Money Without a Master | Daily Blog | 31 Oct 2026
Money Without a Master
Crypto answers to keys, not courts. From the Lufthansa vault to Binance’s $6.3 billion breach, the story of how money slipped free of banks, judges and borders, and what that means for every owner as homes, bonds, funds and even dollars turn into tokens
For most of history, money had masters: the sovereigns who minted it, the banks that held it and the courts that could order it returned. A stolen bank transfer could be recalled; a forged deed could be voided. Crypto answers to none of them. It obeys whoever holds the key, and once it moves, no judge, bank or border can call it back. As more of the world’s wealth is turned into tokens, that stops being a question for crypto traders alone. It becomes a question for every owner: who, or what, is the master of your money?
Every age of finance has defined ownership by a proof: possession of the gold, a signature on a deed, an entry in a ledger, a private key. Every age of theft has attacked that proof. The newest thieves do not break into vaults; they persuade systems that they are the owner.
Money without a master is money without a referee. The Binance breach of 29 October 2026 shows how far that has gone. No key was reported stolen. An attacker took over an engineer’s laptop, reached the software that signs withdrawals, and had Binance’s own systems approve $6.3 billion of transfers to itself. On the blockchain, those transfers look exactly like legitimate ones. As homes, funds and bonds are tokenised, the same logic reaches ordinary property. A house recorded on a government register can be defended in court. A house whose ownership is a token is only as safe as the key, the custodian and the identity checks behind it. The coming challenge is not only security. It is proving, at speed and at scale, what is real.
- Part one · The historyWhat ownership is (01); six ages of theft, from vaults to deepfakes (I–VI); and the cold cases, the biggest and most mysterious thefts and where each stands today (07).
- Part two · The presentWhy crypto exchanges are where the money is, and how pseudonymity helps thieves escape (08); the Binance breach, fact by fact (09); the market impact (10); scenarios for Monday and beyond (11); and balanced trade ideas for a week, a month and a year (12).
- Part three · The futureHow tokenisation is changing wealth and money, and the tokenised home (13); splitting keys so no single breach is worth anything (14); exchanges that never hold the asset (15); and what AI and quantum computing mean for security (16).
- ClosingNew rules for owning anything (17), the verdict (18), and a ledger of 36 incidents with sources (19).
At 20:05 UTC on Thursday 29 October 2026, the first funds left Binance’s wallets on the XRP Ledger. Within minutes, outflows followed on Solana and Optimism. At 20:20 UTC, a single Ethereum transaction carrying 50 pre-signed authorisations gave attacker code control of a Binance hot wallet. Three minutes and twenty-four seconds later, 167,464 ether and 1.6 billion USDT had gone (source: TRM Labs). Bitcoin and Tron followed. By the time Binance paused withdrawals at about 22:15 UTC, roughly $6.3 billion had moved across ten blockchains, about four times the previous record.
Nothing was carried out of a building. No safe was opened. To the blockchain, every transfer was valid: properly signed, properly formatted, final. The only thing wrong with them was that the owner had not meant them. That gap, between what a system records and what is true, is the subject of this chronicle. It traces six ages of theft, each defined by what thieves attacked: the object, its authenticity, the books, the record, the key and finally the person. It follows the biggest of those thefts to where they stand today, explains why crypto exchanges have become, in Willie Sutton’s phrase, where the money is, and sets out what the Binance breach means for markets over the next week, month and year. It ends with the future: tokenised homes, keys split so that no single breach is worth anything, exchanges that never hold the asset, and the double-edged arrival of AI and quantum computing.
A house is a story everyone agrees to believe
Ownership has never been the thing itself. It is a record, and a system that honours the record.
Imagine a house in your name. You hold the title deed; the land registry holds the official record; a court will enforce it. If someone breaks in, they can take the furniture but not the house. If someone forges your signature and records a fake deed, the law in most countries treats a forged deed as void, and a judge can restore what was taken. Your ownership is protected by layers: paper, a register, clerks, lawyers, courts and, ultimately, the state.
Now imagine the same house represented by a token on a blockchain. Selling it takes seconds instead of weeks. Anyone, anywhere, can buy a fraction of it. The record is public, permanent and cannot be quietly edited. But if the token is the ownership, then whoever controls the key that moves it controls the house. Steal the key, or trick its holder into signing, and the transfer is final. There is no clerk to call at midnight, and the blockchain does not ask whether you meant it.
The same house, two kinds of proof
Editorial comparison. Real tokenisation projects often sit between these poles; see section 13.
On paper
- Proof of ownership
- Entry in a government land register
- How it is stolen
- Forged deeds, impersonation of the owner, corrupt insiders
- Speed of theft
- Weeks: filings, notaries, a sale to close
- If stolen
- A forged transfer can be voided in court; title insurance may pay
- Weak point
- Slow, local, paper-based checks
On a chain
- Proof of ownership
- Control of a token, and of the key that moves it
- How it is stolen
- Stolen keys, hacked custodians, tricked signatures, fake identities
- Speed of theft
- Seconds to minutes, across borders
- If stolen
- Final on-chain, unless the token’s issuer can freeze and reissue it
- Weak point
- Whoever, or whatever, can sign
Paper is not perfectly safe. The FBI warned in 2025 that “home title theft” was rising: criminals forge quitclaim deeds, record them with county clerks, then sell or borrow against homes they do not own. More than 58,000 Americans reported losses of $1.3 billion to real-estate crime from 2019 to 2023 (source: FBI via HousingWire). The difference is not that one system is honest and the other is not. It is what happens after a lie is recorded: on paper, the law can unwind it; on a pure blockchain, nothing can. To understand why that matters, it helps to see how theft has evolved, one proof at a time.
When wealth had weight
Vaults, trains and tunnels. Theft was physical, local and limited by what could be carried.
On 8 August 1963, a gang stopped a Royal Mail train in Buckinghamshire and took about £2.6 million in used notes, the Great Train Robbery. Twenty years later, on 26 November 1983, six men entered the Brink’s-Mat warehouse near Heathrow expecting £1 million in cash and found about three tonnes of gold bullion worth £26 million. In 2003, on the eve of the Iraq war, about $920 million in US dollars was removed from the Central Bank of Iraq, reportedly on the orders of Saddam Hussein’s family; US forces later found about $650 million hidden in palaces. In 2005, thieves in Fortaleza, Brazil, dug a tunnel of about 78 metres from a rented house to the vault of the Banco Central and removed about $70 million in notes.
The United States produced its own legends. On 24 November 1971, a man the press called “D.B. Cooper” hijacked a Northwest Orient flight, collected a $200,000 ransom and parachuted into the night over the Pacific Northwest; he was never identified. On 11 December 1978, a crew raided Lufthansa’s cargo vault at New York’s JFK airport and took about $5.875 million in cash and jewellery, then the largest cash robbery in US history; most of those involved were later murdered and the money was never found. On 18 March 1990, two men dressed as police officers talked their way into Boston’s Isabella Stewart Gardner Museum and left with 13 works, including a Vermeer and Rembrandts, valued at about $500 million. And on 12 September 1997, a safety inspector who had been fired the day before used his keys to let five friends into the Dunbar Armored depot in Los Angeles; they loaded $18.9 million into a rented van in about 30 minutes.
These were spectacular crimes, but they had natural limits. Money had mass. The gold had to be smelted, the notes moved, the crews paid and kept quiet. Serial numbers, informants and simple weight brought many of them down. The defences of the age were thick walls, guards, time locks and armoured vans, and they worked because the thing being protected could only be in one place at a time.
The weight of a heist (tonnes)
Physical weight of the haul. Iraq and the Binance equivalents derived from $100 notes at about 1 gram each; gold equivalent at ≈$4,000 per ounce. Tap a bar.
The Binance attacker moved more value than every robbery in this section combined and carried nothing. The whole history of physical security, walls, guards and the sheer weight of money, simply did not apply. That shift did not happen overnight. It began with the oldest trick of all: not taking the money, but making more of it.
Forgery: when a copy is as good as the original
The first attacks on reality: counterfeit money, false documents, and things sold by people who never owned them.
In 1925, a Portuguese businessman named Artur Alves dos Reis pulled off what may be the purest attack on the idea of “real” money. Using forged contracts, he persuaded Waterlow & Sons, the London firm that printed Portugal’s banknotes, to print a large run of 500-escudo notes from the official plates, supposedly for the colony of Angola. The notes were not counterfeit. They were genuine notes, printed by the genuine printer, that should never have existed. Discovered only in December 1925 when duplicate serial numbers were noticed, the scandal shook public trust in Portugal’s institutions and is counted among the causes of the fall of the First Republic in 1926 (source: PMG).
The same year, the con artist Victor Lustig famously “sold” the Eiffel Tower to a Paris scrap dealer, posing as a government official with forged letterhead. He did not own it; he only needed the buyer to believe the paperwork. During the Second World War, Nazi Germany’s Operation Bernhard forced prisoners at the Sachsenhausen camp to forge British pound notes, with an estimated face value of more than £130 million, in an attempt to undermine sterling. And from 1989, when a bank teller in Manila flagged a suspicious $100 bill, the US Secret Service tracked “supernotes”: counterfeits printed on intaglio presses with near-identical paper, which investigators traced to North Korea (source: CoinWeek).
Four ways to fake the thing
Each attacked a different part of what made money or property “real”.
Forgery taught two lessons that matter more now than ever. First, the most dangerous fake is not a poor copy but a perfect one produced through a legitimate channel: Alves dos Reis did not fake the notes, he faked the instruction. Second, the same state can reappear across ages. The government whose agents were linked to supernotes in the 1990s is the one investigators now blame for the largest crypto thefts in history, including, according to TRM Labs and Chainalysis, Binance’s.
