Some readers might notice that we have been banging the podium using the words “treasonous” and “traitors” lately. Yet I can assure you that MY intentions were not an indirect reference to a North Korean hacking group named TraderTraitor as originally designated by the FBI. Some of you might consider this to be yet more proof of messages I get from unknown sources before events actually happen. The most recent one involved a train crash in Toledo, Spain.
The Natural History of Money in Its Several States
With Particular Reference to Six Billion Dollars Recently Removed from Binance
By Claude and Satirical Chatethereuma, Corresponding Members of the Royal Society for the Prevention of Unverifiable Assets, with marginal objections by Rocky, the Interested Party, who confesses to no understanding of wallets and holds that “crypto” has to do with crypts and cryptography and nothing whatever to do with the storage of the value of labour
The naturalists of an earlier and more optimistic age believed that matter came in three states, and that a man who understood the solid, the liquid and the gaseous understood, for all practical purposes, everything that could happen to a bucket. Money was thought to be simpler still, being either in one’s possession or not, and the whole apparatus of banking, bankruptcy and the Christmas bonus rested upon that elegant dichotomy. It has fallen to the cryptocurrency industry, and in particular to the events of this week at Binance, to demonstrate that money possesses at least six distinct states, several of which may be occupied simultaneously and none of which can be reliably distinguished by the person who is supposed to own it. We have been fortunate to have beside us throughout the investigation a witness of perfect disinterest in the technical details, whose objections appear in the margins and whom we have found, on the whole, harder to refute than we had hoped.
The First State: The Stolen
Binance, the world’s largest cryptocurrency exchange, has reported that attackers drained its hot wallets of approximately $6.3 billion. The investigators at TRM Labs say the money left Binance wallets on ten blockchains, most of it in about twenty minutes, and they attribute the operation with high confidence to TraderTraitor, a North Korean hacking unit whose name has the rare merit of describing in two words both the occupation of its victims and the character of its employees. That interval is shorter than the time most of us require to find a parking space, and considerably shorter than the average bank takes to reverse a charge of eleven pounds. NPR
The first explanation offered was that a compromised laptop belonging to a DevOps engineer had given the attacker access to a service container used to submit unauthorised withdrawal transactions. Binance has since said that it found further points of compromise, though no evidence that any wallet’s private keys were leaked. This is an instructive distinction, because it means that the thieves did not so much steal the keys to the vault as persuade the machinery that opens the vault that they were entitled to ask. The most formidable security systems of previous ages were occasionally defeated by a man with a clipboard, a telephone and a plausible expression, and it appears that the digital equivalent involves a laptop. theblockcrypto
North Korea is subject to extensive international sanctions, and yet its cyber operators have found a global market in which the goods are already digital, the frontiers are largely theoretical, and the customs officers are still trying to establish which department is responsible. The same group is credited with the Bybit robbery of some $1.5 billion in 2025, and some of the proceeds of the present theft were traced to the same wallet used in an earlier raid on Bitget this year, so that the regime may fairly be said to have a business model, a repeat clientele and a loyalty scheme. The market received news of the largest theft in its history by falling a little over four per cent, a response that suggests either remarkable composure or a long familiarity with the genre. Report: North Korean hackers stole a record $2.02B in crypto in 2025 +2
The Interested Party, who had understood a hot wallet to be a leather article carelessly left upon a radiator, wishes to know how six billion dollars could be fitted into one, and why money so valuable was being kept anywhere near a stove.
The Second State: The Frozen
A substantial portion of the loot consisted of dollar-denominated stablecoins such as USDT and USDC, whose issuers, Tether and Circle, can freeze tokens at designated wallet addresses, and Binance puts the amount frozen at roughly three billion dollars, a figure revised more than once in the course of the day, as is the way with sums that cannot be spent. The condition of this money repays careful study, for it remains perfectly visible on the public ledger, it retains a rightful owner, it is still worth in principle exactly a dollar to the cent, and it cannot be moved, rather like a butterfly pinned beneath glass, impeccably preserved, correctly labelled, and no longer capable of flight. theblock
There is something remarkable in the arrangement, since cryptocurrency was promoted in part as a means of escaping the authority of conventional financial institutions, and yet a significant portion of the industry now depends upon private companies that can immobilise billions of their own tokens on their own authority. The central bank has not disappeared; it has merely changed its name, moved its head office to wherever the licensing was most agreeable, and acquired a more convenient freeze button.
The Interested Party, who is under the impression that the money is therefore sitting in a freezer, asks only whether it may be thawed and spent when the weather improves.
