ROLLUP: Blue Wave, Black Swan | $6B Binance Heist | French Bank Robbed | ETH Goes Quantum-Proof

Ryan: Bankless Nation, it's the first week of November. We got a blue wave and a black swan. We got the midterm results in first. The markets hated the Democrat sweep. Then it loved it the day after the midterms. And now on Thursday morning, we are seeing some of the worst selling that we have seen in many, many years. The worst decline in both the NASDAQ and the S&P since something like 2018. In just the first 40 minutes of trading, the S&P 500 has erased $2 trillion in market cap. There was a midterm rally right after the midterms got over, and that's all completely gone. Crypto is getting hit as well, but I would say not as bad.

David: Was this because of the midterms, or was this the AI bubble popping, or was this something else? I don't know, Ryan. It seemed like we were just out of the woods on the crypto side from the biggest hack in crypto history and the biggest heist ever. The $6 billion Binance hack that happened last Friday. Crypto went down, then it was recovering, things looked good, and now we have this AI sell-off to contend with. But we got to go over the details of the Binance hack and put it in a historic context and actually go through the retrospective of what happened. And it also wasn't just a crypto bank that was hacked last week. A regular bank was hacked as well, and they used crypto as their getaway car. I want to tell you about this because last week we posed the question: can this type of thing happen to traditional banks, fiat? I thought trad banks are safe. They're not safe.

Ryan: Okay, I want to give you the story of how hackers got in, what they did with the funds, and what's going to happen next. Also, it's Ethereum DevCon happening in Mumbai, India at the moment. So we get to go down onto the ground, get some takes from people who are there on the streets. There were updates to the lean roadmap for Ethereum from Justin Drake, making Ethereum post-quantum even sooner. We got updates from Layer 2s and also just a sample of what Ethereum and Vitalik are focusing on from the DevCon keynote that we get every single DevCon. But first, we got to just talk about the markets. Markets can't seem to make up their mind.

David: Yeah, there was a Democrat sweep, of course. This is the blue wave. The Senate flipped in favor of the Democrats. Fifty-four senators elected, I think, two other seats in contention. That is a healthy majority. Also, the House flipped blue as well. So there's a full sweep of both chambers. Pretty historic win, both chambers flipping in this way. And also the governor races. Definitely this was a blue wave. Some calling it a blue tsunami. I don't know if I'd go that far, but this is definitely the Democrats pushing back against recent Republican gains.

Ryan: I think the answer to why is probably everyone kind of knows this seemed like a self-inflicted wound from the Trump agenda. I think DC Investor had a take where he just said, look, people aren't into the war, energy prices going up, CPI going up. It seemed like Trump wasn't focused on affordability. Trump had a mandate and he just floundered all of it.

David: Yes. So even on things like border security, which was somewhat popular, the way it was implemented, ICE in cities with masks and people. I mean, this seemed like it was coming and certainly Democrat voters showed up for it. But the question as to what's going on in the markets is still to be determined. In fact, Ryan, maybe we should pull up some charts because a lot of this is playing out in real time. But you started by saying this was one of the largest crashes that we've seen in recent memory on the S&P, at least in terms of volume and time scales here.

Ryan: Yeah, I keep having to update my numbers on the S&P, but in the last just day and a half of trading, the S&P is down 4%. 4% is just gargantuan for the S&P. That takes it all the way back to June 2026 prices. But just the level of red on this candle, it's straight down, straight down. And the QQQ NASDAQ is even worse because NASDAQ is just so heavily tech oriented. NASDAQ is down 6%, taking it all the way back to April 2026 prices. And then you can kind of zoom into specific sectors. State Street Tech Sector ETF is down 7%. Semiconductors, SOXX, is down 12%, just an index of semiconductors. And then we can get into some individual names like NVIDIA. NVIDIA down 8.6%. Intel down 7%. But not only is Intel down 7%, but Intel is off of its all-time highs by 61%. MU Micron, just an AI build-out favorite, down 14% on the day, but also just down 45% from its all-time highs.

David: There are some assets that I think are getting buffered from this massive sell-off. Like Amazon is down 2%, but on the week it's flat. Google's down 1.5%, but it hasn't gone down since it reported its earnings. Apple's actually doing okay. So if you're an Apple hoarder, you're down 1.5%, but you're at near all-time highs. So the AI infrastructure build-out companies are just getting absolutely walloped. A lot of the AI spenders, Amazon, Google, these aren't doing so bad, even though the whole market is down this week. And so I think you could definitely say that this is an AI bubble popping, as well as you have some actual specific assets that are selling off specifically because of the Democrat blue wave, and these would be all the Elon assets. So Tesla's down really, really bad.

Ryan: I would say it's still too early on this Thursday to call this an AI bubble pop. It does seem like a correction.

David: It's been correcting though. Micron down 60%, Intel down 40% from its all-time highs.

Ryan: Absolutely, but these sectors have had tremendous gains. I guess in general, we're back to what, summertime in the S&P, summertime in the NASDAQ?

David: Yeah, so if you're an AI build-out like Semi or like Micron doing selling memory, you're back as bad as possible, which is back to April. If you're a Google, if you're an Amazon, you're back to like June. It's weird, though. It's hard to call the market reaction a result of the blue wave because it was originally up, right? So we had kind of a run-up. We had a very green day that everyone was like, oh, it turns out getting kicking Trump's chaos out of office is actually good for a variety of reasons. This morning, Thursday morning, everyone changed their mind. Everyone just suddenly changed their mind.

Ryan: Well, my attitude is that there was an AI tech stock sell-off going into the midterms and then midterms took center stage and we focused on that. And now that midterms are in the rearview mirror, people still want to sell tech stocks.

