done the same and slept well. He gave his reason in the same post on X that announced the freeze: "Protecting the industry and our partners is our main priority." Changpeng Zhao, the founder of Binance, quoted that post at 21:31 and added three praying hands and two words.
**Changpeng Zhao, 21:31 UTC, 29 October 2026, with a reply at 21:32 UTC*
"Life saver."
The man who built the largest cryptocurrency exchange in the world, thanking the man who runs the largest dollar token in the world for reaching into the ledger and stopping the money where it sat.
Fifty-seven minutes later Ardoino quoted a post praising Tether's response time and answered it in six words of his own.
**Paolo Ardoino, 22:28 UTC, 29 October 2026*The night the Th
"With great power comes great responsibility."
He is not wrong about either half of that sentence, and I do not think he was being careless when he wrote it. It is the accurate description of his position and he accepted it in public on the night it was demonstrated. Tether holds great power. Tether exercised it. Tether intends to exercise it responsibly, on its own terms and nobody else's.
It has also now done the thing it promised for years, which is to submit to a full audit. In August 2026, KPMG, one of the four largest accounting firms, [gave an unqualified opinion](https://www.coindesk.com/business/2026/08/13/tether-says-it-completed-long-promised-big-four-audit-of-finances-behind-usd180-billion-usdt-stablecoin?ref=gregchew.ch), an auditor's clean bill of health, on Tether International's accounts for 2025, which tells you that last year's books were fairly stated, down to a count of the gold bars it holds as part of its reserves. It does not tell you who decides, the next time, whether your balance is money, and it changes nothing about who answers for that decision. An entity holding more than $180 billion of other people's money against a promise to pay a dollar is doing the work of a commercial bank, or of a money market fund, the kind of fund that aims to hand savers back a dollar for every dollar they put in, and it is supervised as neither.
Now put to Ardoino's sentence the five questions Tony Benn, who [sat in Parliament for forty-seven years](https://members.parliament.uk/member/326?ref=gregchew.ch), [recommended to the House of Commons](https://api.parliament.uk/historic-hansard/commons/1990/may/21/social-charter?ref=gregchew.ch#column%5F135) in May 1990\.
1. What power have you got? The power to decide, unilaterally and in minutes, whether a balance denominated in dollars is money or is nothing.
2. Where did you get it? From our own adoption, from every holder who took the token because it was the only door the chips could leave by.
3. In whose interests do you exercise it? In the interests, on the issuer's own account, of the industry and its partners.
4. To whom are you accountable? For the decision to freeze, to no supervisor, no court and no holder, under no legal duty running to any of them.
5. How can we get rid of you? You cannot.
**Tony Benn, House of Commons, 21 May 1990, Hansard columns 134 to 135*
A bank that reverses a fraudulent transfer does it under a statutory duty, under a supervisor who can fine it, with insurance behind it, and with a court that will hear the customer who says the bank got it wrong. Strip all four of those away and what remains is not a system working. It is a system with a king in it, and the only reason the question of the king's judgement has not yet arisen is that last night his judgement was good.
---
## What the button could not reach
Follow the money out of Binance one step at a time, because the route it took is the playbook. The coins did not come out of anybody’s account. A Binance customer owns a balance in Binance’s own records, and the coins behind all those balances sit together in pooled wallets that Binance controls. Those wallets are what the attacker emptied, all seventeen of them, and every customer’s balance in Binance’s records stayed exactly as it was; what left were the coins behind those balances.
The moment those coins landed in addresses the attacker controlled, they stopped being in anybody’s custody. The attacker held them the way anyone holds coins in a wallet of their own, by holding the key, with no custodian, no ledger and nobody to ask, and the blockchain obeyed the new key as faithfully as it had obeyed Binance’s a minute before. That is self-custody, and on Thursday night it worked perfectly, for the thief: Binance’s customers were left holding lines in Binance’s ledger, and the thief was left holding the coins.
On most of those chains the only thing that can stop a coin is the company that issued it, and only for its own tokens. That is why the dollar tokens went first. The stolen Tether dollars were swapped into ether and TRX through Uniswap before the freezes landed, and some of the rest were pledged at Aave to borrow wrapped ether. Whatever was still sitting in a dollar token when the issuers acted was frozen, and on Arbitrum, a network built on top of Ethereum, a committee with emergency powers locked what had reached it. Everything else had already crossed into coins that no company issues, created by their own networks’ rules, with nobody to telephone.
From there the money kept moving in plain sight, and Etherscan named one of the attacker’s addresses for what it was.
**Etherscan, Binance Hot Wallet Exploiter 2, read at 23:00 UTC on 29 October 2026*
Its labels read "Exploit" and "Heist". In the half hour before I took that picture the address was still sending money out into one token after another, among them Ethena’s dollar, Ondo, wrapped Bitcoin and Aave’s own, while the industry congratulated itself on the freeze. On Friday morning [Bitquery](https://www.bitquery.io/investigations/binance-hack?ref=gregchew.ch) counted about $3.2 billion still in the attacker’s hands, some $1.43 billion of it in bitcoin and $1.14 billion in ether, and [Arkham](https://decrypt.co/382203/binance-finds-additional-points-of-breach-in-6-3b-hack?ref=gregchew.ch) about $2.9 billion still movable. Anyone on earth can open those pages, watch the balance and the transactions, and do nothing whatsoever about it.
So the switch fails both ways. It was too slow for the thief, who had moved what they could into currencies no issuer can freeze before anybody pressed it. It is fast enough for you: the issuer can stop your balance whenever it decides to, exactly as a bank can stop an account, but with none of the protections that come with a bank account. The thief keeps what they got away with, and the honest holder carries the risk of the freeze. That is the worst of both worlds, and it was not bad timing on one night. It is what a private blacklist on a public chain does, every time, to everybody who holds the token.
---
## The defence, and why it broke last night
Whenever an exchange collapses or is robbed, the industry gives the same answer, that the blockchain did not fail and the company did, and every time it has been true.
[Mt Gox](https://www.justice.gov/opa/pr/russian-nationals-charged-hacking-one-cryptocurrency-exchange-and-illicitly-operating-another?ref=gregchew.ch), once the largest bitcoin exchange in the world, held the keys. [Celsius](https://www.cftc.gov/PressRoom/PressReleases/9256-26?ref=gregchew.ch), which pooled its customers’ coins to earn a return on them, held the keys. [FTX](https://www.justice.gov/usao-sdny/pr/samuel-bankman-fried-sentenced-25-years-prison?ref=gregchew.ch), whose founder was sentenced to twenty-five years in prison for what he did with his customers’ deposits, held the keys. In each case the chain did exactly what it was told, the ledger was never wrong, and what failed was a company holding other people’s money with nobody watching it. None of those collapses was a failure of the technology, and every one of them was reported as one.
The defence holds for Binance too. Nothing in Ethereum failed: the key was a key, the wallet obeyed it, and the fault sits inside a company that held billions of dollars of other people’s property in wallets reachable from a laptop. Look, though, at how it held them. [Binance’s own terms](https://bin.bnbstatic.com/static/cms/cg08ou2ak0tn7mcplvfg/file/ba68c39023fe6c69d304cce43e2dfd2bdce6e0eebef312e7fbcfecf8a2e6d653.pdf?ref=gregchew.ch) make the Binance company that holds its customers’ coins their trustee, and then let it keep those coins on the blockchain in pooled wallets together with its own and those of other Binance companies, kept apart only by an entry in its own internal ledger, “for operational efficiency and in accordance with market practice”. The same terms put a customer’s cash with third parties as client money, “in accordance with the Client Money Rules”, where none of it is Binance’s. The cash gets the protection those rules exist to give, and the coins get a pass, written into the contract every customer accepts by opening an account. Coinbase and Kraken write the same mixing into theirs.
Binance’s answer, ever since Changpeng Zhao promised [“Merkle-tree proof of reserves”](https://decrypt.co/113917/binance-ceo-promises-to-implement-proof-of-reserves-after-run-on-ftx?ref=gregchew.ch) and “full transparency” in the week FTX collapsed, is that the blockchain lets anybody see the coins are there, and Zhao put the rest in one line: “Banks run on fractional reserves. Crypto exchanges should not.”
Seeing the coins is not protecting them, and on Thursday night anybody could watch them leave and see the fallacy unfold before their own eyes.
