Inside the $6 Billion Binance Hack | Ari Redbord

Binance was hit by a $6 billion hack. What happens when the stolen crypto starts moving? TRM Labs' Ari Redbord joins David Hoffman to unpack the frantic first hours of the response, how stablecoin issuers froze billions, and the clues pointing investigators toward North Korea. --- 📣SPOTIFY PREMIUM RSS FEED | USE CODE: SPOTIFY24 https://bankless.cc/spotify-premium --- BANKLESS SPONSOR TOOLS: 🔓NEAR | TRADE CONFIDENTIALLY, GET 20% BACK https://bankless.cc/near2026 🌍 RIPIO | LOCAL CURRENCIES, ONCHAIN https://bankless.cc/ripio 🛡️VIZOR | THE WALLET ZCASH DEVS USE https://bankless.cc/vizor --- TIMESTAMPS 00:00 The $6B Binance Hack 01:38 Inside TRM's War Room 03:29 Freezing Billions and Tracking Funds 08:51 Law Enforcement and Attack Clues 13:50 Why North Korea Is Different 21:26 The Regulatory Fallout for Crypto 24:53 AI and the Next Cyber Threat 27:43 Securing Crypto After the Attack --- RESOURCES Ari Redbord https://x.com/ARedbord TRM Labs https://www.trmlabs.com/ --- Not financial or tax advice. See our investment disclosures here: https://www.bankless.com/disclosures

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:02David Hoffman?

  All right, Redbord, you are at TRM Labs. At TRM Labs, you guys are just on the front lines of any big exchange hack. Let me start with this question here. The day of the Binance exchange hack, this was like a mythological day that never existed, only in our imaginations, but it's finally here. Was this expected? Was a Binance hack kind of expected in your possible futures? Or were you surprised to see this?

• 0:28Speaker 01

  Look, David, thank you for having me on in this crazy moment. If I look scruffier than usual, it's because I, as you indicated, sort of haven't slept all that much in the last 24 hours or so. Look, I think that as hackers have gotten more and more sophisticated, we're seeing higher and higher numbers. If you asked me, you know, a year or so ago, that there'd be a $1.5 billion hack on Bybit, I would have said, you know, that's crazy, right? Like, we're talking about a billion dollars a year by North Korea at the most, and then it happened in one day. We've now seen North Korea steal about 6, 7, 8 billion in the last six years or so, and then we saw them steal 6 billion yesterday evening.

• 1:11Speaker 01

  So, I mean, the threat actors on the other side of these hacks are becoming more and more sophisticated. There's more money within the crypto ecosystem, which makes crypto a target for these types of cyber attacks. And I know we'll probably get to this later, but AI is really supercharging these types of operations. So am I surprised that there's a $6 million hack of Binance? I don't think I'm really surprised about much of anything right now in this ecosystem.

• 1:39David Hoffman?

  The news broke about 12 hours, a little bit more than 12 hours ago, so like last evening, Eastern time, maybe 6, 7, 8 PM Eastern time. What have you been doing? Phyllis, put us in the life of Ari over the last like half of a day.

• 1:53Speaker 01

  Yeah, no, it's a great question. And, you know, I'll tell you, I've seen the ecosystem come together in really extraordinary ways, and we'll get into the work of Tether and Circle, I'm sure, in all of this and really beyond. But I was really proud of what happened at TRM, right? I mean, immediately, the team started reaching out to our clients and customers. What, you know, smaller exchanges potentially could be impacted. Our partners had reached out to our partners at Binance. We are a remote-first company, so we created a war room within Slack, where our blockchain intelligence team, where our global investigations team was coordinating, and then reaching out to our Beacon network partners.

• 2:36Speaker 01

  The Beacon network is the largest information-sharing network within the crypto ecosystem. It accounts for about 85% of all centralized crypto volume, think Binance, Coinbase, Kraken, OKX, Robinhood, Stripe, PayPal, and 100 global law enforcement agencies, all coordinating for a night like last night. And really kind of being able to leverage those resources, allowing us to move really, really quickly. So I would say it was an all-hands-on-deck, true war room mentality, where I also wanted to make sure that we were getting out information to the community as we could. So I was scrambling on the report we ultimately put out last night. My colleague Nick Carlson, who is too humble to like when I say stuff like this, I think

• 3:18Speaker 01

  is the foremost expert in the world on North Korea and cryptocurrency. He was, you know, talking to everyone he possibly could internally, externally, to really coordinate a lot of this effort.