David: I guess so. There were some specific losers like the Trump media asset was down like 30%. Even this was on the back of the election results. I wonder what it's at this morning. And then there's also the Trump meme coin. Don't look at that chart. That chart is down 30% post the blue wave. And as I kind of said, like Tesla and SpaceX, while everything else was rallying post midterms, Tesla and SpaceX were down bigly just because Democrats are going after Elon. So there were specific assets that did respond as you would expect them to the blue wave. Overall, though, you can kind of just look at the AI industry and see that the AI buildout assets have been down the most.

Ryan: All right. So AI markets in carnage. Let's talk about our beloved crypto assets, because it seemed like on Wednesday we were out of the woods. We just survived this Binance hack. Somehow, some way, we were above on Bitcoin the 50-week moving average, which has been a key. We're in early bull cycle territory. We somehow stayed above that. Now, where are we at the time of recording? What's Bitcoin price?

David: Yeah, post-midterms, Bitcoin jumped up to above 80,000. So we got above 80,000 for a moment, almost touched 81,000. And now we have set a new low, just a smidge of a new low, but a new low nonetheless of $75,500. We're up to $76,000 right now. Maybe the worst is over.

Ryan: Do you know what the 50-week moving average is, David? Tell me.

David: It's right at 76.

Ryan: 76?

David: Yeah, right at 76. 75.9 or something like that.

Ryan: There it is. Yeah, there it is. So we're just hanging above it. Galaxy's Alex Thorne talked about the 50-week moving average. Michael Nadeau from the DeFi Report talks about the 50-week moving average. In previous early bull cycles, we've always stayed above that. And even in the Binance hack, we were kind of bouncing on that 76k number. We bounced back up to 80, which is a bullish indicator. Now we survive that. The question is, are we going to be able to survive the AI sell-off with the Bitcoin bull market above the 50-week intact?

David: Yeah, not all assets kind of responded the same. So Bitcoin set a new local low. ETH did not. ETH actually has performed better than Bitcoin on the week. I think Bitcoin is down like 2% or 3% on the week, and ETH is kind of flat on the week. Zcash as well is kind of holding its own at the moment. We'll see if that continues to play out. Overall, I would say crypto has fared this sell-off. It's gone down, but I wouldn't say it's gone down uniquely. And so as a crypto holder, I'm somewhat pleased that prices are a little bit more favorable. But my industry, my assets aren't getting hammered specifically.

Ryan: I was ready to come into this episode fully bullish before the sell-off this morning, which was just like, oh my God. I was expecting after the largest crypto exchange gets hacked, which by the way we'll talk about in a little bit, I would expect to be down like 15%, down 20% on Bitcoin in a week. And yet we recovered. And that was like a bullish fact. And now we're back down again. So overall, I would say it just still feels net bullish from a market structure perspective. Of course, if there was a massive AI sell-off, Bitcoin and crypto are going to take it on the chin for a bit. But there's still a lot of strength here in the numbers I'm seeing. And the Binance hack and our recovery from that really proved that.

David: Right. Resting on the 50-week moving average means that you're getting a great deal, but also we could break through it and it could be even worse. The AI sell-off could continue. Ben Cowan could be right. We could set a new actual low. Place your bets. I think there's more to talk about with the Dems. Now that the Dems are in power, are they going to come after crypto? Are they going to mess us up and get some retribution?

Ryan: Before we talk about that, though, we've got to talk to our friends and sponsors over at Near AI. They have a new product called Near AI Red. And this is for people who don't have access to things like OpenAI or Anthropic's top tier coding models, because you are not on the inside of the AI tech elite. You are not given permission to have uncensored coding models to defend your systems. If that's you, if you're on the outside, Near AI Red is what you need. It is uncensored, obliterated models with all the safety restrictions removed so you can defend your systems against AI attackers. So don't get refused by your AI provider while trying to protect yourself. Use Near AI Red and keep your shit secure. There is a link in the show notes.

David: Ryan, you sent me this meme right before we started recording. Is this an actual Warren Buffett quote? This is the funniest meme I have seen in forever. It is, for the listeners, a picture of Warren Buffett with a quote next to him saying, "Freak the fuck out and sell everything right now. It's fucking over." It's so funny how in this market, the VIX is hitting like 2018 highs, but we are whipsawing from "oh, we're so back" to "it's so over" in 24 hour increments. So maybe Warren Buffett has some good advice for us.

Ryan: All right. So with Democrats back in charge of Congress, the question is, what does that mean for crypto? Are they going to come and fuck up crypto? There's a number of different takes on this, David, and I'd love to get yours. First of all, we should probably zoom out and say the structure of a Republican president and a Democratic sweep where it's sort of divided. You have the executive branch, one party, and you have another party with the halls of Congress. Markets have traditionally liked that. They sort of like the standoff. They like the balance of power.

David: The gridlock.

Ryan: Yeah, they like the gridlock. That means no individual—oh, you guys aren't going to get anything done? Thanks. We will take control from here. So traditionally, that has been good. Here's a chart: stocks after the midterm, doing quite well in the three-month, the six-month, nine-month, and the 12-month when it's been a Republican president specifically, and then Democrat-controlled House and Senate. That said, of course, Democrats, at least previous versions of Democrats, you're thinking of maybe Maxine Waters, you're thinking of maybe Senator Elizabeth Warren, they have been fairly hostile to crypto. And we should recall that they are coming back into power with some of these key positions. So Warren leads Senate Banking. She has previously. Waters has been on the House Financial Services. These are former members of the anti-crypto army. So that also seems bearish on its face. So what's your take on this? What's your way in? Do you think this will be okay? Do you think it will be bullish? Do you think it will be bearish for crypto?

David: Well, I think you can kind of sense that the markets are pricing something in. So the Trump tokens, the Trump meme coin, WFLI, and also Trump media assets on the equity side, those are down bad. And I think that Democrats are going to come and seek retribution for Trump using the crypto industry as his grifty piggy bank, just extracting billions of dollars from the crypto industry. I do not think that is the same thing as them coming and cuddling the crypto industry in the same way that they did under the Biden administration with Gary Gensler.

