Binance says roughly $6.3 billion was stolen. Elliptic calls it almost certainly the largest known theft of any kind. Holy shit. Binance has promised to cover the losses and says about $3 billion has been frozen. TRM’s on-chain reconstruction identifies about $2.67 billion in frozen stablecoins, including roughly $1.77 billion of Tether’s USDT and $825 million of Circle’s USDC. That ability to freeze billions is a useful reminder of what these instruments actually are. I prefer “dollar tokens.” Their issuers retain control, and their purchasing power follows a currency whose central bank explicitly targets inflation. Calling them stable feels generous. The censorship-resistant, decentralized money proposition that brought me to bitcoin disappears when an issuer can turn your balance off. In my view, the rest of crypto keeps failing that test.
The attacker understood the freeze risk and moved quickly. According to Aave’s risk service provider, LlamaRisk, a wallet supplied $60 million of stolen USDT as collateral and borrowed 19,762 wrapped ether, worth about $44.6 million at the time. Aave is a permissionless lending protocol: post eligible collateral and borrow without a banker checking who you are. Here, that let a thief exchange exposure to a token with an issuer-controlled freeze switch for an asset without that same switch. The lending risk is obvious. If an issuer freezes collateral so it cannot be liquidated, who absorbs the loan loss after the borrower walks away? LlamaRisk says this particular position remains overcollateralized and liquidatable, with suppliers protected. The danger I’m pointing to is the mismatch between permissionless lending and collateral controlled by a third party. Aave itself froze new supply and borrowing across its markets while the response teams worked through the incident.
Last week I wrote that attackers would chase immediately monetizable assets first. In crypto land, the code is the money. Binance’s preliminary explanation points to a compromised engineer’s laptop that opened access to a service container and unauthorized withdrawals; it says it has found no evidence of leaked wallet private keys. We still don’t know the full intrusion path or whether AI played a role. My concern is what happens as AI-assisted attacks become more capable. Crypto is the heat shield on the rocket ship of global cybersecurity, and it is burning off. Beyond it sit utilities, water systems and pipelines, where an attacker has to take another step to monetize access, usually by demanding a ransom. I consider a major, disruptive infrastructure attack within the next 12 months a certainty. Multiple days without power would turn an abstract cybersecurity story into a very personal one. I’m not advocating a bunker. A generator and a water filter might be sensible things to have on hand.
The other remarkable part is bitcoin’s reaction. LlamaRisk measured it about 4% lower in the hours after the drain. The largest known crypto theft, and a single-digit decline. I could easily have imagined a 20% day. As I wrote on LinkedIn last night, FTX was imploding around this time four years ago and bitcoin fell below $20,000. Even using $20,000 as the starting point, the roughly $76,000 price reported Friday is close to four times that level. People with the conviction to get long and stay long did very well. I think getting long from here can work out similarly once this mess shakes out. An exchange can fail spectacularly while bitcoin keeps doing exactly what it was built to do. Know which one you own, and who holds the keys.