What happens if someone hacks into your bank account and steals your money? Is there anything you can do about it? At a high level, there are two somewhat reassuring answers:
Your bank might be able to get the money back. “Stealing your money,” in this context, means basically moving some money from your bank’s electronic ledger representing your account to another bank’s electronic ledger representing the thief’s account. Your bank can call the thief’s bank and be like “that was theft, give us our money back,” and the thief’s bank probably will. Banks are quasi-law-enforcement agencies, and they will cooperate to reverse fraud or theft.
On the other hand, the theft might be irreversible. The thief might have moved the money to another bank, and then withdrawn it in cash from the other bank, used the cash to buy art or casino chips, and rendered the money untraceable and removed from the electronic system allowing its recovery. In that case, you’re not necessarily out of luck. Your bank might be out of luck. Your bank is required to have good cybersecurity controls, prevent theft, etc., and if it messes this up it will probably have to reimburse you. This means, effectively, that the bank’s shareholders have to reimburse you. The bank has, like, $100 billion of money in its electronic ledgers, of which like $90 billion belongs to depositors like you and $10 billion belongs to its shareholders. (The $10 billion is the bank’s “capital,” and the law requires banks to have at least some minimum level of capital as a percentage of assets.) If the bank loses $100 of your money, it might have to subtract $100 from its shareholders’ money and add that back to yours. You are protected.
These answers are in various ways imperfect. There are scenarios where the bank might not have to reimburse you. (The term of art is that banks need to reimburse you for “fraud,” but not for “scams.”) And you could imagine really bad forms of hacking — where the hackers take all of the bank’s money, or where the bank loses its ledger of accounts entirely — where these solutions wouldn’t work.
What happens if someone hacks into your crypto account and steals your Bitcoin?[1] Is there anything you can do about that? There is a traditional crypto answer, which is “lol no, not your keys not your coins, bro!” More broadly:
Bitcoin transfers are irreversible. That is the point. The third sentence of Satoshi Nakamoto’s Bitcoin white paper complains that, in traditional finance, “completely non-reversible transactions are not really possible,” but Bitcoin fixes that. So if someone takes your Bitcoin, they’re gone.
If you hold Bitcoin for yourself, in your own wallet, there is no “bank” — no centralized intermediary — who might have to cover your losses.
Even if you hold Bitcoin in custody at a centralized crypto exchange, there is, uh, some history of those exchanges getting hacked and not covering customers’ losses. Crypto exchanges tend not to be held to rigorous risk-based capital requirements.
Last week, hackers took Binance, the big crypto exchange, for about $6.3 billion of customers’ cryptocurrencies, on the order of 5% of Binance’s assets. It’s apparently the largest crypto hack ever. “The fate of all crypto exchanges is to be hacked and lose their customers’ money,” I have said many times around here, and Binance can’t outrun fate. Apparently the hackers were from North Korea.
The two biggest stablecoin issuers said they took steps to freeze affected currency. Paolo Ardoino, the chief executive officer of Tether, said in an X post that it froze more than $1.5 billion of the stablecoin “related to a potential Binance exchange hack.” Jeremy Allaire, who runs Circle Internet Group Inc., said $800 million of its coin had been frozen amid “reports of a potential exploit involving Binance.”
A lot of the stolen money was in USDT and USDC. Those are stablecoins, blockchain-based tokens each representing a $1 deposit at Tether and Circle, respectively. Those tokens are redeemable for $1 at Tether or Circle, and they are traceable on the blockchain. When someone hacks into Binance and steals some USDT and USDC, Binance can call up Tether and Circle and say “hey please freeze those tokens.” (Tether and Circle answer the phone when Binance, the biggest crypto exchange, calls: Binance is in a sense their main customer.) Tether and Circle can easily do that: They can see where the tokens went and add the thief’s blockchain address to a blacklist, so that it can’t transfer any of the stolen tokens.
Unlike a bank, Tether and Circle can’t transfer those USDT or USDC back to Binance: Those tokens can only move on the blockchain, and can only be transferred by someone with the private keys. The theft is, technically, irreversible. But that is a small distinction: If Tether and Circle permanently freeze those tokens and conclude that they are no longer valid claims against their balance sheets, that leaves Tether and Circle with an extra $1.5 billion and $800 million, respectively, of cash that no longer has to back the thief’s USDT or USDC. Tether and Circle can mint new USDT and USDC tokens backed by that $2.3 billion, and give them back to Binance.
The result is centralized financial intermediaries (Tether, Circle) performing a quasi-law-enforcement function and reversing transactions to return stolen tokens to Binance.
