How North Korea Pulled Off the Biggest Heist in History

Binance

Across the shows: 3 speakers in other episodes, 2 bullish and 1 bearish calls, past 30 days

• Patrick Boyle · Patrick Boyle On FinanceBearish

  Binance's bitcoin-denominated emergency fund is a poor hedge for stablecoin and ether losses.

  Binance keeps its emergency fund, SAFU, in bitcoin. That is a natural hedge only if the thieves take bitcoin and take less of it than the fund holds. In practice the thieves took billions in stablecoins and ether, and the bitcoin they took was worth more than the whole fund. Bitcoin's price also fell as the hack rattled markets, and the Wall Street Journal reports the fund lost about $100 million at the moment Binance needed it. Boyle calls the reserve a fire insurance policy that pays out in kindling.

  “the value of the fund dropped by about $100,000,000 at the exact moment Binance needed it. It is a bit like a fire insurance policy that pays out in kindling.”at 29:10

• Patrick Boyle · Patrick Boyle On FinanceBullish

  Binance's trading-fee revenue is large enough to absorb the hack losses without strain.

  Binance has around 335 million users and handled about $34 trillion of trades last year, which makes it enormous. Its trading fees are large enough to cover the hack losses out of its own pocket, even though the losses ran about three times higher than the early $1 billion estimate. Boyle sees this scale as the reason the damage is survivable. He notes that Binance's co-CEO said annual revenue was enough to cover the losses, which supports the balance-sheet argument.

  “Binance is enormous, and it makes enough money in trading fees to cover the difference out of its own pocket.”at 29:35

• Patrick Boyle · Patrick Boyle On FinanceBearish

  Binance's security failure is underweighted by the market; its centralized custody was the real weak point.

  Binance's hot wallet signed about 50 transactions without reading them, and its signing system and security software failed to catch malware sent to an engineer through a fake job interview. An internal AI tool then let the hackers take over other engineers' laptops and gain access to the signing service. The hackers got in through the company's own systems, not through the blockchains, which recorded every transaction accurately. Boyle argues that the public and analysts have given too little weight to this failure, even though it enabled the largest theft in history.

  “I am surprised by how little weight people are putting on the security failure.”at 32:56

• Patrick Boyle · Patrick Boyle On FinanceBearish

  Binance's compliance controls look weak, given the suspicious accounts and sanctions-linked customers in its files.

  Binance pleaded guilty in 2023 to breaking US anti-money-laundering and sanctions laws and paid $4.3 billion in penalties. The US Treasury says it had not reported more than 100,000 suspicious transactions, including ones linked to ransomware, terrorist groups and large-scale hacks. Internal files show a junior bank employee moving $93 million through an account logged in from two countries, and a Brazilian account with a weak ID that later received $16 million. Another customer is linked to an alleged $1.5 billion Iranian oil network. Binance says it has strict controls and that the activity is not evidence of wrongdoing, but Boyle's reading is that the customer base shows weak compliance.

  “customers are sharing an exchange with an alleged sanctions busting oil trader, well traveled and surprisingly wealthy bank clerks and an international cash settled sausage entrepreneur”at 36:33

Bitcoin

Across the shows: 31 speakers in other episodes, 25 bullish and 12 bearish calls, past 30 days

• Patrick Boyle · Patrick Boyle On FinanceUncertain

  Bitcoin's muted reaction to the Binance hack may be premature, given its drop after Bybit.

  Bitcoin fell only about 5% after the Binance hack, compared with 19% in three days after FTX collapsed, and has been fairly steady since. Analysts read the market reaction as an operational shock, not a systemic one, and Boyle agrees that FTX was a fraud while this was a robbery and the victim could afford it. He cautions that after the Bybit hack last year, bitcoin also held up at first and then fell 14% a week later. He therefore sees the calm as possibly premature.

  “after the Bybit hack last year, Bitcoin also held up at first and was 14% lower a week later, so it may be early to celebrate.”at 26:51

Cybersecurity

• Patrick Boyle · Patrick Boyle On Finance

  North Korean state hackers are the dominant theft threat to crypto and are very capable operators.

  According to Chainalysis, North Korean hackers stole about $2 billion in crypto last year, roughly 60% of all crypto stolen worldwide. The Binance hack, at about $6.3 billion, took the record from Bybit's $1.5 billion hack, which was also attributed to North Korea. Boyle cites about 8,400 cyber personnel in North Korea and a pipeline that recruits talented teenagers into hacking. The hackers also rehearsed the attack on public blockchains for about 37 hours and ran a final dress rehearsal before the real attack. The state's employees face no extradition risk, so the threat is persistent and well resourced.

  “Last year, according to Chainalysis, North Korean hackers stole about $2,000,000,000 in crypto, which was roughly 60% of all the crypto stolen worldwide.”at 9:14

Stablecoins & crypto policy

• Patrick Boyle · Patrick Boyle On Finance

  Freezable stablecoins let crypto recover funds, but that means it relies on centralized issuers like a bank would.

  About $2.8 billion of the stolen funds were in stablecoins issued by Tether and Circle. Tether and Circle could freeze those tokens, trapping about $2.4 billion, and anything else the hackers moved into those wallets was frozen on arrival. Tether and Circle can also reissue new tokens to Binance to replace frozen ones, which Levine describes as centralized intermediaries performing a quasi-law-enforcement function. Boyle concludes that the supposedly decentralized system survived its biggest crisis by behaving like a traditional bank.

  “So, the decentralized financial system survived its biggest crisis by doing exactly what a traditional bank would have done.”at 19:14

Bitcoin & crypto markets

• Patrick Boyle · Patrick Boyle On Finance

  Crypto is now more centralized than the traditional financial system it was meant to replace.

  Traditional finance is split across dozens of regulators, hundreds of exchanges and thousands of banks. Crypto has one exchange, Binance, holding about six times as much as its nearest rival, a few whale investors, and two companies issuing most of its dollars. In the Binance crisis, the biggest exchange gated withdrawals, paid for the damage from its corporate balance sheet, and relied on two stablecoin issuers to do the policing. On this evidence Boyle argues crypto has become more centralized than the system it set out to replace.

  “I'd argue that crypto is now more centralized than the system it set out to replace.”at 37:41