Transcript

The Binance Hack Isn’t Funny!

From Patrick Boyle · Episode page · Watch on YouTube

· 41 min · 5,793 words · 46 timestamped sections

This is the full, timestamped transcript of "The Binance Hack Isn’t Funny!", an episode of Patrick Boyle published November 6, 2026 (41 min, about 5,793 words). It mentions 26 people, works and ideas, including Binance, North Korea, Bitcoin, Stablecoin, Ethereum.

What this episode is about

The piece examines a $6.3 billion heist targeting Binance by North Korean hackers, highlighting how centralized exchanges can funnel vast losses despite secure blockchains, and arguing that crypto’s promise of an unbanked, irreversible system is challenged by traditional risks and centralized vulnerabilities. It contrasts the attack with blockchain transparency while noting the role of centralized custody and the fragility of exchange-level security.

Key takeaways

  • Even a centralized exchange can be a fragile ‘bank’ with a black box liability trap and endless relocation tricks.
  • The most audacious thefts still leave a ledger; the real breach is management risk, not code failure alone.
  • Regulatory evasions are a business model; stability comes from accountability and clear geographic legitimacy, not moving excuses.
  • Hashes record thefts perfectly; human processes and customer trust are the real bottlenecks in crypto’s claim of security.
  • Grounded skepticism beats fanfare: visibility of bias shapes outcomes more than the headlines about hacks.

Who speaks in this episode?

What is discussed, and when

  1. – 5:00: Binance, North Korea, Ground News, Stablecoin
  2. – 10:00: Binance, North Korea, Changpeng Zhao, FT Alphaville
  3. – 15:00: Binance, Harry Donnelly, Ethereum, North Korea
  4. – 20:00: Binance, Circle, Tether, Bitcoin
  5. – 25:00: Tether, Binance, Bitcoin, North Korea
  6. – 30:00: Binance, Bitcoin, North Korea, Circle
  7. – 35:00: Binance, Bitcoin, Elon Musk, Stablecoin
  8. – 40:00: Binance, North Korea, George Bailey, China
  9. – 40:37: Decentralized Finance, Ground News, Pyongyang

Notable quotes from "The Binance Hack Isn’t Funny!"

  • Last Thursday, North Korean hackers took roughly $6.3 billion from Binance, the world's largest crypto exchange, most of it in the first 30 minutes. Elliptic, a blockchain analysis firm, told the FT.
    about Binance · at
  • About $2 billion in crypto, which was roughly 60% of all the crypto stolen worldwide. As employees of the state, they don't have to worry about extradition. And as far as…
    about North Korea · at
  • Before that, a signature on a simple wallet authorized one payment. After the change, a wallet could sign a short note that as Donnelly puts it, says from now on, follow this program's rules. It was designed for convenience so that you.
    about EIP-7702 · at
  • About 3 minutes later, a single transaction moved almost all of it out of the wallet, leaving exactly one ether behind, which is, I suppose, good manners. On the other blockchains, they.
    about Ethereum · at
  • Whether they'd be able to do that or not came down to a race. According to the FT, about $2.8 billion of what was stolen was in stable coins issued by Tether and Circle. Stable…
    about Stablecoin · at
  • What surprised a lot of people was how the market reacted. When FTX collapsed in 2022, Bitcoin fell 19% in three days.
    about Bitcoin · at
  • Circle, which froze $800 million of the stolen money within minutes, saw its shares fall about 9% anyway. No good deed goes unpunished, which leaves us with an odd result. The.
    about Circle · at
  • Binance's founder spent the next day arguing with Elon Musk on Twitter. It started when an account called Baseball Bonk Inu, which I assume is a respected market commentator, replied to CZ with a.
    about Changpeng Zhao · at

Who and what is mentioned in this episode?

People

  • Changpeng Zhao — Person · Referenced executive / founder of Binance (referred to as CZ) · 2 mentions · first at
    Founder and public face of Binance; his memoir, legal history, prison stint, and public interactions (e.g., Twitter spat with Elon Musk) are discussed to illustrate Binance's culture and governance.
  • Harry Donnelly — Person · Crypto hack breakdown author / Substack writer mentioned · 5 mentions · first at
    Identifies the primary explainer of the hacking mechanism referenced in the narrative
    The North Korean hackers were a lot more relaxed than that. The clearest explanation of how the hack worked that I've found comes from Harry Donnelly, who writes breakdowns of crypto hacks on Substack. And the analogy I'm about to.
  • Satoshi Nakamoto — Person · Referenced originator / ideological reference · 1 mention · first at
    Referenced via his white paper to highlight the original critique of irreversible transactions and to frame the philosophical irony of attempting to reverse transactions after the hack.
    18 years later, the crypto industry spent a whole night trying to reverse as many transactions as it could.
  • Elon Musk — Person · Referenced third party (Twitter spat participant) · 3 mentions · first at
    Appears in anecdote where CZ argued with Musk on Twitter after the hack; used to illustrate corporate social media dynamics and Binance's relationship with SpaceX/Twitter.
    Binance's founder spent the next day arguing with Elon Musk on Twitter. It started when an account called Baseball Bonk Inu, which I assume is a respected market commentator, replied to CZ with a.