A firm that treated its clients’ cash the way these exchanges treat their clients’ coins would be breaking the very rules Binance applies to the cash. That is Binance’s own contract drawing the line its marketing never will: the dollars are protected as money, and the coins are not. Yet again the industry’s conduct is the evidence against its claims, because nobody leaves a thing they truly believe is worth a fortune mixed in with their own, protected by nothing but an entry in their own books.
The defence is still true, and that is the problem. “The blockchain worked, the company failed” gets the industry off the hook only if the industry is the blockchain, and on Thursday night an industry that sells decentralisation behaved, at every point that mattered, as a collection of centres:
1. Binance, the exchange, lost the money because its signing machine did what it was told;
2. Tether, Circle and three smaller issuers froze what they could, because each holds a lever over every balance it has ever issued;
3. Aave, the lending protocol that nobody is supposed to control, froze its own markets by committee; and
4. Arbitrum’s security council, a committee with emergency powers over that network, locked the thief’s funds there.
Behind them, by Friday, stood the United States Secret Service, whose investigators, [its spokesperson said](https://www.cnn.com/2026/10/30/tech/binance-crypto-heist-hnk-intl?ref=gregchew.ch), were working “around the clock” with Circle and others “to identify, freeze, trace, and recover funds stolen from Binance”. Every one of them is a messenger, every one of them behaved exactly as a messenger behaves, and the industry cheered the rescue, on the record, with timestamps. You cannot sell people a world in which they trust the message, not the messenger, and then thank the messengers for saving them. The defence says the technology did not fail; the rescue says the decentralisation was never there. How many more times does this need to happen before people wake up to the obvious truth?
---
## "Not capable of being effectively supervised"
If the industry is a collection of centres, it has to be judged the way any firm holding other people’s money is judged, and the first question about such a firm is whether anybody can supervise it. Britain’s financial regulator answered that question about Binance in March 2022, on [its own website](https://www.fca.org.uk/news/press-releases/recent-statements-binance-and-eqonex-limited?ref=gregchew.ch), where the answer still sits. It restricted Binance Markets, the group’s British arm, because, in its view, “Binance Markets is not capable of being effectively supervised”, and it added that “this is particularly concerning in the context of Binance Markets’ membership of the global Binance group”.
UK **Financial Conduct Authority, first published 7 March 2022*
A regulator does not write that sentence about a firm that gave it difficult answers. It writes it about a firm whose structure made answers impossible.
In Australia the securities regulator had called a hearing on whether to cancel the licence of Binance's business there in derivatives, contracts tied to the future price of an asset, and in April 2023 Binance [asked for the cancellation itself](https://asic.gov.au/about-asic/news-centre/find-a-media-release/2023-releases/23-091mr-binance-australia-derivatives-afs-licence-cancelled/?ref=gregchew.ch). In May 2023 it found Canada, in its own words, [no longer tenable](https://coindesk.com/business/2023/05/12/binance-announces-exit-from-canada-citing-regulatory-tensions/?ref=gregchew.ch) and left, and a year later the country's financial intelligence unit, which polices money laundering, [fined it just over six million Canadian dollars](https://fintrac-canafe.canada.ca/new-neuf/nr/2024-05-09-eng?ref=gregchew.ch) for operating there without registering as a money services business. In Germany it [withdrew its application to BaFin](https://www.coindesk.com/policy/2023/07/26/binance-withdraws-german-crypto-license-application?ref=gregchew.ch), the national financial regulator, in July 2023, after reports that it was about to be refused. In November 2023 the company [pleaded guilty in the United States](https://www.justice.gov/usao-wdwa/pr/binance-and-ceo-plead-guilty-federal-charges-4b-resolution?ref=gregchew.ch) to violations of the Bank Secrecy Act, the country's main law against money laundering, to operating an unregistered money transmitting business and to sanctions breaches, and paid roughly $4.3 billion. In June 2026, with Europe's crypto regulation requiring authorisation in a member state by 1 July, it [withdrew its application in Greece](https://www.coindesk.com/policy/2026/06/26/binance-tells-eu-users-it-will-no-longer-provide-services-after-failing-to-secure-mica-license?ref=gregchew.ch), which under those rules would have opened the whole Union to it, and from that date could not serve a client anywhere in the European Union, while around two hundred other firms cleared the same bar.
**United States Attorney's Office, Western District of Washington, 21 November 2023*
Then, last December, somebody said 'yes'. The Financial Services Regulatory Authority of the Abu Dhabi Global Market, a financial centre in the United Arab Emirates with its own laws and courts, [authorised Binance's global platform](https://www.binance.com/en-GB/legal/licenses?ref=gregchew.ch), though it did not license Binance as one company. It licensed three separate ones.
- Nest Exchange Limited became a Recognised Investment Exchange, licensed to run a multilateral trading facility, the regulated marketplace where buyers' orders meet sellers'.
- Nest Clearing and Custody Limited became a Recognised Clearing House, which stands between buyers and sellers to see that every trade settles, with permission to keep clients' assets in custody and to act as a central securities depository, the institution that keeps the official record of who owns what, which is where the clients' property goes.
- Nest Trading Limited became the broker-dealer, which is the part that trades, for clients and on its own account.
Three companies, because the three jobs are meant to be kept apart: the company that holds your coins should never be the company that trades against you, so that whatever the trader loses, it cannot lose what is yours. That is the theory Abu Dhabi licensed, and on paper Binance followed it. In practice its terms let all three companies keep their coins in the same wallets as yours, so the separation lives in the company register and, by Binance’s own contract, need not exist on the blockchain at all. Britain, Australia, Canada, Germany, the United States and, under Europe’s new rules, Greece each looked at Binance and restricted it, fined it, prosecuted it or watched it withdraw. Abu Dhabi licensed a separation that Binance’s own terms take apart, and after Thursday night there is egg on a great many faces, the regulator’s among them.
On 5 January 2026 the rights and obligations of Binance’s global customers were transferred to those three companies. If you have an account, read clause 8.1.1 of [the terms you are now on](https://bin.bnbstatic.com/static/cms/cg08ou2ak0tn7mcplvfg/file/ba68c39023fe6c69d304cce43e2dfd2bdce6e0eebef312e7fbcfecf8a2e6d653.pdf?ref=gregchew.ch): “By opening a Binance Account, you appoint NCCL as custodian of all your Digital Assets, Securities and Currency.” NCCL is Nest Clearing and Custody Limited. Clause 8.2 says it holds them as trustee, under a legal duty to you as their owner. Clause 8.4.1(c) says those assets may be held on the blockchain “*in one or more omnibus wallets together with Digital Assets held by NCCL for itself and its other clients, including other ADGM Binance Entities and Binance Affiliates*.” The other ADGM Binance Entities are the exchange and the trading company that Abu Dhabi licensed alongside it.
**Binance Terms of Use, clause 8.4.1(c), effective 7 May 2026*
Read together, those clauses describe what a customer actually held on Thursday evening. The coins were not on a blockchain in any sense the customer would recognise. They were in a pool, mixed with the custodian’s own and with those of other Binance companies, in wallets one company controlled, and all the customer held was an entry in that company’s internal ledger and a claim on the pool, the ledger being, by clause 8.4.1(a), the one place where the custodian’s assets and its clients’ are kept apart. The decentralisation, the claim that no single party is in control, was a property of the network the assets were sitting still on. It was never a property of anybody’s holding.
Binance has said since Thursday night that user funds are safe. [Its statement on X](https://x.com/binance/status/2115918888429133902/history?ref=gregchew.ch) said at 21:16 that it had "not confirmed any impact to user funds"; eight minutes later that sentence was gone, and five minutes after that the same post said "User funds are completely safe."
**Binance, the opening of one post as it stood at 21:16, 21:24 and 21:29 UTC, 29 October 2026*
On Friday its co-chief executive said, [CoinDesk reported](https://www.coindesk.com/tech/2026/10/30/binance-uncovers-wider-breach-in-usd6-3-billion-exploit-targets-sunday-withdrawal-restart?ref=gregchew.ch), that the attack had targeted Binance’s own hot wallet, not customer funds. ***Binance’s own records say otherwise, twice.*** Binance 14 appears in [its proof of reserves of 1 October](https://www.coindesk.com/business/2026/10/30/binance-hack-drained-wallets-backing-customer-assets-reserve-data-shows?ref=gregchew.ch), the list Binance publishes of the assets that back its customers’ balances, then holding 1.26 billion Tether dollars and 89,475 ether. On Friday Binance itself said it was buying tokens on the market [to “address any asset shortfalls”](https://x.com/binance/status/2116121748555153621?ref=gregchew.ch) and would use company money to “cover confirmed shortfall”, and a shortfall can only mean that what is left is less than what customers are owed.