Ryan: You don't think they're just going to be like, "Oh, crypto is corrupt, Trump is corrupt, Trump uses crypto. Let's just nuke all of crypto from orbit. Take it all down."

David: Yeah, I don't think that is happening. What I do think is on the table is that the banks get a second attempt at stablecoin yield with the Clarity Act. And so maybe the banks go into Maxine Waters and Elizabeth Warren and say, "Hey, let's revise the Clarity Act to be more favorable for the banks." I think we could see a round two on the Clarity Act. But in terms of stamping out the crypto industry, I don't see any evidence for that. I think there is no evidence that they want to do that. And I think it's far more likely that they've learned their damn lesson. They got walloped by crypto. And their political battles—I know crypto was kind of trying to get some political wins, right? Like the Elizabeth Warren graphic, "I'm recruiting an anti-crypto army," that wasn't really smart calculus by her then. And it's even worse calculus to do something like that now. AI is the bigger fish to fry. So why would they go out of their way to come after crypto? I don't think we are very high up on their priorities.

Ryan: I'm not super bullish that Elizabeth Warren has learned her lesson and will not mess with crypto. But I am more bullish on your second point, which is they have bigger fish to fry. I think it'll be an anti-data center army that Elizabeth Warren is recruiting. That is probably the new thing. The other thing I would say is when the anti-crypto army started in 2022, 2023, that era was post-SBF, a different world. The banks and BlackRock and the big financial money that supports a lot of these Democrat legislators were on the sidelines. They had not yet entered crypto. And so their incentive was like, "Hey, slow down, slow down, slow down until we have ETFs, until we figure out a path to tokenized securities." Now I think they're more on the side of full steam ahead. They see the opportunity. Larry thinks there's opportunity in tokenization. And they're fully bought in on crypto. And there are some of the Democrats' funders as well. So ironically, you have big asset manager Wall Street on the side of crypto, and that's different than it was in 2022, 2023.

David: So what we've seen so far, this was mild asks from the Democrats. Of course, it is incredibly early, but this is Hasib tweeting out that Maxine Waters has proposed something called the Crypto Investor Bill of Rights. And it would include things like all exchange withdrawals have to happen within 24 hours, customer assets segregated, bankruptcy remote, monthly proof of reserves. Some of this stuff is great. And honestly, we're already heading that way anyways.

Ryan: That's good. That's reasonable. And honestly, uncovering any sort of Trump or Trump family grift in crypto. I mean, you made the point. You said this is just like medicine that we have to take, right? You said that one of the biggest constraints on crypto's upside was Trump turned crypto into his grift piggy bank. This is probably a rough but necessary exorcism for the crypto industry to get rid of Trump. So they can come after Trump corruption, Trump meme coins all they want. Welcomed behavior. That's very good for crypto, right? I feel like crypto always knew doing this kind of Trump thing was a little like a deal with the devil. But now we get all the upside. So long as the Democrats leave the SEC and CFTC alone, and allow Paul Atkins and Mike Selig to continue what they're doing, which is good, responsible, productive legislation. So long as that stays put, they can do whatever they want with all the Trump grift crypto stuff. Have at them.

David: That's a happy case, though, I got to say, Ryan. It's not clear whether they'll take that path or they'll just go back to old 10-seas anti-crypto, like everything. And that could also happen as well.

Ryan: I'm hoping that the absolute overperformance of the crypto PACs, the Fair Shakes, all the crypto money, can't that be a carrot for them to agree with us? They like money. We all know the Democrats like money. All political parties like money. Maybe they would want to get some of that money by doing stuff that we want. I'm just hoping it's a "don't notice us" situation.

David: The problem is we have big hacks in the news, like the Binance hack, $6 billion. Everybody notices that. It's impossible for senators and legislators not to weigh in. And that's what we're going to talk about next. Binance was hacked. This is the biggest heist in human history. We've got the retrospective of how this happened in the first place. Also, Ryan, I got to tell you about the French bank. The actual normal bank that got hacked? I thought banks were immune to getting hacked. They are not. We'll talk about all this and more.

Ryan: But before we do, we want to thank the sponsors that made this possible. Zcash fixes this. Zcash is private digital money with privacy enforced by zero-knowledge cryptography. Zcash shielded transactions let you send and spend without publicly revealing who you're paying or how much. When it comes to privacy, there is no second best. Get started with Zcash using Visor, the wallet Zcash devs and enthusiasts use to encrypt their money. Zcash wallets are non-trivial and Visor goes the extra mile to make sure your money and privacy are fully protected. Open source, self-custodial, fully private. Use the link in the show notes to download Visor on mobile or desktop. Protect your future. Use Zcash.

David: I've been trading crypto for almost a decade and I've used so many different wallets, exchanges, aggregators, or front ends. And I'm basically always looking for the same thing. Just one interface with deep liquidity across a bunch of chains and assets where I can access markets like perps, earn yield, trade confidentially, and still control all of my funds. And I've never really found it. I'm always switching wallets, juggling gas fees, or getting eaten by slippage. But Near.com feels fundamentally different to me. I can do anything I want from any chain and keep all of my activity confidential. Crypto, tokenized assets, perps, payments. I can even earn yield confidentially. One account, over 30 chains, confidential by default. It's the way that crypto ought to work. And it's powered by Near, which has moved over $30 billion cross-chain, uses post-quantum signatures, and has run over five years on mainnet with zero downtime. Near.com is the best way to be on-chain and be in control. Get 20% of your trading fees back on Near.com using the Bankless link in the show notes. Not investment advice.

Ryan: The largest bank heist in human history. $6.34 billion hacked by North Korea. The FBI sent out an alert saying the DPRK, the Democratic People's Republic of Korea, was responsible for a theft of more than $6 billion from cryptocurrency exchange Binance. Specifically, the trader Trader, which is the Lazarus Group.

David: Well, it's like a subgroup. Is it the same as Lazarus? They have these little sub teams.