Companies & orgs

  • Binance — Company · Primary company under discussion / case study · 47 mentions · first at
    Central subject: the exchange that was hacked for ~$6.3B; discussion focuses on its security failures, response, corporate structure, and role in crypto centralization.
  • Tether — Company · Stablecoin issuer / actor who froze stolen tokens · 6 mentions · first at
    Issuer of USDT stablecoin; used its blacklist/freeze capability to prevent hackers from moving large amounts of stolen stablecoins, trapping some of the theft proceeds.
    Issued by companies with executives, compliance departments, and a button that freezes your money. So the hackers needed to swap these freezable tokens for something nobody could freeze before anyone pressed that button.
  • Circle — Company · Stablecoin issuer / actor who froze stolen tokens · 5 mentions · first at
    Issuer of USDC stablecoin; froze stolen USDC wallets shortly after Tether, helping trap billions of the stolen funds and enable Binance to recover/reconcile funds.
  • FBI — Company · Investigative authority · 7 mentions · first at
    One of the US agencies investigating the hack; quoted as attributing blame to North Korean hacking unit and involved because of sanctions and US connections in laundering routes.
    Which the Wall Street Journal says was unaffected by the hack. That doesn't stop them from trying, though. The FBI is investigating along with the Secret Service and the IRS.…
  • TraderTraitor — Company · Accused hacker group (named actor) · 3 mentions · first at
    Named in reporting as the North Korean state hacking unit blamed by the FBI and analytics firms for the theft; mentioned as the alleged perpetrator.
    The FBI blames TraderTraitor, a North Korean state hacking unit.
  • FT Alphaville — Company · Referenced media source / reviewer · 2 mentions · first at
    Cited for a review of CZ's memoir and for reporting and investigative material about Binance; used as a reputable media reference in the episode.
    Banned crypto exchanges, so Binance moved to Japan. CZ published a memoir earlier this year, and according to the FT Alphaville review, when Japan's financial regulator started…
  • Coinbase — Company · Competitor / market comparator · 1 mention · first at
    Mentioned to illustrate stock market reaction; Coinbase's shares fell after the hack even though it was a separate exchange, showing contagion effects on centralized crypto companies.
    It. That said, after the Bybit hack last year, Bitcoin also held up at first and was 14% lower a week later. So it may be early to celebrate. Crypto stocks were less forgiving.…
  • Blessed Trust — Company · Alleged counterparty in sanctions-related activity (referenced) · 1 mention · first at
    Paired with Hexa Whale Trading in US prosecutors' allegations concerning funds passing through Binance accounts linked to Iranian oil sales; used as an example of suspicious flows.
    In September, US prosecutors moved to seize $61 million that they allege two Chinese companies, Hexa Whale Trading and Blessed Trust, passed through Binance accounts as part of a network.
  • Hexa Whale Trading — Company · Alleged counterparty in sanctions-related activity (referenced in past investigations) · 1 mention · first at
    Named in prosecution efforts to seize funds alleged to be linked to Iranian oil proceeds routed through Binance accounts; mentioned to illustrate suspicious account networks associated with Binance.
    In September, US prosecutors moved to seize $61 million that they allege two Chinese companies, Hexa Whale Trading and Blessed Trust, passed through Binance accounts as part of a network.

Products & tech

  • Ethereum — Product · Technical platform / affected blockchain · 3 mentions · first at
    Ethereum feature EIP-7702 was exploited (pre-signed programmatic authorizations); large amounts of stolen funds were moved on Ethereum including USDC and tokenized assets.

Concepts & topics

  • Bitcoin — Concept · Asset class / comparative benchmark · 9 mentions · first at
    Discussed as a store of value, part of Binance's reserves (SAFU), partially stolen in the hack, and as a market indicator whose price reaction was milder than some expected.
  • Stablecoin — Concept · Key instrument / vulnerability vector · 4 mentions · first at
    Stablecoins (USDT, USDC) formed a large portion of the stolen funds and their centralized issuers' ability to freeze tokens materially affected the hackers' laundering options.
  • EIP-7702 — Concept · Technical mechanism exploited · 1 mention · first at
    Ethereum Improvement Proposal used by hackers to create pre-signed programmatic authorizations (bundle payments) which, when blind-signed by Binance, allowed repeated-authority exploitation.
  • Decentralized Finance — Concept · Core ideological topic / benchmark · 1 mention · first at
    Used as the ideological standard against which the hack and industry's response are judged — i.e., promises of censorship resistance and irreversibility versus practical centralization.
    The crypto industry has been promising to build a new financial system for the last 18 years, one that is beyond the reach of governments, where transactions cannot be censored, where no central.

