Unchained

A compromised developer laptop and 50 pre-signed transactions let North Korea drain $6.3 billion from Binance. Jonty and Pablo Sabbatella trace how it happened.

========================================================

Thank you to our sponsor!

Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients.

Find out more at ⁠⁠⁠⁠⁠⁠https://unchainedcrypto.com/go/nexo-podcast-sn⁠⁠⁠⁠⁠⁠.

Geo-restrictions, eligibility and terms apply.

With Election Day on November 3, crypto voters could make the difference in close races. Check where candidates stand on crypto, verify your registration, and make your voting plan at Stand With Crypto’s Voter Hub.

========================================================

Quick favor: We’re deciding what Unchained does next; new shows, stream times, what’s worth paying for.

Our ⁠listener survey⁠ takes five minutes, it’s anonymous, and I read the write-in answers myself. Everyone who finishes it gets a free month of Premium, Unchained or Bits + Bips, your pick. Open through Sunday, November 8.

— Laura

========================================================

North Korea only needed 20 minutes to take $6.3 billion from Binance in the largest hack in history, not just crypto history. According to Binance, one of the attack vectors started with a compromised developer laptop, which ultimately led to the attackers being able to sign transactions from the exchange's hot wallets.

Jonty, founder of Pangolin Intelligence, and Pablo Sabbatella, founder of Opsek, trace how an EIP-7702 upgrade let the hackers sweep those wallets, why roughly 43% of the funds were frozen compared with less than 3% after Bybit, and how Circle, Tether, Arbitrum's Security Council and Aave responded. They also debate how decentralized THORChain really is, why the FBI named THOR node operators, and how TraderTraitor lures developers with fake job interviews.

With Chainalysis tying nearly 89% of this year's reported hack losses to North Korea, Pablo and Jonty lay out the security and anti-laundering steps the industry could take before the next attack.

Host:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained

Guest:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Jonty (tanuki42) - Founder of Pangolin Intelligence

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Pablo Sabbatella - Founder of Opsek

Timestamps

🎬 00:00 Intro

📋 00:26 Unchained Survey: complete the listener survey at https://unchainedcrypto.com/survey

🚨 02:08 How North Korea took $6.3 billion from Binance in about 20 minutes

🔑 07:51 Why the EIP-7702 delegation made the drain faster

💰 17:35 Nexo: earn daily interest on your crypto or borrow against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt

🗳️ 17:52 Stand With Crypto: see where candidates stand on crypto and make your voting plan at https://unchainedcrypto.com/go/standwithcrypto-yt

⛓️ 18:31 Which chains were hit and where exchange signing infrastructure fails

🏦 23:00 Should Binance have held $6 billion in hot wallets?

🧊 29:18 Why Circle and Tether moved fast to freeze the stolen funds

🏛️ 35:38 How the hackers borrowed nearly 20,000 ETH on Aave

🔄 40:37 Is Binance liquidity helping launder funds through THORChain?

⚖️ 45:51 How decentralized is THORChain after a three-vote halt?

🚔 54:19 What the FBI naming THOR node operators signals

🤖 01:02:33 Why the laundering trail looks machine-driven

🕵️ 01:06:06 Who TraderTraitor is and how fake job interviews hack developers

🛡️ 01:13:00 What the industry should change to stop North Korea
Learn more about your ad choices. Visit megaphone.fm/adchoices

Rob Hadick guest-hosts for a second week with Tom and Robert, joined by Nemil Dalal of Y Combinator. Hours before the show, Binance lost an estimated $5 billion in what looks like the largest hack in crypto history, Circle and Tether froze funds faster than anyone expected, YC lays out its crypto Request for Startups, and ICE signs with trade.xyz to bring regulated perps built on Hyperliquid's technology to US customers.

Listen to the episode on Apple Podcasts, Spotify, Pods, Fountain, Podcast Addict, Pocket Casts, Amazon Music, or on your favorite podcast platform.

