GM, frens!

What we’re getting into this week (in 30 seconds):

_Plus:

f you want to argue about this week’s nonsense with actual humans, come find us in our Discord 🤠

And if you like our newsletter, we’d love for you to share it with someone who’d enjoy it too:

Days like today can make everything feel a lot more final than it really is. If you’ve been hit hard, you don’t need to find some grand lesson in it tonight. Sometimes getting through the day and giving yourself a bit of time is enough. It’s all still going to be there tomorrow. Sometimes it’s worth it to go out and touch that grass 🦗

There used to be something shocking about an exchange losing a fortune. Now people hear the news and nobody’s surprised even one bit. Sadly, we have become incredibly efficient at dealing with something our industry was supposed to get better at preventing 😷

Binance has reported a ‘security incident’ affecting about $6.3 billion (to date) - that would make it the largest crypto theft on record, roughly four times the size of last year’s Bybit hack.

An astonishing amount of money. But at the same time, an embarrassingly familiar story.

While people were watching billions leave, Binance was investigating a potential security issue. The reassurance followed: user funds were safe, and the company would cover losses 🪙

Those statements mean Binance intends to replace the missing assets. Definitely not that the assets stayed safe, though. Because they were already gone. Customers could be forgiven for wanting that distinction explained without having to translate exchange crisis language themselves.

Binance initially pointed to a compromised DevOps engineer’s laptop. Its later update said investigators had found additional breach points and that the attack could not have been carried out using one engineer’s permissions in a single click 👇

The laptop explanation understandably went down badly.

Yes, an employee getting targeted is entirely predictable but a company holding that much money should build its security around the assumption that somebody will eventually get through. Explaining where the attacker entered tells us very little about why the rest of the system failed to contain them 🤷‍♂

The early technical findings make that question more uncomfortable.

Somehow, Ethereum’s wallet upgrade got blamed too

Some coverage has latched onto EIP-7702 because the attacker used it to drain an Ethereum wallet. Apparently, spotting a feature in a transaction is enough to declare it responsible for everything that happened before 🥴

7702 lets an account authorize smart contract code to operate through it. That requires a valid signature from the account. The attacker could not simply point malicious code at Binance’s wallet and take over 🔑

They first needed the ability to obtain the signed authorization. Ethereum’s specification explicitly requires that signature.

The unanswered question is how Binance’s signing controls allowed that authorization to happen. Calling the resulting transaction a “7702 exploit” is just ignoring the question.

Some people don’t believe the story.

Replies to Binance’s announcement include accusations of an inside job and outright disbelief about its explanation 🧙

You can understand the suspicion. Community sees enormous transfers, then gets incomplete information from the company responsible. Its account changes as the investigation develops, while customers are stuck waiting for access.

To be completely honest, deciding the whole theft was staged would be handing Binance an unnecessary gift.

The onchain evidence supports a theft. Whether an insider helped is a separate question. Binance still needs to explain who or what could authorize these transfers, which safeguards were supposed to intervene and how the attacker got past them ✂

So yeah nobody needs to invent a secret plot to be furious about a real security failure. And customers don’t need to solve the crime before expecting accountability. They trusted Binance to keep control of their assets. The company lost that control. Identifying the does not settle the question of how well the custodian did its job.

So “funds are safe” currently rests on a commitment to fill the hole. Customers should judge that commitment by the replacement assets and restored withdrawals, rather than how confidently it gets repeated.

The previous record holder, Bybit, already gave the industry an expensive lesson in compromised signing processes. Its February 2025 theft involved attackers deceiving signers through compromised wallet provider infrastructure 🥱

AI doesn’t get to write the excuse

To pause here for a second - isn’t it getting tiresome to hear this crap about AI as if only hackers can access it?

Apparently, criminals are better at using it than multibillion dollar exchanges with government connections and a direct line to big tech and AI companies 😐

You’d think those advantages would produce some serious progress in cybersecurity. Instead, the money disappears and we’re asked to marvel at how sophisticated the thieves were.