Ryan: Yeah, I don't fucking know. I don't know. It's North Korea. It's North Korea. Yes, it was. $2.85 billion was frozen and intercepted, mainly USDC and USDT. So $1.77 billion of Tether, $825 million of Circle, of USDC. Ripple froze $40 million. I've never actually seen them freeze, or at least I haven't remembered that they did that. It happened so quick, didn't it?

David: So quick, yeah. And everyone was on it. WFLI, the same contract call that froze Justin Sun's assets, froze North Korea's assets. And then assets on Arbitrum. Arbitrum froze assets when, what was the other exchange? Bybit got hacked. They hit that same button again. So 8,426 Ether and 74 million ARB tokens were frozen by Arbitrum, on Arbitrum, and are presumably going to be returned to Binance customers.

Ryan: This was the big one, though. This is the world's largest crypto exchange. It's always been sort of the black swan event that crypto has feared would happen is someday some exchange is going to get hacked. This was not Binance's cold storage, but this was one of its hot wallets. And $6 billion, that's absolutely massive. I think the second largest heist in history is probably the Bybit hack and that happened a year ago at 1.5 billion. So this is like a 3 or 4x that. Now it looks like 2.8 billion will be frozen, so there's still a question of return. There's still a question of what about the 3.2 billion dollars? And there was some talk on Friday with all the fear and uncertainty out there as to whether Binance had the funds to actually back up its reserves. Could this be another FTX type of unwind? So pretty chaotic Friday. Binance came out though, and they said they would provide coverage for the full $6 billion.

David: Okay.

Ryan: Even the amount that's still kind of frozen, they still don't have access to. They published proof of reserves up to about 100% of the $6.3 billion in lost funds. They showed that there had been some proof of reserves there. They took this out of their SAFU insurance fund, which had a billion dollars or something. And the remainder was just money that they had on the balance sheet they pulled from other locations and they bought back the assets. So Binance had a good firm recovery response, and they published these proof of reserves too publicly. So these could be authentically verified that the funds were there. The hack to begin with is pretty concerning, obviously, and that calls into question Binance's handling of these funds. We'll talk about the details in a second. I will say their response was top notch, though, including some of the transparency of what happened and the response over the weekend to publish these proof of reserves. A fairly good response. I think that calmed down the market and was part of the reason that Bitcoin didn't lose 20%, that we were only down 5% and that we rebounded so quickly.

David: Yeah. I mean, the core difference between this and FTX was that FTX had just so much contagion. And that was downstream of the other contagion from 3 Arrows Capital. So while these are... He was lying about it.

Ryan: He was also lying, right.

David: Whereas Binance was an upstanding, valuable business that had cash on hand, so much cash on hand that it can just pay the customers the size of the loss of funds. And so to your point, this sent Bitcoin down like three or four thousand dollars, but not really anywhere near what you would expect from the headline "Binance hacked," the worst fear headline that has been in our potential brains for years now. And so people were bullish post that. It's like, yeah, Bitcoin got hit, but it wasn't that bad.

Ryan: That's how North Korea got access. So I think this is kind of the thing worth reading about so that we can kind of see what AI attacks of the future look like. Whether or not it was, I'm sure AI was getting involved somewhere, but it wasn't really AI driven. They set up a fake job interview with a Binance employee. So somebody who works at Binance was given the opportunity to interview with another company. They gave this person a coding task for the job interview, but the said coding task that the person downloaded was actually malware, actually spyware. So that got onto that person's computer because that Binance employee's computer was inside the Binance network. That software was able to spread to other people's computers, which gave them permission to run malicious code and gave access to move crypto because one of the computers that the software got access to had the private keys. They abused an Ethereum feature called EIP-7702. This is something with the smart contract wallet that Binance uses. But once they got access to that, they could make unapproved transactions approved and allowed them to transfer the funds outside of Binance's normal withdrawal process. So it was a social engineering attack, namely. And then you can imagine that AI helped write the actual software to do some of the more sophisticated stuff behind the scenes.

David: It played out over months too, right? So the first infiltration was detected in July and then they gradually ramped this out. Social engineered this employee, but this employee was doing a job interview on a work laptop, downloading software on a work laptop, but a fake company completely socially engineered. You can kind of see how this type of thing would happen unless companies completely clamped down on the social engineering attack vector.

Ryan: This, of course, causes so many other ripple effects in crypto. And there's so many stories in the week, and we probably can't cover them all. But one to at least touch is probably the ThorChain story. Because once North Korea hacked some amount of funds, and of course, this was many different assets. This is stablecoins. This is also Ether. This was even, we'll talk about like Polygon, tokens like that. Then they have to launder these funds somehow. So they might use a protocol like Tornado Cash. They also commonly use something called ThorChain, which has some different attributes versus Tornado Cash, which is like nobody runs Tornado Cash. It's just smart contracts. There's no engineers or no team involved. But there are validators in the case of ThorChain. So what happened here?

Ryan: The difference, the comparison is that the people running Tornado Cash software are Ethereum node operators. You're just running all of Ethereum because all of the smart contracts live on Ethereum. With ThorChain, the ThorChain is run by node operators. So there's a direct one-to-one relationship with the node operators of ThorChain and people running the transactions that are coming out of North Korea. It's like as if you could go directly target the people who are running Tornado Cash software, which is not what you can do in Ethereum.

David: Money was laundered through ThorChain. So TRX was sent through ThorChain. A bunch of Solana was sent through ThorChain. And then Bitcoin and Ether came out the other side because those are the immutable assets. The FBI sent out an alert explicitly naming ThorChain node operators saying, "Hey, don't process those transactions associated with the North Korean wallets." Obviously, not just ThorChain, but regular RPC node operators. Anyone who is a service provider who manages these transactions, they're saying, "Hey, don't process those. If you have the ability to freeze or stop processing these transactions, then stop processing. Don't do that." Specifically, they named ThorChain node operators.