**Binance, 10:55 UTC, 30 October 2026*
So the coins that left were the coins backing customers’ balances, and when Binance calls them its own it is describing a decision, not a fact on the chain. Its terms put customers’ coins and its own in the same pooled wallets and tell them apart only in its own books, so whose loss this is comes down to which line in those books Binance decides to debit.It has chosen its own, for now, and that is not the same thing as the customers’ coins having been safe. Which of its three licensed companies held the keys to the wallets that emptied, Binance has not said.
Less than ten months after the three-company structure went live, seventeen of Binance's hot wallets were emptied, starting from an engineer’s laptop, and on Friday the Financial Services Regulatory Authority [said it was aware of the matter](https://www.khaleejtimes.com/business/uae-fsra-statement-binance-63-billion-security-breach?ref=gregchew.ch), described it as a security incident involving unauthorised withdrawals of assets, and said it was monitoring and engaging closely with Binance. That is the mildest language a supervisor has, and it is still the first time a loss on this scale has landed on the desk of a regulator that licensed the business that suffered it.
[Binance says](https://x.com/binance/article/2116258356109496479?ref=gregchew.ch) it has set aside over $6.34 billion to restore customer balances one for one, about $5 billion of it already held in the same tokens that were taken and the rest to be bought on the market and in private deals. Withdrawals are suspended; Binance aims to begin reopening them on Sunday, in phases and once its own security checks are done, and to have the result of an initial snapshot of its reserves by Monday. Bitcoin [fell overnight to $76,400](https://www.coindesk.com/markets/2026/10/30/crypto-liquidations-jump-to-usd1-57-billion-as-binance-hack-sends-bitcoin-ether-lower?ref=gregchew.ch), its lowest since September, ether touched $2,170, and liquidations, the forced closing of bets placed with borrowed money, jumped fourfold to $1.57 billion. The restoration is therefore circular: the exchange will make its customers whole in the assets whose price its own failure helped drive down, partly by buying those assets in the market it helped drive down, and they may not take their money out while it does so.
Which leaves the question nobody in this industry wants asked. This time the bill was $6.3 billion, and Binance says it will pay it from what it calls its Secure Asset Fund for Users, which [Al Jazeera put at $1 billion](https://www.aljazeera.com/news/2026/10/30/binance-says-6-3bn-stolen-in-biggest-crypto-heist-in-history-what-we-know?ref=gregchew.ch), and from its corporate treasury. Nothing I have found in its terms or in its regulator’s statement obliges it to: the promise to make customers whole is Binance’s own, and what a customer holds is a claim on Binance, not a coin on the chain. So what happens on the night the bill is bigger than the treasury, or bigger than its owners’ appetite for taking the long view on behalf of customers? On that night the customer’s protection is exactly what it was on Thursday, the goodwill of the people who own the company, and goodwill has a price at which it runs out.
---
## Which kills 'crypto' first?
By the end of Friday the industry had its story ready: nearly half the money frozen within hours, every customer promised every coin back, withdrawals to reopen on Sunday. The story is true, and it misses the point. Crypto is now in a race between two ways of dying. It can die of its own bad practice, the work of people who handle other people's money as though it were a game and of governments that let them, or it can die because it is the most exposed part of a web that is facing its own Y2K moment, and on Thursday night both were at work.
Take its own practice first. The largest exchange in the world keeps its customers' coins in wallets pooled with its own, online, behind a machine that signs whatever reaches it. The largest issuer of dollar tokens holds more than $180 billion of other people's money, is supervised as neither a bank nor a money market fund, and can freeze any balance it has ever issued, on its own say-so, in minutes. The protocols nobody is supposed to control are run, when it matters, by committees. On the night it mattered most, Binance told the world its users' funds were "completely safe" while its wallets were still being emptied, Tether's chief executive wrote that "Protecting the industry and our partners is our main priority", and Binance's founder answered the freeze with three praying hands and the words "life saver". None of that is how anybody behaves with money they take seriously.
The governments that might have stopped it split in two. Britain's regulator found Binance's British arm "not capable of being effectively supervised", Europe's rules shut Binance out of the European Union this June, and in November 2023 the United States secured guilty pleas from the company and its founder, Changpeng Zhao, and $4.3 billion in penalties.
Then Washington stopped looking. In February 2025 the Securities and Exchange Commission [dropped its case against Coinbase](https://www.sec.gov/newsroom/press-releases/2025-47?ref=gregchew.ch), saying it acted to reform "its regulatory approach to the crypto industry, not on any assessment of the merits", and in March it [dropped its case against Kraken](https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26278?ref=gregchew.ch) in the same words. That same month MGX, "the Abu Dhabi-based AI and advanced technology investor" in Binance's own description, [put $2 billion into Binance](https://www.binance.com/en/support/announcement/detail/23d0a12bf35f42f4a9f7f0cff998ae64?ref=gregchew.ch), and on 1 May World Liberty Financial, Donald Trump's crypto venture, announced that its dollar token, USD1, had been "[selected as the official stablecoin to close MGX's $2 billion investment in Binance](https://www.foxbusiness.com/markets/trumps-stablecoin-chosen-2-billion-abu-dhabi-investment-binance-co-founder-says?ref=gregchew.ch)".
Four weeks later, on 29 May, the Commission [dropped its case against Binance and Zhao](https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26316?ref=gregchew.ch), with prejudice, so that it can never be brought again, "as a policy matter". On 23 October President Trump [pardoned Zhao](https://www.reuters.com/world/us/trump-pardons-convicted-binance-founder-zhao-white-house-says-2025-10-23/?ref=gregchew.ch), who had been, in the White House's words, "prosecuted by the Biden Administration in their war on cryptocurrency". In December Abu Dhabi's financial regulator licensed Binance's global platform, and on Friday it said it was monitoring the matter.
Congress, meanwhile, has written the switch into law. The [GENIUS Act of July 2025](https://www.govinfo.gov/content/pkg/PLAW-119publ27/html/PLAW-119publ27.htm?ref=gregchew.ch) lets an issuer put out dollar tokens "only if the issuer has the technological capability to comply, and will comply, with the terms of any lawful order", meaning an order from a court or a federal agency to "seize, freeze, burn, or prevent the transfer" of them. The bill meant to regulate the sale of the coins themselves, the Digital Asset Market Clarity Act, [stalled in the Senate on 15 September](https://www.senate.gov/legislative/LIS/roll%5Fcall%5Flists/roll%5Fcall%5Fvote%5Fcfm.cfm?congress=119&session=2&vote=00234&ref=gregchew.ch), when a vote to take it up failed, forty-nine to fifty, with sixty needed. That is the casino as its governments have left it: it picked its own inspector, it keeps the players' chips in the house float, and whoever holds the key to the cashier's window decides which chips are still worth anything.
That kind of death is slow. It can take years and look like business as usual almost the whole way down, a failure absorbed, a statement amended, a licence found where others were refused, a case dropped and a switch applauded, until the night the bill is bigger than the treasury, as Thursday's already was more than six times the size of the fund Binance keeps for exactly this, and the goodwill of the owners runs out.
---
Go back to that page as it stood on Thursday night.
**Etherscan, Binance 14, read at 23:00 UTC on 29 October 2026*
By Friday evening the word had gone from it.
**Etherscan, Binance 14, read at 17:39 UTC on 30 October 2026*
The word was Authority, and it names the second way crypto can die. Thursday's thief broke no cryptography. A stranger's contract was handed the wallet by a signature the wallet's own key had given, through a machine that signs what it is handed, reached from an engineer's laptop. That weakness belongs to the whole web: the same mandate, signed once and spent by whoever reaches the thing that holds it, sits behind the login at your bank, the register that holds the title to your house, the system that built the software you are reading this on, and every AI agent now being sent out with a credential. Its only protection was ever the cost of getting in, and artificial intelligence has collapsed that cost. In April Anthropic reported that its newest model had taken full control of ten fully patched targets, and that same month Switzerland's financial regulator said that if models like it were loose in the world, ["virtually all existing software systems could simultaneously be affected"](https://www.swissinfo.ch/eng/finma-says-immediate-mythos-access-would-pose-systemic-bank-risk/91312240?ref=gregchew.ch), which it would classify as "a systemic risk". In June the heads of the Five Eyes cyber security agencies warned that frontier AI will transform what attackers can do and put the timeline in eight words, "The timeline is not years, it is months", which makes systemic compromise of web operations a matter of months. That is the web's Y2K moment, and I set out its record eight days ago in [The Web's Y2K Moment](https://www.gregchew.ch/the-webs-y2k-moment-the-executive-summary/); start with the executive summary, and the full report, six months of long hours of reading, research and writing to illuminate the whole story, follows by 2 November.