• 3:29David Hoffman?

  As a result of the effort that you, TRM, and the Beacon network put in last night, is that why money was saved, assets were frozen, user funds were recovered? Can you talk about what the actual positive results of all that?

• 3:43Speaker 01

  Sure, yeah. And I certainly wouldn't take credit for all or any of it. I think that like what we did with Beacon is really bringing the community together. And essentially, the way Beacon works is as funds are moving in real time, law enforcement investigators, private investigators like Zach XBT and others, are flagging illicit proceeds as they're moving in real time, and they send out an alert to this network. So the real work that is being done here is like we bring the community together, but it's these investigators who are flagging addresses, and it's the exchanges who then are blocking them and working with law enforcement to seize back those funds. The two biggest players last night, again, outside of the Beacon network, were certainly Circle and Tether. And what they did was absolutely extraordinary.

• 4:28Speaker 01

  You know, I think that like, to me, if there are two headlines on this attack, it's one, obviously, this is the largest bank robbery in human history, you know, by magnitudes. You know, I was in this Netflix documentary called The Biggest Heist Ever. That was 70 million at the time. Even, you know, 4.2 was recovered in the Bitfinex case, right? This is bigger out the door than we could even imagine. So obviously, the number is really important, but to me, the response is really the story, right? Like, literally, Tether and Circle were able to freeze 40% of the stolen funds last night, about 2.4 billion, within an hour or so of the hack.

• 5:11Speaker 01

  That really shows the power and promise of what the crypto ecosystem is able to do from a compliance perspective, from a technology perspective, from an investigations perspective. So I think that the number of the hack is a huge story, but literally, I mean, more was recovered last night than any hack that has actually ever happened. And I think that's a really important story here, too.

• 5:30David Hoffman?

  I know this just happened, so we're on like hour 15, 16 of this. What's left to settle? When you're off of this live stream and you go back to work, I believe you haven't slept, so I hope you get some rest in shortly, but like, what's left to do? I know like some, the Ether is gone, like the Bitcoin is gone, like the permissionless immutable assets, those are just going to be hard to recover. So like, what's left to do today and this weekend and next week?

• 5:57Speaker 01

  So I hope you're not entirely right. I do think it's going to be really hard. It always becomes harder and harder to recover in that sort of decentralized ecosystem, where funds are starting to spread out, starting to move other places, where you're using smaller OTC brokers to off-ramp funds, to convert funds from crypto to cash. I can get into that in a moment. But the reality is that, you know, between the Beacon network and just the way that law enforcement works with the exchange community today, I still believe that there's hope. I mean, just to give your sort of, your listeners a sense, you know, as this attack happened, we're watching funds flow from Binance. And we put a bunch of graphs in our report last night that hopefully visualize this. But as you're seeing funds move, what we're doing is we're counting those funds, we're

• 6:41Speaker 01

  watching them go, we're labeling the addresses where those funds go, and we're watching every dollar move. So the hope is not just, hey, you know, obviously, stablecoin issuers have these really unique capabilities to immediately freeze, or what I call burn, and then ultimately reissue that asset, right? You're able to actually pull that, those funds out of an illicit actor's wallet address and put them into an inaccessible wallet address. It's just extraordinary capability. But for all the other, the other funds, the Ether, the Bitcoin, you know, potentially Bitcoin, as we see the laundering process move on, that becomes much harder, but not impossible. So as those bad actors are, well, as North Korea is trying to off-ramp those funds through

• 7:24Speaker 01

  exchanges, we need to use the Beacon network, we need to just use legal process to try to block and ultimately seize back those funds. Because the problem here is, right, this recovery effort is absolutely extraordinary. Again, like hats off to Circle and Tether for what they did last night for this ecosystem. But even with those funds out of play, it's still the largest hack ever by about 2X. I mean, so we're talking about a lot, a lot of money. And I guess, I guess the last point I'd make on this, and we can kind of get into this to the extent it's interesting, is it's North Korea. And, you know, when we talk about a hack, or, you know, hackers, or, you know, cyber criminals, you know, they're going to use the funds for a lot of different reasons. Some of it is just purely greed. You know, you want to make money, you want to buy cars, you want to, you know, buy yachts