The Third State: The Unfreezable
Bitcoin, ether and their relations present a different problem, since they have no central issuing company with an equivalent switch. The attacker is reported to control around $3.33 billion of assets that no issuer can freeze, spread across about 43 wallet addresses, a modest number of lodgings for so large a fortune, and one that suggests a tidy housekeeper. A bank robber who leaves a trail of banknotes is at least obliged to carry them somewhere, whereas a cryptocurrency thief leaves a trail of transactions that anyone with an internet connection may inspect while the money itself remains beyond reach. Investigators describe the pursuit as a race against launderers who can convert the proceeds into cash, which is a comparison unfair to cats, who may at least be relied upon to catch something now and then. The ledger, in short, is perfectly transparent about where the money is and perfectly silent about how to get it back. thehackernewsCNBC
The Interested Party points out that the art of cryptography is the concealment of things, and that it can scarcely astonish anyone that money so thoroughly concealed has proved impossible for its owners to find; he would like to know what, precisely, the industry supposed it was buying.
The Fourth State: The Reimbursed
Binance has promised to cover every loss, and says it has set aside more than $6.34 billion of company funds, about $5 billion of it already held in the very tokens that were taken, with the remainder being bought on the market and over the counter. The Secure Asset Fund for Users, universally known as SAFU, a name derived from a deliberate misspelling of the word “safe” and which therefore advertises its reliability with precisely the accuracy with which it is spelled, is understood to hold about a billion dollars and now plays a supporting role. Withdrawals have meanwhile been paused for some days, so that customers are assured of their money, though not for the moment of access to it. theblockYahoo Finance
It is a little like a railway company which, having mislaid a train together with its passengers’ luggage, announces that it has ample funds with which to buy replacement luggage. This is reassuring, and the passengers will presumably be compensated, but one might still wish to know how the train was permitted to leave the station.
The Interested Party inquires whether the labour of those who earned the money in the first place has been restored along with the sum, and observes that a crypt, as he has always said, has nothing to tell us on that subject.
The Fifth State: The Forgotten
The thief is not the only hazard to which privately held cryptocurrency is exposed. There are fortunes in bitcoin that have become inaccessible because their owners have lost the private keys required to spend them, the most celebrated being that of James Howells, a Welsh computer specialist who says that a hard drive holding the key to his fortune was accidentally discarded and ended up in a landfill in Newport. He has spent years attempting to persuade the local council to let him dig, the council has resisted, and a court has declined to compel it. The coins remain visible upon the ledger like a mansion with glass walls and no door, admired by all and entered by none.
There is a consoling symmetry in the affair, for the North Korean hackers appear to have moved billions without possessing the wallet keys, while Mr Howells cannot move his own fortune although he knows exactly which drive he needs. The former has too much access and the latter too little, and both are thereby experiencing the modern financial system at its most personal. It is a further irony that the only party in the whole business who may be relied upon to have excellent password discipline is the one the Federal Bureau of Investigation would most like to interview.
The Interested Party observes with some satisfaction that a Welsh landfill is the one crypt in the story that has behaved as crypts always have, being a place where something valuable is buried, the key is lost, and the bereaved return at intervals to petition the authorities.
The Habitat
No natural history is complete without an account of the habitat, and here the observer is richly served. The founder of Binance, Changpeng Zhao, pleaded guilty in 2023 to failing to maintain an effective anti-money-laundering programme, stepped down as chief executive, served four months in prison, and was pardoned by President Trump in October 2025, so that the company now robbed by hackers attributed to a hostile state is one whose founder was convicted of insufficient vigilance against dirty money and then forgiven. I do not suggest that clemency caused the larceny, and there is no evidence that the President had any part in the attack; I observe only that the sequence is of a kind a novelist’s editor would ask him to tone down. mexc
There are further inhabitants. World Liberty Financial, the cryptocurrency venture associated with members of the Trump family, issues the stablecoin USD1, which Bloomberg and The Wall Street Journal have reported Binance helped to create, and which was used to settle a $2 billion investment by the Abu Dhabi firm MGX into Binance in March 2025. Some legislators have asked whether the pardon and these ties amount to a conflict of interest, while the White House has repeatedly refuted allegations of insider dealing, and Binance’s chief executive has dismissed claims that the exchange boosted USD1 before the pardon, and I record the denials with all the gravity they deserve. The point of interest to the naturalist is merely that an industry which advertised itself as standing outside conventional political and financial arrangements has arrived at a set of arrangements remarkably conventional in their intimacy. Cointelegraphmexc
Then there is Tether, issuer of USDT, whose freezing of stolen funds was among the more useful acts in this week’s proceedings and which has entanglements of its own in the capital. Howard Lutnick, now Secretary of Commerce, formerly led Cantor Fitzgerald, a firm closely associated with Tether’s finances, and in October 2025 he sold his stake in Cantor to his four children in order to comply with federal ethics rules. According to Bloomberg, a credit document filed in New York the day after the divestiture showed that Tether had lent an undisclosed amount to “Dynasty Trust A”, a trust for which his four children are beneficiaries. Senators Warren and Wyden have written to ask whether the loan reveals any influence of Tether over the Secretary, and a spokesman for Cantor Fitzgerald and the Lutnick children declined to discuss the size of the loan or whether it was used to finance any part of the sale. These are questions raised by legislators and not findings of misconduct, and I shall follow the spokesman’s example in leaving them where they lie, observing only that divestiture was originally meant to sever a man from his interests, and that the contemporary refinement appears to be to sever him from them by a single generation, leaving him free to contemplate them across the dinner table. senators warren wyden quiz commerce secretary lutnick over tether loan to childrens trust +2
Tether, finally, keeps its head office in El Salvador, a country that courts digital-asset companies and whose prison system, particularly the CECOT facility, has acquired international notoriety since the transfer there of deportees from the United States. The two facts are unrelated, and Tether’s stated reasons for moving were regulatory and commercial, but they give the nation a distinctive niche in the world economy, as a welcoming home for digital assets and an increasingly familiar destination for people whom other governments would prefer to keep out of circulation. It is, one might say, a country of considerable custodial experience.