Places & events

  • North Korea — Place · Accused actor / contextual antagonist · 15 mentions · first at
    Named as the state behind the TraderTraitor hacking unit widely blamed for orchestrating the Binance heist; discussed as a motivated, long-term crypto thief and sanctions evader.
  • Iran — Place · Alleged source of illicit proceeds (context) · 3 mentions · first at
    Referenced in relation to alleged Iranian oil sales whose proceeds passed through Binance accounts (per prosecutors), illustrating the exchange's exposure to sanctions-related flows.
    In September, US prosecutors moved to seize $61 million that they allege two Chinese companies, Hexa Whale Trading and Blessed Trust, passed through Binance accounts as part of a network.
  • Pyongyang — Place · Contextual location (capital of North Korea) · 2 mentions · first at
    Location referenced in discussing North Korea's involvement
    Lot of work and old-fashioned. Once the crypto industry built a means for moving value without a courier, Pyongyang quite sensibly pivoted. I the term is that they were orange…
  • Venezuela — Place · Example jurisdiction linked to suspicious accounts · 2 mentions · first at
    Used when recounting FT-obtained Binance internal files showing suspicious accounts (e.g., a junior bank employee in Caracas moving large sums), illustrating risky customer base and KYC failures.
    Internal Binance files on a network of 13 suspicious accounts, and they give us some idea. One account belonged to a junior bank employee in Caracas, Venezuela, who moved $93…
  • China — Place · Historical origin / regulatory context · 2 mentions · first at
    Referenced as Binance's original founding country (2017) and in context of later Chinese regulatory actions that influenced Binance's relocations.
    Country it was based in. It was founded in China in 2017 by Changpeng Zhao, who goes by CZ. A few months later, China banned crypto exchanges, so Binance moved to Japan. CZ…
  • Brazil — Place · Origin of a suspicious account example · 1 mention · first at
    Mentioned in FT-internal files example: an account opened by a Brazilian man allegedly tied to illicit activity, illustrating weak KYC and suspicious account onboarding.
    Million, I suppose he could afford the jet. It's just not clear why he works as a junior bank employee. Another was opened by a Brazilian man who was later charged over an…

Media & podcasts

  • George Bailey — Character · Analogy / cultural reference · 3 mentions · first at
    Used as an analogy (from It's a Wonderful Life) to explain fractional/loan-like use of customer deposits and to compare historical bank-run logic to Binance's model.
    What got rewarded was a fast, reassuring tweet and a balance sheet big enough to pay for the mistake. There's a famous scene in the film It's a Wonderful Life where a crowd…

Sponsors

  • Ground News — Sponsor · Sponsor (episode sponsor / recommended service) · 4 mentions · first at
    Sponsor of the episode; host promotes Ground News and a subscription offer, linking it to media-bias tracking and his personal recommendation.
    Video interesting, you should watch my video on how the infinite money glitch is broken next. Don't forget to check out our sponsor, Ground News, using the link in the video description. See you in the next video. Bye.

Full transcript with timestamps

I've made quite a few videos about crypto, and the comment section usually fills up with people telling me that I just don't get it. Traditional banking is broken, they tell me, and the future is a financial system with no banks, where nobody can freeze your money or reverse your transactions. Well, I guess I need to apologize, as this week I found a crypto investor who lives by every one of these principles and who stuck to them through one of the most difficult weeks the industry has ever had. It's the North Korean government.

Last Thursday, North Korean hackers took roughly $6.3 billion from Binance, the world's largest crypto exchange, most of it in the first 30 minutes. Elliptic, a blockchain analysis firm, told the FT that it was almost certainly the largest theft of any kind in history. The previous crypto record was last year's $1.5 billion hack of Bybit, which was also North Korea. So they've lapped both the field and themselves with this one. The biggest conventional bank robbery in history was the Central Bank of Iraq in 2003, and I think Saddam Hussein and his sons were in on that one, and it was for about a billion dollars. So after years of promises, crypto has finally disrupted something.

About an hour and a half into the hack, Binance posted a statement assuring customers that their funds were safe. Now usually when a company announces out of nowhere that there's no need to panic, you should probably panic. 15 minutes later, Binance's systems topped up one of its wallets with an additional $200 million. The hackers had controlled that wallet for more than an hour, and they scooped up the money 72 seconds later. Traditionally, bank robbers have to bring their bags. To be fair to the crypto purists, the blockchains themselves were never breached. In fact, they recorded every single theft with perfect accuracy.

Binance is a centralized exchange, a company with a database and some executives. And this is something that the purists have been warning people to avoid for years. The weak point was the company. When masked men walk into a bank and ask the teller for $6 billion, the teller tends to ask a few follow-up questions. Binance's systems, as far as anyone can tell, signed everything they were handed. While the centralized nature of Binance allowed the hack to happen, the centralized nature of two stablecoin companies also allowed them to press a button called Add Blacklist, preventing the hackers from getting away with all of the money. North Korea, I'd note, would never press a button like that.