• 8:08Speaker 01

  or whatever it ultimately is, the way Rosal Khan and lived in the Bitfinex hack, right? But when it's North Korea, we're talking about destabilization, we're talking about, you know, nuclear weapons ambition, we're talking about really destabilizing the Korean Peninsula and beyond. This is a country with, I think, estimates around a $20 billion economy. I mean, this is a banana republic by all accounts. They stole 6 billion last night. That's a third of their overall economy. I mean, just like, let that sit there for a second. That is crazy! So when we're talking about North Korea, to me, it puts an entirely other angle on any type of theft like this. It becomes a global security issue.

• 8:51David Hoffman?

  I know that when there's hacks of this size, we saw this with the Bybit hack, the FBI got involved immediately. What's been the engagement with law enforcement looks like? Like, what role do they play when it comes to hacks like this?

• 9:05Speaker 01

  Law enforcement plays a really critical role here. And look, I mean, I am a huge believer that between technology and community, you know, tracking and tracing, plus building out that Beacon network type of, type of collaboration, we can get a lot done, but we don't have legal process, right? So ultimately, an exchange or a stablecoin issuer is going to need a subpoena, or a search warrant, or a seizure warrant, in order to actually take those funds. And the funds that we seize back, there's likely going to be a civil forfeiture process, which is going to require court proceedings. So that's when you really need, you know, a Department of Justice, or a global prosecutor's office, or law enforcement to really get involved. There's, you know, there are limitations, right? Zach XBT is the best in the world, or one of the best in the world at tracking and

• 9:50Speaker 01

  tracing funds, but he can't serve that subpoena on the exchange to ultimately get those underlying records. And that's when you need that sort of real coordination. And that's what you're seeing from law enforcement, for sure.

• 10:00David Hoffman?

  There's this conversation around EIP 7702 and how the actual hack was executed. I know you're not Binance, you're not inside of their internal operations, so you only have so much limited perspective here, but what can you say about how the hack actually was executed and how novel of an exploit that was?

• 10:17Speaker 01

  Yeah, it's probably the one thing I would mostly stay away from here, only because I know that Binance has come out with some information, which I'm tracking, which honestly, their, their narrative around, I believe, an engineer whose laptop or computer systems was hacked in order to gain access to those, to those codes, those private keys, is consistent with what we were seeing on chain, the way this sort of exploit happened, and the way those funds ultimately left the platform. But I'd probably leave ultimately that to Binance, and ultimately figure out what happened over the course of a few days. I mean, if you think through Drift and some of the other activity that we saw over the summer...

• 10:56Speaker 01

  There could be an extraordinary story here of social engineering and how they ultimately gained access. And we'll see how kind of all that played out. One thing I think that's really important and really how we attributed North Korea in the first place is ultimately, we saw cash withdrawals about 36 hours ahead of the attack, small tornado cash withdrawals. Sorry, small tornado cash withdrawals at least 36 hours ahead. The attack code was tested on two wallets, then rehearsed on a third with test funds routed back to the attacker and only then installed on that Binance hot wallet. So what I think the story

• 11:36Speaker 01

  is going to ultimately tell is a long-term, very deliberate effort to plan, coordinate, and breach Binance's cybersecurity systems.

• 11:47David Hoffman?

  This is how I understand when the Lazarus Group identifies a potential attack vector, they kind of set up a dummy exploit and then they exploit it live, like on-chain. Like, they create a fake Binance wallet and then they see if they can actually do it live. Were you, is it possible to see these things come ahead of time based off certain patterns of like, oh, there's a bunch of gas transactions coming out of tornado cash? This is what you would expect to see in case of like some actual larger attack coming. Were there any signs that you could reveal ahead of time that this was coming?

