The Commoner

Friday, October 30, 2026

Sup, freaks.

Binance lost $6.3 billion last night because of how it chose to run its hot wallets. Below is how it happened, what it did to Aave and why the stablecoin freezes that followed should make you think hard about where you keep your money.

WHAT TO EXPECT IN THIS NEWSLETTER

• Binance loses $6.36 billion across ten chains in the largest crypto theft on record.
• Binance's co-CEO now says multiple attackers, self-destructing tools and an EIP-7702 delegation that skipped its approval controls.
• Issuers froze about $2.7 billion. Nobody froze the 18,270 BTC.
• AI compute commitments, France's 57% state, CrowdHealth open enrollment, PJM's data center bill and Lagarde's early exit.
• Sparrow 2.5.6 keeps your Tor connection alive.

Marty's Bent

Binance's $6.3 Billion Single Point of Failure

Binance lost roughly $6.3 billion last night in the largest theft this industry has ever seen, and I want to make it clear right out of the gate that this has nothing to do with bitcoin. It has nothing to do even with broader crypto. The most severe problem is the process that Binance ran to operate its hot wallets, and it's completely insane. TRM Labs puts the total at $6.36 billion, about four times the $1.5 billion that walked out of Bybit in February 2025. The money left Binance wallets on ten different blockchains, most of it within roughly 20 minutes of the first transfer at 20:05 UTC.

Here is how Binance explained it early this morning:

"Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak."

One engineer's laptop got an attacker into a service container that could submit withdrawals across ten chains. Six hours later Binance said its investigation had uncovered "additional points of breach," so the laptop may not be the whole story, but the shape of the failure doesn't change. While this was unfolding I tweeted my first read of the situation:

"It's looking like Binance had one master key for all of their hot wallets across all chains. Pretty insane."

Marty Bent (@MartyBent), October 29, 2026

TRM has a more precise explanation of what happened, and it makes Binance look even worse. These wallets sit on different chains with different key types and signing schemes, and every one of them produced valid signatures for the attacker within about half an hour. TRM's best explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign whatever it wanted. So it may not have been one key so much as one system that could tell every vault to open. You should not have $6 billion of other people's money sitting behind a setup that one compromised laptop can talk to. This is willful incompetence teetering on negligence from the biggest exchange in the world, an exchange that has had plenty of time to learn this lesson. Let's not forget, Binance lost 7,000 BTC out of its hot wallet in May 2019 after attackers used phishing and viruses to work their way in, and it covered that loss itself too. Seven years later the hot wallet is still the soft underbelly, only now it holds a lot more than bitcoin.

Then this morning Binance's co-CEO Richard Teng posted a video update that is the most candid thing we've heard from the exchange so far, and it's a big one. "This was not carried out by one person," he said. The laptop is where it may have started, but "our subsequent investigation has uncovered additional points of breach. This was a complex attack." The attackers used a "self-destruct mechanism that destroyed tooling and traces as they ran," which makes it that much harder for Binance to even figure out what happened inside its own systems. He also confirmed that the attackers used EIP-7702 to take control of a hot wallet on Ethereum, and that "the delegation did not pass through our normal approval controls." Binance has pulled its withdrawal service offline to rebuild and retest it, and Teng says the company is now running a full security review across "endpoints, cloud, key management, signing, everything." The co-CEO of the largest exchange in the world just put key management and signing on the list of things that need a full review after a $6 billion theft. That's the process I'm talking about.

Rob Hamilton spun up a Space as the drain was happening, and I hopped on with a group of people pulling apart the on-chain data in real time. The replay is disabled so I can't link the audio, but Rob's posts tell the story. He flagged that the address Binance publicly lists as its bitcoin hot wallet was being emptied. In block 973,732 that wallet sent more than 18,000 BTC to a single fresh address, and TRM puts total bitcoin outflows at 18,270 BTC, about $1.47 billion. The address Rob pointed to as Binance's cold storage still holds roughly 248,600 BTC and hasn't moved. The bitcoin network did what it always does. It will settle any transaction signed with valid keys, which is exactly why it matters so much who has access to the machines that do the signing.

We also talked about EIP-7702 on the Space, and we need to be precise about what happened because politicians are going to lump all of this together. EIP-7702 came with Ethereum's Pectra upgrade in May 2025 and lets an ordinary Ethereum wallet hand control of its behavior to a smart contract by signing an authorization. According to TRM, the attacker prepared 50 of those authorizations in advance, submitted them in a single transaction at 20:20 UTC and turned one of Binance's best-known Ethereum hot wallets into a sweeper contract only the attacker could call. The on-chain analyst adamm285 walked through the receipts and showed how far that reached. A separate Binance smart contract wallet that never changed its own code lost $823 million in USDC because it had a standing approval to the hijacked wallet, and about 80 minutes later Binance's own automated deposit sweepers were still dutifully feeding another $204 million of USDT into the trap. The other nine chains were drained with ordinary signed transfers, so 7702 didn't open the door. Getting into Binance's signing system did that. But on Ethereum, 7702 gave the attacker a way around Binance's own safeguards, which is exactly what Teng admitted this morning. The smart contracting ability enabled by EIP-7702 does increase the attack surface for making these attacks easier to wage, and it's a reason why bitcoin has a very simple, stupid rule set and doesn't have too many flashy use cases on the chain. Once you get into smart contracting and virtual machines on the chain, you increase the attack surface, and every new feature becomes another place for a patient, well-funded attacker to turn one human mistake into a catastrophe.