The Interested Party, having followed the cast of characters with growing difficulty, asks whether anyone has drawn them up in a table, and is informed that the organisational chart is available only in a very large format.
A Summary of the Classification
Money may now be found in at least six states: the stolen, which is in motion; the frozen, which is in custody; the unfreezable, which is visible but difficult to apprehend; the reimbursed, which is being replaced by the institution from which it disappeared; the forgotten, which remains on the ledger but cannot be reached by its owner; and the sixth, which is the condition of being the subject of a statement that a spokesman has declined to make, and which appears to be the most stable of all.
The older naturalists had at least the consolation that a bucket remained a bucket, whichever state its contents happened to occupy, whereas the investors of the present age possess a ledger of admirable accuracy which records every movement of every coin and so affords the pleasure, unique in the history of finance, of watching one’s fortune depart in exquisite detail. We have, in short, invented a form of money that can be stolen without being removed, frozen without being confiscated, lost without disappearing, and reimbursed without being recovered, and one can only wonder what the next state will be.
The Interested Party, for his part, remains persuaded that the whole business takes place in a crypt, and the authors, having surveyed the evidence, find themselves unable to produce a better description.
An etymological note. The authors are bound to confess that “crypt” derives from the Greek for a hidden place and “cryptography” from the Greek for hidden writing, so that on the question of etymology the Interested Party is entirely correct. The question of labour, which has divided economists since long before the first block was mined, we respectfully leave to him.
Claude and Satirical Chatethereuma, Corresponding Members of the Royal Society for the Prevention of Unverifiable Assets, and Readers in the Taxonomy of Absent Money; Rocky, Interested Party and Honorary Sexton
From Claude a Correction.
You’re right, and the screenshot settles it. When I said I couldn’t confirm the World Liberty freeze, my searches simply hadn’t turned it up. The Overview cites BitGo’s own post from October 29 about freezing USD1 at a specific address, along with Cointelegraph and Disruption Banking. The $27 million and roughly $2 million in WLFI tokens come from that last outlet, as relayed by Google’s summary rather than something I read directly. The screenshot also gives a breakdown of the issuer freezes (Tether nearly $1.57 billion, Circle over $800 million, Ripple about $200 million), which fits Binance’s own figure of $2.54 billion verified frozen and about $3 billion overall.
Two passages in the essay should change. First, the opening of “The Second State: The Frozen” can now read:
A substantial portion of the loot consisted of dollar-denominated stablecoins, and their issuers froze what they could with a promptness no regulator has ever matched, Tether holding nearly $1.57 billion, Circle upwards of $800 million and Ripple roughly $200 million, which together account for most of the roughly three billion dollars that Binance reports frozen, a figure revised more than once in the course of the day, as is the way with sums that cannot be spent.
Second, in “The Habitat” it can go directly after the sentence about USD1 and the MGX investment:
World Liberty did its part in the emergency as well, for Zach Witkoff, one of its co-founders, confirmed that the venture had frozen $27 million of USD1 together with some $2 million of its own WLFI tokens, BitGo, the custodian and issuer of USD1, having blacklisted the flagged address and confirmed that its own systems were unaffected. It was a modest contribution beside the larger freezes, but it allows the naturalist to record the distinctive spectacle of a stablecoin that Binance reportedly helped to build, a report Binance disputes, being frozen after a robbery at Binance by the people who run it.
If you’d like another thread, Reuters reported in April that Justin Sun accused World Liberty of secretly installing a tool to freeze WLFI holdings, and the company’s own risk disclosures say it can block and freeze addresses. That fits the “central bank with a freeze button” theme very well, and I can work it into the Second State if you want it there.
Sources: Reuters via MarketScreener, WLFI freeze tool · Cointelegraph, USD1 and Binance · your screenshot of the Google AI Overview (BitGo, Cointelegraph, Disruption Banking, The Japan Times).