Binance kept withdrawals frozen until Sunday morning. This is the traditional response to a bank run, and it works for the reason you'd expect it to. Money that can't leave the building can't run. Binance also promised to cover every dollar of the losses itself, which is generous because according to Alexander Shirtcliff, a lawyer at Edwin Co, it doesn't have to. In comments reported by Finance Feeds, he pointed out that Binance's terms of service limit its liability to customers, and he said customers should not regard this as legally binding. It's probably just good business since an exchange that didn't pay up wouldn't have many customers left after a hack like this. When Binance lifted its withdrawal freeze on Sunday, customers pulled $4.7 billion out of the exchange, about 3% of the assets according to Reuters, which analysts read as a sign that customer confidence mostly held given the size of the

breach. Whether that reads as reassuring or alarming depends a lot on which outlet gets to you first. Of the 97 sources on this week's sponsor Ground News, 23% lean left, 40% are center, and 37% lean right. That's the kind of thing I check Ground News for. And what interests me as much as any single story is what doesn't get covered at all. Outlets decide daily what to run based on what they think their readers are interested in. So a whole story can just vanish depending on where you get your news. Ground News tracks this with their blind spot feed. Right now, Goldman Sachs raising its oil price forecast, warning Brent could hit 140 by 2027, has 29 sources and 0% left-leaning coverage.

A story on environmental protesters outside Bute House in Scotland has nine sources and 0% right-leaning coverage. You can't have an opinion on a story you were never shown, which is what Ground News is really useful for. Not telling you who's right, just making sure that you see the conversation. Go to ground.news/pb for 40% off the Vantage plan, the same one that I use. I highly recommend it. Binance is enormous. It has around 335 million users. It handled $34 trillion of trades last year, and for most of its existence, it couldn't tell you which country it was based in. It was founded in China in 2017 by Changpeng Zhao, who goes by CZ. A few months later, China banned crypto exchanges, so Binance moved to Japan. CZ published a memoir earlier this year, and according to the FT Alphaville review, when Japan's financial regulator started asking whether Binance was registered, CZ wrote, deep down I had a feeling we

might need to again soon. While traditionalists might view this as a questionable approach to regulatory compliance, it does have the advantage of being very easy to explain. Binance moved to Malta next until Malta's financial regulator announced that Binance wasn't actually authorized to operate there. And for years after that, when people asked where the business was headquartered, they simply declined to answer. Eventually, the world ran out of places to move to or CZ got tired of traveling. In 2023, Binance pleaded guilty to breaking US anti-money laundering and sanctions laws and paid $4.3 billion in penalties. According to the US Treasury, Binance had not reported more than 100,000 suspicious transactions, including ones linked to ransomware, terrorist groups, and large-scale hacks. CZ pleaded guilty to a single charge over Binance's anti-money laundering failures, served four months in a federal prison, and was

pardoned last year. In his memoir, he describes prison as designed to deliver the lowest possible customer satisfaction. I don't believe he mentions whether he would use the service again. Last December, Binance finally settled on a regulator in Abu Dhabi, although it still won't call it a headquarters. It isn't allowed to sign up new customers in the UK. It left Canada in 2023. It doesn't serve Singapore, and it doesn't officially serve Americans either, although it is under US supervision until 2028. It was also ordered to wind down its EU business in July, and regulators in Europe are asking why it still seems to serve customers there. Binance says that those customers sought it out entirely on their own initiative under a legal exemption called reverse solicitation, which I guess is how all web traffic works. [snorts] So, everybody possibly has jurisdiction over Binance. It's quite hard to say, but nobody has

jurisdiction over the people who robbed it. To this point, it's not even clear why the FBI even cares about this. Binance is not supposed to have any US customers, or at least its US customers are supposed to use binance.us, which the Wall Street Journal says was unaffected by the hack. That doesn't stop them from trying, though. The FBI is investigating along with the Secret Service and the IRS. The US seems to care because North Korea is under American sanctions. The proceeds are taught to fund its weapons programs, and stolen money usually passes through American companies at some point, which is where the FBI can try to grab it. The FBI and the main blockchain analytic firms are blaming the hack on Trader Traitor, a hacking unit of the North Korean state. And North Korea does have a long history of building out its reserves by unconventional means. Per the FT, in the early 2000s, the US

accused the regime of drug trafficking, making counterfeit cigarettes, producing highly sophisticated fake $100 bills known as supernotes, and filing dubious insurance claims. In 2010, Washington sanctioned Office 39, the Secret of Bureau that manages money for the North Korean leadership, which also sounds like a low-end WeWork competitor. The thing is that counterfeiting has logistics problems. You have to move all of that paper money around. It's just a lot of work and old-fashioned. Once the crypto industry built a means for moving value without a courier, Pyongyang quite sensibly pivoted. I I the term is that they were orange pillled. According to South Korea's intelligence service, North Korea has about 8,400 people working in cyber warfare. The FT reports that students who excel at math and science are picked out in their teens and trained in hacking. There's even a university course that mixes military

training with code breaking. The graduate employment rate is presumably excellent. Last year, according to Chainalysis, North Korean hackers stole about $2 billion in crypto, which was roughly 60% of all the crypto stolen worldwide. As employees of the state, they don't have to worry about extradition. And as far as anyone knows, nobody has ever asked them to complete an anti-money laundering training module, which makes them, by some distance, the most successful crypto investors I've ever covered on this channel. Although North Korea denies any involvement with Kim Jong Un's sister calling the accusation a grave political provocation, according to state media.