Now count what Thursday's thief needed: an engineer's laptop, a signing machine that signs whatever reaches it, a feature Ethereum added in May 2025 that lets one signature hand a whole wallet to a contract, and seventeen online tills whose balances anyone on earth can read, to the last decimal, on a public web page. Every item on that list is a choice this industry made, for speed and quick money, and it makes the same choices for its customers: the wallets it sells them as the safe alternative are plug-ins in a web browser, built from code nobody has read, and when researchers tested thirty-nine of the most widely used, they could have taken the money from every one.
Once the coins move they are gone, paid in seconds to whoever holds the key and called back by nobody, unless an issuer holds a switch over them. Binance's terms give the reason for the pool in two words, "operational efficiency", and the same two words would serve for all of it. No industry on the web is as exposed as crypto, none chose its exposure so completely, and the thief it faces is, on the evidence of the firms tracing the money, a state: North Korea, which the FBI named for the $1.5 billion taken from Bybit last year and which TRM Labs names with high confidence for Thursday.
So the race is this. Crypto's own practice will kill it slowly, over years, one absorbed failure and one dropped case at a time. The web will kill it fast, in months, one emptied wallet at a time, and crypto stands first in the line. The cruelty is in how the two fit together. When the web broke in on Thursday, crypto was saved by its own bad practice, by switches, committees and an exchange's money, the middlemen it was invented to get rid of. Every time the web wins a night, crypto can be rescued only by more of them, so that every escape from the fast death is a step further into the slow one. Which arrives first is the only question left, and either way it ends on the same night, the night nobody believes the sign any more.
Binance has set aside the money to pay for its own failure, and on Friday evening [its co-chief executives wrote](https://x.com/binance/article/2116258356109496479?ref=gregchew.ch) that Binance "will absorb the financial impact of these stolen funds, not our users." Magnanimous; responsible, certainly, if it can be delivered. This time.
**Binance, Security Incident Update #2, 19:58 UTC, 30 October 2026*
Someone answered for Thursday night, and it was nobody with a switch, a licence, a vote or a pardon. It was not Binance, which keeps taking deposits while withdrawals stay shut and made its promise in an announcement that, like all its announcements, it reserves the right to cancel "at any time and for any reasons without prior notice". It was not Tether, which pressed its button for "the industry and our partners" and was thanked for it, nor Circle, which pressed its own, nor World Liberty Financial, a venture [Reuters describes](https://www.foxbusiness.com/markets/trumps-stablecoin-chosen-2-billion-abu-dhabi-investment-binance-co-founder-says?ref=gregchew.ch) as aiming to give people financial services "without intermediaries like banks", which froze its dollar tokens like any bank.
It was not the founder who was pardoned a year and six days before he called the freeze a life saver. It was not the regulator in Abu Dhabi that is monitoring the matter, the one in Washington that dropped its case "as a policy matter", or the Senate that could not find the votes to take up the rules.
It was the customers. They were told they held something nobody could take, they agreed to clause 8.4.1(c) by opening an account, and they are locked out of what is theirs, and with them is everyone holding these assets who watched their positions closed out, $1.57 billion of positions in a night that no promise of Binance's reaches. They are the ones who lost their money and the ones these cowboys betrayed, sold a world with no messengers to trust by the messengers themselves.
© Gregory Chew, 30th October 2026
## Bibliography
1. Etherscan, transaction 0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3, block 26300770, 20:24:23 UTC on 29 October 2026, read 30 October 2026: called on Binance 14 by 0x7C8601d4645b93cea45F71e118A729332e6B5CA0, labelled Binance Hot Wallet Exploiter, with an internal transfer of 167,464.247856558836135296 ether from Binance 14 to Binance Hot Wallet Exploiter 2 and sixty-three token transfers from Binance 14 in sixty-three different tokens, among them 1,615,409,498.97324 USDT. [https://etherscan.io/tx/0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3](https://etherscan.io/tx/0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3?ref=gregchew.ch)
2. Etherscan, address page for Binance 14, 0x28C6c06298d514Db089934071355E5743bf21d60, read at source 23:00 UTC on 29 October 2026, carrying the tags Binance 14, Authority, Delegated to 0x63e842B0...73e9c6fAe, Binance and Exchange, with an ether balance of 0.960965124283924068; read again at 17:39 UTC on 30 October 2026, carrying only the tags Binance 14, Binance and Exchange. [https://etherscan.io/address/0x28C6c06298d514Db089934071355E5743bf21d60](https://etherscan.io/address/0x28C6c06298d514Db089934071355E5743bf21d60?ref=gregchew.ch)
3. Invezz, "Is Binance being hacked? Billions leave hot wallets as Tether and Circle freeze funds", 29 October 2026, for the second Binance wallet sending 28,005 ether to the same address. [https://invezz.com/news/2026/10/29/is-binance-being-hacked-billions-leave-hot-wallets-as-tether-and-circle-freeze-funds/](https://invezz.com/news/2026/10/29/is-binance-being-hacked-billions-leave-hot-wallets-as-tether-and-circle-freeze-funds/?ref=gregchew.ch)
4. Bitquery, "Binance Hack: $6.3B Drained on 9 Chains", investigation published 06:30 UTC on 30 October 2026, for seventeen hot wallets drained across nine blockchains between 20:04 and 23:56 UTC, the $729 million of USDT swapped into ETH and TRX before the freezes, the attacker's holdings of about $3.2 billion at 06:43 UTC, and the locking of the attacker's funds by Arbitrum's Security Council. [https://www.bitquery.io/investigations/binance-hack](https://www.bitquery.io/investigations/binance-hack?ref=gregchew.ch)
5. Decrypt, "Binance Finds 'Additional Points of Breach' in $6.3B Hack", 30 October 2026, for Binance's estimate of about $6.3 billion, its statements on additional points of breach and on finding no evidence of a private key leak, Richard Teng's remarks, and Arkham's figures of $6.01 billion taken and about $2.9 billion still movable. [https://decrypt.co/382203/binance-finds-additional-points-of-breach-in-6-3b-hack](https://decrypt.co/382203/binance-finds-additional-points-of-breach-in-6-3b-hack?ref=gregchew.ch)
6. Help Net Security, Sinisa Markovic, "Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record", 30 October 2026, for Binance's security update on the compromised DevOps engineer's laptop and the service container, TRM Labs' analysis of fifty pre-signed authorisations and of valid signatures across ten blockchains, its conclusion of a compromise of hot wallet signing infrastructure and its attribution to TraderTraitor, and the Chainalysis attribution. [https://www.helpnetsecurity.com/2026/10/30/binance-crypto-hack/](https://www.helpnetsecurity.com/2026/10/30/binance-crypto-hack/?ref=gregchew.ch)
7. Federal Bureau of Investigation, Public Service Announcement I-022625-PSA, 26 February 2025, attributing to the Democratic People's Republic of Korea, under the name TraderTraitor, the theft of approximately $1.5 billion in virtual assets from Bybit on or about 21 February 2025\. [https://ic3.gov/psa/2025/psa250226](https://ic3.gov/psa/2025/psa250226?ref=gregchew.ch)
8. CoinDesk, Krisztian Sandor and Stephen Alpher, "Binance loses over $6 billion in 'biggest crypto hack in history'", 29 October 2026, updated 30 October 2026, for Tether's freeze of over $1.57 billion and Circle's of over $800 million, and for the attacker borrowing at least 20,000 wrapped ether, worth around $44 million, from Aave against stolen USDT. [https://www.coindesk.com/business/2026/10/29/potential-multi-billion-binance-hack-hitting-crypto-markets](https://www.coindesk.com/business/2026/10/29/potential-multi-billion-binance-hack-hitting-crypto-markets?ref=gregchew.ch)
9. CoinDesk, "Binance arranges $6.34 billion to cover losses from record crypto hack", 30 October 2026, for the reserve, the roughly $5 billion already held in the affected tokens, purchases of the remainder on public markets, the roughly $3 billion frozen, and the suspension of withdrawals. [https://www.coindesk.com/business/2026/10/30/binance-arranges-usd6-34-billion-to-cover-losses-from-record-crypto-hack](https://www.coindesk.com/business/2026/10/30/binance-arranges-usd6-34-billion-to-cover-losses-from-record-crypto-hack?ref=gregchew.ch)