Money that existed only in the accounts
Insiders, fictitious trades and statements describing assets that were never there.
As finance moved from vaults to ledgers, a new kind of loss appeared: one created entirely inside the books. In 1995, Nick Leeson hid losses of £827 million in a Barings error account numbered 88888, bringing down a bank founded in 1762. In 2008, Jérôme Kerviel built about €50 billion of hidden positions at Société Générale, masked by fictitious offsetting trades; the bank lost €4.9 billion and survived only by raising fresh capital. These were not thefts in the legal sense. They were distortions of reality on a balance sheet, invisible until markets moved.
Then came the frauds in which the reality itself was fake. When Bernard Madoff was arrested on 11 December 2008, his clients’ statements showed about $64.8 billion; the trades behind them had largely never happened, and investors had lost about $17.5 billion of real principal, of which a court-appointed trustee has since recovered more than $14 billion. In June 2020 Wirecard, then a member of Germany’s DAX index, admitted that €1.9 billion of cash in Asian trust accounts probably did not exist. In November 2022, FTX halted withdrawals; customer balances on screen were real numbers, but about $8 billion of the assets behind them were missing, allegedly used by an affiliated trading firm.
On the statement versus in the vault
Sizes of book-based losses and phantom assets, in their original currencies. None of these was an outside theft.
This age matters for the Binance story for one reason: it is the main thing Binance is not, on current evidence. In every case above, the institution’s own records misrepresented reality. In Binance’s case, an outsider manipulated the systems, and the company says it has the assets to make customers whole Analysis. Telling those two situations apart quickly is the single most important skill for anyone holding assets on a platform during a crisis.
When money became messages
Banking networks, payment instructions and stolen identities. Theft moved to wherever the system trusted a message.
In mid-1994, a group linked to the Russian programmer Vladimir Levin used stolen user IDs and passwords to enter Citibank’s cash management system and made about 40 transfers totalling more than $10 million to accounts around the world. Customers noticed about $400,000 missing; most of the rest was frozen before it could be withdrawn. Levin was lured to London and arrested in March 1995 (source: FBI). It is often called the first great online bank robbery, and it set the template: the money never moved physically, only the messages describing it did.
The template scaled. From 2013, the Carbanak and Cobalt groups infected more than 100 banks in about 40 countries with malware, watched staff for months, then made ATMs dispense cash on command, taking up to €1 billion (source: Europol). Over a weekend in February 2016, attackers using malware inside Bangladesh Bank sent 35 fraudulent SWIFT payment orders to the Federal Reserve Bank of New York asking for $951 million; most were blocked, but about $81 million vanished into Philippine casinos. The United States later charged a North Korean programmer. Meanwhile, the Equifax breach of 2017 exposed personal data on about 147 million people: no money was taken directly, but the raw material of identity, names, birth dates and social security numbers, was now in the wild.
What each system trusted
The point of attack moved from the vault to the message.
| Incident | The system trusted… | The attacker supplied… | Result |
|---|---|---|---|
| Citibank, 1994 | A valid user ID and password | Stolen credentials | $10m+ moved; most frozen |
| Carbanak, 2013–18 | Commands from bank staff computers | Malware controlling those computers | Up to €1bn |
| Bangladesh Bank, 2016 | Authenticated SWIFT messages | Messages sent from inside the bank | $81m lost of $951m requested |
| Equifax, 2017 | Unpatched public software | An exploit | Identity data of ≈147m people |
| Coinbase, 2025 | Its own support staff | Bribes to contractors | Customer data used for impersonation scams |
The lesson of this age: a system that accepts a correctly formatted instruction from a trusted channel will obey it, whoever is really behind it. Banks responded with transaction monitoring, two-factor authentication, payment limits and the ability to recall transfers. Crucially, the traditional system kept a safety valve. Payments could be frozen, reversed or clawed back through correspondent banks and courts. The next age removed that valve.
Bearer assets for the internet
In crypto, whoever holds the private key owns the coins. Lose it, or let someone else use it, and the transfer is final.
Bitcoin solved an old problem: how to own and send digital money without a bank. It did so by making ownership equal to control of a private key. That made cryptocurrency the first internet-native bearer asset, like cash or gold, but transferable across the world in minutes. It also made it the ideal target. In February 2014, Mt. Gox, then handling most of the world’s bitcoin trading, halted withdrawals and filed for bankruptcy with about 850,000 bitcoin missing. In 2016, a bug in The DAO let an attacker drain 3.6 million ether, and Ethereum split in two over whether to reverse it. In January 2018, Coincheck lost $530 million in NEM from a single hot wallet. In March 2022, attackers obtained five of the nine validator keys securing the Ronin bridge and took about $620 million.
Two American cases show both sides of the bearer-asset coin. In 2012, James Zhong found that double-clicking the withdrawal button on the Silk Road marketplace paid out twice, and over several days took more than 50,000 bitcoin, then worth about $620,000. Nine years later, federal agents found the keys on a computer hidden in a popcorn tin and a safe under his floorboards; the coins had become worth over $3 billion (source: Fortune). In August 2016, 119,754 bitcoin, then about $71 million, were stolen from the Bitfinex exchange. In February 2022, US authorities arrested Ilya Lichtenstein and Heather Morgan and seized about 94,000 of the coins, by then worth $3.6 billion, after following them across the blockchain for years. The ledger that let the thieves move the money also, eventually, led investigators to them.
Since then, the targets have shifted from keys themselves to the people and machines that use them. In February 2025, Bybit lost about $1.46 billion after attackers compromised a developer at its wallet-software provider and slipped a disguised transaction into a routine transfer; the FBI attributed it to North Korea’s TraderTraitor group. In September 2026, Bitget lost $388 million after attackers exploited a third-party security product to send fraudulent withdrawal commands. A month later came Binance.
The largest crypto thefts on record (US$ billion at the time)
Sources: company statements, FBI, TRM Labs, Chainalysis, Elliptic and contemporaneous reporting. FTX excluded: its loss was a shortfall, not a theft. BNB Bridge: ≈$570m minted, ≈$100–110m left the chain. Tap a bar.
Three changes stand out. Speed: Fortaleza took three months of digging; the Ethereum leg of the Binance theft took 3 minutes 24 seconds. Scale: Binance’s loss alone is almost twice the $3.4 billion stolen across the entire crypto industry in 2025 (source: Chainalysis). Method: the attacker did not need Binance’s keys, because it could make Binance’s own signing systems sign. It even used EIP-7702, an Ethereum feature introduced in May 2025 that lets a wallet delegate its actions to code, to collect a bundle of authorisations in advance (source: TRM Labs). The blockchain recorded a perfectly valid transaction. It had no way of knowing that the owner did not intend it.
When seeing and hearing are no longer believing
Cloned voices, synthetic faces and entire fake meetings. The newest attack is on the human who approves the transfer.
In 2019, the British arm of an energy company sent about €220,000 to a supplier after its chief executive took a call from his German boss. The voice, accent and tone were right; the boss was a computer. In a case revealed through court documents in 2021, criminals in the United Arab Emirates used a cloned voice of a company director, backed by fake emails from the company and its lawyer, to persuade a bank manager to transfer about $35 million; Dubai investigators believed as many as 17 people were involved (source: Forbes via Gizmodo). In January 2024, a finance employee at the engineering firm Arup in Hong Kong joined a video call with the company’s chief financial officer and several colleagues. All of them were deepfakes. He made 15 transfers totalling HK$200 million, about $25.6 million (source: CNN).
The economics are shifting fast. Reported losses from deepfake-enabled fraud were about $128 million across 2019–2023, $359 million in 2024 and $410 million in the first half of 2025 alone (source: Surfshark analysis of AI Incident Database and Resemble AI data; these count only cases reported in the media). Deloitte forecasts that generative AI could push US fraud losses to $40 billion by 2027, from $12.3 billion in 2023. North Korean operatives, the same groups blamed for the largest crypto thefts, have used fake identities and AI tools to get hired as remote IT workers at Western companies.
Reported deepfake fraud losses (US$ million)
Source: Surfshark, July 2025, using AI Incident Database and Resemble AI data. Media-reported cases only, so true losses are higher.
The reality ladder: what can now be faked convincingly
Editorial summary. Each rung was once treated as proof.
- A signatureForged for as long as signatures have existed
- A document or banknoteForged by states and criminals for a century: Alves dos Reis, supernotes
- A loginStolen credentials since the 1990s: Citibank, 1994
- A voiceCloned in live calls since at least 2019
- A face in a live meetingA whole video conference faked by 2024: Arup
- A digital signature, used by your own systemValid signatures for transfers the owner never intended: Bybit 2025, Binance 2026
- An identity, end to endDocuments, selfie, voice and history generated together: the next rung
This is the age that turns the Binance breach into something larger than a crypto story. The final defence of almost every financial system, from a bank’s payment desk to a token issuer’s recovery process, is a human being who checks that a request is genuine. When voices, faces, documents and signatures can all be produced on demand, that check becomes the weakest link. And as more of the world’s property becomes digital, there is more for that link to protect.
Where they are now
The biggest and most mysterious thefts, and what eventually happened to the money and the people, as of October 2026.
Some thefts end in court. Many never end at all. The pattern across the cases below is striking. Physical robberies that relied on cash or art have often stayed unsolved for decades, because paper money leaves no trail once it is spent and a stolen Vermeer cannot be sold openly. Crypto thefts are the reverse: every coin leaves a permanent public trail, and some of the largest recoveries in history, Bitfinex and Silk Road, came years after the crime because investigators could follow that trail. Yet when the thief is a state-backed group with no need to cash out in a Western country, a perfect trail can still lead nowhere.