So my favorite crypto investor won't even admit to being in crypto, which is modest of them. You might imagine that pulling off the largest heist in human history would involve smashing through firewalls in the dead of night with the aid of some incredibly sophisticated AI. The North Korean hackers were a lot more relaxed than that. The clearest explanation of how the hack worked that I've found comes from Harry Donnelly, who writes breakdowns of crypto hacks on Substack. And the analogy I'm about to use is his. According to him, the hackers spent about 37 hours practicing the attack out in the open on public blockchains. And 4 hours before the real thing, they ran a final dress rehearsal on their own wallets with the same code that they would point at Binance. It's good to see take a rehearsal, seriously.

Their target was Binance's hot wallets. Customers expect to be able to withdraw their money instantly, so exchanges keep billions of dollars in online wallets that pay out automatically with no human checking each payment. Binance's biggest Ethereum hot wallet has handled over 31 million transactions, and on the evening of the hack, it was holding about $2.5 billion in 64 different tokens. It was extremely good at sending money to people. The tool the hackers used was a feature added to Ethereum last year called EIP 7702.

Before that, a signature on a simple wallet authorized one payment. After the change, a wallet could sign a short note that as Donnelly puts it, says from now on, follow this program's rules. It was designed for convenience so that you could bundle payments together. It worked exactly as intended. The convenience just went to someone else. There was one big obstacle, however. Each wallet numbers its outgoing transactions sequentially, and a note only works if it carries the number that's next in line when it lands.

Donnelly compares this to a company checkbook. In this analogy, Binance is the company, the hot wallet is its checkbook, and the Ethereum network is the bank. To stop old paperwork from being reused, the bank will only accept a form with the next check number on it. Paperwork with any other number gets rejected. Binance's wallet was paying out customer withdrawals nonstop, so the next check number was constantly changing, and the hackers couldn't know in advance which number their note would need. So they covered every likely number. They wrote a note that essentially said, add this person to the account, made 50 copies of it, each with a different upcoming check number, and got Binance's signing system to sign all 50. As far as anyone can tell, Binance hasn't said how its signer works. It signed whatever it was handed without reading any of it. In crypto, this is called blind signing. In most

other industries, it's called not reading the contract. The bank binned 49 of the 50, but number 35 matched. The misses cost the hackers nothing, and I believe it's the first time a 2% success rate has made anyone billions of dollars. From that point on, the hackers were on the account, and they had no further need for Binance's signature. About 3 minutes later, a single transaction moved almost all of it out of the wallet, leaving exactly one ether behind, which is, I suppose, good manners. On the other blockchains, they didn't need anything so clever. On Bitcoin, XRP, Tron, and several others, Binance's signing system simply signed ordinary payments to the hackers, and the note on the Ethereum wallet kept working. That wallet also controlled a second account holding USDC. So the hackers moved another $820 million out of that. Meanwhile, Binance's own systems kept topping the wallet up,

which, as we saw earlier, the hackers collected within seconds. It took Binance until 10:00 past midnight, almost 4 hours after the note went through, to take the hacker's name off the account. So how did they get into Binance's signing system in the first place? This Tuesday, Binance published an initial report on its investigation, a few days later than the 48 hours it had originally promised. Co-CEO Richard Teng described the the as a months-long campaign which started with someone looking for an AI coding tool. Back in June, one of the engineers who looks after Binance's wallet when searching for a popular AI coding assistant, clicked on an internet ad and downloaded a tampered version of the installer. Binance's security team spotted it, replaced his laptop, and changed his credentials. But by then the hackers had learned what his job was and who he worked with. In September, a second engineer was approached on a job

hunting site by a project director from a company that turned out not to exist. After a first interview with a fake HR person and a second with the fake company's fake CEO, he was asked to download an assignment onto his work computer, which he did. The assignment contained malware, and Binance says its security software didn't catch it. North Korea, as the FT has reported, already has operatives posing as remote workers to get hired by Western companies. It now appears to be working both sides of the job market. On October 20th, the hackers used that laptop and one of Binance's own internal AI tools to take control of two more engineers' computers, and on one of them they found a token that let them deploy software.

On the 29th, they used it to get into Binance's internal wallet signing service and send transactions that bypassed the normal withdrawal process. There was a lot of speculation last week about whether the hackers had used AI. It turns out that they did. It was Binance's. That also explains why it took almost 4 hours to stop. Binance splits control of its keys between several parties so that no single person can move the money, which turned out to mean that no single person could quickly stop someone else moving it either. Suspending withdrawals didn't help because the hacker's permission was already sitting on the blockchain and Binance had to come up with a procedure to cancel it.

Binance's keys, by the way, were never compromised. They were just extremely helpful. The central promise of cryptocurrency is that transactions are irreversible and censorship resistant. There's no manager you can complain to and no central authority that can freeze your account. This is usually presented as being a feature right up until the moment where someone steals $6 billion from you. As Matt Levine pointed out, Satoshi Nakamoto's white paper criticizes traditional banks because completely non-reversible transactions are not really possible.

18 years later, the crypto industry spent a whole night trying to reverse as many transactions as it could. Whether they'd be able to do that or not came down to a race. According to the FT, about $2.8 billion of what was stolen was in stable coins issued by Tether and Circle. Stable coins are issued by companies with executives, compliance departments, sort of, and a button that freezes your money. So the hackers needed to swap these freezable tokens for something nobody could freeze before anyone pressed that button.

