Nov 5, 2026 · 1h 18m
Crypto’s emergency powers face their hardest test
Uneasy Money: What the $6B Binance Hack Revealed About Who Can Freeze Stolen Funds
The Binance theft shows how decentralized protocols must balance permissionless access, rapid intervention, and legal exposure when stolen assets can be stopped.
- 1Aave lost nothing because participants froze affected markets as stolen funds moved through the protocol.
- 2Stablecoin issuers and protocols can contain theft, but intervention depends on governance, risk controls, and imperfect oracles.
- 3The FBI’s North Korea attribution raised difficult questions about sanctions exposure and whether crypto networks must block stolen funds.
Don't miss
The hosts confront whether Thorchain should have blocked funds after the FBI attributed the theft to North Korea, despite the legal risks for node operators.
The brief
The $6 billion Binance theft triggered a rapid response across crypto: Llama Risk, Aave participants, Tether, Circle, and others worked to freeze or contain stolen funds.
Adam Sadowski explains how the attacker moved USDT into ETH through Aave, while risk stewards froze affected markets and prevented Aave itself from taking losses.
The response exposed a central trade-off: tighter borrowing limits and emergency powers can reduce damage, but they also challenge permissionless access and decentralized governance.
The discussion turns to oracle limits, incident planning, and Synthetix’s ability to reclaim stolen assets—showing how technical safeguards become ethical choices under pressure.
After the FBI attributed the theft to North Korea, the hosts debate whether Thorchain should have blocked stolen funds and how that decision could create sanctions-law exposure.
What was said on this episode
18 statements · 6 positive · 9 negative · 3 neutral
Aave operated as designed, preserving solvency and allowing suppliers to withdraw funds.
“worked as it was intended, which is that users can supply collateral and create an over-collateralized loan, maintaining the solvency of the protocol and users so suppliers to the lending market can always withdraw their money.”
Listen at 11:22
- Adam Sadowskion Aave hacker positionNeutral13:16
The hacker supplied $60 million USDT as collateral and borrowed roughly $45 million ETH.
“They supplied $60 million of USDT and borrowed $45 million-ish worth of ETH.”
Listen at 13:16
- Adam Sadowskion Aave hacker positionNegative13:47
The hacker’s Aave position will be liquidated if ETH rises sufficiently.
“So if ETH goes up, they get liquidated.”
Listen at 13:47
An Aave market freeze blocks new borrowing and supplying but preserves repayment and withdrawals.
“when Aave executes a market freeze, that means that no one can borrow additional money from the market and no one can supply additional capital into the market. But it still keeps the... the ability for users to repay their debt and to withdraw their money from the capital.”
Listen at 22:10
- Adam Sadowskion DeFi protocol controlPositive34:01
DeFi protocols should retain control rather than relinquish it to third-party operators.
“We want to arrive at a system where the DeFi protocol is never relinquishing its control to a third-party operator”
Listen at 34:01
- Adam Sadowskion On-chain financial systemsNeutral37:28
Sophisticated on-chain financial systems will always require external data.
“in order to have a sophisticated financial system on-chain, we're always going to need external data that's coming in.”
Listen at 37:28
- Adam Sadowskion On-chain lending price feedsNegative37:52
A failed price feed can make a protocol insolvent or erase users’ positions immediately.
“That price feed goes out and you lose everything. The protocol can become insolvent or existing users can lose their entire position instantaneously, basically.”
Listen at 37:52
- Adam Sadowskion On-chain oracle risk layerNegative43:16
On-chain finance has an insufficiently understood risk layer beneath oracle infrastructure.
“there's a risk layer that is not yet fully understood.”
Listen at 43:16
Teams able to stop North Korea receiving Binance users’ stolen funds should do so.
“Stopping North Korea from getting money from fucking Binance users is a fine hook. If you find yourself stuck on that hook, you are in a privileged position to actually stop these motherfuckers, and you should.”
Listen at 52:19
- Adam Sadowskion Protocol incident-response planningPositive53:33
Protocols should establish incident-response plans and pre-agreed actions beforehand.
“just having a game plan beforehand for any kind of incident that could happen and what is your pre-agreed response action is really really great practice”
Listen at 53:33
Thorchain double-spent after an Ethereum one-block reorganization.
“Thorchain somehow double-spent, meaning Thorchain paid out because there was a one-block reorg on Ethereum.”
Listen at 54:57
Thorchain shut down and deployed an update to fix its reorganization vulnerability.
“they had to turn off and then they had to push an update”
Listen at 55:41
Thor nodes resumed operations and processed transactions involving FBI-listed addresses.
“The Thor nodes then vote to turn the network back on and in doing so, They processed transactions that were involving addresses that were explicitly on the FBI's list.”
Listen at 1:03:28
Thorchain processed nearly $200 million in DPRK-related volume over several days.
“they've already done like almost $200 million in volume for DPRK in like a few days.”
Listen at 1:03:42
About $30 million could not be frozen because the fiat victim was unidentified.
“I think Zach cited 30 million. Basically, he was watching about 30 million dollars that should have been stopped and should have been frozen, but couldn't because there was no victim identified.”
Listen at 1:11:08
Traditional banks are not prepared for rapidly connected crypto-finance thefts.
“banks are not fucking prepared for this shit.”
Listen at 1:11:52
Ethereum has begun accelerating its development roadmap.
“the acceleration of the roadmap finally has hit Ethereum”
Listen at 1:14:27
Ethereum’s roadmap is now being discussed on a 2028 timeline.
“now we're talking 2028”
Listen at 1:14:50
Statements are attributed to the speaker as said on the episode and reflect their view at the time, not PodLume's. They are not advice.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.