Ryan: I don't know what's going on behind the scenes there, but if I was a ThorChain node operator, I would be very worried about not listening to the FBI. I know it's been in the social contract of ThorChain: "Hey, we don't censor transactions. We're totally neutral. We can't even stop it if we could." But interestingly, ThorChain had a fault in the bug when there was an Ethereum block reorg. As a result of that, something bad happened and they stopped ThorChain from processing blocks because there was a bug in the code. This happened on October 31st, right around the same time as the Binance hack. It was completely adjacent. So they clearly will stop running transactions, stop the ThorChain protocol when there's a bug in the code, but they have been resistant to doing anything else as a result of the hacks.

David: I'm kind of confused as to why we haven't actually seen any stories about the FBI raiding ThorChain node operators' houses. That's something that you would expect. My only plausible answer is that the FBI is running ThorChain nodes and the CIA is inside the ThorChain house. That's my only explanation as to why ThorChain node operators aren't in jail. Either that or they're incredibly bold.

Ryan: I think there's the stance that if you do have a button, and if you can be regulated to go push that button, then the state will regulate you to push that button, and probably should in these cases. So the only answer is to go fully decentralized and not have the ability to do these types of things. But ThorChain is somewhat in the squishy middle. It's not like Tornado Cash where it's just deployed immutable code. Nobody could turn it off without turning off the entire Ethereum network. ThorChain can be censored, can be turned off. Things can be reversed.

David: I saw a post from the Defiant podcast. One of the founders of ThorChain said, "ThorChain refused to block the BitGet hacker. Here's why." I just don't know what the incentive is to go, "We've seen what's happened with Roman Storm." If you're a ThorChain operator or a dev, this is just the FBI asking you politely to not do this. What are the next steps there if it's not a hands-off-the-button, complete decentralization situation, and you have some ability to press it? Not only that, but what gives him the audacity to go on the Defiant podcast and say, "Yeah, we don't do that. We don't freeze stuff. I know the FBI asked us not to, but yeah, fuck you. We don't care."

Ryan: My only explanation is that they're working with the FBI and the FBI wants the information. If you're running the RPC node, you have a specific vantage into the funds being routed, and the FBI needs that to trace the money. My only explanation is that the ThorChain operators are narcs.

David: It could be. I have no idea. It's just an unexplained phenomenon going on. I do wonder, though, if this attack from North Korea was flying a little too close to the sun. I know you had someone from TRM Analytics, who helps the FBI and authorities trace these types of things, on last Friday to talk about this. But this is a story: Kim Jong-un's sister is apparently coming out and saying, "Hey, this wasn't us. This wasn't North Korea." I don't recall her saying these types of things in the past. This is a massive hack, biggest ever, international. The FBI was clearly involved seconds after receiving notice that this happened. I almost wonder at what point in time the U.S. or other world authorities start to go on the offensive with respect to North Korea. This is a form of cyber warfare. The U.S. and other countries have offensive capabilities here. They could even bounty it out such that, "Hey, if you can go and get some of the $6 billion back and restore it, then maybe the U.S. will pay a 10% bounty." Maybe they'll bounty this out privately. Maybe the U.S. will begin to go on the offensive here. If they did, and if they were doing that, we wouldn't know about it. We would know about it maybe after it happens and not before. But do you think this is like a Do Kwon moment for Kim Jong-un? Do you think this hack is sort of like, "Wow, you've tripped over something that has the rest of the world now coming after you?"

Ryan: If so, then if it is too close to the sun, we would have to say that this $6 billion hack was too close to the sun, but the Bybit $1.6 billion hack was not too close to the sun. We had Ari Redbord on after the Bybit hack, and he was like, "Yeah, one of the big solutions here is to allow people, vigilantes, to go get the money back and to say, 'Hey, if you get any of the $6 billion back from North Korea, we'll give you 10%.' Do something like that." I feel like that's been a conversation. I don't know to what degree of money moves the FBI to become more motivated than $1.6 billion.

David: It's a national security thing. These hacks are a significant double-digit percentage of North Korea's GDP, and it's going right into their missile program. It's their number one source of revenue, not even close. So it's a national defense reason why you'd want to restore these funds. I sort of wonder if things are going on in the background that we might read a headline someday that some of these funds were mysteriously restored. Maybe Trump would... This would be a win for Trump, right? For crypto that everyone would basically support, rather than a new meme coin. It's like, "Hey, we're going on the offensive. Look, we just took back X billions of dollars from..."

Ryan: It's very generous of you to credit Trump with that. It's a possibility here. There are some other things that were happening, including, I don't know if you saw this, David. Part of the funds were Polygon funds that ended up on the Polygon chain, and Polygon proposed a hard fork to recover it. Validators have already frozen about $6.5 million in POL. Some of this was from the Binance hack. Actually, some of this was another hack we didn't even have time to cover, which is the Polymarket hack that happened on Friday too.

David: So the POL is frozen on Polygon right now. They are proposing an improvement proposal which would actually roll back the chain. This would be the biggest rollback since the DAO.

Ryan: This would actually roll back the chain and delete the POL from the hackers' accounts. Here's the kicker: the hackers actually bribed validators to unfreeze the POL. They did this by broadcasting a transaction with an incredibly generous Polygon fee, a 20K fee in order to move it.

David: Interesting. They're just saying, "Hey, and plus it only takes one validator to process that transaction, take that bribe, defect from everyone, and then release the funds." That was probably North Korea's only option left: "Let's bribe them with one-third the value of the funds to process the transaction."

Ryan: And no one did it? No Polygon validator defected?

David: Not so far. You probably don't want to be put on the list. I don't want to go to jail.

Ryan: They've also directly contacted validators and said they'd offer them side cash as well. So it doesn't even have to be an on-chain publication of this type of thing.