Tether got there first, pressing that add blacklist button, and Circle did the same 3 minutes later. Between them, they trapped about $2.4 billion, and anything else the hackers moved into those wallets was frozen on arrival. Levine points out that this goes further than a freeze. Tether and Circle can't send the frozen tokens back, but they can decide that those tokens no longer count and issue new ones to Binance to replace them. As he puts it, you end up with centralized intermediaries performing a quasi law enforcement function and reversing transactions. So the decentralized financial system survived its biggest crisis by doing exactly what a traditional bank would have done.

Now this isn't the first time a private company that prints its own money has had to deal with a heist. American viewers might find this a bit strange, but in Northern Ireland and in Scotland, a handful of ordinary commercial banks are allowed to print their own paper currency. They're in pound sterling and the law requires each bank to hold an equal amount of Bank of England money to back them. So a Northern bank 10 pound note is always worth 10 pounds, which if you think about it makes it a stable coin printed on paper. Americans had something similar until the 1860s when private banks issued their own dollar bills. In December 2004, thieves took about 26.5 million pounds from Northern Bank's headquarters in Belfast, including roughly a tenth of all the Northern Bank notes in circulation at the time. Most of it was in brand new notes with known serial numbers.

Northern Bank did essentially the same thing that Tether did. It decided that the stolen money was no longer money. It recalled every one of its 10, 20, 50, and 100 pound notes, about 240 million pounds in total, and replaced them with new notes in different colors. It took 95 branches, a special command room, extra police on the street, and about three months. Tether did the same thing on a much bigger scale in under an hour. Some of the old Northern Bank notes did turn up later. 2.3 million pounds were found buried in compost in County Cork, and £50,000 were found in the toilets of a police social club in Belfast. To a crypto purist, the way the tokens were canceled is a betrayal of a core crypto principle. But as I mentioned earlier, one participant refused to compromise.

The North Korean hackers knew the freezes were coming. So while the rest of the industry was rediscovering the joys of centralized banking, North Korea was dumping $434 million of Tether for Ether, an asset with no company backing it and no button to press. According to Donnelly, they were in such a hurry that they sold at between 12 and 26% below the market price, giving up more than $50 million in a matter of minutes to stay on a truly decentralized ledger. Now, you have to admire that level of ideological commitment. Few investors have been willing to take a hit of up to 26% for their principles. And I'm starting to think that they may be the last true believers in crypto. So who was on the other side of all that panic selling? Those discounts were somebody else's profit. As the hackers dumped stable coins and bought Ether and other tokens wherever they could find them, they pushed prices wildly out of line

between exchanges. And according to Bloomberg, a handful of quick-witted trading firms spent the night picking off those trades. The blockchain data firm Bitquery estimates that the hackers lost about $120 million to poor execution, with about half of it going to the traders and arbitrage bots. Matt Levine made the point that taking a hit like that when you push this much money through thin markets isn't really bad execution. When laundering stolen money, your demand for immediate liquidity is unusually high and you pay for it.

Getting into assets that nobody can freeze is only half the job though. You still have to eventually turn them into money that you can spend on whatever it is that Kim Jong-un spends his money on. Armored Mercedes limousines mostly if the photos are anything to go by. He just doesn't look like a Lambo guy, does he? Long-term viewers will remember my video on Do Kwon and the Croc, the legendary rapper and her husband who were caught laundering Bitcoin from the 2016 hack of the Bitfinex exchange, a hack that Do Kwon later admitted to carrying out himself. They were sitting on billions of dollars worth of Bitcoin and could barely spend any of it because every time money came out, the FBI was able to follow it straight back to them. Their problem was that they had an address.

North [snorts] Korea doesn't have this problem. Well, it does have an address. It's North Korea, but it's not the kind of address the FBI can turn up at with a search warrant. And no precious metals dealer is going to ask Kim Jong-un for a photograph of his driver's license. Turning the stolen crypto into money still isn't easy. In the first four days, according to Elliptic, the hackers used about 12,000 wallets across 11 blockchains, opening a new wallet every 25 seconds. Elliptic's Tom Robinson told the FT that it looked like scripts run by people with pauses that look like human working patterns. So even North Korea's hackers take a lunch break, which is better working conditions than Binance's signing system gets.

Chainalysis co-founder Jonathan Levin told the FT that the hackers simply had too much money for their trusted laundering venues to handle, which is a problem most investors would love to have. Eventually, Robinson expects it to sold to over the counter brokers who ask little or no questions. Nobody expects them to hurry. Elliptic says hardly any of it has been turned into cash so far, and according to the think tank 38 North, named after the 38 parallel that divides the two Koreas, one analytics firm found a stash of North Korean crypto from as far back as 2017 that still hasn't been laundered. These guys are the ultimate long-term investors, diamond hands. They certainly added to their holdings this week.

Strategy, Michael Saylor's company, formerly MicroStrategy, announced on Monday that it had bought 811 Bitcoin during the week of the hack, and Saylor celebrated with a post saying, we found room for even more orange. Over the same week, North Korea acquired 18,270 Bitcoin. For once, Michael Saylor was the small investor. What surprised a lot of people was how the market reacted. When FTX collapsed in 2022, Bitcoin fell 19% in three days. This time it fell about 5% and has been fairly steady since. Part of the reason is that Binance was buying tokens to replace the ones that had been stolen.

And as Kelly Yi at the trading firm Talos told Bloomberg, the market treated this as an operational shock, not a systemic one. FTX was a fraud. This was a robbery, and the victim could afford it. That said, after the Bybit hack last year, Bitcoin also held up at first and was 14% lower a week later. So it may be early to celebrate. Crypto stocks were less forgiving. One day after the hack, Coinbase fell about 11%, although in fairness, it had also just reported quarterly results showing that its trading revenue had fallen 44%.

Circle, which froze $800 million of the stolen money within minutes, saw its shares fall about 9% anyway. No good deed goes unpunished, which leaves us with an odd result. The decentralized asset at the center of the largest theft in human history did fine, while the centralized, regulated, listed companies took a beating. Possibly that's because Binance itself is privately owned. So if you want to sell something crypto-related on the stock market after a crypto disaster, you have to sell someone else's stock. So Binance has a $6.3 billion hole to fill, and it has promised to cover every dollar itself. It hopes to get a bit under half of that back eventually from the stablecoins that Tether and Circle froze. But in the meantime, Binance is fronting the money. The first place it turned was its emergency fund, which is called the Secure Asset Fund for Users, or SAFU. I think there's some sort of a

crypto joke in that name too, uh but I'm not going to look it up. Binance keeps this fund in Bitcoin, and there's a respectable case for doing that. Binance's liabilities are largely in crypto. If a customer's Bitcoin is stolen, Binance owes them Bitcoin, whatever its dollar price. So holding the reserve in Bitcoin matches the asset to the liability. Treasurers call this a natural hedge. It works perfectly provided two conditions are met. The thieves only steal Bitcoin, and they steal less of it than the fund holds.

Unfortunately, the thieves took billions of dollars in stablecoins and Ether, and the Bitcoin that they did take was worth more than the whole fund. And because a $6.3 billion hack of the world's largest crypto exchange tends to rattle crypto markets even if just a bit. The price of Bitcoin fell. And according to the Wall Street Journal, the value of the fund dropped by about $100 million at the exact moment Binance needed it. It's a bit like a fire insurance policy that pays out in kindling. Luckily, Binance is enormous and it makes enough money in trading fees to cover the difference out of its own pocket.

On the night of the hack, one account on Twitter estimated that once the freezes were taken into account, Binance's loss would be about a billion dollars. CZ replied, loss might be a bit higher than that, but we'll cover. It turned out to be about three times higher, which in crypto counts as a bit. Binance's executives spent that night in a war room of about 100 people working with the FBI and the Secret Service. Binance's founder spent the next day arguing with Elon Musk on Twitter. It started when an account called Baseball Bonk Inu, which I assume is a respected market commentator, replied to CZ with a screenshot of a tweet Sam Bankman-Fried posted in 2022, a few days before FTX went bankrupt, which said FTX has enough to cover all client holdings. Elon Musk responded to that with a grimacing face emoji. CZ replied, Elon, have a lot of respect for you, but bad time to troll.

Please stop. He then reminded Musk that Binance's SpaceX shares, which came from its $500 million investment in Musk's takeover of Twitter, are now worth more than a billion dollars, and added, would appreciate if you show a little support. Thanks. So just to keep track of the corporate governance here, Binance was using Twitter to remind Elon Musk that it owns a piece of his rocket company, which is really more of an AI company, because it helped him by Twitter. Binance's co-CEO then joined the threat to tell CZ that Binance's annual revenue was enough to cover the losses, adding, we do not need to sell the SpaceX shares you're bullish on. CZ replied that he wasn't planning to sell and had only mentioned the shares to Musk so that he can be less worried, which was a polite way of reminding Musk that Binance owns a block of his company's stock and knows where the sell button is. While SpaceX has a

huge market cap, only a tiny sliver of its shares are actually tradable or floated on exchange, meaning that this is a bigger button than it at first sounds like. Most of the coverage of Binance's response was glowing. Bloomberg reported that many experts were impressed by how quickly Binance reacted, how often it posted updates, and the fact that it was paying for the losses out of its own profits. But as we saw earlier, the hackers got in because a job interview assignment was downloaded onto a work computer and one of Binance's own AI tools could take over other engineers' laptops. Binance's co-CEO said it should never have happened and pointed out that Binance had stopped 57 suspected North Korean attacks this year, which is a save rate most goalkeepers would be proud of, although most goalkeepers don't concede $6.3 billion.

I'm surprised by how little weight people are putting on the security failure. After the biggest theft in history, customers pulled only about 3% of their money out and Bitcoin barely moved. And as Donnelly points out, the loss was bigger than the entire crypto insurance market, so there was never an insurer to raise Binance's premiums. What got rewarded was a fast, reassuring tweet and a balance sheet big enough to pay for the mistake. There's a famous scene in the film It's a Wonderful Life where a crowd starts a bank run on George Bailey's bank, and Bailey explains to them that their money isn't sitting in the vault. It's tied up in Joe's house and the Kennedy house and Mrs. Macklin's house and a hundred others. A Blue Sky user called D. LeVoy had some fun reimagining the Binance version of that speech by posting this image.