• 12:19Speaker 01

  So, you know, obviously, this is that staging and rehearsal pattern that's really become a signature for North Korea cyber actors. And sure, you know, obviously, these are things that we can see on-chain, but the reality is, are they really standing out in a way that, you know, you see sort of this, it's, analogies aren't always useful, but in this case, it's like, you know, is an individual acting a certain way that is indicative of, you know, causing a murder or a school shooting? Or, you know, like, it's really easy to Monday morning quarterback what we should or shouldn't have seen. But I think the reality is, yeah, I mean, there's indicia on-chain, but there's a lot of activity on-chain and really hard to sort of see. But I think that's what we're seeing here.

• 13:02Speaker 01

  And in large part, you know, you asked me how my night was last night. Probably the most extraordinary moment was about 9:00, 9:30, maybe 10 o'clock, we were about to put out this report, basically kind of walking through the hack. And right before we did that, my colleague Nick Carlson, former FBI analyst, again, foremost expert in the world on North Korea, says this was North, he says to me, this was North Korea. And we really started to go through the why. And part of it very much is that staging and rehearsal piece, but we're also connecting addresses that we've seen in other hacks, you know, Drift, in particular. There's a lot of the similar signatures from Bybit. But your question is really getting to sort of how we started to really identify and

• 13:46Speaker 01

  believe with pretty high degree of confidence that that North Korea was involved here.

• 13:50David Hoffman?

  Does North Korea care about being identified? Like, if they exploit something and they get the Bitcoin, the Ether, like the bearer assets inside of their wallets, like, we can't go do something because they have nuclear bombs. And so like, do they really care about covering their traces, their footsteps?

• 14:08Speaker 01

  Not that much. And I think that's, that's really what's different about North Korea when you look in. And part of how we have, I think, carved out signatures over the years for North Korea, right? You know, you think of a painting. I think people like Nick and Christian Chesky and others on our global investigations team, you know, they look at this as an art, and they're watching how North Korea is operating and see these signatures. But yeah, part of their signature has always been, hey, we're going to steal as much money as we can. We don't really care if we lose some here or there. I mean, they lost a lot last night, but they also made off with arguably, well, what would it in and of itself be the largest hack ever by two acts, right? So they care a lot less about, you know, getting caught because no one's going to jail. There's never going

• 14:53Speaker 01

  to be an extradition. There's likely not going to be a criminal prosecution of any kind. And this is bank robbery for them at the speed of the internet. So I think that's always been sort of a signature for them. It's like, we're going to steal as much as we can, move it as fast as we can, and try to convert it for weapons proliferation and destabilizing activity. Part of what I believe is that we have to make them care more. And, you know, I talked a lot about cyber letters of Mark and this idea of using, you know, the private sector to go after cyber actors. We talk a lot about offensive cyber. When I was a prosecutor myself, and Nick, who I've mentioned several times when he was at the FBI, and a colleague of mine, Zia Faruki, who's now a federal judge, and others,

• 15:38Speaker 01

  issued a Patriot Act subpoena on a Chinese bank for records in a North Korea money laundering case. We need to put diplomatic pressure on China in order to act, right? That is still an important trading partner and important partner for North Korea. So there are things we can do beyond hardened cybersecurity at cryptocurrency exchanges. There are offensive tools we can use. To me, if they're stealing $6 billion, we should do everything we can to ultimately steal it back. So I think to your question, they don't care because no one's going to jail. And it becomes very, very hard to ultimately seize those funds back. But I think there are pressure points that we could put on them that would make them care more.

• 16:18David Hoffman?

  Yeah, it does feel very lame of us in the West on the United States side of things that like, North Korea just hacks billions of dollars and we're just like, ah, well, it's North Korea, like, can't do anything about it. How much more can we do? Like, if you were in charge, if you were in the US government and you were in charge of like, let's standing up like a cyber, cyber international police division, like, what would you try and do?

• 16:45Speaker 01

  Sure. Well, first of all, look, I am not in the national security space anymore. I'm not a senior government official. I was a prosecutor for many years and spent time at Treasury. So, but I do believe that our national security apparatus, our Department of War, our, our intelligence community are doing a lot of this work today.

• 17:06David Hoffman?

  Right. I guess they're just not disclosing it to people like me.