David: They should say yes, but then go talk to the FBI on the side. It's just fascinating. Now we're getting to the level of validators having to make decisions. I think there's a clear split between chains that are completely immutable, that will never roll back — the Bitcoins, Ethereums, the Zcashs of the world — and everyone else who is doing the Arbitrum thing or the Polygon thing where they're going to freeze, they're going to roll back. At some level, that's also a feature of the chain. If you're a user, maybe you kind of like want that to happen.

Ryan: Arbitrum has been two for two on the last two big hacks, Bybit and then Binance, on not losing customer money. Not their customers. Well, it was their customer because it was Binance as their customer. But Arbitrum has saved the day two for two times.

David: Do you want me to tell you the story of how the actual bank got robbed? Let me set up the premise: crypto has always felt very insecure because of the acceleration of AI exploiting technologies. Especially for bearer assets, once they are stolen, they are stolen because it's sent on a blockchain. It's gone. Banks don't have that problem because if you send a bank transfer, you can just call your bank and say, "Hey, undo that." There is no transaction finality in the bank context. You can undo a transaction that's 60 days old, a year old. You can go really far back with a court order. So there has never been the notion of bank heists in the trad bank world because they can just ledger entry update and undo the heist. You're telling me that that narrative was violated by a trad bank getting heisted. How did that happen?

Ryan: This is a crazy story. By the way, that's the reason I've always been skeptical of these takes of, "Oh, traditional banks are going to be hacked." It's just like, well, not in the way of crypto. They're not bearer instruments. Everything is AML KYC. It moves at the speed of people approving paperwork. How could a hack happen? Well, we saw exactly how a hack could happen. There is a bank called Credit Mutuelle — I'm mispronouncing this because it's a French bank. They were robbed, estimated about $130 million. This was fiat stolen from a bank. This is a pretty large French bank. About $200 billion balance sheet, 5.5 million customers. It's a co-op, so it's not publicly traded. This is a major French bank.

David: How did it happen?

Ryan: An entry was made by some hacker through a third-party vendor system. This is not internal human error. It's probably some sort of API, some sophisticated external attack. Once they were in, because fiat is not a bearer asset, if you want to move fiat from a bank system, you have to do so through SWIFT, through a messaging protocol. You're not actually physically moving the assets. You're just launching these communication messages through something like the SWIFT protocol. The hacker did that and sent this out to a bunch of mule accounts. These mule accounts were other bank accounts that received these funds in small amounts.

David: What's a mule account?

Ryan: It's like a fake account at some other bank, almost like a drug mule type of illusion. It had all of these organized mule account networks across all of these banks. The $130 million stolen from this bank was pushed out with regular fiat transfers to all of these other banks, went below the radar somehow. Then these smaller banks pushed out the funds to crypto exchanges — Kraken, Crypto.com, OKX. Mule accounts in these crypto exchanges then moved the fiat into stablecoins. Once in stablecoins, it ended up on chain, ended up in true bearer assets, and then disappeared.

David: The only way this works is that it slipped under the radar because they would need time for all of these bank transfers to settle before they can send another bank transfer to Coinbase or Kraken. Once the money is credited in Coinbase or Kraken, they are free to buy their assets. Do we know how much time that was?

Ryan: I'm not sure. It looked very innocuous from the bank's perspective. It was just regular bank transfers being made, going to other banks, and then they lose track of it. Here's the craziest thing: ZachXBT was actually the first person to notice this. How the fuck did he see this? He saw it on chain November 2nd, before maybe even the bank noticed that this was happening. He flagged $106 million through his methods. He saw this was an aberration. This looked suspicious. He tweeted out that it looks like there's some sort of bank hack that has happened, didn't know the details. Now the bank has confirmed this.

David: What breadcrumbs was Zach able to see to identify it as a trad bank hack?

Ryan: I'm assuming it's because the money ended up in known thieves' wallets. Probably, right? But how he sourced it from a trad bank hack is interesting. ZachXBT is just very sophisticated with on-chain analytics. He just saw this suspicious behavior.

David: ZachXBT has got to be the CIA. I've asked him like twice over the years, "Hey, do you want to do a written interview on Bankless?" He said no, not even any voice modification. He's like, "No, no, I don't." Because he's the CIA. Maybe. I don't know.

Ryan: So anyway, that's how a bank is hacked. I'm sure there are so many open doors through third-party tools for hackers to get inside of a bank network and fire off these innocuous-looking fiat-type transactions to correspondent mule-type banks, then move it into crypto, and then exit. This was $130 million, but can you imagine a major U.S. institution getting hacked for billions of dollars and it ending up in crypto on the other side of this?

David: There was a clip I saw from CZ after Binance got hacked, and he talked about how crypto banks have to deal with this, but also trad banks are totally under duress from exactly this type of event. When I saw that clip, I was like, "What are you talking about, CZ? You can't hack a bank." So my big question is: was this a one-off, or is this a very repeatable strategy? You can get behind decently insecure banking security apparatus with AI, and with the right sophistication, you can move money around under their radar because they have so many customers moving so many trillions of dollars a day that you can squeeze out a couple million dollars here and there, or $106 million in this case, because there's so much money over there that it flies under the radar.

Ryan: It remains to be seen, but there have got to be so many holes into their internal networks. These social engineering attacks are so sophisticated in crypto, yet crypto has hardened itself because it has a bearer instrument. Imagine how many holes exist in every single major bank around the world.

David: That's actually a crypto bull case. I guess so. Crypto isn't immune from this either, but our defensive practices are already a generation ahead of the banks. If the banks have to do cybersecurity, because they've always been in the beneficial position of just, "If somebody hacks us, we will just undo it," that's no longer the case anymore, apparently, according to this one single story.

Ryan: It's crazy. Banks aren't used to just losing money. This is like the 1800s, when banks used to get actually robbed by bandits, like Billy the Kid. We're moving back to that era. This bank isn't publicly traded, so we can't see the effect on the stock market. But they have to go eat a $133 million loss and also realize this could have been much bigger. The whole banking industry is going to have to react to this and respond in some way.

