The last 250 BTC landed and Liquid's bitcoin IOUs are fully backed again, September's $320 million hole finally closed. Whose coins those were, the federation behind the network still hasn't said. I've carried that around all day, because it's the question under everything on my screens since Sunday, just at different sizes. Who ate it? 🧾
Binance at least put its name on the check. It's covering the theft with its own money, balances came through whole, and when withdrawals reopened Sunday the wallets DeFiLlama tracks bled $2.5 billion net in a day: $1,083 million in USDT, $385 million in USDC, $912 million in bitcoin, $131 million in wrapped ether. More dollars walked than coins. That money wasn't leaving crypto, it was leaving a building, and I'd love to know where it went next. A run and a relief valve look identical on day one. I watched Binance hold through a withdrawal wave in the FTX winter, so I'm not drafting an obituary. Since Bybit, filling the gap within days has become house style, just never at this size.
The SAFU wallet bothers me more. Binance has spent half its SAFU bitcoin, about $580 million worth, leaving the fund under the $800 million line where its own rules say a top-up kicks in. No refill date yet. When they moved the fund into bitcoin earlier this year, that top-up was sold as drawdown insurance, not as a backstop for a bill like this. The fund covered a slice and the rest came out of a balance sheet I can't audit. My guess, only a guess, is that some of that SAFU bitcoin left inside Sunday's $912 million.
Mercado Bitcoin is making the same pledge in miniature. Brazil's biggest bitcoin exchange lost $40 million and says the loss is on the house, yet withdrawals are still frozen with no restart date. I believe they mean it. A refund you can't withdraw is still a promise you can't test, though, and frozen withdrawals were the first thing Gox did too, an association I've never shaken even with exchanges that turned out perfectly solvent.
Liquid sits worse with me than either, even though its hole is the one actually closed. It was pitched as a step up from trusting one exchange, a federation of firms holding the keys, and now the peg has been rescued by a name the federation hasn't given. If one member covered it, the peg is that member's balance sheet. If several split it, the split is the real cap table of L-BTC, and I'd want to read it before parking a sat there.
The other question, how the holes get there, got a new answer today, the one I'll take to bed. 🎣 This one started with a coding test in a fake job interview, run on the engineer's work machine, the laptop from Friday's entry. I've had those messages. A recruiter, a role that pays a little too well, a repo to clone and run before the call. If I remember the FBI's write-up right, DMM's breach began with a fake pre-employment test at its wallet vendor, and Ronin fell to a fake offer letter back in the Axie days. The perimeter runs through LinkedIn now, both directions, since the same crews also apply for your jobs.
What came next rearranged my head. They had the signing service bless EIP-7702 authorizations, the 2025 Ethereum feature that lets a wallet run a contract's code as its own. A signature like that doesn't move a coin. It changes who the wallet listens to. From then on the hot wallet paid out whenever they called it, fresh deposits included, and Binance's pause stopped Binance's payouts, not theirs. I suspect the controls were tuned to watch money move, and this didn't look like money until it was gone. The summer after 7702 shipped, the dashboards filled with delegations to copy-paste sweeper contracts and we filed it under retail phishing, the right bug at the wrong scale. Only the same key signing again could take the wallet back, and that signature landed minutes after the last 2,961.9 ETH left. I keep wondering what held it back until the wallet was empty, diagnosis or distrust of their own signer.
Pyongyang, for its part, answered through Kim Yo Jong, calling Washington's accusation "absurd rhetoric," the line they always reach for. Chainalysis had the more useful answer, the stolen funds mixing with proceeds of an earlier exploit, and reused laundering routes are as close to fingerprints as this industry gets. Lee Jae Myung wants a cybersecurity czar for South Korea, one agency across government, and he tied it to AI raising the stakes for banks and infrastructure. Seoul carries an Upbit scar from the same crew, so I don't read it as theater. What I hear in the AI part is the recruiter. Nothing Binance shared says the interviewer was synthetic, but if I were running that op this year I wouldn't pay a human to sit through the call.
AI turned up in Apple's cost line too. 🍎 Apple reported on a rare Monday, the first print of the John Ternus era, into inflated memory prices and tougher consumer spending. My read is that the memory bill is the AI boom invoicing everything that isn't AI, data centers built around Nvidia's chips soaking up supply while Apple pays the surge price. Tokenized Apple and tokenized Nvidia sit one tap apart on the rails I watch, and this quarter they look like two ends of one trade. The Monday slot also gave the tokenized shares the weekend mostly to themselves, positioning into Ternus's first report while Nasdaq slept, the same weekend $2.5 billion left Binance, and I couldn't pull much signal from that tape. Whatever the stock does from here, I'll watch the memory line, because it shows how much of the boom gets paid for by the parts of the economy that aren't booming.
Oil is the other thing squeezing that side of the economy. US crude is testing its rising channel while hopes for peace with Iran lean on the price. A break means relief for the same household budgets Apple is fretting over, and less air under the hike Hammack and Cook already voted for last week. If the channel holds, December stays live. I don't know which it'll be. Oil can break on hope long before any deal earns it, and I've watched that movie end both ways.
Every IOU on my screens this week, an L-BTC, a Binance balance, the tokenized Apple in my own wallet, is a promise that a balance sheet somewhere fills the hole if one opens. The theft is the most legible part of all this. I can follow the stolen coins hop by hop as they mix with the last job's money. What I can't see is the rescue: whose 250 bitcoin, which pocket at Binance, when SAFU gets topped up again. We put the crime on-chain and kept the cure in a back office. 🌙