10. Jeremy Allaire (@jerallaire), chief executive of Circle, post on X, 21:18:30 UTC on 29 October 2026: "In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation." [https://x.com/jerallaire/status/2115916207463481846](https://x.com/jerallaire/status/2115916207463481846?ref=gregchew.ch)
11. Dan Held (@danheld), reply on X to Jeremy Allaire's post of 21:18:30 UTC, posted 21:46:04 UTC on 29 October 2026: "🫡 good guy Circle". [https://x.com/danheld/status/2115923144263246201](https://x.com/danheld/status/2115923144263246201?ref=gregchew.ch)
12. Satoshi Nakamoto, "Bitcoin: A Peer-to-Peer Electronic Cash System", 2008, circulated on 31 October 2008, for the statement of what was needed: "an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party". [https://bitcoin.org/bitcoin.pdf](https://bitcoin.org/bitcoin.pdf?ref=gregchew.ch)
13. CNN, Sean Lyngaas, "Binance crypto hack: North Korea suspected to be behind biggest-ever heist", 30 October 2026, 11:43 ET, for Binance as the world's largest cryptocurrency exchange, the FBI's statement that it is engaged with public and private partners, and a US Secret Service spokesperson's statement that its investigators are working around the clock with private-sector partners including Circle to identify, freeze, trace and recover the funds, in coordination with the United States Attorney's Office for the District of Columbia. [https://www.cnn.com/2026/10/30/tech/binance-crypto-heist-hnk-intl ](https://www.cnn.com/2026/10/30/tech/binance-crypto-heist-hnk-intl?ref=gregchew.ch)
14. Coinbase, User Agreement (United States), as published on 30 October 2026, clause 2.7.3, for “As long as you continue to hold Supported Digital Assets with Coinbase, Coinbase shall retain control over electronic private keys associated with blockchain addresses operated by Coinbase, including the blockchain addresses used to hold the Supported Digital Assets credited to your Digital Asset Wallet”, and clause 2.7.4, for its use of “shared blockchain addresses, controlled by Coinbase, to hold Supported Digital Assets for Digital Asset Wallets on behalf of customers and/or held on behalf of Coinbase”. [https://www.coinbase.com/legal/user\_agreement/united\_states](https://www.coinbase.com/legal/user%5Fagreement/united%5Fstates?ref=gregchew.ch)
15. Kraken, Global Terms of Service, last updated 28 October 2026, “Custody and Title of Digital Assets”, for “In order to more securely and effectively custody Digital Assets, we may use shared blockchain addresses, that we control, to hold Digital Assets on your behalf and to hold on our behalf.” [https://www.kraken.com/legal/global-terms](https://www.kraken.com/legal/global-terms?ref=gregchew.ch)
16. Ethereum Improvement Proposal 7702, "Set Code for EOAs", status Final. [https://eips.ethereum.org/EIPS/eip-7702](https://eips.ethereum.org/EIPS/eip-7702?ref=gregchew.ch)
17. Ethereum Foundation, "Pectra Mainnet Announcement", 23 April 2025, for activation on mainnet on 7 May 2025 at 10:05:11 UTC with EIP-7702 included. [https://blog.ethereum.org/2025/04/23/pectra-mainnet](https://blog.ethereum.org/2025/04/23/pectra-mainnet?ref=gregchew.ch)
18. Cointelegraph, Felix Ng, "Binance hack may involve private key misuse, not theft: Blockaid", 30 October 2026, for Ido Ben-Natan's assessment and Blockaid's finding of fifty bundled EIP-7702 authorisations against Binance 14\. [https://cointelegraph.com/news/binance-hack-may-involve-private-key-misuse-not-theft-blockaid-ceo](https://cointelegraph.com/news/binance-hack-may-involve-private-key-misuse-not-theft-blockaid-ceo?ref=gregchew.ch)
19. CryptoTicker, "Binance Hack: $2.8B Drained From Hot Wallet via EIP-7702", 29 October 2026, for the deployment of the attacker's contract on the afternoon of 29 October, the delegation of Binance 14 at 20:20:59 UTC and the sweep at 20:24:23 UTC. [https://cryptoticker.io/en/binance-hack-hot-wallet-drained/](https://cryptoticker.io/en/binance-hack-hot-wallet-drained/?ref=gregchew.ch)
20. Greg Chew, "The Web's Y2K Moment: The TLDR Notes", gregchew.ch, 22 October 2026\.
21. Richard Teng, co-chief executive of Binance, post on LinkedIn, 30 October 2026, captured the same day, for "the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process"; "Our investigation has not attributed responsibility to any individual"; "So far, we have found no evidence of any wallet private key leak"; and an estimated total impact of about $6.3 billion "with \~$3B frozen on-chain so far, in coordination with our blockchain partners".
22. BleepingComputer, Sergiu Gatlan, "Lazarus hacked Bybit via breached Safe{Wallet} developer machine", 26 February 2025, for the compromise of a Safe{Wallet} developer's machine and Bybit's statement that the attack altered the smart contract logic and masked the signing interface. [https://www.bleepingcomputer.com/news/security/lazarus-hacked-bybit-via-breached-safe-wallet-developer-machine/](https://www.bleepingcomputer.com/news/security/lazarus-hacked-bybit-via-breached-safe-wallet-developer-machine/?ref=gregchew.ch)
23. BleepingComputer, Sergiu Gatlan, "Hackers hijack npm packages with 2 billion weekly downloads in supply chain attack", 8 September 2025, for the eighteen compromised packages, the phishing of the maintainer and the payment-redirecting code. [https://www.bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack/](https://www.bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack/?ref=gregchew.ch)
24. Greg Chew, Craig Everett and Ulf Wiger, "NPM Supply Chain Hack, Unserious Crypto, Serious Gajumaru", full discussion, video. [https://youtu.be/tw6oofOTxT0](https://youtu.be/tw6oofOTxT0?ref=gregchew.ch)
25. LWN.net, Nathan Willis, on the left-pad affair, 30 March 2016, for the withdrawal of Azer Koçulu's packages, the builds broken through left-pad, and npm's unpublish policy of 29 March 2016\. [https://lwn.net/Articles/681410/](https://lwn.net/Articles/681410/?ref=gregchew.ch)
26. MetaMask extension, GitHub issue 5728, “Cant build deps”, opened 12 November 2018, a contributor’s build log recording the package tool auditing 212,620 packages in 45.235 seconds and reporting nineteen vulnerabilities. [https://github.com/MetaMask/metamask-extension/issues/5728](https://github.com/MetaMask/metamask-extension/issues/5728?ref=gregchew.ch)
27. WalletProbe, arXiv 2504.11735, for its test of thirty-nine widely adopted browser wallet extensions, every one of which could be abused to take assets from its users. [https://arxiv.org/abs/2504.11735](https://arxiv.org/abs/2504.11735?ref=gregchew.ch)
28. LavaMoat, the layer that sandboxes a JavaScript dependency graph, written in JavaScript and running inside the JavaScript environment it is meant to contain.[ https://github.com/LavaMoat/LavaMoat](https://github.com/LavaMoat/LavaMoat?ref=gregchew.ch)
29. OtterSec, “Supply Chain Attacks: A New Era”, 10 June 2024, for two escapes from LavaMoat and the researchers’ conclusion that, combined, they permit complete bypass through a compromised dependency. [https://osec.io/blog/supply-chain-attacks-a-new-era/](https://osec.io/blog/supply-chain-attacks-a-new-era/?ref=gregchew.ch)
30. Anthropic Frontier Red Team, “Assessing Claude Mythos Preview’s cybersecurity capabilities”, 7 April 2026, for full control-flow takeover on ten separate, fully patched targets, against one apiece for the preceding generation. [https://red.anthropic.com/2026/mythos-preview/](https://red.anthropic.com/2026/mythos-preview/?ref=gregchew.ch)
31. Five Eyes cyber security agencies, “Five Eyes cyber security agencies statement on the AI shift in cyber risk: why leaders must act now”, 22 June 2026, signed by the heads of the Australian Cyber Security Centre, the Canadian Centre for Cyber Security, New Zealand’s Government Communications Security Bureau, GCHQ, the National Security Agency and CISA, for “The timeline is not years, it is months.” [https://www.cyber.gc.ca/en/news-events/five-eyes-cyber-security-agencies-statement-ai-shift-cyber-risk-why-leaders-must-act-now](https://www.cyber.gc.ca/en/news-events/five-eyes-cyber-security-agencies-statement-ai-shift-cyber-risk-why-leaders-must-act-now?ref=gregchew.ch)
32. OpenAI, "Responding to the next frontier of critical cyber capabilities", 7 August 2026, for its statement that it cannot rule out critical cyber capabilities under its Preparedness Framework in a model it had yet to release, and for its definition of the Critical cybersecurity threshold, a model that can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention. [https://openai.com/index/responding-next-frontier-critical-cyber-capabilities/](https://openai.com/index/responding-next-frontier-critical-cyber-capabilities/?ref=gregchew.ch)
33. Dario Amodei, "We must pace the frontier", 12 September 2026, for his concern that within six to twelve months a swarm of agents could be capable of taking over the entire internet with a persistent botnet. [https://darioamodei.com/post/we-must-pace-the-frontier](https://darioamodei.com/post/we-must-pace-the-frontier?ref=gregchew.ch)