David: We've got more coming up. We need to talk about Ethereum's DevCon. There are two things that I feel kind of bullish about coming out of that. Maybe one thing I'm not so bullish about. Also, David, you have some takes on the Coinbase earnings report that just happened earlier this week. We'll get to all that and more. But before we do, we want to thank the sponsors that made this possible.

[Sponsor break]

Ryan: Some exciting news. We are launching a new podcast to help people figure out the crypto cycle, how to navigate it. The best crypto cycle investor I know, his name is Michael Nadeau. He runs the DeFi Report. This is the guy that sent me a sell alert before the 10/10 price drop happened. His cycle analysis has been absolutely on point. I've been following him for years. This year, we started recording weekly podcast episodes. Each one, we get into his portfolio, what he's holding, the market structure, entry targets, fair market value of Bitcoin and Ether, and where we are in the cycle. New episodes are released every Wednesday. They're 30 minutes. They're short. They're punchy. I think this crypto cycle is harder to navigate than most, so let's do it together. Go subscribe to this podcast. Search "The DeFi Report" wherever you get your podcasts — YouTube, Apple, Spotify — or find a link in the show notes. There's a new episode waiting for you now.

David: DevCon 8 was in Mumbai, India, part of this week. One of the things I was most bullish on was Justin Drake's plan. He announced to make Ethereum post-quantum by December 2028. Moving these timelines up, he stated the problem: all quantum attacks and also AI breakthroughs in math. The solution is Ethereum has to become post-quantum sooner than we all thought. This is a clip from DevCon from his presentation.

[Clip plays: Justin Drake speaking]

David: So I think the question is: can Ethereum ship post-quantum in 24 months? Justin Drake is bullish that they can. Some of the AI tools, some of the formal verification breakthroughs make him more bullish that that's possible. But the big message is quantum dates are coming sooner. The roadmap has to adjust, and Ethereum has a plan. That was probably the most bullish thing I saw personally coming out of DevCon. But again, I'm not there, so I'm watching all of this from afar.

Ryan: The other thing that was pretty cool was the Ethereum Economic Zones from the Gnosis team. I know you've interviewed them in the past, David. This is the idea of L2s tapping into the liquidity of L1s. The path was for Gnosis Chain to become an Ethereum Economic Zone sort of rollup. There were some pretty impressive demos. They showed three demos of progress in the Ethereum Economic Zone types of rollups, including just like CalSwap, tapping into the liquidity of mainnet. Pretty sleek. Gnosis is going to become the first of these chains, these rollups, by spring of next year. It was good to see some updates there. I think there will be a case for some L2s to become Ethereum Economic Zone L2s or just tap into liquidity. Those with their own distribution, like Robinhood, Coinbase, for example, maybe not so much.

David: Probably not. They're making so much on MEV. But there is another cadre of L2s that I think will become much more like the United Chains of Ethereum. It feels like what Ethereum's main arc could have been, should have been, maybe now is, and is now coming into fruition, especially with parts of Justin Drake's roadmap that he updated. Parts of that are components to bolster the capacity capability of the Ethereum Economic Zone. I think these are actually true aligned L2s, aligned behind the value proposition of Ethereum and Ether, the asset.

Ryan: Another sign of the times is L2Beat becoming ETHBeat. Did you see this?

David: Yeah. The reason why is because layer twos are no longer the intermediaries between people's relationship with Ethereum. Historically, the whole thing has been that all users are going to use Ethereum via layer twos, intermediated by layer twos. Checking the power of layer twos becomes very important. L2Beat was like a watchdog to show the power that a layer two has over its users as it relates to connection to Ethereum. Since we are trying to do things like the Ethereum Economic Zone, but also do other layer one things as well, they have rebranded L2Beat to ETHBeat to be a bit more expansive in their mandate of protecting user sovereignty, but also focus a bit more on the layer one and all of the intermediated relationships that people have with Ethereum in layer one, such as node providers or just smart contracts in general.

Ryan: Both of these things make me a bit more bullish on the direction that Ethereum is taking. It's the right focus. That said, I heard a lot of conversation about DevCon that it was not attended as well, that the energy was a bit lower than previous years. In particular, there were some murmurings on crypto Twitter of criticism of Vitalik's keynote. He gave a 15-minute keynote. I watched this. He only mentioned Ethereum once. Didn't mention DeFi. This is Georgios with his comments on it: "It's kind of painful to see DevCon keynote after 10 years building Ethereum's OSS stack. Is this what's left? Where's the accountability? How are you going to inspire the next wave of strong devs, not the B players and the rent seekers in the age of AGI? Come on."

David: He was talking specifically about Vitalik's keynote. I came away from watching the keynote and it didn't seem that relevant to the topics facing Ethereum. It almost seemed like he was talking about a different project or different thing altogether. I don't necessarily think that's bearish for Ethereum, but it does signify that Vitalik was on a different wavelength. That was a little different than what holders, investors, and Ethereum devs actually wanted from him. It wasn't really about Ethereum, the project. There was mention of Farcaster, Lens, decentralized AI. Those things aren't core use cases of Ethereum these days.

Ryan: My take on the keynote is that it's Vitalik being continually nerd-sniped by d/acc — defensive acceleration — which Ethereum has a role to play in, perhaps a significant role, but it is not really the main course. Ever since Zuzalu in 2023, Vitalik has just really been focused on other frontier technologies that are of the same vibe as Ethereum: protecting user rights and individualism, especially with the rise of AI. AI gives a lot of power to incumbents and to totalitarian dictators. Vitalik is interested in technologies that help individuals resist that. Even in the keynote, he talked about how health devices need to become more trustworthy, how social media needs to give users more control, how private communication platforms like Signal need to be more than just encrypted messages and give user control over data management and end-user verifiability. I did like the closing principle where he said that collecting data is bad, and apps and platforms and companies should treat personal data as toxic waste and just not collect it. This is all great. This is all noble. But if you're looking to Vitalik as a startup leader for the inspirational direction of Ethereum, the project, the EF, DevCon, the event, I think you were disappointed in the off-focus-ness of the subject matter.