Show highlights

🔹 Rob Hadick is back for a second week, and Nemil Dalal of Y Combinator returns as a repeat guest.

🔹 The hosts planned to skip hacks this week. Three hours before the show, Binance was hit for an estimated $5 billion, three times the largest hack in crypto history.

🔹 Tom says the attack looks tied to how Binance managed EIP-7702 delegation, letting an attacker generate signatures and withdraw funds by proxy.

🔹 Circle and Tether froze the stolen stablecoins within hours. Nemil says the USDC team literally practiced for moments like this.

🔹 Tom compares freeze requests to social media takedown requests: Circle can't adjudicate thousands of claims a day, but a call from Binance is high signal.

🔹 Robert asks why, four and a half years after 2022, no team has shipped a genuinely different architecture for DeFi protocols, even as the forest gets darker.

🔹 Rob says his stablecoin and TradFi crossover founders barely felt the hack, and Nemil warns that every financial crisis is about interconnection.

🔹 Nemil runs through YC's crypto Request for Startups: tokenization, new financial primitives, agents that need APIs, and raising capital for AI on-chain.

🔹 Rob calls it the bull run, but not the bull run the crypto people want. Nemil says he has to steal that.

🔹 Robert asks if it's better to build pre-cool or post-cool, and rules that crypto is post-cool, which makes it pre-cool again.

🔹 Nemil says every personal agent will have a credit card, while stablecoins win where payments are global and micro, like Cloudflare's pay-to-crawl.

🔹 ICE signs a definitive agreement with trade.xyz to bring regulated perps built on Hyperliquid's technology to US customers, pending CFTC approval.

🔹 Stan Druckenmiller tweets about Hyperliquid, and Robert says nobody likes ADL, Druckenmiller least of all.

🔹 Robert argues perps are a superior form factor to dated futures for everything, and that the institutional gap is credit risk.

🔹 Robert marvels that crypto went from Byzantine generals to talking about credit risk.

Hosts

⭐️Rob Hadick, Managing Partner at Dragonfly

⭐️Tom Schmidt, Managing Partner at Dragonfly

⭐️Robert Leshner, Founder & CEO of Superstate

Guest

⭐️Nemil Dalal, Visiting Partner at Y CombinatorDisclosures

Timestamps

00:00 Cold Open

00:30 Intro

01:42 The $5B Binance Hack

04:40 Circle's Fast Freeze

10:57 Where's the New DeFi?

19:48 YC's Crypto Wishlist

26:38 The Wrong Bull Run

36:53 Is Crypto Just AI Rails?

40:18 ICE x Hyperliquid

51:45 Perps vs. Dated Futures
Learn more about your ad choices. Visit megaphone.fm/adchoices

Galaxy's Alex Thorn argues Bitcoin bottomed in late June. While macro funds exit, sovereign wealth funds buy and AI pushes debasement, he says now makes a good entry point.

========================================================

Thank you to our sponsor!

Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients.

Find out more at ⁠⁠⁠⁠⁠https://unchainedcrypto.com/go/nexo-podcast-sn⁠⁠⁠⁠⁠.

Geo-restrictions, eligibility and terms apply.

========================================================

Quick favor: We’re deciding what Unchained does next; new shows, stream times, what’s worth paying for.

Our listener survey takes five minutes, it’s anonymous, and I read the write-in answers myself. Everyone who finishes it gets a free month of Premium, Unchained or Bits + Bips, your pick. Open through Sunday, November 8.

— Laura

========================================================

Bitcoin has now traded five or six weeks above its 50-week moving average. In every prior bear market, Alex Thorn says, that signal meant the bottom was already in, and he believes this one came in late June.

Thorn, Head of Firmwide Research at Galaxy, walks Laura Shin through his essay "Why Now Is the Time to Add and Hold BTC," including 13F filings showing Millennium and D.E. Shaw cutting Bitcoin ETF exposure while Mubadala and Morgan Stanley Wealth Management added, and long-dormant coins waking up at 34,000 BTC a month in 2026, down from 67,000 in 2024.