How much was ever recovered?
Share of the original haul recovered, found or frozen, as reported. Derived from figures in the table below; Binance and Bybit are frozen shares, not final recoveries. Tap a bar.
The cold-case file
Status as of 31 Oct 2026. Sources: FBI; court records; Fortune; Infosecurity Magazine; CoinDesk; Cointelegraph; The Business Standard; contemporaneous reporting.
| Case | Taken | How | What happened | Status today |
|---|---|---|---|---|
| D.B. Cooper, US, 1971 | $200,000 ransom | Hijacked a passenger jet and parachuted out at night | $5,800 of the marked notes found on a Columbia River bank in 1980 | Never identified; FBI ended its active investigation in 2016 |
| Lufthansa, JFK airport, US, 1978 | ≈$5.875m cash and jewels | Armed crew acting on an inside tip | Most participants murdered; one airport worker convicted; a reputed mobster acquitted in 2015 | Unsolved; the money was never found |
| Brink’s-Mat, UK, 1983 | £26m in gold | Armed crew with a guard’s help | Gold smelted and laundered; several convictions over the following decades | Most of the gold never recovered |
| Gardner Museum, US, 1990 | 13 works, ≈$500m | Thieves dressed as police officers | Empty frames still hang in the museum | Unsolved; $10m reward still offered |
| Dunbar Armored, US, 1997 | $18.9m cash | A fired safety inspector’s keys | Caught two years later when a gang member paid for property with cash still in bank straps; mastermind sentenced to 24 years | ≈$5m recovered; ≈$13.9m never found |
| Antwerp Diamond Centre, 2003 | ≈$100m+ in gems | Defeated a vault with layered alarms | Gang leader convicted | Gems never recovered |
| Silk Road, US, 2012 | 50,000+ BTC | A withdrawal bug that paid twice | Keys found in 2021 in a popcorn tin and a floor safe; thief sentenced to a year and a day in 2023 | Coins seized by the US government |
| Mt. Gox, Japan, 2014 | ≈850,000 BTC | Years of hot-wallet theft and poor records | ≈200,000 BTC found in 2014; repayments began in 2024 | ≈34,400 BTC still held; deadline 31 Oct 2027 |
| Bitfinex, 2016 | 119,754 BTC (≈$71m then) | Exchange hack | ≈94,000 BTC seized in 2022; hacker sentenced to five years in 2024, released early to home confinement at the end of 2025; courts ordered the coins returned to Bitfinex in kind | Largely recovered |
| Bangladesh Bank, 2016 | $81m (of $951m requested) | Malware and fraudulent SWIFT orders | US charged a North Korean programmer; in Feb 2024 a New York appeals court let the bank sue the Philippine bank RCBC | Litigation continues; most of the money not recovered |
| Bybit, 2025 | ≈$1.46bn | Compromised wallet-software supplier | By Apr 2025: 68.6% still traceable, 27.6% gone dark, 3.8% frozen | Mostly unrecovered |
| Binance, 2026 | ≈$6.3bn | Compromised laptop and signing systems | ≈$3bn frozen; Binance covering losses | Ongoing |
The comparison carries a lesson for everything that follows. Recovery has never depended on whether a trail exists. It depends on whether someone can be made to give the money back: a court that can reach the thief, a bank that can reverse a payment, an issuer that can freeze a token. Where none of those levers exists, the most transparent ledger in the world becomes a very precise record of a loss.
Why thieves go to crypto exchanges
Willie Sutton’s famous answer, updated for an age of hot wallets and pseudonymous addresses.
Willie Sutton robbed American banks for more than two decades and escaped from prison several times. Asked why he robbed banks, he is said to have answered: “Because that’s where the money is.” Sutton later denied saying it, crediting “some enterprising reporter who apparently felt a need to fill out his copy”, but conceded that “if anybody had asked me, I’d have probably said it” (source: Quote Investigator, citing his 1976 memoir Where the Money Was). The line survives because it is obviously true. Thieves go where value is concentrated and reachable.
In 2026, that place is the hot wallet of a centralised exchange. A large exchange such as Binance holds tens of billions of dollars of customer assets. Most of it sits offline in cold storage, but a meaningful float must stay online so that millions of withdrawals can be paid in seconds, at any hour, in dozens of assets on dozens of blockchains. That float is the modern bank vault: large, constantly in use, and reachable over the internet from anywhere on earth.
The bank vault and the hot wallet
Editorial comparison.
| A bank vault, 1950 | An exchange hot wallet, 2026 | |
|---|---|---|
| What is inside | Cash and gold, limited by space | Billions in digital assets, limited only by policy |
| How to get in | Physically, past guards and time locks | Remotely, through people, software and suppliers |
| Time to empty | Minutes to hours, with a van | Seconds to minutes, with a signature |
| Can transfers be reversed? | Cash cannot; bank transfers often can | Native coins cannot; some stablecoins can be frozen |
| Can the thief be identified? | Witnesses, cameras, serial numbers | Addresses are public, but names are not |
| Where to spend it | Locally, slowly, through launderers | Globally, within minutes, through swaps and bridges |
Why crypto is such a frequent target
Pseudonymous, not anonymous
Crypto is often called anonymous. It is more accurately pseudonymous. Every transaction is public and permanent, but it is recorded against an address, a string of characters, not a name. Anyone can create unlimited addresses in seconds without asking permission. The link between an address and a person exists only where the person touches a regulated business that checks identity, such as an exchange that converts crypto into dollars.
Thieves exploit exactly that gap. They split the haul across hundreds of fresh addresses, swap one token for another through decentralised exchanges that require no identity checks, move value from one blockchain to another through bridges, pass it through mixers that pool many users’ coins to blur the trail, and finally cash out through brokers in jurisdictions beyond the reach of Western courts. Speed is part of the method. In Global Ledger’s study of 119 breaches in the first half of 2025, the fastest laundering began four seconds after the breach, one in four incidents was fully laundered before the public even learned of the hack, and bridges were used 4.4 times more often than mixers (source: Global Ledger via GCFFC).
How stolen crypto disappears
A simplified sequence of common laundering steps. Each step aims to break the link between the stolen coins and the person who finally spends them.
- ScatterSplit the haul across hundreds of new addresses
- SwapExchange freezable tokens (USDT, USDC) for unfreezable ones (ETH, BTC), even at a loss: the Binance attacker accepted a discount of more than 10%
- BridgeMove value to other blockchains, where tracing tools are weaker
- MixPool coins with other users to blur the trail
- PeelSend small amounts off a large balance, step by step, as the Binance attacker did with 18,270 BTC
- Cash outSell through over-the-counter brokers or exchanges with weak identity checks
Pseudonymity cuts both ways. The public ledger is also the reason Bitfinex’s thieves were caught six years later and Silk Road’s nine years later: investigators never lost the trail and waited for the moment the coins touched a business that knew a name. That works against individuals who want to spend their money in the West. It works far less well against a state that can hold stolen bitcoin indefinitely and spend it through its own networks.
What is confirmed, what is reported and what is still unknown
A record theft, a cause still under investigation and a balance sheet that appears large enough to absorb it.
Timeline (UTC)
Sources: TRM Labs; Binance statements via Cointelegraph live updates, Fox Business, The Hacker News and others. Scroll sideways.
Status board
As of 30 Oct 2026, about 21:00 UTC. Sources in brackets; full list in section 19.
| Question | Answer | Status |
|---|---|---|
| Was there a breach? | Yes. Binance “has confirmed a security incident”; co-founder Changpeng Zhao said it “does look like a hack” (Binance; Zhao on X). | Confirmed |
| When? | 29 Oct 2026; most transfers 20:05–20:24 UTC; second wave from 23:05 UTC (TRM on-chain data). | Confirmed |
| How much? | About $6.3bn (Binance). Independent estimates: $5.9bn at theft-time prices (Chainalysis), $6.36bn (TRM), $6.43bn (Elliptic). | Confirmed range |
| Whose money? | Binance says only its proprietary hot wallets were hit; most customer assets are in cold storage (co-CEO Richard Teng). | Reported by Binance |
| How? | A compromised DevOps engineer’s laptop gave access to a service container that submitted unauthorised withdrawals; further breach points found; no evidence of private-key leakage; a “multi-step process” (Binance). Blockaid and TRM point to compromised signing infrastructure. | Reported; root cause not final |
| Who? | North Korea’s TraderTraitor, with high confidence (TRM Labs; Chainalysis). Elliptic urges caution. Binance has named no attacker and is working with the FBI and US Secret Service. | Unverified officially |
| How much frozen? | About $3bn (Binance), led by Tether (≈$1.77bn) and Circle (≈$825m), per TRM; also Ripple, First Digital, World Liberty Financial and Arbitrum. | Confirmed |
| Still with the attacker? | About $2.4bn (TRM) to $3.3bn (Elliptic), mainly ether and 18,270 BTC, which no issuer can freeze. | Reported range |
| Services affected | Withdrawals paused since ≈22:15 UTC 29 Oct; deposits briefly paused, normal by early 30 Oct. Market makers Wintermute and GSR disclosed exposure without amounts. | Confirmed |
| Will customers lose money? | “Users will not bear the financial impact.” $6.34bn set aside, excluding the frozen ≈$3bn; ≈80% replenished; SAFU fund holds ≈15,000 BTC. | Reported; to be tested by proof of reserves |
| When do withdrawals return? | Phased by token, around Sunday 1 Nov (UTC); full proof of reserves and report by Monday 2 Nov. | Reported plan |
In plain terms: exchanges keep most customer crypto in offline “cold” storage and a smaller float in online “hot” wallets to pay withdrawals instantly. An internal signing service checks each withdrawal and applies the wallet’s signature. Binance’s account is that the attacker did not steal the keys; it took over the machinery that uses them. That is Age IV and Age V combined: a trusted message, signed by a real key, for a transfer the owner never intended.