David: That was Georgios's take anyway, and there was some pushback. Some people saying, "You went Georgios, and you're working for Tempo now on a corporate slop chain." There's a lot of money going back and forth there. That's such a lame critique. At the end of the day, Paradigm and Georgios are shipping, at least for the EVM. This is part of the hidden bullishness of Ethereum: there are so many talented devs now working on the EVM stack. Georgios and Paradigm shipped Solar, which is 100x faster Solidity. Criticizing Ethereum, but yet working in the EVM. He's contributing to Ethereum as much as anyone.

Ryan: I see all sides of this and I understand the take. I'm not as bearish as Georgios on one specific Vitalik keynote. But I do think it's indicative of him taking a different leadership role in the Ethereum ecosystem than he has previously. Other things I was much more bullish on coming out of DevCon, other talks, not his.

David: It's downstream of the same critiques of Ethereum that we've seen in the past: it just doesn't have focus. What is Ethereum for? If you go to Vitalik and say, "Okay, Ethereum is for protecting users from AI. It's for secure healthcare data. It's for this." I'm pretty sure, David, it's for ETH the asset. I'm pretty sure it's for ETH, the goddamn asset, which was not mentioned at all in the DevCon keynote. This is something I've been hearing a lot from the Zcash roadmap. They're very clear on what the application of the asset is. Zcash is for Zcash. Zcash the asset. I think Ethereum could get back to that a bit more, but we've talked about that so many times here.

Ryan: Tell me about Coinbase, the earnings report. Stock is down. What's going on over in Coinbase land?

Ryan: Yeah, so there are some just like normal earnings things that we will get through. So trading revenue, Coinbase made $590 million, which is flat quarter over quarter. They made more money from their prediction markets, which offset the 10% drop in spot volume. More money than previous quarters, not more money than trading revenue. Consumer spot volume on Coinbase is down 60% year over year. They now make more money on subscriptions and services, which is always kind of the plan. So they make 49% of net revenue from subscriptions and services. They made $307 million in stablecoin revenue.

David: Oh, that's great.

Ryan: This is all kind of normal quarterly earnings report stuff. The unique thing was that they filed a new 10B5-1. I don't know what that is, but apparently it's just the plans that insiders who have a lot of coin shares need to file with the SEC if they want to sell shares. And so this relates to CEO Brian Armstrong, Fred Arisom, and Emily Choi. Emily Choi is the president. Really, the interesting thing I think is about Brian Armstrong, who in this plan made a plan to sell 24% of his shares at specific price targets.

David: So this is not Brian. You should also say have the option to sell. It doesn't have to actually hit the sell button.

Ryan: Yes, at specific price targets. And so this is not a market dump. Brian Armstrong has filed giving himself the option to sell 24% of his shares at specific price targets. And so that is 3% of the total supply of Coinbase. Fred and Emily, they both are kind of doing the same plan. So Fred can sell 70% of his shares, which is 1.5% of the total supply. And then Emily Choi. But Fred's out. He's no longer kind of like executively leading the thing. I think the big news is really Brian Armstrong. So apparently he had 8.5% or he owns 8.5% of Coin today. And if you comp this, like Vlad Teneff, who's also founder-led CEO, which in general, I think you're bullish on companies that are led by founder CEOs, so am I. He has about 5.2% of Robinhood. But this is still a large amount that Brian is potentially going to be selling, right? It's 25% of his stack.

David: Yeah. So Vlad, and this is just normal, Vlad also has a plan just like this one to sell hood shares at specific price years. This is probably similar across many, many, most companies. Just the difference is in the amount of shares and the direction of travel. So Vlad's plan allows him to sell 4% of his shares. Brian Armstrong's plan allows him to sell 24% of his shares. And while Brian, to your point, he owns 8.5% of Coinbase, where Vlad only owns 5.25% of Robinhood, it's still the direction of travel that I think is like, if you were a coin investor, which I'm not currently, I would be just, it's kind of just a downer to see the stock down 60%. It's at 970 day low. And then in the new quarterly earnings report, like the CEO has filed to meaningfully raise the amount of shares he is potentially going to sell.

Ryan: I think, I mean, there could be the argument that this is all part of normal diversification, but I would agree with you as an investor. What you want to see is like, well, coin stock is down 70% from all-time highs, you'd rather see Brian be like, I'm buying coin. I'm buying. Fuck you guys. Fuck you. I believe in my company. I'm buying. Not the opposite.

David: Yeah. So we'll see what is in store for Coinbase in the years to come. But it's definitely underperformed the rest of crypto, at least on the year and certainly recently. Last thing to note before we go, So Stretch has hit $100, which means that Michael Saylor can just hammer the ATM if he wants. I actually don't think that's true since we are all dumping this morning. But at least for a moment yesterday, STRC from Strategy hit $100. It was off the peg for 174 days. It's a long time. It has now finally returned. I think it's at like $98, $99 now. But I think it is pretty notable that my strategy did get stretched above $100. We don't have these in the notes because we don't have enough time to talk about them today. But there is actually a lot of incoming debt that is coming due. And since MSTR price is not above the thresholds that it would need to be, that is going to be cash that Saylor needs to come up with to pay these convertible notes. So that is looming ahead once again for strategy over the next six to nine months.

Ryan: I think, but hey, at least stretches at $100. Bankless Nation, that was it for this week. Hopefully, we have some green candles next week to talk about. For some reason, I feel like it's either going to be big up or big down one way or another, but we will see you in seven days. That has been the weekly roll-up. Crypto is risky. You can lose what you put in, but this is a frontier. It's not for everyone, and we're glad you're with us on the Bankless Journey. Thanks a lot.

David: Thank you.