The attacker had plenty of patience and money. TRM attributes the theft with high confidence to TraderTraitor, the North Korean unit most people lump in with the Lazarus Group. The operator wallet was funded with small Tornado Cash withdrawals starting the morning of October 28, and the attacker rehearsed its sweeper code on test wallets before pointing it at Binance. Overnight ZachXBT reported that funds from this theft and the $388 million Bitget exploit had been commingled at the same address after passing through THORChain. It's the same playbook they ran against Bybit. Find the one weak human in an otherwise sophisticated operation and work your way in from there.

Then came the freezing. Tether froze 971 million USDT sitting in the main receiving wallet 37 minutes after the main sweep, and Paolo Ardoino was out shortly after with an even bigger number:

"Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority. Stay safe everyone."

Paolo Ardoino (@paoloardoino), October 29, 2026

TRM counts about $2.67 billion in stablecoins frozen by Tether, Circle, Ripple and World Liberty Financial. Over on Arbitrum, the chain's Security Council moved 8,425 ETH and 74.6 million ARB out of an exploiter address into a wallet that "can only be moved by further action of the Security Council or a vote of Arbitrum DAO governance." Binance says about $3 billion has been frozen so far.

A lot of people are cheering this and I understand why. Nobody wants North Korea walking away with billions of dollars. But I'd ask everyone to think about what these freezes actually demonstrate. If Tether can freeze a hacker's dollars in 37 minutes, it can freeze yours just as fast, for whatever reason it or the government leaning on it decides is good enough. If a security council can reach into an address on a layer two and move the ETH out, it can do that to anybody using the chain. You don't really have sovereign money with stablecoins. You have an IOU from a company with an admin key, and the admin key works on everybody. What nobody could freeze were the 18,270 BTC and the 420,000-plus ETH the attacker still controls, about $2.4 billion by TRM's count. Nobody being able to freeze a bearer asset is uncomfortable in a situation like this, but it is also the entire reason bitcoin is money. The answer isn't to build a freeze button into bitcoin. The answer is to stop leaving your coins in hot wallets run by somebody else.

What this did to Aave concerns me most. Between 20:58 and 21:01 UTC, right as Tether's first freeze was landing, a wallet in the attacker's cluster supplied 60 million USDT to Aave and borrowed 19,762 WETH, about $44.6 million. The hacker walked away with ether, which nobody can freeze, and left the USDT behind as collateral that is now frozen too. According to LlamaRisk's write-up on Aave's governance forum, the position holds $59.9 million of USDT against $43.8 million of debt, so it's still over-collateralized and subject to normal liquidation, and Aave isn't sitting on bad debt today. The damage showed up elsewhere. Aave's guardians froze 175 reserves on V3 across 16 networks and another 117 on V4, and depositors heading for the exits pushed the largest stablecoin reserves to between 92% and 100% utilization, which leaves little to nothing in those pools for the next depositor who wants out. The risk team then cut about $3.7 billion of unused borrow capacity on V3 and set USDT and USDC to zero loan-to-value on every market where they're listed. A protocol that markets itself as permissionless spent the night freezing nearly 300 markets. If you are building on top of stablecoin collateral, what happens to everything you've built when that collateral gets frozen?

Binance says it will cover all losses with its SAFU fund and company funds. It says it has reserved more than $6.34 billion, $5 billion of it already held in the exact tokens that were taken, and is buying the rest through market and OTC channels. Teng says the withdrawal service won't be switched back on until it passes rigorous testing, with withdrawals on track to reopen "within 40 hours," before Sunday, and a full proof of reserves report by Monday. He was also quick to point out that what got hit was "Binance's own hot wallet" and not customer funds. That's the hot wallet that exists to pay out customer withdrawals, and customers are the ones who can't withdraw right now. If they make everyone whole, good. But the people with coins on Binance are going to wait almost two days for permission to touch their own money, and they're trusting that the same company that left the vault door open has the balance sheet to refill it.

Matt Dines pointed out something last night that I can't stop thinking about. FTX halted withdrawals on Election Day 2022 and filed for bankruptcy three days after the midterms. Now Binance suffers the largest heist in history five days before the 2026 midterms. In the same week, Polymarket halted trading after one of its third-party providers was compromised and says it's fully reimbursing affected traders, and Google hosted a room full of bankers at Pier 57 to show off its MPC custody system, which we covered yesterday. Maybe it's all coincidence. I have my antenna raised. It has the shape of the old problem, reaction, solution playbook, and I fully expect politicians and regulators to use this to try to overregulate the industry, to say crypto is immature and can't be trusted with people's money, and that the responsible thing to do is let Big Tech and the banks hold the keys for you.

Individuals must reject that framing aggressively. The problem last night was one company keeping billions of dollars of other people's money behind a single signing system that attackers could get to through an engineer's laptop. Handing your keys to an even bigger company with an even bigger single point of failure doesn't fix that. It just makes the target more attractive to the next nation-state with a team of patient hackers. You can hold bitcoin in your own custody, ideally in a multisig setup where no single device, laptop or engineer can move your coins. There's no need to freeze anything or scramble to find $6 billion over the weekend, and nobody has to wait 40 hours for permission. Get your coins off of exchanges.

SIGNAL

AI labs are buying compute like airlines buy planes

Snowflake CEO Sridhar Ramaswamy, a former Google ads chief, put out a 16-post thread this week that's worth your time. His thesis is simple. AI labs buy compute for years and sell intelligence by the token. That's long-term fixed cost against short-term, cancelable revenue. He walks through banks, airlines and utilities to show how that mismatch breaks, and concludes, "A capacity bust is more likely than a bank run."

Anthropic's S-1, filed Monday, puts numbers on it. About $265.6 billion in expected future fixed or minimum guaranteed commitments as of June 30, with terms of one to 20 years, and another $321.4 billion in leases that haven't commenced yet. First-half revenue was $16.3 billion, up 1,300% from a year earlier. But the filing says those commitments are payable "regardless of actual utilization." Watch the public miners pivoting to AI hosting. They're becoming the offtake layer for these labs and inheriting their credit risk. Bitcoin mining load is the opposite. It's flexible, it can shut off in seconds and it gets paid in a bearer asset.

France spends 57% of GDP and is striking for more

France's public spending hit about 57% of GDP last year, according to INSEE, with a deficit of 5.1% and debt at 115.7% of GDP. A chart making the rounds, credited to Michael Arouet, stacks that against the Soviet Union at 50% in 1989. Soviet-era numbers aren't apples to apples with modern GDP accounting, so take the comparison as a gut punch rather than a statistic. The gut punch lands anyway.

And the French want more. Dock workers are striking today, Yellow Vest rallies are set for Saturday and the major unions have called a nationwide strike for November 5 against the government's roughly €54 billion austerity budget for 2027. When the state is more than half the economy, every attempt to trim it becomes a fight over who gets to keep feeding at the trough. That's where fiat leads.

Open enrollment starts Sunday. Seriously consider CrowdHealth.

A health insurance renewal letter I shared this week shows Blue Cross and Blue Shield of Alabama quoting an estimated $4,287.61 a month for a 2027 Silver plan. That's more than $51,000 a year before you touch the deductible. It's completely insane to subject yourself to that when CrowdHealth exists. I pay $725 a month for my family of five, less than $10,000 a year. We've been members since 2021, had two babies and dealt with multiple health events, and it's worked incredibly well for us. CrowdHealth estimates we've saved $73,664.89 versus traditional premiums.

Open enrollment starts Sunday and runs through January 15. If you're staring at a renewal notice that makes your stomach drop, seriously consider CrowdHealth. Use code TFTC for a discount on your first three months. Full disclosure: CrowdHealth is a TFTC sponsor, and it is not insurance, so understand how it works before you switch.

PJM wants data centers to pay for the power they need

PJM, the grid operator for 13 states and D.C., filed an amended reliability backstop on Thursday to cover a projected 6.8 gigawatt shortfall. The big change is who pays. Costs would be allocated by each zone's growth in firm large loads, measured from the actual summer 2026 peak to the 2028/29 forecast. In plain English, the zones adding data centers carry the bill. Procurement now launches March 1, 2027, with 15-year terms and a $555 per MW-day cap.

This is the right instinct. Cost causation beats moratoriums. If you bring a load that needs firm power around the clock, you pay for the firm power. It also highlights why flexible loads like bitcoin miners, which can shut off when the grid is stressed, are the cheapest customers a grid can have.

Lagarde is leaving the ECB nine months early

Christine Lagarde announced on Thursday that she'll step down as ECB president on February 7, 2027, about nine months before her term ends. The same day, the ECB held its deposit rate at 2.5% and noted that energy prices have continued to rise and financing conditions have tightened. Her explanation at the press conference: "I want to have the freedom of speech, the freedom of expression and the freedom to engage on matters that are not monetary policy matters."

Her successor will be picked by the European Council, not by voters, and the timing lands ahead of France's presidential election in April. Either way, the next person running the euro will be chosen by a handful of heads of government behind closed doors. Your money, their choice.

⚡ FREEDOM TECH CORNER

DATA SNAPSHOT

Spot price, block height and hashrate estimate: October 30, 2026, 10:20 a.m. ET. Bitcoin Lab daily series: October 29, 2026. U.S. spot ETF flows: October 29, 2026.

Sources: Kraken spot quote, mempool.space block height and hashrate, Bitcoin Lab daily metrics, and TFTC ETF flows. Daily metrics use the provider’s October 29 observation, not live intraday estimates.

Have a great weekend, freaks.

Marty Bent · TFTC · Nostr

YouTube

Podcast