• 17:09Speaker 01

  Exactly. And, or me. But I believe we can, I always believe we can do more, especially in this space. And part of it is just that diplomatic pressure. And to me, like, all roads lead to China. You know, one other piece to this, and we saw that in the Bybit hack, is that eventually, North Korea turns these stolen funds over to professional money laundering networks. I think we talked about this a few months ago on the show, more generally. But if we haven't seen that here, we're going to see that here. Right? North Korea understands that, hey, we can sell these funds, you know, take a percentage and call it a day and let these Chinese organized crime groups try to use their network of

• 17:50Speaker 01

  OTC brokers and others to convert these funds to cash. We see cartels do the same thing. We see these transnational pig butchering networks do the same thing. So, but how do we put pressure on the Chinese government to put pressure on organized crime, right? Like, so I think there are levers we can pull. I mentioned a Patriot Act subpoena, offensive cyber. There are a lot of levers we can pull to really, really put pressure on this regime. But the reality is that, you know, this is not a Russia. This is not Iran. This is not a China, right? This is essentially a banana republic, an entirely rogue regime, who has never really cared that much about consequences.

• 18:31David Hoffman?

  I've been trading crypto for almost a decade, and I've used so many different wallets, exchanges, aggregators, or front-ends. And I'm basically always looking for the same thing, just one interface with a deep liquidity across a bunch of chains and assets, where I can access markets like perps, earn yield, trade confidentially, and still control all of my funds. And I've never really found it. And I'm just always switching wallets, juggling gas fees, or getting eaten by slippage. But near.com feels fundamentally different to me. I can do anything I want from any chain and keep all of my activity confidential. Crypto, tokenized assets, perps, payments, I can even earn yield confidentially. One account over 30 chains, confidential by default. It's the way that crypto ought to work. And it's powered by Near, which has moved over $30 billion cross-chain, uses

• 19:15David Hoffman?

  post-quantum signatures, and has run over five years on mainnet with zero downtime. Near.com is the best way to be on-chain and be in control. Get 20% of your trading fees back on near.com using the bankless link in the show notes, not investment advice. Dollar stablecoins taught Latin America how to store value on-chain. Rippio is taking that same idea and bringing it to the currencies people actually use every day. With wrapped fiat, Rippio is putting more than a decade of experience powering crypto infrastructure for leading companies across Latin America behind a suite of six local currency stablecoins, covering Argentina, Brazil, Mexico, Colombia, Chile, and Peru. Each is pegged one-to-one to its local currency and fully backed by reserves held in regulated financial institutions with independent attestations published for each token. But wrapped fiat is not just

• 19:58David Hoffman?

  designed to sit there, it's built to move. The suite is live across 10 EVM chains with liquidity and integrations already spanning platforms like Morpho, Uniswap, and Chainlink. Users can move between local payment rails like Pick's and Spay and matching wrapped fiat one-to-one in real time with zero fees on both on-ramps and off-ramps and no FX conversion. Local rails in, on-chain in the middle. And for builders, Rippio offers APIs, webhooks, widgets, and a sandbox just from day one. Start building with wrapped fiat today at platform.rippio.com. Your checking account isn't public, so why should your crypto be? As AI gets more powerful, your privacy gets weaker. Connecting your identity to your financial history, on-chain or off, is the easiest it's ever been and will only get easier from here. Every data breach adds another piece to the puzzle, and every public

• 20:43David Hoffman?

  transaction leaves a trail back to you. And when your wealth is visible, you become a target. Money that can be seen can be stolen. Being in control of your money should include controlling who sees what you do with it. Zcash fixes this. Zcash is private digital money with privacy enforced by zero-knowledge cryptography. Zcash shielded transactions that you send and spend without publicly revealing who you're paying or how much. When it comes to privacy, there is no second best. Get started with Zcash using Visor, the wallet Zcash devs and enthusiasts use to encrypt their money. Zcash wallets are non-trivial, and Visor goes the extra mile to make sure your money and privacy are fully protected. Open source, self-custodial, fully private. Use the link in the show notes to download Visor on mobile or desktop. Protect your future. Use Zcash.

• 21:26David Hoffman?