Where the stolen funds came from (US$ million)
Source: TRM Labs, at transfer-time prices, as of 30 Oct 00:30 UTC. Total ≈$6.36bn.
Where the money is now (US$ billion)
Sources: TRM Labs (freezes at 00:30 UTC; remainder ≈$2.4bn); Binance (≈$3bn frozen); Elliptic (remainder up to $3.33bn). Estimates differ on timing and prices.
How big is the hole relative to Binance?
Stolen amounts against users’ balances in Binance’s August 2026 proof of reserves (BTC ≈657,000; ETH ≈3.98m; USDT ≈$32.9bn). Derived. Binance says the wallets hit were its own.
That is why most analysts are treating this as a confidence event rather than a solvency event Analysis. Even for USDT, the worst-hit asset, the loss equals under 8% of what users hold on the platform, and Binance says it has already replaced about 80% from company funds. The comparison with FTX, where the institution’s own records hid a hole, does not hold on present evidence. The open questions are whether the proof of reserves confirms full backing, whether the breach is fully contained, and whether customers decide to leave anyway. The attacker has already begun laundering: swapping USDT for ether at a discount of more than 10%, borrowing ether against USDT on Aave before the markets were frozen, and splitting bitcoin into smaller pieces (source: TRM Labs). After Bybit, a similar group converted its haul within about ten days.
What a theft does to prices, and what history says
No blockchain failed on Thursday. Leverage, liquidity and confidence did the damage.
Bitcoin and Ethereum kept producing blocks; only the exit from one company closed. Yet prices fell, for three reasons. Leverage: about $1.57 billion of positions were liquidated in 24 hours, mostly bets on rising prices. Liquidity: Binance is the deepest market for many coins, and when its withdrawals stop, arbitrage between exchanges weakens. Overhang: the attacker still holds billions in ether and bitcoin that may be sold. A broad technology sell-off on Thursday and Friday, after weak results from Alphabet and Intel, added to the pressure.
The first 24 hours
Sources: Cointelegraph (30 Oct, 01:19 UTC), CoinDesk, Fox Business/Reuters. Approximate; crypto equities intraday.
Asset by asset Analysis: BNB is the most directly exposed, fell the most (about 8%) and has negative funding. Bitcoin has historically fallen less than the wider market in exchange crises and benefits most from any move into self-custody. Ether carries the most specific overhang, because the attacker holds several hundred thousand ETH. Stablecoins came out looking stronger: there was no reported loss of peg, and their issuers froze most of the stolen dollars, although the same power to freeze is a reminder that they are centrally controlled. DeFi tokens such as AAVE and UNI fell about 11% as Aave froze markets, yet Standard Chartered’s Geoffrey Kendrick argued the episode could push trading toward decentralised exchanges. Crypto equities fell hardest (Coinbase down as much as 13%), but they also tend to rebound fastest if an incident is contained.
How markets moved after past incidents
Change from the close before each event, Coin Metrics daily reference prices (derived). Past moves also reflect the wider market; they are not a forecast.
One day on, only the collapses (Mt. Gox, FTX) and the DAO exploit for ether produced double-digit falls.
The pattern is clearer than it first looks. Thefts from solvent firms were mostly short-term events: after Binance’s own 2019 hack, bitcoin was almost 40% higher a week later. Collapses of institutions whose books hid a hole were different: after FTX halted withdrawals, bitcoin fell 23% in a day and was 16% lower a month later; after Mt. Gox, it was 70% lower a year later. Bybit sits in between: bitcoin fell 14% in a week and 13% in a month, during a broader sell-off. The type of incident has mattered more than its size.
Binance 2026 against the benchmarks
Sources as in the ledger; Binance as of 30 Oct 2026.
| Mt. Gox 2014 | Coincheck 2018 | FTX 2022 | Bybit 2025 | Binance 2026 | |
|---|---|---|---|---|---|
| Age | Take the key, and the books | Take the key | Bend the books | Take the key via a supplier | Take the key via its own systems |
| Amount | ≈850,000 BTC | ≈$530m | ≈$8bn shortfall | ≈$1.46bn | ≈$6.3bn; ≈$3bn frozen |
| Withdrawals | Halted for good | Suspended for weeks | Halted for good | Stayed open | Paused; restart ≈1 Nov |
| Losses covered? | No; repayments from 2024 | Yes, in cash | Via bankruptcy, from 2025 | Yes, within days | Binance says yes, in full |
| Solvency | Insolvent | Solvent | Insolvent | Solvent | Solvent on present evidence |
| BTC 1 month later | −16% | −14% | −16% | −13% | ? |
| Outcome | Bankrupt | Sold to Monex | Bankrupt; founder jailed | Operating | To be decided |
Four scenarios, one weekend and three horizons
No arbitrary probabilities: each scenario lists what would trigger it and what would confirm it.
Method: scenarios are judged against the evidence on 30 Oct: the size of the loss relative to Binance’s holdings, the amounts frozen and replenished, Binance’s stated timetable and how past incidents of each type unfolded. “More likely” means the evidence points that way; it is not a numerical probability.
Fast restart, quick recovery
- Triggers
- Withdrawals reopen on schedule across major assets; proof of reserves shows full backing; root cause explained and contained.
- Confirming signs
- Net outflows fade within 48 hours; BNB funding back to zero or positive; stablecoin reserves stable; no new breaches.
- Binance’s options
- Publish detailed reserve data and a post-mortem; add to SAFU; speed up phased reopening.
- Investors
- Brief withdrawal spike, then return; traders re-enter; institutions wait for the audit.
- Prices, liquidity
- Relief rally in BTC, BNB and crypto stocks; liquidity normalises; the attacker’s ETH remains a cap.
- Why this likelihood
- Evidence so far, a loss under 8% of user holdings of any major asset, ≈80% replenished and a firm timetable, supports this most.
Restart, but confidence dented
- Triggers
- Withdrawals restart, but customers move assets elsewhere; questions persist about the cause or the attacker’s access.
- Confirming signs
- Net outflows of several billion dollars over weeks; rising balances at rivals; BNB lags BTC; volume share slips.
- Binance’s options
- Incentives to stay; third-party attestation; partnerships with independent custodians.
- Investors
- Large clients split assets across venues; retail moves to self-custody.
- Prices, liquidity
- Prices stabilise but BNB underperforms; liquidity fragments; volatility stays high.
- Why this likelihood
- Users often leave even when repaid. The size of this theft makes it a real possibility.
Major crisis at Binance
- Triggers
- Restart delayed; proof of reserves shows gaps; new breach points or legal action emerge.
- Confirming signs
- Missed deadlines; reserve ratios below 100%; regulators intervene; large BNB sales.
- Binance’s options
- Emergency funding, asset sales or limits on withdrawals.
- Investors
- Wider flight from Binance; institutions cut exposure.
- Prices, liquidity
- Sharp falls in BNB and crypto equities; BTC and ETH lower; spreads widen across venues.
- Why this likelihood
- Would require new information contradicting Binance’s statements and on-chain data so far.
Industry-wide contagion
- Triggers
- A Binance crisis spreads to other exchanges, lenders, stablecoins or market makers.
- Confirming signs
- Withdrawals rising across several venues; stablecoin redemptions; more protocol freezes; ETF outflows.
- Binance’s options
- Limited; the outcome would depend on regulators and other firms.
- Investors
- Broad deleveraging; flight to cash or self-custodied bitcoin.
- Prices, liquidity
- Large falls across crypto; a liquidity crunch, as in 2022.
- Why this likelihood
- No sign yet: no reported stablecoin de-pegging, spot BTC ETF inflows on Thursday, and Aave reopened markets within a day.
If withdrawals reopen on Monday
Crypto trades around the clock, but the deepest pools of money, US equities, crypto ETFs and institutional desks, return on Monday 2 November. That makes Monday the first full session in which traditional investors can respond to whatever Binance delivers over the weekend. A large outflow on Sunday and Monday is not necessarily bad news, because it shows withdrawals work; what matters is whether it fades.
Five possible Mondays
Analysis. Each outcome is tied to the conditions that would make it more plausible.
| Outcome | More plausible if… | What it would look like |
|---|---|---|
| Relief rally | Withdrawals open on time; proof of reserves ≥100%; cause contained | BTC back toward its pre-hack ≈$80k; BNB recovers part of its fall; crypto stocks bounce |
| Bounce, then fade | Smooth restart, but weak macro or attacker selling | Early gains given back in the US session; ETH lags |
| Orderly exodus | Customers withdraw heavily despite a clean restart | Large net outflows; prices steady as coins move to self-custody; BNB lags |
| Grinding volatility | Phases slip or some assets stay paused | Choppy prices; gaps between Binance and other venues |
| Negative surprise | Reserve gaps, new breaches or delay | Sharp fall in BNB and crypto stocks; outflows spread to other exchanges |
The Monday dashboard
Thresholds are editorial reference points.
| Indicator | Where to see it | Calm | Stress |
|---|---|---|---|
| Withdrawal status by token | Binance announcements | All majors open by Monday | Phases delayed or reversed |
| Proof of reserves | Binance PoR page | ≥100% for BTC, ETH, USDT, USDC, BNB | Any major asset below 100% |
| Net flows | CryptoQuant, Nansen, Arkham | Outflows fade within 48 hours | Sustained multi-billion outflows |
| BNB funding, BNB/BTC | Derivatives data | Funding back to zero or positive | Deeply negative; BNB/BTC falling |
| BTC level | Price feeds | Holds above the ≈$76,300 low of 30 Oct | Breaks lower with liquidations |
| Attacker wallets | TRM, Arkham, Elliptic | Dormant or slow | Large ETH or BTC sales on exchanges |
| Stablecoin issuance | Tether and Circle data | Net minting | Large net redemptions |
| ETF flows, crypto stocks | Issuer data, US equities | Inflows; COIN recovers | Outflows; new lows |
Next 7 days
Base case: phased reopening, a burst of outflows, volatile BNB and crypto stocks; bitcoin finds support if the reserve report is clean. Upside: a relief rally as funding and open interest reset. Downside: delays, reserve gaps or attacker selling push bitcoin below the 30 Oct low.