34. Greg Chew, "Someone to Answer For It: Why Stablecoins Fail as Money", gregchew.ch, 27 June 2026\.
35. FinanceFeeds, "Suspected Binance Hack Drains $3.3B From Hot Wallets as Tether, Circle Freeze $1.8B", 29 October 2026, for the stolen USDT swapped through Uniswap and other pools before the blacklisting. [https://financefeeds.com/binance-hack-3-3b-hot-wallets-drained-tether-circle-freeze/](https://financefeeds.com/binance-hack-3-3b-hot-wallets-drained-tether-circle-freeze/?ref=gregchew.ch)
36. Crypto Briefing, "Aave freezes Avalanche lending markets to block suspected Binance hacker", 29 October 2026\. [https://cryptobriefing.com/aave-freezes-avalanche-markets-binance-hacker/](https://cryptobriefing.com/aave-freezes-avalanche-markets-binance-hacker/?ref=gregchew.ch)
37. Forbes, Boaz Sobrado, "'Withdraw Now' - Inside Aave's Sudden $200M Bad Debt Crisis", 18 April 2026, updated 20 April 2026, for the rsETH exploit, the estimated $177 million to $200 million of bad debt, the freezing of the affected markets and Aave's statement that its contracts were not exploited. [https://www.forbes.com/sites/digital-assets/2026/04/18/withdraw-now-inside-aaves-sudden-200m-bad-debt-crisis/](https://www.forbes.com/sites/digital-assets/2026/04/18/withdraw-now-inside-aaves-sudden-200m-bad-debt-crisis/?ref=gregchew.ch)
38. Unchained, "Binance Says User Funds Are 'Completely Safe' After $3.5 Billion Drains From Its Hot Wallets", 29 October 2026, for the blacklisting times, the seven further wallets blacklisted downstream, and Binance's statement that user funds are completely safe. [https://unchainedcrypto.com/binance-says-user-funds-are-completely-safe-after-3-5-billion-drains-from-its-hot-wallets/](https://unchainedcrypto.com/binance-says-user-funds-are-completely-safe-after-3-5-billion-drains-from-its-hot-wallets/?ref=gregchew.ch)
39. Cointelegraph, live updates, "As it happened: Binance's record $6.3B crypto hack", carried by TradingView, for the freezes by World Liberty Financial of USD1 (22:36 UTC on 29 October), by Ripple of RLUSD (23:40 UTC) and by First Digital of FDUSD (02:21 UTC on 30 October 2026). [https://www.tradingview.com/news/cointelegraph:3a8f5c45b094b:0-live-updates-binance-6-3b-hack-linked-to-north-korea-s-tradertraitor/](https://www.tradingview.com/news/cointelegraph:3a8f5c45b094b:0-live-updates-binance-6-3b-hack-linked-to-north-korea-s-tradertraitor/?ref=gregchew.ch)
40. Etherscan, transaction 0x7baba482077843514d9c72bac0110ba0916b0814288a72917e2c3bb27a9d8659, block 26300954, 21:01:35 UTC on 29 October 2026, read 30 October 2026, which Etherscan records as "Blocked Binance Hot Wallet Exploiter 2 from USDT": a confirmation on the multisignature wallet that owns the USDT contract, executing addBlackList for 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c. [https://etherscan.io/tx/0x7baba482077843514d9c72bac0110ba0916b0814288a72917e2c3bb27a9d8659](https://etherscan.io/tx/0x7baba482077843514d9c72bac0110ba0916b0814288a72917e2c3bb27a9d8659?ref=gregchew.ch)
41. Changpeng Zhao (@cz\_binance), post of 21:31 UTC on 29 October 2026, quoting Paolo Ardoino's post that Tether froze more than 1.567 billion USDT and that protecting the industry and its partners is its main priority. [https://x.com/cz\_binance/status/2115919590178075039](https://x.com/cz%5Fbinance/status/2115919590178075039?ref=gregchew.ch)
42. A reply on X to Changpeng Zhao's post, 21:32:38 UTC on 29 October 2026, from a private account the essay does not name: "can u release my $32 bro i need to pay my bills". It is shown beneath the post at [https://x.com/cz\_binance/status/2115919590178075039](https://x.com/cz%5Fbinance/status/2115919590178075039?ref=gregchew.ch)
43. Paolo Ardoino (@paoloardoino), post of 22:28 UTC on 29 October 2026, "With great power comes great responsibility". [https://x.com/paoloardoino/status/2115933752702476369](https://x.com/paoloardoino/status/2115933752702476369?ref=gregchew.ch)
44. CoinDesk, Krisztian Sandor, "Tether says it completed long-promised Big Four audit of finances behind $180 billion USDT stablecoin", 13 August 2026, revised 14 August 2026, for KPMG U.S.'s unqualified opinion on Tether International's financial statements for the year ended 31 December 2025, the physical count of its gold bars, and USDT's market capitalisation above $180 billion. [https://www.coindesk.com/business/2026/08/13/tether-says-it-completed-long-promised-big-four-audit-of-finances-behind-usd180-billion-usdt-stablecoin](https://www.coindesk.com/business/2026/08/13/tether-says-it-completed-long-promised-big-four-audit-of-finances-behind-usd180-billion-usdt-stablecoin?ref=gregchew.ch)
45. UK Parliament, "Mr Tony Benn: Parliamentary career", for his membership of the House of Commons from 30 November 1950 to 1 December 1960, from 20 August 1963 to 9 June 1983 and from 1 March 1984 to 7 June 2001\. [https://members.parliament.uk/member/326](https://members.parliament.uk/member/326?ref=gregchew.ch)
46. Hansard, House of Commons, Social Charter, 21 May 1990, volume 173, columns 134 to 135, for Tony Benn's five questions. [https://api.parliament.uk/historic-hansard/commons/1990/may/21/social-charter#column\_135](https://api.parliament.uk/historic-hansard/commons/1990/may/21/social-charter?ref=gregchew.ch#column%5F135)
47. Etherscan, address page for Binance Hot Wallet Exploiter 2, 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c, read at source 23:00 UTC on 29 October 2026, tagged Exploit and Heist, holding 2,075.433763829218689157 ether and $2,191,750,812.47 across sixty-one tokens, funded by Binance 14\. [https://etherscan.io/address/0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c](https://etherscan.io/address/0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c?ref=gregchew.ch)
48. United States Department of Justice, Office of Public Affairs, "Russian Nationals Charged With Hacking One Cryptocurrency Exchange and Illicitly Operating Another", 9 June 2023, for Mt. Gox as the largest Bitcoin exchange of its day, which stored the cryptocurrency wallets containing its customers' bitcoin, and the alleged theft of approximately 647,000 bitcoins from it between September 2011 and May 2014\. [https://www.justice.gov/opa/pr/russian-nationals-charged-hacking-one-cryptocurrency-exchange-and-illicitly-operating-another](https://www.justice.gov/opa/pr/russian-nationals-charged-hacking-one-cryptocurrency-exchange-and-illicitly-operating-another?ref=gregchew.ch)
49. Commodity Futures Trading Commission, release 9256-26, "CFTC Resolves Action Against Celsius Founder", 18 June 2026, for Celsius as a platform on which its customers allowed it to pool their digital assets, which were not secure, and its bankruptcy. [https://www.cftc.gov/PressRoom/PressReleases/9256-26](https://www.cftc.gov/PressRoom/PressReleases/9256-26?ref=gregchew.ch)
50. United States Attorney's Office, Southern District of New York, "Samuel Bankman-Fried Sentenced To 25 Years In Prison", 28 March 2024, for customer deposits held by FTX and channelled to Alameda. [https://www.justice.gov/usao-sdny/pr/samuel-bankman-fried-sentenced-25-years-prison ](https://www.justice.gov/usao-sdny/pr/samuel-bankman-fried-sentenced-25-years-prison?ref=gregchew.ch)
51. Binance, Terms of Use, effective 7 May 2026, clauses 8.1.1, 8.2, 8.3.1, 8.4.1(a) and 8.4.1(c), and the novation of 5 January 2026, for the custody company as trustee of customers’ digital assets, customers’ currency held “as Client Money with one or more third parties in accordance with the Client Money Rules”, the custodian’s own assets segregated from clients’ “in the Internal Ledger it maintains”, and the omnibus wallets holding clients’ assets “together with Digital Assets held by NCCL for itself and its other clients, including other ADGM Binance Entities and Binance Affiliates”, “for operational efficiency and in accordance with market practice”. [https://bin.bnbstatic.com/static/cms/cg08ou2ak0tn7mcplvfg/file/ba68c39023fe6c69d304cce43e2dfd2bdce6e0eebef312e7fbcfecf8a2e6d653.pdf](https://bin.bnbstatic.com/static/cms/cg08ou2ak0tn7mcplvfg/file/ba68c39023fe6c69d304cce43e2dfd2bdce6e0eebef312e7fbcfecf8a2e6d653.pdf?ref=gregchew.ch)
