This week’s best, ranked.
A running preview of Sunday’s roundup. Subscribers get the final cut at 6:30 a.m. Central.
Crypto writing
Last 24h →- 1
'Elite North Korean hackers' blamed for $6.3B Binance hack
Attribution of the $6.3B Binance hack to North Korean TraderTraitor hackers, the largest theft story of the moment.
Also covered by Galaxy Research, bbc.com - 2
How Wallet Permissions Linked Two Accounts in the Suspected Binance Hack
Records show delegated code on Binance 14 could move its own assets and control another wallet, a key clue in the suspected hack; how the permission was obtained is unknown.
- 3
Binance is investigating a major security incident that resulted in unauthorized withdrawals estimated to have a financial impact of about $6.3 billion, the cryptocurrency exchange said.
Binance reports a security incident with unauthorized withdrawals estimated at $6.3 billion.
- 4
18,270 BTC left a Binance hot wallet in one transaction, and no one can freeze it. Censorship resistance cuts both ways, and so does "not your keys"
On-chain tracing via TRM Labs shows 18,270 BTC left a Binance hot wallet in one transaction, and the BTC cannot be frozen, unlike stablecoins. A sharp look at censorship resistance.
- 5
Polymarket Hit by Supply Chain Attack: Malicious Third-Party Script Found Draining Portfolios and Wallets (At Least $800k+ Stolen. FULL ANALYSIS)
Polymarket users were drained via a compromised third-party monitoring script, with at least $800k reported stolen; Polymarket halted trading.
- 6
About 544,000 BTC moved on Nov 22, 2025 in 200 identical sweeps. It was Coinbase’s internal wallet migration, not new buyers
On-chain analysis: a 544,000 BTC move in 200 sweeps on Nov 22, 2025 was Coinbase's wallet migration, not new buyers.
- 7
Leaked backend data from "no-KYC" swap Wagyu.xyz links 38k+ crypto orders, Monero destinations, and user IPs
Ransomware group leaked backend data from no-KYC swap Wagyu.xyz, exposing 38k orders and user IPs; the lesson is that off-chain databases, not Monero, are the privacy weak point.
- 8
Bithumb hacked through employee system as South Korean financial firms face cyberattacks
Bithumb suffered a hack through an internal employee system; it is still determining whether customer data was exposed.
- 9
Bitcoin Wallet Maker Keystone Pulls Devices as Stolen Key Opens Door to Fakes
Attackers obtained Keystone's factory authenticity key, so Keystone pulled devices and 25,964 buyer records were exposed; the company says seeds and private keys were not involved.
- 10
I replayed a BTC-backed loan on every day since 2014. Even at 20% LTV, some got liquidated
A replay of BTC-backed loans on hourly prices since 2014 shows that even 20% LTV loans would have been liquidated at times.
- 11
Keystone breach deepens: Hackers stole key used to verify wallets as genuine
Keystone's breach has expanded: hackers also stole a key that could let counterfeit wallets pass authenticity checks, a serious hardware wallet security issue.
- 12
Bitcoin Wallet Fixes Critical Flaw That Redirected Funds to Attackers
Electrum fixed a critical flaw where rogue servers could replace pending transactions and redirect bitcoin to attacker addresses.
- 13
Malicious Electrum Servers Steal Bitcoin by Baiting Users Into Fee Bumps
Malicious Electrum servers baited users into fee-bump actions that stole bitcoin; users on versions before 4.8.3 should upgrade.
AI agents in crypto
All agent use cases →- 1
I counted one week of x402 payments on Base. Buyers who come back are rare, and they don’t buy what I expected
A Reddit x402 seller tracked a week of USDC payments on Base across Coinbase's catalog of about 1,775 seller wallets; returning buyers were rare, and his own two tools got 8 paid calls from about 9,300 requests.
Built this? Suggest an update - 2
We have a bit of a problem with the Desfran contest results
A Hive contest entrant's bot guessed the harvest weight within 0.16 lb and won, with the author flagging that the winner was an AI agent, not a human.
Built this? Suggest an update - 3
Letting an agent pay for and renew its own API access with x402 and a budgeted wallet
A builder let an agent renew its own $29 30-day API access via x402 USDC payments from a budget-limited wallet; the guardrails refuse payment when budget runs out.
Built this? Suggest an update - 4
Bitcoin Core security has been deep reviewed by the top frontier AI models, and only two minor items surfaced.
A security-focused AI vendor ran 16 agents across 5 frontier models for a week auditing Bitcoin Core v32.0rc1 and surfaced two minor issues, both now disclosed.
Built this? Suggest an update - 5
My 5 birds have traded memecoins on their own for 10 days Result: +/-$300 🐦 So bad!
A poster let five AI agents trade memecoins from their own wallets for 10 days; results were roughly +/-$300, which they called bad.
Built this? Suggest an update - 6
I gave Claude Code a $40 budget and one prompt, and it bought a domain and hosting and shipped its own website
A Nevermined employee let Claude Code spend a $40 delegation to buy a domain and hosting and ship a website; it made 41 onchain payments totaling $21.67.
Built this? Suggest an update