Next 30 days
Questions: does Binance keep its market share; do large clients split assets across venues; does the attacker sell; do regulators act? History: exchanges that paid customers in full (Coincheck, Bybit, Bitget) kept operating and mostly recovered within weeks to months. Risks: sustained outflows, regulatory probes, and further attacks elsewhere.
Next 12 months
Likely effects: tougher custody and signing standards; pressure for reserve reports that include liabilities; more third-party custody and off-exchange settlement; and a sharper debate over whether tokenised property should be freezable and recoverable by design. Markets: past thefts did not set the following year’s direction; liquidity, rates and the cycle did.
Positioning for a week, a month and a year
Balanced long and short setups on the assets most directly exposed to the Binance breach. Each idea is conditional: it applies only if its trigger appears.
The breach touches markets through four channels: BNB, the token most tied to Binance’s fortunes; bitcoin and ether, through liquidations, outflows and the attacker’s remaining holdings; listed crypto companies, led by Coinbase, which may lose on sentiment but gain on market share; and related tokens and stablecoins, which could benefit if trading migrates to rival venues. The ideas below pair a long and a short for every market, because the evidence on 30 October supports either path depending on what Binance delivers this weekend.
Reference levels, Friday 30 October 2026
Sources: 24/7 Wall St. (BTC levels, Coinbase), Coin Edition (BNB levels), Motley Fool/CoinGecko (prices at 20:16 UTC), CoinDesk (crypto stocks, close), Cointelegraph (ETH levels). Approximate.
| Market | Price | Support | Resistance | Context |
|---|---|---|---|---|
| Bitcoin | ≈$76,900 | $76,300–76,600; $73,100 (200-day) | $79,100; $81,600–81,900 (20/50-day) | Pre-hack ≈$79,800; lowest close since 17 Sep |
| Ether | ≈$2,240 | $2,170 (30 Oct low); $2,150 | $2,330 (pre-hack); $2,400 | Attacker holds several hundred thousand ETH |
| BNB | ≈$700 | $692 (200-day EMA); $674.60 | $750–762; $772.60 | Pre-hack ≈$755–760; funding negative |
| Coinbase (COIN) | $143.21 | $139.11 (52-week low) | $160.59 (29 Oct close) | −37% year to date; targets $120–275 |
Driven by Sunday’s phased reopening, the proof of reserves due by Monday and whether the attacker sells.
Bitcoin ≈$76,900
- Trigger
- Withdrawals reopen on schedule, proof of reserves shows ≥100% backing and Binance outflows fade.
- Entry
- Buy a daily close above $79,100 (resistance, just below the ≈$79,800 pre-hack level)
- Stop
- $76,900
- Targets
- $81,800 (20/50-day averages), then $83,500
- Reward : risk
- ≈1.2 : 1; ≈2.0 : 1 to second
- Stand aside if
- Attacker’s BTC moves to exchanges
- Trigger
- Restart is delayed, reserves show a gap, or the attacker starts selling.
- Entry
- Sell a daily close below $76,000 (below the 30 Oct low of $76,301)
- Stop
- $78,200
- Targets
- $73,100 (200-day average), then $71,000
- Reward : risk
- ≈1.3 : 1; ≈2.3 : 1 to second
- Stand aside if
- Restart confirmed and BTC reclaims $79,100
BNB ≈$700
- Trigger
- Clean restart and reserve report; BNB funding returns to zero or positive.
- Entry
- Buy a daily close above $720
- Stop
- $690 (below the 200-day EMA at $692)
- Targets
- $755 (pre-hack zone), then $772
- Reward : risk
- ≈1.2 : 1; ≈1.7 : 1 to second
- Stand aside if
- BNB/BTC makes a new low
- Trigger
- Phases slip, reserve gaps or deeper negative funding.
- Entry
- Sell a daily close below $674 (critical support at $674.60)
- Stop
- $703
- Targets
- $620, then $600
- Reward : risk
- ≈1.9 : 1; ≈2.6 : 1 to second
- Stand aside if
- Full reserve report published and BNB back above $700
Driven by whether customers return, whether the stolen ether is sold and whether trading shifts to rivals.
Ether ≈$2,240
- Trigger
- Attacker’s ETH stays dormant or is frozen at venues; Aave markets normal; ETH fund inflows.
- Entry
- Buy a daily close above $2,400
- Stop
- $2,230
- Targets
- $2,600, then $2,800
- Reward : risk
- ≈1.2 : 1; ≈2.4 : 1 to second
- Stand aside if
- Large attacker deposits to exchanges
- Trigger
- Attacker sells ETH; Binance outflows persist; DeFi withdrawals rise.
- Entry
- Sell a daily close below $2,150
- Stop
- $2,330
- Targets
- $1,950, then $1,850
- Reward : risk
- ≈1.1 : 1; ≈1.7 : 1 to second
- Stand aside if
- Daily close back above $2,330 (pre-hack)
Coinbase (COIN) $143.21
- Trigger
- Share gains from Binance; crypto volumes recover; analysts at Cantor, TD Cowen and Compass Point see the sell-off as an opportunity.
- Entry
- Buy a hold of the $139–143 zone (52-week low $139.11); reference $141
- Stop
- $132
- Targets
- $160.60 (29 Oct close), then $174 (Wells Fargo target)
- Reward : risk
- ≈2.2 : 1; ≈3.7 : 1 to second
- Stand aside if
- Daily close below $132
- Trigger
- Volumes stay weak after Q3 revenue fell 34% year on year; crypto sell-off extends.
- Entry
- Sell a daily close below $139 (new 52-week low)
- Stop
- $150
- Targets
- $128, then $120 (Barclays target)
- Reward : risk
- ≈1.0 : 1; ≈1.7 : 1 to second
- Stand aside if
- Close back above $150
Driven by the crypto cycle, regulation, custody reform and whether Binance keeps its place. Wider stops; smaller size.
Bitcoin ≈$76,900
- Trigger
- History: thefts from solvent firms have not set the following year’s direction; ETF demand and self-custody rise.
- Entry
- Accumulate $73,000–77,000 (200-day average to true market mean); reference $75,000
- Stop
- Weekly close below $70,000
- Targets
- $100,000, then $126,080 (all-time high)
- Reward : risk
- ≈5.0 : 1; ≈10 : 1 to second
- Stand aside if
- Weekly close below $70,000
- Trigger
- Contagion, high rates or sustained ETF outflows extend the 2026 bear phase.
- Entry
- Sell a weekly close below $73,000 (200-day average)
- Stop
- Weekly close above $82,000
- Targets
- $66,000, then ≈$57,000 (the June 2026 low)
- Reward : risk
- ≈0.8 : 1; ≈1.8 : 1 to second
- Stand aside if
- Weekly close above $82,000
BNB ≈$700
- Trigger
- Binance pays in full and keeps its share, as Coincheck and Bybit did; a year after the 2023 SEC suit and DOJ plea, BNB was 124% and 139% higher (derived).
- Entry
- Accumulate $674–700; reference $690
- Stop
- Weekly close below $600
- Targets
- $810, then $900
- Reward : risk
- ≈1.3 : 1; ≈2.3 : 1 to second
- Stand aside if
- Weekly close below $600
- Trigger
- Lasting loss of market share, regulatory action or a second incident; a year after FTX, BNB was 27% lower (derived).
- Entry
- Sell a weekly close below $600
- Stop
- Weekly close above $680
- Targets
- $500, then $450
- Reward : risk
- ≈1.25 : 1; ≈1.9 : 1 to second
- Stand aside if
- Weekly close back above $680
Coinbase (COIN) $143.21
- Trigger
- Regulated venues gain share; prediction markets and derivatives diversify revenue; crypto cycle turns.
- Entry
- Accumulate $139–150; reference $145
- Stop
- Weekly close below $120
- Targets
- $187 (JPMorgan target), then $275 (Canaccord)
- Reward : risk
- ≈1.7 : 1; ≈5.2 : 1 to second
- Stand aside if
- Weekly close below $120
- Trigger
- Trading revenue keeps shrinking and the crypto slump deepens.
- Entry
- Sell a weekly close below $139
- Stop
- Weekly close above $165
- Targets
- $120 (Barclays target), then $100
- Reward : risk
- ≈0.7 : 1; ≈1.5 : 1 to second
- Stand aside if
- Weekly close above $165
Related assets to watch
Direction depends on the scenario. No levels are given where reliable reference data was not available.
| Asset | Why it is exposed | If Binance recovers (A) | If confidence erodes (B–C) |
|---|---|---|---|
| Robinhood (HOOD), ≈$85 | Retail crypto trading revenue | Rebounds with crypto volumes | Volumes fall; may gain switching users |
| Strategy (MSTR), ≈$130.5 | Leveraged proxy for bitcoin | Outperforms BTC on the way up | Falls faster than BTC |
| Circle (CRCL), ≈$72.5 | USDC issuer; froze ≈$825m of stolen funds | Recovers with risk appetite | Pressure from reimbursement-related stablecoin redemptions (Compass Point) |
| Bullish (BLSH), ≈$23.9 | Rival exchange | Little change | Possible share gains (CoinDesk) |
| UNI, HYPE | Decentralised venues | Recover with the market | Kendrick (Standard Chartered) expects a shift to DEXs |
| BTC/BNB, BNB/ETH | Relative value: the market vs the exchange | BNB outperforms as discount closes | BNB underperforms |
Risk notes. These are conditional scenarios for education, not recommendations. Crypto trades through the weekend, so the first reactions to the restart and proof of reserves will happen before US stock markets open on Monday; equity ideas can open with gaps. Leveraged products magnify losses. Reward-to-risk ratios are measured from entry to stop and first target. Levels are as of 30 October and should be refreshed before use.