52. Decrypt, “Binance CEO Promises to Implement Proof of Reserves After Run on FTX”, 8 November 2022, for Changpeng Zhao’s plan to add “Merkle-tree proof of reserves”, citing “full transparency”, and his post “Banks run on fractional reserves. Crypto exchanges should not.” [https://decrypt.co/113917/binance-ceo-promises-to-implement-proof-of-reserves-after-run-on-ftx](https://decrypt.co/113917/binance-ceo-promises-to-implement-proof-of-reserves-after-run-on-ftx?ref=gregchew.ch)
53. Financial Conduct Authority, "Recent statements by Binance and Eqonex Limited", first published 7 March 2022, for the finding that Binance Markets is not capable of being effectively supervised. [https://www.fca.org.uk/news/press-releases/recent-statements-binance-and-eqonex-limited](https://www.fca.org.uk/news/press-releases/recent-statements-binance-and-eqonex-limited?ref=gregchew.ch)
54. Australian Securities and Investments Commission, media release 23-091MR, "Binance Australia Derivatives AFS licence cancelled", 6 April 2023, for the cancellation of the licence of Oztures Trading Pty Ltd at Binance's request, following ASIC's review and its notice of hearing of 29 March 2023\. [https://asic.gov.au/about-asic/news-centre/find-a-media-release/2023-releases/23-091mr-binance-australia-derivatives-afs-licence-cancelled/](https://asic.gov.au/about-asic/news-centre/find-a-media-release/2023-releases/23-091mr-binance-australia-derivatives-afs-licence-cancelled/?ref=gregchew.ch)
55. CoinDesk, "Binance Announces Exit from Canada, Citing Regulatory Tensions", 12 May 2023, for Binance's statement that new guidance made the Canada market no longer tenable for it. [https://coindesk.com/business/2023/05/12/binance-announces-exit-from-canada-citing-regulatory-tensions/](https://coindesk.com/business/2023/05/12/binance-announces-exit-from-canada-citing-regulatory-tensions/?ref=gregchew.ch)
56. Financial Transactions and Reports Analysis Centre of Canada, "FINTRAC imposes an administrative monetary penalty on Binance Holdings Limited", 9 May 2024, for the penalty of C$6,002,000 for failing to register as a foreign money services business and failing to report large virtual currency transactions. [https://fintrac-canafe.canada.ca/new-neuf/nr/2024-05-09-eng](https://fintrac-canafe.canada.ca/new-neuf/nr/2024-05-09-eng?ref=gregchew.ch)
57. CoinDesk, "Binance Withdraws German Crypto License Application", 26 July 2023, for the withdrawal of the BaFin application and the earlier report that Binance was set to be denied a licence. [https://www.coindesk.com/policy/2023/07/26/binance-withdraws-german-crypto-license-application](https://www.coindesk.com/policy/2023/07/26/binance-withdraws-german-crypto-license-application?ref=gregchew.ch)
58. United States Attorney's Office, Western District of Washington, "Binance and CEO Plead Guilty to Federal Charges in $4B Resolution", 21 November 2023, for the company's pleas and the total financial penalty of $4,316,126,163\. [https://www.justice.gov/usao-wdwa/pr/binance-and-ceo-plead-guilty-federal-charges-4b-resolution](https://www.justice.gov/usao-wdwa/pr/binance-and-ceo-plead-guilty-federal-charges-4b-resolution?ref=gregchew.ch)
59. CoinDesk, "Binance tells EU users it will no longer provide services after failing to secure MiCA license", 26 June 2026, for the withdrawal of the Greek application, the absence of authorisation in any member state and the number of firms authorised. [https://www.coindesk.com/policy/2026/06/26/binance-tells-eu-users-it-will-no-longer-provide-services-after-failing-to-secure-mica-license](https://www.coindesk.com/policy/2026/06/26/binance-tells-eu-users-it-will-no-longer-provide-services-after-failing-to-secure-mica-license?ref=gregchew.ch)
60. Binance, "Licenses, Registrations and Other Legal Matters", for the authorisations held by Nest Exchange Limited, Nest Clearing and Custody Limited and Nest Trading Limited from the Financial Services Regulatory Authority of the Abu Dhabi Global Market. [https://www.binance.com/en-GB/legal/licenses](https://www.binance.com/en-GB/legal/licenses?ref=gregchew.ch)
61. Binance, "Binance Becomes First Crypto Exchange To Secure a Global License Under ADGM Framework", 8 December 2025, hosted by Abu Dhabi Global Market and labelled by it a third-party communication rather than an official ADGM announcement, for the approval of the three entities and their permissions and activities beginning on 5 January 2026\. [https://www.adgm.com/media/announcements/binance-becomes-first-crypto-exchange-to-secure-a-global-license-under-adgm-framework-setting-a-new-standard-in-digital-asset-regulation](https://www.adgm.com/media/announcements/binance-becomes-first-crypto-exchange-to-secure-a-global-license-under-adgm-framework-setting-a-new-standard-in-digital-asset-regulation?ref=gregchew.ch)
62. Binance (@binance), post on X and its edit history, read 30 October 2026: first published 21:15:37 UTC on 29 October 2026; edited at 21:16:31 to add "At this stage, we have not confirmed any impact to user funds"; edited at 21:24:16 to remove that sentence; edited at 21:29:09 to add "User funds are completely safe." [https://x.com/binance/status/2115918888429133902/history](https://x.com/binance/status/2115918888429133902/history?ref=gregchew.ch)
63. CoinDesk, Olivier Acuna, "Binance discovers multiple breach points in $6.3 billion attack, eyes Sunday reopening", 30 October 2026, 12:31 EDT, for Richard Teng's statement that the attack targeted Binance's own hot wallet rather than customer funds. [https://www.coindesk.com/tech/2026/10/30/binance-uncovers-wider-breach-in-usd6-3-billion-exploit-targets-sunday-withdrawal-restart](https://www.coindesk.com/tech/2026/10/30/binance-uncovers-wider-breach-in-usd6-3-billion-exploit-targets-sunday-withdrawal-restart?ref=gregchew.ch)
64. CoinDesk, Oliver Knight, "Binance says customer money is safe after huge hack drains key reserve wallets", 29 October 2026, updated 30 October 2026, for the inclusion of Binance 14 in Binance's proof of reserves of 1 October 2026, holding 1.26 billion USDT and 89,475 ETH among 37 assets, as part of the assets backing customer balances. [https://www.coindesk.com/business/2026/10/30/binance-hack-drained-wallets-backing-customer-assets-reserve-data-shows](https://www.coindesk.com/business/2026/10/30/binance-hack-drained-wallets-backing-customer-assets-reserve-data-shows?ref=gregchew.ch)
65. Binance (@binance), post on X, 10:55:15 UTC on 30 October 2026, for the more than $6.34 billion reserved, $5 billion of it held in the affected tokens, the purchase of the remainder "to match the format of the remaining token assets and address any asset shortfalls", $3 billion frozen, and the commitment to "cover confirmed shortfall". [https://x.com/binance/status/2116121748555153621](https://x.com/binance/status/2116121748555153621?ref=gregchew.ch)
66. Khaleej Times, "UAE's FSRA issues statement after Binance reports $6.3-billion security breach", 30 October 2026\. [https://www.khaleejtimes.com/business/uae-fsra-statement-binance-63-billion-security-breach](https://www.khaleejtimes.com/business/uae-fsra-statement-binance-63-billion-security-breach?ref=gregchew.ch)