He argues a $40 trillion national debt and a credit-funded AI buildout make the debasement case stronger than at the October high, then names the tripwires that would break his thesis, from a sustained drop below the 50-week average to a quantum computer. With conferences full of tokenization panels, being long Bitcoin may be the contrarian trade.

Host:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained

Guest:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Alex Thorn - Head of Firmwide Research at Galaxy

Timestamps

🎬 00:00 Intro

📋 00:29 Unchained Survey: complete the listener survey at https://unchainedcrypto.com/survey

🎙️ 01:28 Bits + Bips: search Bits + Bips and subscribe at https://www.youtube.com/@Bitsandbips

🧭 01:50 Why Alex says retaking the 50-week average means Bitcoin bottomed in June

🏦 06:36 Who sold and who bought: macro funds out, sovereign wealth funds in

💳 12:19 Nexo: Generate daily interest on your crypto or borrow funds against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt

🐋 13:09 Why fewer old coins are waking up in 2026, and what that means for supply

💵 16:42 Why Alex says the debasement case is stronger than at the October high

🕵️ 19:56 Why Alex sees Bitcoin as an exit from an AI-powered surveillance state

🧱 23:48 Why Alex sees the tokenization boom as a contrarian signal to buy Bitcoin

⚠️ 29:31 The tripwires that would invalidate Alex's bottom call

🎯 34:09 Alex's $125K target and his $250K call for the end of 2027
Learn more about your ad choices. Visit megaphone.fm/adchoices

Anthropic's S-1 shows the company is still burning cash. Kain Warwick and Taylor Monahan say the bigger risk is a founder voting bloc that has to vote together.

========================================================

Thank you to our sponsor!

Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients.

Find out more at⁠⁠ Nexo⁠⁠.

Geo-restrictions, eligibility and terms apply.

========================================================

Quick favor: We’re deciding what Unchained does next; new shows, stream times, what’s worth paying for.

Our listener survey takes five minutes, it’s anonymous, and I read the write-in answers myself. Everyone who finishes it gets a free month of Premium, Unchained or Bits + Bips, your pick. Open through Sunday, November 8.

— Laura

========================================================

Anthropic has filed its S-1, and Kain Warwick stacks it up against Google's 2004 IPO: $12 billion in revenue in Q2 2026 alone and $8.7 million in revenue per employee. What jumped out at him, though, was governance: 7 founders holding 50% of the voting shares in a side pot that has to vote together.

Warwick, Taylor Monahan, and Austin Griffith say crypto has run this experiment before. Monahan calls the founders' sense of moral superiority Anthropic's biggest risk, and Griffith compares the bloc to every multisig that stalled once the incentives to coordinate faded.

The hosts also cover how AI models started sending bug bounty disputes to SEAL 911, an AI result that says "ETH is false," Keystone's leaked device signing key, phishing emails sent from Foundation's own mail system, and why Ethereum's Glamsterdam upgrade was cancelled.

In what Warwick calls one of the most dangerous times to be in crypto, the safest move may be doing less.

Hosts:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Kain Warwick⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ - Host of Uneasy Money and Founder of Infinex and Synthetix

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Taylor Monahan⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ - Co-host of Uneasy Money and Security Expert

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Austin Griffith⁠⁠⁠⁠⁠⁠ - Co-host of Uneasy Money and Builder Enablement at Ethereum Foundation

Timestamps

🎬 00:00 Intro

📋 00:38 Unchained Survey: complete the listener survey at https://unchainedcrypto.com/survey

🎙️ 01:40 Bits + Bips: search Bits + Bips and subscribe at https://www.youtube.com/@Bitsandbips

📈 02:08 Anthropic's S-1: how $12B in Q2 revenue stacks up against Google's IPO

🗳️ 10:27 Why Kain thinks Anthropic's 7-founder voting bloc is destined to blow up

🤖 23:24 Austin on why AI answers could become winner-take-all like Google search

🚨 27:41 How AI models started sending bug bounty disputes to SEAL 911

🏦 30:50 Nexo: generate daily interest on your crypto or borrow funds against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt

🧮 31:32 'AI says ETH is false': why AI chipping away at hard math matters

🎓 46:06 Will kids still go to college? Austin, Tay, and Kain on parenting with AI

🔑 49:52 Are hardware wallets bad again? Keystone's leaked device signing key

☎️ 54:13 Why nobody legit in crypto will ever call you, and Kain's OTC scam story

📧 01:01:17 Foundation's hacked mail system and a phishing site too polished to be real

🧘 01:07:50 Don't panic: Kain's 'personal Lindy' and Tay's case for doing less

⛽ 01:11:12 Austin's 'smooth brain take' on why Glamsterdam was cancelled

🐜 01:18:33 OpenAI's Terra 6.1 and the agent armies battling on AntWars.ai
Learn more about your ad choices. Visit megaphone.fm/adchoices

Can the US fight AI-powered hackers and North Korea by deputizing its private sector? Two government veterans explain why the answer is yes and no.

========================================================

Thank you to our sponsor!

Put your crypto to work with Nexo: earn daily interest or borrow funds against your assets on one platform trusted by more than 10 million clients.

Find out more at ⁠⁠⁠⁠https://unchainedcrypto.com/go/nexo-podcast-sn⁠⁠⁠⁠.

Geo-restrictions, eligibility and terms apply.

========================================================

Quick favor: We’re deciding what Unchained does next; new shows, stream times, what’s worth paying for.

Our listener survey takes five minutes, it’s anonymous, and I read the write-in answers myself. Everyone who finishes it gets a free month of Premium, Unchained or Bits + Bips, your pick. Open through Sunday, November 8.

— Laura

========================================================

North Korea has stolen more than $1 billion in crypto this year, AI-driven ransomware attacks have run with no human in the loop, and a single week exposed weak keys and bugs buried in old internet infrastructure. One answer gaining traction in Washington dates to the age of sail: privateering.

Chris Giancarlo, former chairman of the CFTC and author of The New Adventures of CryptoDad, proposed reviving letters of marque and reprisal in a Cointelegraph op-ed with Chris Perkins, then pitched it at a White House crypto summit. Giancarlo and Ari Redbord, global head of policy at TRM Labs, join Laura Shin to unpack the August presidential memo that followed.

They cover why the memo lets vetted contractors target scam compounds, cartels, and ransomware gangs but leaves Lazarus Group to the government, how the Prince Group's $15 billion forfeiture shows stolen funds can be clawed back, and how deepfake interviews put DPRK IT workers inside US companies. The final question: does hitting back make the problem bigger?

Host:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained

Guest:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠J. Christopher Giancarlo - Former Chairman of the US CFTC

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Ari Redbord - Global Head of Policy at TRM Labs

Timestamps

🎬 00:00 Intro

📋 01:01 Unchained Survey: take the listener survey for a free month of Premium at https://unchainedcrypto.com/survey

🎙️ 02:02 Find Bits + Bips’ new channels and subscribe at https://www.youtube.com/@Bitsandbips

🚨 02:40 Why Redbord says AI-run ransomware is now a civilization-level threat

📜 05:29 Letters of marque: how Giancarlo and Perkins proposed reviving them

💰 10:24 Nexo: Generate daily interest on your crypto or borrow funds against your assets at https://unchainedcrypto.com/go/nexo-podcast-yt

🏛️ 11:14 How crypto privateering went from an op-ed to a White House memo

🛑 16:50 Why the memo bars privateers from going after Lazarus Group

🕸️ 23:04 What hacking back looks like: scam compound infrastructure and clawbacks

🔓 35:24 PHP bugs and weak eMudhra keys: privateering as risks multiply

🇰🇵 42:14 North Korea: why the government, not privateers, pulls the trigger

🎭 48:59 How companies can catch North Korean IT workers using deepfakes
Learn more about your ad choices. Visit megaphone.fm/adchoices