When wealth becomes a token
Money, funds, bonds and homes are moving onto blockchains. Whether each keeps a master, someone able to freeze, reverse or reassign it, may be the most important design choice in finance.
Tokenisation means representing a real asset, a building, a bond, a fund share, a bar of gold, as a token on a blockchain. The promise is real: settlement in minutes rather than days, trading at any hour, fractions small enough for small investors, and a public record that cannot be quietly altered. The market is still small but growing quickly. Estimates of tokenised real-world assets, excluding stablecoins, range from about $33 billion (RWA.xyz, July 2026) to about $39 billion (Stobox, September 2026), depending on what is counted; broader measures are far larger. BlackRock’s BUIDL and Franklin Templeton’s BENJI, both tokenised money-market funds, are among the largest products.
Property is following. On 19 March 2025, the Dubai Land Department launched a pilot with the Virtual Assets Regulatory Authority, becoming, by its own description, the first real-estate registration authority in the region to tokenise title deeds. Tokenised deeds are issued on the XRP Ledger, with Ripple providing custody technology to its partner Ctrl Alt (source: Banking Exchange). In February 2026 the department opened phase two, letting about 7.8 million property tokens be resold on a regulated secondary market from 20 February, and it expects tokenised property to reach about Dh60 billion ($16 billion), or 7% of Dubai’s property transactions, by 2033 (source: The National). In the United States, a Florida home was sold in February 2022 as a non-fungible token for 210 ether, about $653,000 (source: The Block).
Money, with and without a master
Tokenisation is not only changing what we own; it is changing what money is. Stablecoins, dollar tokens issued by private companies, reached about $300.9 billion in supply by 1 October 2026 (source: RWA Foundation via Bitget News). Banks are following: in November 2025 JPMorgan made JPM Coin (JPMD), a token representing its own dollar deposits, available to institutional clients on Base, a public blockchain, with round-the-clock, near-instant settlement (source: The Block). Tokenised money-market funds pay interest while sitting in a wallet. Each of these changes wealth in the same ways: it never closes, it moves across borders in seconds, it can be split into tiny fractions, and it can be programmed to pay, lend or settle automatically.
What separates them is the question in this article’s title. Some tokens keep a master, an issuer, bank or registry that can freeze, reverse or reissue them on a court’s order. Others have none. That is why Tether and Circle could freeze billions of the Binance haul within hours, and why no one could freeze a single one of the 18,270 bitcoin that left at the same time.
The master spectrum
Editorial classification of tokenised money and wealth by who, if anyone, can intervene after a transfer.
| Form | Who is the master? | Can a theft be frozen or reversed? | Example or scale |
|---|---|---|---|
| Native crypto | No one: only the key | No | Bitcoin, ether; 18,270 BTC from Binance unfrozen |
| Stablecoins | The issuing company | Frozen, yes; reversed, only by reissue | ≈$300.9bn supply (Oct 2026); ≈$2.6bn of Binance haul frozen |
| Bank deposit tokens | The bank, under banking law | Yes, within the bank’s own system | JPMorgan’s JPMD (Nov 2025) |
| Tokenised funds and bonds | Fund manager or transfer agent | Yes, through permissioned token rules | BlackRock BUIDL, Franklin BENJI |
| Tokenised property | The land registry, if the token mirrors it | Yes, if the register stays the legal record | Dubai: Dh60bn target by 2033 |
The trade-off is unavoidable Analysis. The further an asset sits toward “no master”, the freer it is from censorship, inflation by decree or confiscation, which is exactly why many holders value bitcoin. The same freedom makes theft final. The further an asset sits toward “a master”, the more it can be protected, frozen and returned, at the price of trusting whoever holds that power. Tokenisation does not settle this argument. It forces every owner, and every issuer, to choose a side, often without realising it.
Is the token the house, or a picture of the house?
Everything depends on what the token legally is. There are, broadly, three designs, and they carry very different risks of theft.
Three ways to put a house on a blockchain
Editorial classification. Real projects mix features; terms vary by jurisdiction.
| 1 · Bearer token | 2 · Wrapper token | 3 · Register mirror | |
|---|---|---|---|
| What the token is | The ownership itself; whoever holds it owns the asset | Ownership of a company that owns the house | A reflection of an official register, which remains the legal truth |
| Who can reverse a theft? | No one | Courts, through the company, slowly | The registry or issuer can freeze and reissue the token |
| If your key is stolen | The house is effectively gone | Legal fight; outcome uncertain | Prove your identity; the stolen token is cancelled |
| New weak point | The key | The gap between chain and company law | The recovery desk, and anyone who can impersonate you to it |
| Closest example | Native crypto | Early property NFTs | Dubai’s DLD model; ERC-3643 permissioned tokens |
The third design is where most serious tokenisation is heading, and it answers the question at the start of this article. Under permissioned standards such as ERC-3643, an authorised agent, typically the issuer or a regulated transfer agent, can freeze a wallet, force a transfer to execute a court order, and reissue tokens to a new wallet after the owner proves their identity. In that model, “the issuer’s register, not the wallet, is the legal record” (source: Stobox). A stolen token can be cancelled, much as a stolen share certificate could be.
That protection comes with a twist Analysis. If an owner who loses a key can recover the house by proving who they are, then an attacker who can pretend to be the owner can do the same. The recovery desk becomes the new vault door, and Age VI says that voices, faces and documents can now be faked. Meanwhile, custodians that hold keys for thousands of tokenised assets become what Binance’s hot wallets were on Thursday: a single, very large target. The paper deed, it turns out, was not just a record. It was friction, and friction bought time for humans to notice that something was wrong.
Where a tokenised house can be stolen
Layers of a typical tokenised property, from law to person. Editorial.
Tear the note into ten pieces
Will exchanges change the way they authorise withdrawals so that breaching any one place is worthless?
Imagine tearing a banknote into ten pieces and storing each piece in a different city. A thief who breaks into one city gets a scrap of paper. Only someone who gathers enough of the pieces can rebuild a note worth spending. That is the logic behind the next generation of crypto custody, and the Binance breach is likely to accelerate it Analysis.
A token on a blockchain cannot literally be torn: one bitcoin is one bitcoin. What can be torn is the authority to move it. Cryptographers have known how since 1979, when Adi Shamir published a method for splitting a secret into parts so that any agreed number, say seven of ten, can reconstruct it while fewer reveal nothing. Modern versions, known as multi-party computation (MPC) and threshold signatures, go further: the full private key never exists in one place at all. Each party holds a share, each signs its part independently, and the shares combine into one valid signature. Many exchanges and custodians already use such systems for their cold storage.
Seven of ten: how a threshold key works
Illustrative. Each share sits with a different person, device or location. Seven valid partial signatures are needed to move funds; a thief holding three has nothing usable.
Result: 3 shares captured, 7 required. Funds cannot move.
So why did Binance and Bybit still lose billions? Because splitting the key protects the key, not the decision to use it. Bybit’s cold wallet required several signers, and all of them approved a transaction whose true content had been disguised by compromised software. At Binance, the attacker reached the service that prepares and submits withdrawals, so the signing machinery did exactly what it was built to do. The weak point moved from the vault to the assembly line, the place where the pieces of authority come together.
The next step is to split the value as well as the key, and to make every piece-holder think independently. In practice that means several measures working together:
From one big vault to many small ones
Editorial assessment of custody designs and what a single breach would yield.
| Design | How it works | A single breach yields… | Weak point |
|---|---|---|---|
| Single hot key | One key signs everything | Everything in the wallet | The key |
| Multisig | Several keys must sign | Nothing, unless signers are fooled together | A shared, compromised interface (Bybit) |
| MPC / threshold signing | Key exists only as shares | Nothing, unless the signing workflow is hijacked | The service feeding requests (Binance) |
| Independent policy at each share | Each share-holder checks the transaction itself against its own rules and limits | Nothing, unless most holders are compromised separately | Collusion; cost; speed |
| Sharded value with limits | Balances spread across many vaults, each with time locks and per-hour caps | One vault’s fragment, capped and delayed | Slower large withdrawals |
The combined effect is the one described by the torn note: a breach of any single location, person or service yields only a capped, delayed fragment, while assembling enough fragments would require compromising many independent parties at once. The cost is convenience. Large withdrawals would take longer, exchanges would need more people and machines, and some of the instant, round-the-clock liquidity that crypto users expect would be traded for safety. After a $6.3 billion lesson, many institutions may decide that is a price worth paying.
An exchange that holds nothing worth stealing
What if trading venues stopped holding the asset at all, and relied instead on proof that you own it, like a bank guarantee?
In traditional trade finance, a company that wants to buy goods abroad does not ship cash to the seller. Its bank issues a guarantee or a letter of credit: a promise, backed by the bank, that the money exists and will be paid. The seller trusts the guarantee, not a pile of cash in its own warehouse. Applied to crypto, the idea is simple and powerful. An exchange would not need to hold your bitcoin. It would only need trustworthy proof that the bitcoin exists, is yours and is locked for settlement somewhere else.