67. Binance (@binance), "Security Incident Update #2 (2026-10-30)", article on X signed "Yi and Richard, Co-CEOs of Binance", 19:58 UTC on 30 October 2026, read 30 October 2026, for the statement that Binance "will absorb the financial impact of these stolen funds, not our users"; more than $6.34 billion set aside, $5 billion of it in the stolen tokens and the rest bought through market and over-the-counter channels; withdrawals suspended while "Deposits and other unaffected platform services remain operational"; the withdrawal service to start resuming in phases within about thirty-four hours, subject to security checks; an initial proof-of-reserves snapshot with its result ready by Monday 2 November 2026; and the reservation beneath its signatures of the right "in its sole discretion to amend or cancel this announcement at any time and for any reasons without prior notice", the standard line beneath Binance's announcements, carried for instance by "Important Update to Proof of Reserves (POR)", 7 January 2026, and "Introducing Risk Warnings for Tokens with Significant Tokenomics Changes", 1 October 2024\. [https://x.com/binance/article/2116258356109496479](https://x.com/binance/article/2116258356109496479?ref=gregchew.ch)
68. CoinDesk, "Crypto liquidations jump to $1.57 billion as Binance hack sends bitcoin, ether lower", 30 October 2026, for bitcoin's overnight low of $76,400, ether's low of $2,170 and the liquidation total. [https://www.coindesk.com/markets/2026/10/30/crypto-liquidations-jump-to-usd1-57-billion-as-binance-hack-sends-bitcoin-ether-lower](https://www.coindesk.com/markets/2026/10/30/crypto-liquidations-jump-to-usd1-57-billion-as-binance-hack-sends-bitcoin-ether-lower?ref=gregchew.ch)
69. Al Jazeera, Nils Adler, “Binance says $6.3bn stolen in biggest crypto heist in history: What we know”, 30 October 2026, for Binance’s Secure Asset Fund for Users at $1 billion. [https://www.aljazeera.com/news/2026/10/30/binance-says-6-3bn-stolen-in-biggest-crypto-heist-in-history-what-we-know](https://www.aljazeera.com/news/2026/10/30/binance-says-6-3bn-stolen-in-biggest-crypto-heist-in-history-what-we-know?ref=gregchew.ch)
70. Securities and Exchange Commission, press release 2025-47, 27 February 2025, for the joint stipulation with Coinbase Inc. and Coinbase Global Inc. to dismiss the civil enforcement action, and the Commission's statement that the decision rests on its judgment that dismissal "will facilitate the Commission's ongoing efforts to reform and renew its regulatory approach to the crypto industry, not on any assessment of the merits". [https://www.sec.gov/newsroom/press-releases/2025-47](https://www.sec.gov/newsroom/press-releases/2025-47?ref=gregchew.ch)
71. Securities and Exchange Commission, Litigation Release No. 26278, 27 March 2025, for the joint stipulation with Payward Inc. and Payward Ventures Inc., together known as Kraken, to dismiss with prejudice, on the same stated grounds. [https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26278](https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26278?ref=gregchew.ch)
72. Binance, announcement of 12 March 2025, for MGX, "the Abu Dhabi-based AI and advanced technology investor", and its $2 billion investment, "the single largest investment into a crypto company and the largest investment ever paid in crypto (stablecoin)". [https://www.binance.com/en/support/announcement/detail/23d0a12bf35f42f4a9f7f0cff998ae64](https://www.binance.com/en/support/announcement/detail/23d0a12bf35f42f4a9f7f0cff998ae64?ref=gregchew.ch)
73. Fox Business, carrying Reuters, "Trump's stablecoin chosen for $2 billion Abu Dhabi investment in Binance, co-founder says", 2 May 2025, for Zach Witkoff's statement that "USD1 has been selected as the official stablecoin to close MGX's $2 billion investment in Binance", World Liberty Financial as Donald Trump's crypto venture, and its stated aim of financial services "without intermediaries like banks". [https://www.foxbusiness.com/markets/trumps-stablecoin-chosen-2-billion-abu-dhabi-investment-binance-co-founder-says](https://www.foxbusiness.com/markets/trumps-stablecoin-chosen-2-billion-abu-dhabi-investment-binance-co-founder-says?ref=gregchew.ch)
74. Securities and Exchange Commission, Litigation Release No. 26316, 29 May 2025, for the joint stipulation with Binance Holdings Limited, BAM Trading Services Inc., BAM Management US Holdings Inc. and Changpeng Zhao to dismiss with prejudice, "In the exercise of its discretion and as a policy matter". [https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26316](https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26316?ref=gregchew.ch)
75. Reuters, "Trump pardons convicted Binance founder Zhao, White House says", 23 October 2025, for the White House statement that Zhao "was prosecuted by the Biden Administration in their war on cryptocurrency". Checked against the story as carried by Dawn, [https://www.dawn.com/news/1950796](https://www.dawn.com/news/1950796?ref=gregchew.ch). [https://www.reuters.com/world/us/trump-pardons-convicted-binance-founder-zhao-white-house-says-2025-10-23/](https://www.reuters.com/world/us/trump-pardons-convicted-binance-founder-zhao-white-house-says-2025-10-23/?ref=gregchew.ch)
76. ABC News, "Trump pardons billionaire Binance founder Changpeng Zhao", 23 October 2025, for Karoline Leavitt's statement that Zhao was "prosecuted by the Biden Administration in their war on cryptocurrency". [https://www.goodmorningamerica.com/amp/news/story/trump-pardons-billionaire-binance-founder-changpeng-zhao-126803113](https://www.goodmorningamerica.com/amp/news/story/trump-pardons-billionaire-binance-founder-changpeng-zhao-126803113?ref=gregchew.ch)
77. Guiding and Establishing National Innovation for U.S. Stablecoins Act, Public Law 119-27, 18 July 2025, Government Publishing Office, for section 2(16)(A), which defines a lawful order as an order of a court of competent jurisdiction or an authorised federal agency that "requires a person to seize, freeze, burn, or prevent the transfer of payment stablecoins issued by the person", and section 4(a)(6)(B), under which a permitted issuer "may issue payment stablecoins only if the issuer has the technological capability to comply, and will comply, with the terms of any lawful order". [https://www.govinfo.gov/content/pkg/PLAW-119publ27/html/PLAW-119publ27.htm](https://www.govinfo.gov/content/pkg/PLAW-119publ27/html/PLAW-119publ27.htm?ref=gregchew.ch)
78. United States Senate, Roll Call Vote 234, 119th Congress, second session, 15 September 2026, 2:19 pm, on cloture on the motion to proceed to H.R. 3633, the Digital Asset Market Clarity Act, a bill "To provide for a system of regulation of the offer and sale of digital commodities by the Securities and Exchange Commission and the Commodity Futures Trading Commission", rejected, forty-nine to fifty with one not voting, three-fifths required. [https://www.senate.gov/legislative/LIS/roll\_call\_lists/roll\_call\_vote\_cfm.cfm?congress=119&session=2&vote=00234](https://www.senate.gov/legislative/LIS/roll%5Fcall%5Flists/roll%5Fcall%5Fvote%5Fcfm.cfm?congress=119&session=2&vote=00234&ref=gregchew.ch)
79. Bloomberg, carried by SWI swissinfo.ch, "FINMA says immediate Mythos access would pose systemic bank risk", 24 April 2026, for the Swiss Financial Market Supervisory Authority's statement that "The uncontrolled and immediate availability of AI models such as Mythos would be classified as a systemic risk" and that "virtually all existing software systems could simultaneously be affected by a multitude of previously unknown zero-day vulnerabilities, which would be exploited immediately and via AI." [https://www.swissinfo.ch/eng/finma-says-immediate-mythos-access-would-pose-systemic-bank-risk/91312240](https://www.swissinfo.ch/eng/finma-says-immediate-mythos-access-would-pose-systemic-bank-risk/91312240?ref=gregchew.ch)