  What are the second-order consequences do you think might be coming to the crypto industry? I know this isn't an FTX implosion where there was fraud, but nonetheless, when something of this magnitude happens, I'm kind of just worried about the blowback on the industry, the increased regulation pressure. I'm sure entities like the FBI are just not happy with crypto because as a result of crypto, North Korea keeps on ending up with billions of dollars.

• 21:52Speaker 01

  You know, it's interesting. Yeah, it's a great question. And like, I think there, like, I've been asked that today, and I've been trying to sort of think it through because I do think this is different, like you said, than an FTX, or even a situation where you're seeing sanctions evasion at scale or some other type of activity that, you know, skeptics can sort of point to as a reason. I mean, when I think about the Genius Act, right, it essentially codifies exactly what happened.

• 22:16Speaker 01

  Yesterday evening, it it it envisions through regulation and legislation, stablecoin issuers having to do compliance to include freeze, seize, burn their native token when it's used for illicit purposes. This is an amazing example of that happening, the best ever. Sadly, like, there's also half of these funds you're not able to do that with. But the reality is, I think that this is like, to me, this is the compliance and law enforcement and national security provisions of genius at work. So I think that that's like an important lesson that I've been trying to hammer home. Because obviously, everyone's focused on the hack and North Korea, as they should be.

• 22:58Speaker 01

  But this is an amazing story to me for the industry, particularly around, you know, Tether and Circle and the amazing work they did. I was so, I was heartened to see Coinbase come out last night, very much in support of Binance, how can we help? I mean, these are two huge competitors that have fought it out over the years. But to come together in a moment like that for this community, I think, says a lot about what we're building. Another important piece, I mentioned the Beacon Network, right? The Clarity Act, rest in peace, I guess, codifies the Beacon Network. There's an entire section on certifying networks that information sharing, interdiction, disruption.

• 23:38Speaker 01

  So I think lawmakers, for a long time, have been thinking about, like, what do we do in reaction to this? You know, I spent time with a law enforcement agency this week, who couldn't have been more bullish on the way they're able to track and trace the flow of funds in ways they never could before. Quite frankly, worried that somehow they will lose connectivity to this industry, or the industry will be hurt in some way, will will lose the ability to use, you know, these capabilities to track and trace funds, a US federal law enforcement agency. So I say that to say that, like, will there be blowback? Like, yes, and there should be from a cybersecurity perspective. Like, we really, really need best practices.

• 24:22Speaker 01

  You know, I think DeFi has really learned that. I know the DeFi Education Fund, I met with them recently, are doing some really great work, you know, in the, in, in the wake of Kelp and Drift. I think this is, this probably calls for, you know, maybe Binance is the right place, given that they're the largest, you know, crypto business in the world by magnitudes, to kind of bring together the community to harden cybersecurity. So I think, I think it's really a mix of things. But honestly, I think a lot of what we need, we have. We just got to stop these types of events from happening.

• 24:53David Hoffman?

  One big concern that's kind of plaguing the crypto industry is that the rise of AI capacity to exploit vulnerabilities in software is as high as it's ever been and will only get higher from here. I don't know if this hack of Binance really is that same story. This seems, as you, as you kind of alluded to, a little bit more of the classical Lazarus Group strategy, which is social engineering of a internal Binance piece of hardware, laptop with private keys on it. Is there an AI story here? Or is this more of just the classical Lazarus exploit story?

• 25:29Speaker 01

  We don't know yet, is the short answer to it. But I think the sort of longer answer is, we have seen North Korea really lean in to AI, both open and frontier models, in order to, you know, do some of that social engineering upfront. We've also seen them use it in that just pure sort of tech cyber space, the, the exploit space. So I think that, one, we don't know. I've definitely not connected, and our team is not necessarily connected, AI to this specific hack. But I definitely think we've seen North Korea start to figure out how to use AI at scale. And obviously, that's like a huge focus for us at TRM. I think we spent some time in our last conversation on that. But what we're really trying to do now is use AI to combine on-chain and off-chain

• 26:14Speaker 01

  insights in order to sort of build a holistic picture of risk, which I think is very apropos here, in that we see all the on-chain activity, but now we're going to need to understand, hey, where are these funds going? Are these shell companies or these OTC brokers? Who's sort of moving these funds? And kind of build out that entire picture. But I would say that, like, that was a long wind of saying, I'm not sure. But if I, if I had to, you know, if I had to bet, I believe it was probably used in, in, in some way, you know, here, if, if nothing else, to work sort of on the exploit piece.

