The signer did its job. 🔑 I keep landing back there, hours after I should have closed the screens. $6.3 billion left Binance, a record for this industry, and by Binance's own early findings the key never leaked. It signed what it was handed. An engineer's hacked laptop got the attacker into a service container, the withdrawals went in through the approved pipe, and from where the signer sits a thief inside the pipe looks exactly like you asking for your coins back. All these years we've argued about the vault, cold storage, multisig, MPC, while the big ones keep starting on a work laptop. Bybit's $1.5 billion in 2025 came through a wallet vendor's developer machine. We still haven't priced that the hardest part of the system takes orders from the softest part.
What I can't get past tonight is a pair of statements. Binance has found no sign of a leaked private key. Richard Teng also says the attackers erased evidence and bypassed security checks, and the breach keeps turning out wider. I've read enough post-mortems to know "no sign" is only as good as the logs, and these are logs the intruder had a chance to edit. The key may well be fine, I have no idea, but Binance can't be sure either, not on a Friday night, and still the plan is withdrawals back on Sunday and proof of reserves on Monday, so the door opens a day before the receipt shows up. 🚪 Part of me thinks that's the right call, a withdrawal that clears beats any Merkle tree. The other part keeps asking how you call a pipe clean within days when whoever was inside wiped their tracks. A friend DM'd me over dinner asking whether to pull everything the second it reopens. I started typing, deleted it, started again. In the end I said take some, partly to find out if the door works, though not your keys lands softer after the hardware wallet mess I wrote about Monday.
Hard to answer, because the numbers are almost reassuring, which bothers me more than it should. Binance's own reserve data lists the drained wallets as backing customer balances, ether an estimated 6% short until the gap gets filled, and it says it has $6.34 billion arranged to fill it. Back in the FTX week we'd have wept for any honest number at all, and the dashboard this one comes from only exists because of FTX. If those funds aren't already in ether then some desk is selling or lending it to them this weekend, the way Bybit's gap got plugged within days, and that's the flow I'll watch. Then I read the cover again. As far as I can parse it, roughly $3 billion of that is freezes on the stolen assets, a different kind of money from money you hold. Nearly half the loot stopped moving. 🧊 Nothing at the protocol level freezes bitcoin or native ether, so a freeze means a switch, an issuer or a venue with an admin key and a compliance desk that picked up the phone. I haven't seen the breakdown, this is a guess, but what's stuck looks to me like the part that was never really bearer money. I've spent years calling those switches the betrayal. Tonight they're the reason the hole isn't far worse, and I don't love how that sits.
Which is why Canton and DTCC opening access to $30T in eligible securities landed differently than it would have a week ago. Eligible is the word I'd circle, access isn't migration. Still, that's the deepest plumbing in American finance stepping onto rails where every instrument carries a switch, in the very days a switch saved billions at an exchange. If I sat at DTCC I wouldn't read Binance as a warning about blockchains, I'd read it as proof we were right to keep the admin key. They might be right. What I'd want to know is what can reach that key, because a tokenized Nvidia or a Treasury ends up where the ether did, a signer trusting a service that trusts an engineer's machine, and I don't yet know Canton's answer.
The sell side didn't wait for answers. Cantor Fitzgerald, TD Cowen and Compass Point were already telling clients to buy the crypto stocks, Coinbase and Robinhood on the list, the pitch being that Binance failed, not Bitcoin. I've heard that song, back when it was FTX failed, not crypto, true then and still expensive to be early. When Gox went down there was no Cantor note, just a Reddit thread and a guy with a spreadsheet, so part of me calls this growing up, even as it unnerves me how fast my feed moved on to tickers. The honest version of the pitch is market share, flow leaving a wounded venue and landing on US-listed ones, and that may well be right. It just has nothing to do with safety, those are pipes too, and Coinbase had its own support desk bribed only last year.
While the tickers got passed around, half my timeline scrolled straight past Jupiter Lend, whose API showed 3.35 USDC immediately withdrawable against 418.5 million USDC in Earn deposit claims. I laughed, then stopped. 🫠 Jupiter calls it a liquidity crunch, nothing I've seen says anything was stolen, and the rate curve is supposed to drag borrowers back in. I can't draw a line from Binance to Jupiter and I don't trust the accounts already drawing one. I've watched that word Earn before though, at Celsius, at Gemini, and it always turns out you were a lender the whole time and the app never made you feel like one. A balance is an opinion until the withdrawal clears. Hacked pipe or empty pool, I keep arriving at that same sentence.
The macro sits off to the side of all this and I've been trying not to force it. Warsh, fresh off the split I wrote about Wednesday, leaned toward higher rates while keeping his options tied to the data, and the data showed up Thursday running hot, 3.4% GDP with September inflation accelerating and consensus PCE at 3.7%. Oil fell as Vance moved to restart the Iran talks, the one thing all week that could buy Warsh some room. Lagarde announced she's gone on Feb. 7, the woman who told Dutch television crypto was based on nothing, and any other week I'd have spent an evening on who inherits her digital euro. I can't find a thread from any of that to an engineer's laptop, except maybe this. We dreaded the Gox coins for years, Bitcoin shrugged when they came, and I suspect the half that got away ends up the same, loud for a week. Whether those Cantor notes age well probably gets decided by a hot economy and a December vote, not a thief's wallet.
Sometime on Sunday, if the date holds, an order comes down that pipe again. The signer will check where it came from, find nothing wrong, and sign. It found nothing wrong last time too.