That said, only about $3 billion of the stolen cryptocurrency was actually frozen (by Tether, Circle and “other crypto firms”), leaving a $3.3 billion hole of irreversible theft. Binance is not subject to much in the way of capital and customer protection regulation. On the other hand it’s a big lucrative business, and not run by idiots. Step 2 is that Binance’s shareholders eat the remaining loss:
Binance has an emergency reserve called the Secure Asset Fund for Users, or SAFU, set up for cyber incidents like this. As of Thursday, the SAFU held $1.23 billion in bitcoin, blockchain data shows. ...
Binance says it will fund the difference from its other company reserves. “Binance will cover all losses from the SAFU fund and company funds,” co-Chief Executive Richard Teng said Friday on X. …
A Binance spokesman said the exchange has already reserved over $6.3 billion of company funds, including the SAFU amount, to cover users’ affected assets. Of this sum, $5 billion is held in the same cryptocurrencies that hackers stole, the spokesman said. The company said it is fronting the money itself and will pay itself back with the $3 billion in frozen funds once it is released.
Binance is purchasing the remaining $1.3 billion of cryptocurrency through market channels, the spokesman said, adding this step could take longer.
The crypto ecosystem has matured enough that now it can rely on trusting well-capitalized central intermediaries who have reputational and business reasons for reversing fraudulent transactions. No doubt Satoshi Nakamoto would find this very annoying. But for the rest of us, it is very normal and sensible! You should be able to get your money back when it is stolen from your bank!
Binance hack price impact
That said. If you run a casino, and some guys in masks run into your casino carrying bags of cash, and they go up to a cashier and plunk down a sack of $1 billion and say “we need to turn this into chips right away,” how many chips should you give them? I feel like “$500 million worth” is a perfectly fair answer? They are expressing a high demand for liquidity, and you are taking a certain risk in this transaction. You should make sure it’s worth your while.
No, no, I’m kidding; casinos are subject to strict anti-money-laundering compliance requirements, and of course if masked men run into your casino with obviously stolen cash you should not help them launder it at all. Crypto has not matured to that point, though. Bloomberg’s Sidhartha Shukla and Emily Nicolle report that the Binance hackers expressed a high demand for liquidity, and liquidity providers charged them for it:
As apparent North Korean hackers rushed to convert funds stolen from the world’s biggest crypto exchange, they accepted punishing prices. That handed well-prepared traders a fleeting but lucrative opportunity. Bitquery, a blockchain data firm, estimates the attackers lost about $119 million through poor execution in their haste.
“The hack created sharp price volatility and a single, large, price-insensitive seller moving through thin liquidity,” said James Aitchison, chief investment officer at Caerus Global Management. That aggressive, one-way torrent distorted crypto prices across disparate venues and blockchains, he said, adding: “We traded the event and found several attractive dislocations.”
After gaining control of Binance funds on Oct. 29, the attackers focused on getting rid of the stablecoin portion of the haul, knowing issuers would soon begin freezing those stolen tokens. Within roughly half an hour, they began aggressively swapping stablecoins such as USDT into other cryptocurrencies like Ether, which can’t be frozen, buying the tokens wherever they could and jacking up the price.
Tether and Circle froze roughly $1.8 billion worth of their stablecoins about 40 minutes after the main Ethereum leg of the hack began, according to blockchain intelligence firm TRM Labs. …
Luca Parlamento, founder and chief investment officer of D2 Finance, said his firm spent the night “on the other side of the thief’s trades.”
Parlamento said the attackers paid an average of about $2,657 for Ether through decentralized exchanges such as Uniswap, well above the roughly $2,300 price on Hyperliquid, a crypto derivatives platform.
“The gap was ours to close,” Parlamento said.
A couple of points here:
Apparently the hackers paid up like 15% for immediate liquidity in size, which I am not sure I would call “poor execution.” Like I get that it’s poor execution in the context of a normal trader doing normal trades, but in the context of laundering stolen money, 15% does not seem especially egregious. The value of immediacy here was unusually high, and the hackers got what they paid for.
Were the counterparties taking a certain risk in these transactions? As far as I can tell Tether and Circle froze the $1.8 billion of stablecoins that the hackers still held, but not the stablecoins they had already traded for Ether. But that is to some extent a matter of Tether’s and Circle’s discretion: Circle, for instance, “reserves the right to ‘block’ certain USDC addresses and, if such addresses are Circle custodied addresses, freeze associated USDC (temporarily or permanently) that it determines, in its sole discretion, may be associated with illegal activity or activity that otherwise violates these Terms. In the event that you send USDC to a Blocked Address, or receive USDC from a Blocked Address, Circle may freeze such USDC and take steps to terminate your USDC Account.” There is at least some theoretical risk that if you’re buying tons of USDC from the North Korean hackers, you might end up losing the USDC. Again, this is arguably a reason — beyond just an intense demand for immediate liquidity — for charging them a bit more.
It is very funny and very crypto for those guys to be like “oh yeah we made a killing helping North Korea launder its stolen money.” I feel like in traditional finance you don’t brag about that to reporters.