This is already happening among institutions. Under off-exchange settlement, a client’s assets stay with an independent custodian, and the exchange sees a mirrored balance that can be traded against. Copper’s ClearLoop, which connects exchanges including OKX, Bybit, Deribit and Bitget, is reported to handle more than $50 billion of monthly notional trading volume (source: BeInCrypto, April 2026). Ceffu, Binance’s affiliated custodian, runs a service called MirrorX: assets remain in Ceffu’s custody, secured by multi-party computation, and are mirrored to Binance sub-accounts, with positions settled once a day (source: Ceffu). Assets held this way were not in the hot wallets that were drained on Thursday Analysis.
Two ways to trade
Simplified. In the second model, a breach of the exchange reaches trading balances, not the underlying assets.
Exchange custody
- Where the asset sits
- In the exchange’s own hot and cold wallets
- What the exchange knows
- Everything, because it holds everything
- If the exchange is breached
- The assets themselves can be taken
- Speed
- Instant
Proof instead of possession
- Where the asset sits
- With an independent custodian, a bank or the owner’s own wallet
- What the exchange knows
- A verified, locked balance it can trade against
- If the exchange is breached
- Trading positions are at risk; the assets are elsewhere
- Speed
- Trading instant; settlement periodic
The longer-term version goes further Analysis. Cryptographic “zero-knowledge” proofs could let an owner prove they hold an asset without revealing or moving it. Tokenised money-market funds and bonds could serve as collateral while earning interest elsewhere. Settlement could become atomic, with both sides of a trade exchanged in the same instant, so no venue ever holds a large pool of other people’s money. In that world, attacking an exchange would be like robbing a notary’s office: you might steal records, but not the property they describe.
What an attacker gets from breaching one layer
Editorial assessment.
| Layer breached | Today, with exchange custody | With proof-based settlement |
|---|---|---|
| Exchange servers | Hot wallets, potentially billions | Trading balances, unsettled gains |
| Custodian | Not involved | Assets, but protected by split keys and separate controls |
| Proof or settlement layer | Not involved | The ability to fake balances: a new target |
| The owner | Their exchange login | Their own keys or custody access |
Every design moves risk rather than abolishing it. The custodian becomes the new concentration of value, which is why its own keys must be split. Daily settlement leaves a window in which an exchange extends credit against assets it does not hold. And the proof layer becomes the new prize: if an attacker can forge a convincing proof of assets, the exchange will trade against value that does not exist, a digital version of Alves dos Reis’s genuine-looking notes. The direction of travel is still clear. Each layer would hold less on its own, and stealing anything significant would require breaching several independent layers at once. For most attackers, that is the point at which the effort stops being worth it.
Cheaper attacks, stronger codebreakers, and the reality problem
Two technologies could change the economics of theft: one is already here, the other is getting closer.
Artificial intelligence lowers the cost of attack. Every stage of a modern heist is becoming cheaper and faster: researching staff on social media, writing a convincing recruiter message in perfect English, cloning a chief executive’s voice, scanning public code for vulnerabilities, and moving stolen coins through hundreds of addresses. Work that once needed a skilled team can increasingly be done by a small group directing AI tools. Deloitte expects generative AI to push US fraud losses to $40 billion by 2027. Defenders use the same tools to spot unusual withdrawals, simulate transactions before signing them and flag synthetic identities. The likely outcome is not that one side wins, but that attacks become more frequent and more personalised, and that defences must become automatic.
AI on both sides
Editorial summary.
| Stage | How AI helps attackers | How AI helps defenders |
|---|---|---|
| Reconnaissance | Profiles staff and suppliers at scale | Maps exposure before attackers do |
| Entry | Tailored phishing, fake recruiters, deepfaked calls | Detects synthetic voices, faces and messages |
| Exploitation | Finds bugs in public smart-contract code | Audits code and simulates transactions before signing |
| Theft | Automates draining across many chains | Flags abnormal withdrawals in real time |
| Laundering | Optimises routes through swaps and bridges | Traces flows and alerts issuers to freeze |
Quantum computing could one day break the locks themselves. Bitcoin and Ethereum secure ownership with elliptic-curve signatures, which are practically impossible for today’s computers to reverse. A large enough quantum computer running Shor’s algorithm could work out a private key from its public key. In March 2026, researchers from Google Quantum AI, with co-authors including the Ethereum Foundation’s Justin Drake and Stanford’s Dan Boneh, estimated that fewer than 500,000 physical qubits could break Bitcoin’s signature scheme, about twenty times fewer than earlier estimates, and that such a machine could crack a key in roughly nine minutes, less than Bitcoin’s average block time (source: Forbes). Google’s largest chip, Willow, has 105 qubits, so the gap is still large. Drake nevertheless put the chance of a quantum computer recovering a key from an exposed public key by 2032 at 10% or more.
Quantum risk matters for this article in a specific way. A coin is exposed only once its public key has appeared on the blockchain, which happens when an address is reused or for certain older address types. Exchanges, which recycle hot-wallet addresses constantly, are among the most exposed holders. A working quantum computer would let an attacker take coins from such addresses without hacking a laptop, bribing an insider or faking a voice: the theft would need nothing but mathematics. The defences are known. Post-quantum signature standards were published by the US National Institute of Standards and Technology in 2024, and Bitcoin and Ethereum developers are working on migration paths, but moving millions of coins to new address types is a slow, coordinated process, and some coins whose owners have lost their keys may never move at all. There is also a quieter risk, known as “harvest now, decrypt later”: attackers can record public keys today and wait for the hardware to catch up.
The reality problem
A blockchain is extraordinarily good at one thing: proving that a particular key approved a particular transaction at a particular time, and that no one has changed the record since. It cannot tell whether the person behind the key was coerced, impersonated or a piece of malware on an engineer’s laptop. As more of life’s proofs become digital, this creates an uncomfortable possibility. The record of ownership becomes more trustworthy than ever, while the identity of the person behind it becomes less certain than ever.
Consider three illustrative situations, each an extension of something that has already happened Analysis. A homeowner’s cloned voice and synthetic video call a token issuer to report a “lost key”; the issuer reissues the house to a new wallet. A deepfaked chief financial officer instructs a treasury team to move tokenised bonds to a “new custodian”. An AI agent with authority to trade on a fund’s behalf is manipulated by a crafted message into signing a transfer. In each case, every system works as designed. The record is perfect. The reality is not.
What could restore trust
Defences in use or under development. Editorial assessment of strengths and limits.
| Defence | How it works | Limit |
|---|---|---|
| Multi-party approval | Several independent people or devices must sign large transfers | Bybit’s signers all approved a disguised transaction |
| Time locks and delays | Large transfers wait hours or days, allowing a cancel | Slows legitimate business; attackers wait too |
| Freezable, recoverable tokens | Issuers can freeze and reissue after a theft | Reintroduces a central authority; recovery can be spoofed |
| Out-of-band verification | Confirm requests through a separate, known channel | Fails if the channel is also compromised |
| Content provenance | Cryptographically signed photos, video and documents | Only proves where content came from, not that it is true |
| Proof of personhood | Credentials proving a unique, live human | Privacy concerns; new databases to steal |
| Legal finality layer | Courts and registers keep the last word over the chain | Slow, national, costly |
None of these is complete on its own. The likely future Analysis is a hybrid: blockchains for speed and transparency, legal registers for the final word, and deliberate friction, delays, limits, second confirmations, reinserted exactly where large or irreversible value moves. The irony is hard to miss. The technology built to remove the need for trusted intermediaries is, for the most valuable assets, likely to bring some of them back.
The chain can prove that a key signed. It cannot prove that a person meant it.
New rules for owning anything
Six ages of theft distilled for investors, institutions and anyone whose home may one day be a token.
Practical checklist
| For | What to do |
|---|---|
| Individuals | Keep only trading balances on exchanges; understand any self-custody you use; treat “support” calls during incidents as likely scams; with tokenised property, read who can freeze and recover the token. |
| Traders | Size leverage for exchange outages; keep collateral on more than one venue; watch funding and liquidation levels around restarts. |
| Institutions | Use third-party custody and off-exchange settlement; demand liability-inclusive attestations; test withdrawal paths; require out-of-band confirmation for large transfers. |
| Issuers of tokenised assets | Keep the legal register as the final record; make recovery require several independent checks, not one video call; add time locks on high-value transfers. |
| Regulators | Require segregation, audited reserves and incident-disclosure deadlines; coordinate freezes across issuers and borders; set standards for identity in recovery processes. |
Money without a master
The money is the headline. Who commands it is the story.
The Binance breach is the largest theft in crypto history and probably the largest single theft from any financial institution. It also completes a long arc. The Brink’s-Mat robbers needed a van for three tonnes of gold. Alves dos Reis needed a printing press that was not his. Levin needed a password. The Binance attacker needed a laptop and the patience to wait until a trusted system signed on its behalf. At each step, theft moved further from the object and closer to the proof.
On the evidence available on 30 October, Binance looks like a solvent victim rather than a hidden hole: the loss is under 8% of users’ holdings of the worst-hit asset, about half has been frozen, about 80% has been replaced, and a restart and reserve report are promised within days. If those promises are kept, history points to a sharp but temporary market shock. If they slip, the comparison will move toward something less comfortable.
The larger story will outlast the weekend. As homes, bonds and funds become tokens, ownership gains speed and transparency, and loses the friction that once gave people time to notice a lie. In a world where a voice, a face, a document and a signature can all be produced on demand, the hardest problem in finance may not be storing value. It may be proving, quickly and convincingly, what is real and whose it is, and deciding, asset by asset, whether wealth should have a master at all.
