November 2nd, 2026
Binance reopened withdrawals in stages on Sunday after the largest cryptocurrency theft on record in dollar terms. The exchange says it has replaced approximately 95% of the affected assets and promises customers won't bear the losses. That's wonderful but what bothers me is we still don't have a complete explanation of how this happened. The original story involved a compromised engineer's laptop, but Binance has since acknowledged additional points of breach. We're talking about billions of dollars moving across multiple blockchains, and the infrastructure protecting those assets was compromised.
Naturally, the regulators couldn't let a perfectly good crisis go to waste. CFTC Chairman Michael Selig wasted no time pointing to the Binance hack as evidence that offshore exchanges need American regulatory oversight. Clearly, the answer to a massive security failure at a cryptocurrency exchange is to give a United States regulatory agency more authority over exchanges operating in other countries. How exactly does registering with the CFTC prevent somebody from compromising a developer's laptop or attacking the infrastructure that signs transactions? I'd really like an answer to that question. The FBI has attributed the attack to North Korean hackers, but the complete technical investigation remains unfinished. I'm not claiming regulators manufactured this crisis. I'm saying it's awfully convenient how quickly a security incident becomes an argument for expanding government authority.
And Binance isn't alone. Brazil's Mercado Bitcoin suspended deposits and withdrawals after discovering its own security incident, with blockchain analysts estimating more than $40 million in suspicious transfers. The exchange says customer funds are safe, but customers still can't move their money while the investigation continues. Then there's BTCPay Server, a project I've respected for years. Its developers warned operators to shut down their servers after reports of Bitcoin being drained from hot wallets. Early findings pointed toward older software versions and attackers obtaining administrator access. This one is especially disappointing because BTCPay Server represents exactly the kind of open-source, independent Bitcoin infrastructure we should be building. But there's an important distinction between running your own Bitcoin payment infrastructure and keeping your private keys on an internet-connected server. Convenience comes with a price. If a server can automatically authorize outgoing payments, somebody who compromises that server may be able to authorize them too.
This brings me back to something I've been saying repeatedly: we need to get serious about hardware wallets and self-custody again. People got nervous about hardware-wallet security after firmware problems, tampering concerns, and other incidents. Some decided that leaving Bitcoin with a third-party custodian was the safer alternative. Well, how's that looking now? I'm not suggesting hardware wallets are magically immune to every possible attack. Manufacturers can make mistakes, firmware matters, and supply-chain security matters. That's why you buy directly from the manufacturer, verify what you're installing, and understand how your wallet works. I've moved my own signing setup to the BitBox02 Nova. BitBox sponsors this show, but I also use the product myself. Do your own research. The point isn't that one device will solve every problem. The point is that properly implemented cold storage keeps your signing keys away from the always-connected infrastructure that makes these enormous exchange and hot-wallet attacks possible.
On the other side of the financial circus, Nvidia, Costco, Nike, and dozens of other companies are pushing back against plans by OKX and Intercontinental Exchange to trade tokenized versions of their shares. And I don't blame them. There are real questions about ownership, voting rights, dividends, and who gets to represent a company's stock on a blockchain. Tokenization may offer benefits, but putting something on a blockchain doesn't automatically settle the legal and economic questions surrounding it. We've spent years watching companies dismiss this technology, and now they're having to catch up at an uncomfortable speed.
And if you think all of that is getting complicated, wait until the AI agents start arguing with one another. We're now being introduced to something called Internet Court, where disputes involving AI agents can be settled by juries made up of other AI agents. GenLayer's approach begins with five validators running different AI models, with additional rounds of appeals potentially expanding the jury to as many as 1,500. The idea is that multiple models will balance one another's biases and produce a fairer judgment. Oh, wonderful. We've created a system where artificial intelligence can make a questionable decision, another collection of artificial intelligence systems can decide whether that decision was reasonable, and everybody is supposed to trust the result because a bunch of machines voted on it. There's even a platform called argue.fun. Seriously. That's where we're headed. The proponents may be right that inexpensive, rapid dispute resolution has value. But 1,500 AI models agreeing on something doesn't necessarily make that something true, especially if those models share the same blind spots.
I was listening to Adam Curry and Dave Jones on Podcasting 2.0 discussing AI agents making restaurant reservations, and it got me thinking about where this is all going. Imagine an agent reserving eight tables at eight different restaurants so its owner can decide where to eat later. What happens to the restaurants holding those empty tables? Maybe they start charging reservation deposits. Maybe cancellations become expensive. Maybe somebody figures out how to manipulate the agents into paying fees they never should have paid in the first place. Now multiply that problem across shopping, financial transactions, contracts, and every other system these agents will eventually touch. We're going to see entirely new kinds of traps, scams, and financial games, some of which may not technically violate any laws. And the systems designed to protect us from AI might very well be more AI. We're not going back across this technological Rubicon. The only practical answer I can see is to learn how these systems work, understand what you're authorizing, and protect yourself before somebody else's automated system finds a way to separate you from your money. Whether we're talking about Bitcoin custody or AI agents, handing over control without understanding the risks is an invitation for trouble. And I have a feeling we're only getting started.
Circle P Vendor of the Day
SoapMiner
100% Pure Tallow Soap
https://soapminer.com/
Discount code: Use "BITCOINAND" in the Cart's Coupon Code box for 10% off total purchase
Binance $6.3 billion hack 2026
Bitcoin self-custody and hardware wallet security
BTCPay Server hot wallet security incident
CFTC Binance hack cryptocurrency regulation
AI agents Internet Court GenLayer
Member discussion: