In partnership with
OVERVIEW
Binance Got Robbed For $6.3 Billion. Of Course It Did. 🤦
NEWS
Every Damn Branch On The Way Down 🤕
North Korea robbed Binance for somewhere between $6.3 billion and $6.43 billion Thursday night, and my first reaction was a full-body WTF. 😩
Is this what we needed right now?
Bitcoin is sitting around $78K, almost 40% below the $126K top it printed a year ago.
ETH is in the $2,200s, less than half its 2025 high.
SOL couldn't find $100 with a flashlight.
Bitget lost $387 million to hackers last month, CoinDCX got drained last week, and Polymarket and Predict.fun both had wallets emptied this week.
This market has been falling out of the punch-me-in-the-face tree for a year straight, hitting every branch on the way down. Thursday night it hit the ground. White bone sticking out of the elbow, fibula a third of the way out of the kneecap, every front tooth crushed. Then the people walking their dogs came by, and every one of them let the dog pee on us without breaking stride.
😶
Your company data could be worth $100k–$3 million
There's a new channel of revenue that has just been unlocked for companies with over 20 people that have been around longer than a year.
Few know it, but AI labs now let you monetize your company’s operational data, and they're spending $15 billion this year on it to train the next frontier of LLMs. Your workflows, documentation, processes, and internal convos like Slack are extremely valuable and they're paying anywhere from $100k to $3 million for it per company.
Before you ask, all the data is anonymized and cleaned before it's sent to a Lab. Bezel (Y combinator backed) helps find a data partner that is the best fit for you.
NEWS
Saddam's Down To Bronze 🥉
Nobody has ever stolen more crypto. The podium for biggest theft of anything, ever:
Binance, Oct. 2026: about four times the size of Bybit.
Bybit, Feb. 2025: the $1.5 billion job. It took the record from Saddam, and the FBI pinned it on North Korea too.
Saddam Hussein, 2003: pulled $1 billion out of Iraq's central bank on his way out the door.
So Pyongyang just beat its own world record by 4x, and Saddam's down to bronze. 🏆
How fast did it go?
4:04 pm ET: the first coins left on the XRP Ledger.
Within half an hour: most of the money was gone, across nine to eleven blockchains.
7:56 pm ET: the last Ethereum sweep landed. ⌛
NEWS
Order 66, In-House 💻
Binance says it started with one compromised DevOps engineer's laptop. 🤦
The laptop got the attacker into a service container, and from there it submitted withdrawals like it had a badge and a parking spot.
No private keys leaked.
Every drain carried a valid Binance signature.
Which means Binance's own signing system executed Order 66 on Binance.
How'd the laptop get popped? Binance hasn't said. The FBI has warned that TraderTraitor loves a fake job interview with a poisoned coding test, the same play that hit DMM Bitcoin in 2024. Somebody's LinkedIn inbox is about to get a forensic colonoscopy.
Speaking of colonoscopies, I'm still bitter about mine. Last year, for some effed-up reason, I said to myself, "Self, you know what would be a great idea two days after your Oct. 20 birthday? That colonoscopy you've been dodging." Because Lord knows nothing says happy 44th like watching friends and family plow through cake and ribs while you sit there with a plain chicken breast, followed by two days of clear liquids and a toilet you get on a first-name basis with.
Two things, though.
Zero polyps, no cancer.
Sweet baby Jesus in a manger, the stuff they use to knock you out is the single greatest feeling a human body can experience. I'd book another one just for the nap.
The whole ordeal was more fun than crypto this month. At least the prep ended with good news.
Anyway. Back to the heist.
On Ethereum, the attacker got cute.
EIP-7702 lets a normal wallet hand its brain to a smart contract by signing an authorization.
Each one only works at one exact transaction count, and Binance's busiest hot wallet was cranking out withdrawals nonstop.
So the attacker showed up with 50 pre-signed authorizations, one for each count in a row.
Fifty keys to one lock, and one fit.
After that it was vampire rules. Once you invite it in, it stays until you formally revoke the invitation, and Binance needed 3 hours and 50 minutes to do that.
The first sweep took 167,464 ETH and 1.6 billion USDT in one transaction.
Six more followed as fresh deposits landed.
The last two came after Binance had already paused withdrawals.