This is still developing, and we’ll likely learn much more about what failed and who else got caught in it as the investigations continue 🕊

The advice is getting painfully old, but exchanges keep giving it fresh reasons to exist: keep them coins off exchanges and in a wallet ONLY YOU control..

.. and yeah telling people to take control of their coins is easy. Making that control safer takes considerably more work, especially when even dedicated signing devices can leave people guessing about what they are approving nowadays 🔓

This is why Ambire is taking that problem into its own hands. The team behind the extension and mobile wallet has introduced Ambire Ice, its own open source hardware wallet built for Safe accounts 🤯

That is a big step.

A physical device brings long term support into the job and people may trust it with their savings for years. Ambire is taking that responsibility on at a moment when trust in wallet makers badly needs earning back and this says a lot on its own 🤔

Today’s events make the need painfully clear. Our industry has already paid more than enough for security mishaps to stop shrugging at this problem forever.

If taking control of your coins is the real answer, making that control safer should be a priority. Ambire is backing that up with hardware people can inspect and even build themselves 👀

Watching somebody else consistently make money can do terrible things to your confidence. You’re reading everything you can find and still getting nowhere, while some stranger appears to know exactly what to buy. Eventually, following their trades starts to sound more sensible than trusting yourself.

Exchanges understood that feeling 👨‍🔬

Copy trading became a service where your account automatically follows a trader you choose. The successful trader gets an audience, and the exchange gets more business whenever that audience trades 🪙

It grew large enough that people are now building another business around helping traders get rid of those followers 👇

Bitget reported $9.2 billion in copy trading volume during the first quarter of 2025, up 36% from the previous quarter. By July, it reported 1.1 million followers after adding around 100,000 that month.

These are historical figures but the growth shows how quickly the habit became something exchanges could build around 💵

BingX reported more than 1.3 billion cumulative copy trading orders by February 2026, representing $580 billion in lifetime volume 💰

For traders who deliberately build a following, attracting attention can pay.

CEXes heavily invested in and made that copy trading meta grow. For example Binance allowed lead traders to receive up to 30% of followers’ profits and a 10% commission on their trading fees, subject to its conditions and caps, so someone with a strong record could earn from more than their own capital 🫢

Followers got access to their decisions, while the trader got compensated for sharing them.

Whether following that person actually works is another question, but at least everyone has agreed to the arrangement.

Onchain trading removed the need for that agreement.

Once people identify a successful wallet, they can watch it without involving its owner. Public APIs and onchain data provides account information that makes automated tracking possible. A trader can keep their mouth shut and still have strangers studying their positions 🕵

Tools have grown around that activity. HyperDash documents copying the combined exposure of up to three Hyperliquid wallets. Dexly offers copying through its interface. On Solana, GMGN helps people discover wallets and automatically follow their trades. There’s plenty more of similar tools 💻

It’s true that there is something appealing about checking what a trader actually bought instead of trusting whatever they claim on social media. Public transactions are harder to cheat than a screenshot.

But the discovery usually happens after the impressive returns. You find the wallet because it already made money, then assume the next trade will be just as good. Even if it is, arriving later can leave you with a very different result 😶

For the person being followed, the problem goes beyond strangers borrowing their homework.

That gives traders a reason to care about privacy that goes beyond hiding their balance. They may be perfectly comfortable with the market seeing a position, provided nobody can immediately connect it to every other trade they have made.

The industry encouraged people to find the smart money. Some of the smart money would now prefer to stop being found 🫥

Yes, as ridiculous as it sounds, a market is forming around hiding your identity from other traders.

People built businesses around finding good traders to copy. Now other people can build businesses around helping those traders get rid of them. The classic crypto switcheroo 🤪

ShieldTX is one example on Hyperliquid. It uses fresh accounts to make positions harder to connect to a known trader. The trades are still public, but working out who made them becomes harder 👇

You can see where this could go. Traders already compare fees when choosing a platform. If having their positions tied together costs them money too, they have a reason to care about privacy before opening the next trade 🎟

A service that helps them keep more of their returns has something much easier to sell than another promise about changing finance forever.