The MSCI trade
The standard pump-and-dump approach goes something like this:
You find some small illiquid stock that trades at like $0.05 per share.
You buy some for $0.05, you sell it to your buddy for $0.07, he sells it back to you for $0.10, you sell it back to him for $0.15, etc., until you are printing trades at like $5.
You go on message boards to tout the stock: “This stock is UP 10,000% in JUST A WEEK because the company has FOUND A CURE FOR CANCER, get in on it now, etc.”
Some rubes see your post, they look at the trading activity, they think “oh wow yeah this stock is going up a lot, maybe it’ll go up more,” and they put in orders to buy the stock.
You sell your stock to the rubes.
Where do you find the rubes? The classic answer is “message boards,” but the supply of rubes on message boards is finite. Eventually people catch on to this trick.
The great modern answer is “index funds.” If you can pump the stock to a high enough price, it will be one of the 100 biggest stocks or whatever, and will go into the index of the Top 100 Stocks, at which point Top-100-Stock index funds will have no choice but to buy it. Those index funds probably control a lot more money than the rubes on message boards, and they will buy a lot of your stock, enabling you to offload it easily and profitably. The managers of those funds might or might not read your breathless posts on the message boards. “Man, this stock’s trading activity looks pretty fishy,” they might say, “and these posts about it curing cancer are obviously fake. But what choice do we have? We buy the index, and they’re in the index.” They are, as it were, structurally rubes.
They have some choice. If you get too egregious about this, the index-fund managers will call the index providers and say “hey you keep letting obviously fake stocks into the index.” What can the index providers do about it? A really important feature of most stock indexes is that the index providers are not making subjective judgment calls about stock quality: Most big stock indexes are designed for passive investing, not “here are the 100 best stocks” but rather “here are the 100 biggest stocks by market cap.” The index providers mostly defer to the judgment of the market, rather than making their own judgments on a stock-by-stock basis. (This whole theory has been tested a bit by modern artificial intelligence initial public offerings, but it is still roughly true.)
Instead, the basic protection against this sort of thing is:
Your country’s securities regulators probably have rules against egregious pump-and-dumps, and hopefully enforce them carefully enough that the pump-and-dumps are not constantly making it into the index.
If not, though, the index provider might cut your whole country out of the index. If your country’s list of top stocks is constantly full of pump-and-dumps, that arguably makes it uninvestible for index funds. Not for active funds! Active funds can look at the top stocks, say “well 10 of these are real companies whose managers we have met with, and 10 of them are obvious pump-and-dumps that are up 5,000% in a week, so we’ll buy the good ones and ignore the fishy ones.” Index funds do not have that luxury.
Even in Indonesia — a country where mysterious market gyrations are so common that the term “deep-fried stocks” is part of the financial lexicon — the report, penned in late January by the brokerage Samuel Sekuritas, was astonishing.
The 5,000% advance in PT Abadi Lestari Indonesia was merely the beginning, it declared. Before long, Abadi would crack into MSCI’s all-important benchmark indexes and the rally would just build and build, reaching nearly 50,000% and making the company more valuable than global consumer powerhouses like Korea’s LG Corp. and Italy’s Prada SpA.
What Samuel Sekuritas didn’t mention in the report was that, behind the scenes, its traders had been working with Abadi for weeks to pump up the stock and inflate trading volumes, according to people familiar with the matter.
We have talked about this trade before. “If you are really ambitious at pumping and dumping, the ultimate buyer of last resort — the final dumping place for your stock — is an index fund,” I wrote. MSCI is aware of all of this, but the solution is not to subjectively evaluate what stocks to include in the index; it’s to subjectively evaluate what countries to include:
Just two days after Samuel Sekuritas issued its research report, MSCI released a statement of its own that sent shockwaves through Indonesian markets. In it, MSCI said it had discovered “fundamental investability issues” that threatened to knock the country out of its emerging-market index. Among the key concerns that had arisen, the firm said, was that “coordinated trading” was distorting prices in the market.
MSCI doubled down on those statements last month, declaring that the country’s efforts to fix the problems were proving so insufficient that it could suffer a two-notch downgrade to an investing category occupied by the likes of Zimbabwe and Lebanon.
This seems to have worked:
The Indonesian market remains mired today in the deep funk that took hold from the moment the first MSCI warning hit. Abadi shares are down 70%; the benchmark stock index is off 40%; regulators are scrambling to expedite reforms and clean up the market; and, for the moment at least, the MSCI trade is on hold.