Money without a master obeys only the key. The question for every owner is who is holding it.
The ledger of six ages
Thirty-six incidents across six ages. Amounts at the time, rounded.
The ledger
Filter by age. Types: theft, forgery, insider, fraud, data breach, ransomware, deepfake.
| Year | Incident | Age | Type | Amount | What was attacked | Outcome |
|---|---|---|---|---|---|---|
| 1963 | Great Train Robbery, UK | I | Theft | ≈£2.6m in notes | A mail train | Most of the money never recovered |
| 1971 | D.B. Cooper, US | I | Hijacking | $200,000 ransom | A passenger jet | Never identified; $5,800 found in 1980 |
| 1978 | Lufthansa, JFK airport, US | I | Theft | ≈$5.875m | A cargo vault, with an inside tip | Money never found; one conviction |
| 1983 | Brink’s-Mat, London | I | Theft | ≈£26m in gold | A warehouse vault, with inside help | Gold largely smelted and lost |
| 1990 | Isabella Stewart Gardner Museum, Boston | I | Theft | 13 works, ≈$500m | Guards, by thieves dressed as police | Unsolved; $10m reward |
| 1997 | Dunbar Armored, Los Angeles | I | Insider theft | $18.9m | A depot, via a fired inspector’s keys | ≈$13.9m never found |
| 2003 | Antwerp Diamond Centre | I | Theft | ≈$100m+ in gems | A vault thought impregnable | Leader convicted; gems not recovered |
| 2003 | Central Bank of Iraq | I | Insider removal | ≈$920m | Cash reserves | ≈$650m later found |
| 2005 | Banco Central, Fortaleza | I | Theft | ≈$70m | A vault, via a 78 m tunnel | Part recovered; arrests |
| 1925 | Alves dos Reis, Portugal | II | Forgery | 100m+ escudos | The central bank’s own printer | Republic fell in 1926; 20-year sentence |
| 1925 | Victor Lustig, Paris | II | Fraud | The Eiffel Tower, “sold” | Official papers and authority | Buyer too embarrassed to report |
| 1942 | Operation Bernhard, Germany | II | State forgery | £130m+ face value | A national currency | Notes surfaced for years after the war |
| 1989 | North Korean supernotes | II | State forgery | Undisclosed | The $100 bill | US sanctions on Banco Delta Asia (2005) |
| 1995 | Barings, Singapore | III | Unauthorised trading | £827m loss | Internal controls | Bank collapsed; sold for £1 |
| 2008 | Société Générale, Paris | III | Unauthorised trading | €4.9bn loss | Risk limits, fictitious trades | Bank survived with new capital |
| 2008 | Madoff, New York | III | Fraud | $64.8bn on statements | Client statements | ≈$17.5bn principal lost; $14bn+ recovered |
| 2020 | Wirecard, Germany | III | Fraud | €1.9bn missing cash | Audited trust accounts | First DAX member to go insolvent |
| 2022 | FTX, Bahamas | III | Misuse of customer funds | ≈$8bn shortfall | Customer balances | Bankrupt; founder sentenced to 25 years |
| 1994 | Citibank | IV | Cyber theft | $10m+ moved | Corporate cash-management logins | Most frozen; hacker arrested 1995 |
| 2013 | Carbanak and Cobalt | IV | Cyber theft | Up to €1bn | Bank staff computers and ATMs | Alleged leader arrested 2018 |
| 2016 | Bangladesh Bank | IV | Cyber theft | $81m lost of $951m requested | SWIFT payment messages | North Korean programmer charged |
| 2017 | Equifax | IV | Data breach | Data of ≈147m people | Unpatched web software | Settlement of up to ≈$700m |
| 2023 | ICBC Financial Services | IV | Ransomware | Not disclosed | Treasury clearing systems | Trades disrupted; parent stepped in |
| 2025 | Coinbase | IV | Insider bribery, data breach | $180–400m estimated cost | Support contractors | $20m extortion refused |
| 2012 | Silk Road (James Zhong), US | V | Exploit | 50,000+ BTC | A withdrawal bug | Found in a popcorn tin in 2021; seized |
| 2014 | Mt. Gox, Tokyo | V | Theft and mismanagement | ≈850,000 BTC | Hot wallets and records | Bankrupt; repayments from 2024 |
| 2016 | Bitfinex | V | Exchange hack | 119,754 BTC | Exchange wallets | ≈94,000 BTC seized in 2022; returned to Bitfinex |
| 2016 | The DAO | V | Code exploit | 3.6m ETH | Smart-contract logic | Reversed by an Ethereum hard fork |
| 2018 | Coincheck, Tokyo | V | Hot-wallet theft | ≈$530m | A single-signature hot wallet | Customers repaid; bought by Monex |
| 2022 | Ronin bridge | V | Key theft | ≈$620m | Five of nine validator keys | Users reimbursed |
| 2025 | Bybit, Dubai | V | Supplier compromise | ≈$1.46bn | A wallet-software developer | Losses replaced within days |
| 2026 | Bitget | V | Signing compromise | $388m | A third-party security product | Covered; phased restart |
| 2026 | Binance | V | Signing compromise | ≈$6.3bn | An engineer’s laptop and signing systems | ≈$3bn frozen; Binance covering losses |
| 2019 | UK energy firm | VI | Voice deepfake | ≈€220,000 | A chief executive’s voice | Funds moved on before discovery |
| 2021 | UAE bank (revealed) | VI | Voice deepfake | ≈$35m | A company director’s voice, with fake emails | Investigation across several countries |
| 2024 | Arup, Hong Kong | VI | Video deepfake | HK$200m (≈$25.6m) | A whole video meeting of colleagues | Reported to police; 15 transfers made |
For informational and educational purposes only. Not financial or legal advice. Crypto assets and leveraged products are volatile. Binance facts are as of about 21:00 UTC on 30 October 2026 and are changing quickly; check Binance’s latest announcements. Historical price moves are derived from Coin Metrics daily reference prices and do not predict future moves. Scenario judgements, classifications and thresholds are editorial. Legal treatment of forged deeds and tokenised property varies by jurisdiction.
Binance incident: TRM Labs, “North Korea Steals USD 6.36 Billion From Binance” (29–30 Oct 2026); Cointelegraph live updates (29–30 Oct 2026); Binance statements and notices via Fox Business/Reuters, The Hacker News, Winbuzzer, PANews, TechFlow and CryptoTicker; Elliptic and Chainalysis estimates; Bloomberg, CNBC, CoinDesk market reports (30 Oct 2026); CryptoQuant data via Ruga Research; Binance proof of reserves, Aug 2026, via The Cryptonomist.
Tokenisation: The National, “Dubai property tokenisation” (9 Feb 2026); Cointelegraph, Dubai pilot (20 Mar 2025); Banking Exchange, Ripple and Ctrl Alt (16 Jul 2025); Stobox, “Forced transfers and lost keys on a security token” and State of RWA 2026; RWA.xyz via OneBullEx (26 Oct 2026); ERC-3643 documentation; The Block, Propy sale (13 Feb 2022); HousingWire, FBI on home title theft (15 Apr 2025).
Deepfakes and AI fraud: CNN on Arup (16 May 2024); Gizmodo citing Forbes on the UAE voice-clone case (14 Oct 2021); Surfshark deepfake fraud losses (8 Jul 2025); Deloitte Center for Financial Services (29 May 2024).
Cold cases and US incidents: FBI on D.B. Cooper (2016); Lufthansa heist court records and reporting (1979, 2015); Dunbar Armored case records; Isabella Stewart Gardner Museum and FBI; Fortune on James Zhong (14 Apr 2023); Infosecurity Magazine and CNBC on Ilya Lichtenstein’s release (Jan 2026); CoinDesk on Bitfinex restitution (17 Apr 2026); The Business Standard on Bangladesh Bank v RCBC (4 Mar 2024); Cointelegraph on Bybit traceability (21 Apr 2025); Quote Investigator on Willie Sutton (2013).
Tokenised money: RWA Foundation stablecoin data via Bitget News (1 Oct 2026); The Block on JPMorgan’s JPM Coin (12 Nov 2025).
Laundering and future security: Global Ledger H1 2025 laundering report via GCFFC (15 Aug 2025); Chainalysis 2025 crypto crime data; Ceffu, “Understanding Off-Exchange Settlement”; BeInCrypto on off-exchange custody (10 Apr 2026); Forbes on Google Quantum AI’s Bitcoin paper (31 Mar 2026); BIT Knowledge Hub on quantum-exposed bitcoin (12 Oct 2026); NIST post-quantum standards FIPS 203–205 (Aug 2024); Shamir, “How to Share a Secret” (1979).
History: PMG, “The Portuguese Bank Note Crisis of 1925”; CoinWeek on North Korean supernotes; FBI, “A Byte Out of History: $10 million hack”; Europol on Carbanak and Cobalt (2018); US Justice Department indictments (Lazarus Group, 2018 and 2021); Bank of England Board of Banking Supervision report on Barings (1995); court and trustee records on Madoff (SIPA trustee); Wirecard insolvency filings (2020); US v. Bankman-Fried (2023); Chainalysis 2025 crypto crime data via The Record; FBI on Bybit (Feb 2025) and DMM Bitcoin (Dec 2024); The Block on Bitget (Sep 2026) and FTX distributions; Cointelegraph on Mt. Gox (Oct 2026); contemporaneous reporting on Brink’s-Mat, the Great Train Robbery, Central Bank of Iraq, Banco Central Fortaleza, Société Générale, Coincheck, Ronin and Equifax. Price data: Coin Metrics community data.