Some followers will hate losing access. They found a useful wallet and built their trading around watching it. That still does not give them a claim over whatever its owner does next. Someone choosing to hide their activity has not taken anything from you. You just have to do your own research again. Yes, tragic 🫠

For the people building privacy apps, there is a much better reason to get the experience right now. A trader who wants to use one before their next position will not appreciate a setup that takes an afternoon to understand. Making the tools easier to use would help everyone else who wants privacy but has been put off by the hassle 🛠

This gives onchain privacy another use case people can understand without a long explanation. Keeping a trading strategy to yourself is normal. People expect that elsewhere, and using a blockchain should not mean giving it up.

Each reason like this makes privacy harder to dismiss as something only criminals want. Someone should be able to keep control of their coins without turning their wallet into public entertainment. If the promise is financial freedom, deciding who gets to look over your shoulder belongs in there somewhere 🤐

Buying a coin is usually the easy bit. Staying interested while its builders argue about the future takes more effort, especially when you thought the whole point was to end up with something useful 👷

Zcash supporters are dealing with that over staking 👇

Independent team Shielded Labs picked up the work.

Swihart now runs Zcash Open Development Lab, and he still thinks the proposal is wrong for the network. On October 25, he argued that its benefits do not justify the extra complexity and security assumptions 🤔

So this is not a new idea being rejected before anyone has looked at it. Work that one organization abandoned has been developed by another, and they still disagree about whether Zcash needs it.

You can imagine how that feels for supporters. The project keeps producing work, but understanding which work might actually reach users requires following the history of who stopped building what and who picked it up afterward.

Top tier entertainment for anyone who bought private money and accidentally received a subscription to dev politics 🍿

Zcash currently uses mining. As more blocks follow a payment, it becomes increasingly difficult to reverse, but sufficiently powerful attackers can potentially reorganize the chain.

Crosslink proposes keeping mining and adding participants called finalizers, who would help lock in settled blocks. Holders could delegate ZEC through the Orchard shielded pool and earn rewards for supporting that system 💰

Shielded Labs opened incentivized testing this year, setting aside 500 ZEC across the program. People on the community forum volunteered to run the software, and contributors have since built tools around the test network 💵

The forum also shows the concern underneath the enthusiasm. One participant questioned whether the team should seek stronger signals of support before committing so much work. Shielded Labs’ response was that people should be able to assess a working system before deciding whether they want it adopted.

That makes sense. Expecting everyone to approve an idea before they can try it is a great way to keep every discussion theoretical forever. But building something first also creates the risk that a team pours resources into a feature the wider community eventually rejects 🙅

Those costs are real even when the money comes from willing backers. The people testing it are spending their time too. They deserve to know whether their work is helping evaluate a serious candidate or feeding an argument that will never be settled.

Despite all that, Swihart has not canceled Crosslink. His objection carries weight, but adoption requires everyone to agree. Testing has continued, and community members have produced working tools rather than merely posting opinions about them 🤓

That is where the criticism truly belongs - a proposal can be rejected after serious testing without the effort being pointless. What looks useless is an ecosystem that cannot turn the results into a clear decision, leaving supporters to cheer whichever team they already liked.

If participation means helping test a possible future, give that work a fair hearing. If it means waiting indefinitely while influential people disagree, do not act surprised when holders eventually decide they have more useful things to do 🥱

“The Biggest Opportunity In Crypto” - marion:

“Metric: The Next-Gen DEX” - Castle Labs:

“The Tokenized Carry Trade” - RWA.xyz:

That’s it for this week, frens.

If you enjoyed this edition, share the newsletter with someone who would enjoy it too. It only takes a few seconds and helps more people discover W3OF without us having to beg an algorithm for attention 💜

That’s us for this week. Keep an eye on the things that still matter after the excitement passes and we’ll see you next Friday.

Yours, The 🔥 Team