MrCartmill 🛡☀️

In 2014 I went nearly a week without sleep. I was running PayPal and attackers were inside our corporate network. They'd compromised an eBay employee's laptop, got onto the VPN, taken over a domain controller and made themselves domain admins. eBay and PayPal were one company then, on one Windows network. They stole 145M eBay user records, then came for the segregated vault holding PayPal's card credentials. We fought them off. They never got in, but they got close. Too close. Yesterday Binance lost ~$6.3B in what looks like the same way. A DevOps engineer's laptop, then a service inside the withdrawal stack, then withdrawals the signer approved because they came from a trusted source. Hot wallets emptied in under four hours. No key was stolen. Nobody broke cryptography or a ledger. They found someone with access and used the trust that came with it. Banks get hit exactly the same way. 2016: attackers inside Bangladesh Bank used its own SWIFT access to send $951M of payment orders to the NY Fed. $81M was lost. The rest was held because an unrelated sanctions filter tripped on the word "Jupiter". That was luck, and it only worked because wires took days to settle. June 2025: an IT employee at C&M Software, which connects Brazilian banks to Pix, sold his credentials for about $2,700. Attackers used them to send fake Pix transfers out of six institutions' reserve accounts at the central bank. ~$140M in under three hours. August 2025: stolen vendor credentials at Sinqia, another Pix connector. ~R$710M out of HSBC and one other institution in a single afternoon. The central bank froze most of it, after it had already moved. Same attack every time. Speed is what changed. When settlement took days, a filter, a correspondent bank or someone in ops could catch a bad payment. Pix, FedNow, SEPA Instant and blockchains settle in seconds. Payment security was mostly built for the slow world. PayPal's card and user data survived 2014 because domain admin on the corp network couldn't unlock it quickly enough, and our alerting caught the unusual activity on the network. That's the model. Approval policy no laptop or vendor login can reach. Velocity and anomaly limits enforced outside the system that sends. Dynamic caps on what any one wallet, account or service can move per hour. All of it in real time. About $3B of what left Binance has been frozen, almost all of it stablecoins. The $1.4B in bitcoin is sitting in 19 wallets and nobody can touch it. I don't think that's the problem. For decades the ability to reverse a wire or a card charge let a lot of weak security slide. You either stop the transfer before it's signed or you eat the loss. Nothing about the technology failed here. The chains processed exactly the transactions they were handed. Binance's own systems handed them the wrong ones because an engineer's laptop was compromised. That's operational security. eBay in 2014, Bangladesh Bank and two Pix connectors all failed at it on their own rails. In 2014 the attackers never reached the vault. If they had, the fraud losses would have been the small part. PayPal existed so people could pay without handing their card details to every merchant on the internet. We held those details so they didn't have to. Losing them would have broken the one thing the company was built on, and I'm not sure we would have recovered. I expect blockchains and digital assets to become the standard way money moves. Every custodian of digital assets, or of fiat on a real-time rail, is in that position now. The controls have to adapt to settlement in seconds, crypto or not.