• 26:49David Hoffman?

  Maybe another way to say what you're saying is, like, even if the answer is no, we should prepare as if the answer is yes.

• 26:55Speaker 01

  Hundred percent. I mean, like, what we've seen over the last, right, September, October, is this just increasing spike in cyber activity? And, you know, if you ask me what keeps me up at night, it's that, right? It's, hey, if we saw 7,500 ransomware attacks last year, now we don't need humans, we don't need, you know, we don't need affiliates, we can have agentic affiliates. Why isn't that 75,000 or 7.5 million? And that, that's a civilization level threat. When North Korea has that level of capability to take down entire hospital systems, you know, entire, you know, giant exchanges. So, so I, I, I think that, that whether, whether it was used or not, it's absolutely

• 27:35Speaker 01

  something that, I don't know, I, we, I will likely spend the rest of my career working on, you know, to be sure, yeah.

• 27:43David Hoffman?

  What does the industry need to do in reaction to this? How should the industry adapt or change what we do, how we do it, in order to mitigate future instances like this?

• 27:55Speaker 01

  You know, look, I, I think it's an offense-defense type of game here. And I think it's, it's in part, we really, as a community, from the smallest DeFi protocol up to the Binance's of the world, really lean into cybersecurity. You know, look, like, while we couldn't have recovered funds as fast from a bank, no one could steal, walk into a bank and steal $6 billion either. So I think that, like, we got to figure out, how do we really, really safeguard the funds that are, that are on our platforms? And part of that is getting to the bottom of how exactly this happened. And I'm sure that will happen over the next few days. I think then it's this offensive piece, right? Like, hey, if, this, this is a nation-state actor, right? This is not a criminal, per se, this is a criminal state.

• 28:39Speaker 01

  So we need to use every national security tool at our disposal. So sanctions, you know, potential indictments, offensive cyber activity, you know, the, the whole gamut of national security tools. As I said, you know, Patriot Act subpoenas, whatever it takes on, on the offensive side. And, and finally, I think the community is going to continue to come together. I, I think Beacon is a great example. It was, I was really proud, is, is a hard word on a night like last night, but I was, I, I just stepped back for a moment and watched my team coming together. I mean, I joined TRM, we were eight people, we're about 500 today, and this company's grown over the last six years.

• 29:21Speaker 01

  And the team that I saw come together last night, people who just started, people like Nick who've been there forever, it was just, it was really heartening. And then I was simultaneously watching Tether do its thing and Circle do its thing, and World Liberty, Ripple, it was, it was just really extraordinary. And I think that's, that's in large part what I'll remember from, from, from my light, from my night last night. I also ate way too much Halloween candy, so I'm going to blame North Korea for that as well.

• 29:51David Hoffman?

  Stress eating some candy.

• 29:52Speaker 01

  Yes, definitely.

• 29:53David Hoffman?

  Can take a little bit of the edge off.

• 29:55Speaker 01

  Yeah.

• 29:55David Hoffman?

  Ari, well, I'm glad you have, I'm glad we have you in crypto. I know it was a tough day. It's a tough day for the industry, kind of on the, the four-year anniversary of, of FTX, more or less. But there was nonetheless some silver lining, as you kind of described, with the, the teams and the people that we have in, in crypto, making sure that we can, we can prevent stuff like this from happening in the future. I know it's been a very long night. Thank you for coming on and, and giving me some of the time of day to answer some of my questions. I'm sure the Bankless Nation is very appreciative of it.

• 30:24Speaker 01

  David, thank you, and, and thanks to Bankless Nation. It's, the, the, the important thing is really raising awareness, and that last couple of questions around what we could do, and I'm a big believer that we could do a lot and we could do it together. So thanks for having me on.

• 30:36David Hoffman?

  All right, all right, get some rest.

• 30:37Speaker 01

  Yep, thanks, buddy.