The front desk was telling customers the doors were locked while the vault kept emptying out the back. 🔓
STOCKTWITS
Hey, We Have A Forex Newsletter Now 😱
Written by yours truly. Super data heavy. Right up your alley. 👀
Subscribe!
It’s once a week, on Mondays. Let me know what you think! 👇
NEWS
Probably North Korea 🕵️
TRM Labs pins it on North Korea's TraderTraitor unit, with high confidence, and Chainalysis and Elliptic agree. The tell: Binance loot landed in the same wallet as loot from last month's Bitget hack, already tied to North Korea. 🔎
The overlap so far is about $39,000.
The attacker sat on stolen USDT for 37 minutes on Ethereum and 46 on Tron, slow and sloppy by Pyongyang standards.
No government has made it official, either.
So the best argument against North Korea is that North Korea is usually better at crime than this. Hell of a character reference. 🧊
NEWS
Hotel California 🏨
The attacker still holds $3.2 billion to $3.3 billion that nobody can freeze.
More than 500,000 ETH, 2.5x what it stole, the rest bought with stolen stablecoins.
18,270 BTC in 19 addresses, most holding exactly 1,000 BTC, with the neatness of a guy who labels his freezer bags.
The XRP and SOL haven't moved an inch. 👀
None of it has hit an exchange. You don't drive the car with the body in the trunk while the cops are parked across the street. And the part they got away clean with is more than twice Bybit's whole haul.
Binance says user funds are safe.
It's eating the whole loss out of its SAFU fund and company money.
It has $6.34 billion set aside, $5 billion of it already in the exact tokens that walked out the door.
It's buying the rest through the market and OTC desks.
Deposits are open, withdrawals aren't. 🛑
PROMOTION
BitcoinIRA Has More Than Bitcoin. A Lot More.
BitcoinIRA gives you access to 100+ cryptocurrencies, one-click crypto bundles, and staking rewards on select assets - all inside a self-directed crypto IRA.
Buy, sell, and swap 100+ cryptocurrencies
Build diversified crypto bundles with automated rebalancing
Earn staking rewards on select assets inside your IRA*
Choose Traditional or Roth IRA options, with tax treatment depending on the account type*
*3rd Party Ad. Not an offer or recommendation by Stocktwits. See disclosure here.
Get In Touch 📬
Email me, Jonathan Morgan, feedback; I’d love to hear from you. 📧
Follow me on Stocktwits 🫂 And Sponsor this newsletter 😎
|
Get the app Real-time alerts, live earnings calls, your personalised feed - the best experience is on mobile.
|
Terms & Conditions 📝
Securities Disclaimer: STOCKTWITS IS NOT A TAX ADVISOR, BROKER, FINANCIAL ADVISOR OR INVESTMENT ADVISOR. THE SERVICE IS NOT INTENDED TO PROVIDE TAX, LEGAL, FINANCIAL OR INVESTMENT ADVICE, AND NOTHING ON THE SERVICE SHOULD BE CONSTRUED AS AN OFFER TO SELL, A SOLICITATION OF AN OFFER TO BUY, OR A RECOMMENDATION FOR ANY SECURITY. Trading in such securities can result in immediate and substantial losses of the capital invested. You should only invest risk capital, and not capital required for other purposes. You alone are solely responsible for determining whether any investment, security or strategy, or any other product or service, is appropriate or suitable for you based on your investment objectives and personal and financial situation. You should also consult an attorney or tax professional regarding your specific legal or tax situation. The Content is to be used for informational and entertainment purposes only and the Service does not provide investment advice for any individual. Stocktwits, its affiliates and partners specifically disclaim any and all liability or loss arising out of any action taken in reliance on Content, including but not limited to market value or other loss on the sale or purchase of any company, property, product, service, security, instrument, or any other matter. You understand that an investment in any security is subject to a number of risks, and that discussions of any security published on the Service will not contain a list or description of relevant risk factors. In addition, please note that some of the stocks about which Content is published on the Service have a low market capitalization and/or insufficient public float. Such stocks are subject to more risk than stocks of larger companies, including greater volatility, lower liquidity and less publicly available information. Read the full terms & conditions here. 🔍
Author Disclosure: The author of this newsletter holds positions in AVAX, ADA, PUDGY, WLD, NEAR, INJ, LTC, LINK, ZEC, XLM, and FET. 📋