Binance isn't a bank, and it says that its customers' money actually is sitting in the vault, which as we've seen is also what made it so easy to steal. So the question is, if you keep your money on Binance, who are you sharing the vault with? Last year, the FT got hold of some internal Binance files on a network of 13 suspicious accounts, and they give us some idea. One account belonged to a junior bank employee in Caracas, Venezuela, who moved $93 million through it. His account was logged into from Caracas one afternoon and from Osaka, Japan at 1:30 the next morning.

So he either has a private jet or someone else had his password. With $93 million, I suppose he could afford the jet. It's just not clear why he works as a junior bank employee. Another was opened by a Brazilian man who was later charged over an alleged illegal gold trading operation. He used a battered 20-year-old ID card with an ineligible date of birth, a photo that didn't look much like his selfie, and a woman's email address. After what the files describe as enhanced due diligence, Binance recorded the wrong date of birth and a monthly income of $7,000 with no currency specified. The account went on to receive $16 million.

The investigation into this man's family began when a relative tried to cross into Venezuela with $50,000 in cash, which he told border guards was for buying sausages from a Chinese acquaintance. Now, while I happen to share a name with a former president of the American Meat Institute, I can't claim to have any expertise in the cross-border sausage trade. But that strikes me as quite a lot of sausages to be buying in cash. In September, US prosecutors moved to seize $61 million that they allege two Chinese companies, Hexa Whale Trading and Blessed Trust, passed through Binance accounts as part of a network handling $1.5 billion from black market Iranian oil sales. Binance points out that the case wasn't filed against it and that it doesn't allege any wrongdoing by Binance. So George Bailey's depositors were lending their money to Joe and Mrs. Macklin. Binance's customers are sharing an exchange with

an alleged sanctions-busting oil trader, well-traveled and surprisingly wealthy bank clerks, and an international cash-settled sausage entrepreneur, which is a slight departure from the George Bailey business model. Binance told the FT that it maintains strict compliance controls, and its lawyers said any suggestion that it knowingly facilitated bad actors is baseless. According to the FT, some of the activity in those files took place after Binance's 2023 guilty plea and after the US had installed monitors to keep an eye on its compliance.

The crypto industry has been promising to build a new financial system for the last 18 years, one that is beyond the reach of governments, where transactions cannot be censored, where no central authority can freeze your account, and where you never have to trust a bank with your money. As we saw this week, the industry itself has mostly given up on those ideas. I'd argue that crypto is now more centralized than the system it set out to replace. Traditional finance is split up country by country with dozens of regulators, hundreds of exchanges, and thousands of banks.

Crypto has one exchange holding about six times as much as its next nearest rival, a few whale investors, and two companies issuing most of its dollars. When the crisis came, its biggest exchange gated withdrawals, paid for the damage out of its corporate balance sheet, and relied on two stablecoin companies to do the policing. But I think we have to acknowledge that one participant stayed true to the original vision. North Korea holds its own keys. It makes irreversible transactions. It trusts no third parties other than its trusted laundering venues. It is in no hurry to sell either. It's the only crypto enterprise in the world with a clear business plan and full independence from regulators. Somewhere in Pyongyang, the dream of a decentralized, censorship-resistant, sanctions-proof financial system lives on. It's just not exactly where its inventors had in mind. If you found this video interesting, you should watch my

video on how the infinite money glitch is broken next. Don't forget to check out our sponsor, Ground News, using the link in the video description. See you in the next video. Bye.

Questions about this episode

Who speaks in "The Binance Hack Isn’t Funny!"?

Patrick Boyle (Host), North Korea (Guest), CZ (Changpeng Zhao) (Guest), Richard Teng (Guest), Harry Donnelly (Guest), Matt Levine (Guest), Tether (Guest), Circle (Guest).

What is "The Binance Hack Isn’t Funny!" about?

The piece examines a $6.3 billion heist targeting Binance by North Korean hackers, highlighting how centralized exchanges can funnel vast losses despite secure blockchains, and arguing that crypto’s promise of an unbanked, irreversible system is challenged by traditional risks and centralized vulnerabilities. It contrasts the attack with blockchain transparency while noting the role of…

What is mentioned in this Patrick Boyle episode?

26 people, works and ideas are mentioned, including Binance, North Korea, Bitcoin, Stablecoin, Ethereum, EIP-7702. Each one on this page links to its own page with every episode that mentions it.

How long is "The Binance Hack Isn’t Funny!"?

The episode runs 41 min; the transcript is about 5,793 words in 46 timestamped sections.

More from Patrick Boyle

About this transcript: the episode's spoken words as captioned on YouTube, split into timestamped sections. Reclip.Me locates every person, work and idea in the text, keeps the time it is first named, and quotes the words around it verbatim. Last updated November 10, 2026.