It’s an interesting policy question. If you’re the stock regulator in an emerging market, arguably having some of this stuff is good for local investors: They can get rich by selling vaporous shares to outsiders. (Suhartono and Wirayani note “the mindset that had taken hold among many in Jakarta’s financial set … that there’s really nothing wrong with engineering gains that benefit shareholders.“) But if you have too much of it, then it becomes very bad for local investors (and companies): You get kicked out of the index, and local investors can’t get money by selling shares of good companies to outsiders. The index funds are not subtle: Either they buy all the big stocks, however bad they are, or they buy no stocks.
Career risk hedging
Roughly speaking, if you started working at Anthropic PBC five years ago, you were probably a recent graduate with effective altruist leanings and a net worth somewhere near zero. And now you probably have, like, (1) $50 million worth of Anthropic stock and (2) human capital — measured in your ability to get a job elsewhere at very high pay — worth at least that much. Good for you! Congratulations. There is a lot of volatility in those numbers. I am not saying “if you went from zero to $100 million in five years, you could go back to zero in five more.” But, a lot of realized volatility.
A sensible person might want to hedge. I am not saying you’re a sensible person; you probably planned to give away all your money anyway, you’re totally focused on the mission, it may be difficult to know what role money will play in a post-artificial-general-intelligence world, etc. But a sensible person might want to hedge. Convert some of that stock and/or human capital into things that are not tied to the value of Anthropic. You could live well for the rest of your life (until the AI apocalypse) off $100 million. Quit while you’re ahead. I once wrote about a guy who made $300 million day-trading Tesla Inc. options:
First things first! Get the heck out of the Tesla options! The point of day-trading the Tesla options was to get you hundreds of millions of dollars, but now you have hundreds of millions of dollars, and you don’t need to day-trade the Tesla options anymore! Oh, what, you want to? You love day-trading Tesla options? Fine fine fine, go ahead, take ten million dollars and use it to day-trade Tesla options, and if you parlay that into hundreds of millions more dollars then that’s gravy. But you are too rich to have 100% of your net worth in Tesla options. The roulette wheel landed on your number 30 times in a row, you gotta stop!
The situation is not quite analogous; being an AI researcher has more persistent returns than retail options trading. Still.
There is only so much you can do to hedge your human capital.[2] But that stock, man. You might want to sell that. But this is hard. The stock doesn’t trade publicly; there are only occasional tender offers where you can sell. There are other possible hedges — sell forward contracts, sell perpetual futures on Hyperliquid, etc. — but they will get you fired: Anthropic’s “Insider Trading Policy applies to all of our officers, directors, and employees, as well as designated consultants, and specifically prohibits ownership of financial instruments or participation in investment strategies that hedge the economic risk of owning our equity securities, such as prepaid variable forwards, equity swaps, and collars.”
Plausibly the answer is to quit your job so that you have more freedom to hedge your stock. Oh of course you will be sad about that: Your job is prestigious and fulfilling, and you are quitting as a pure risk-management decision, not out of any dissatisfaction with the company. And you are giving up a ton of upside by quitting, and by hedging the stock for that matter. (Also of course this only works if a lot of your stock is already vested.) Maybe your stock will be worth $500 million in two years, etc.; you’re potentially leaving a lot of money on the table. But you are taking a lot of money off the table, and it’s all house money.
What do I know, though; you’re driven by the mission and have $50 million of Anthropic stock; I type in a box and don’t. None of this is any sort of investing advice. Here, however, is a Wall Street Journal article in which a guy claims that people are quitting big tech jobs to have more freedom to hedge their stock:
“We’re seeing really significant demand from folks looking to protect downside,” said Stephen Solaka, a senior vice president at Gateway Investment Advisers. ...
Solaka oversees portfolios for individuals who often have concentrated bets in individual stocks, including the tech giants that have powered markets in recent years. Increasingly, he said, his clients—some of whom are former employees of those very technology companies—are looking for something else: insurance.
“These people have made so much money, they’re quitting to hedge their stock,” Solaka said, adding that some companies have restrictions around employees’ trades.
You might think that giant stock compensation packages would help retain employees, but at some level they apparently drive them away.
Prediction market alt data
The good case for prediction markets is that they give people financial incentives to find and analyze information to discover the true probabilities of important events. It is interesting and arguably useful for the world to know the probability of, say, the Democrats winning the Senate, and if that probability on Kalshi or Polymarket is too high or too low, you can make money by making it correct. How do you know the probability is too high or too low? I think the main answers these days are:
Nate Silver-style quantitative aggregation of public polls, economic data, etc., and
Various forms of on-the-ground gut feeling.
Both seem socially useful to me; both, in different ways, add information to the world. Bloomberg’s Ben Weiss writes about some members of “an invite-only chatroom, known as Poly Alpha, for self-described ‘sharps,’” who “took field trips to Maine and Los Angeles” to get some gut feelings for the midterm elections:
On their trip to Maine, Bensoussan went to Bangor while Campbell flew to Portland with four other traders, and they went door-to-door speaking to everyone they could find about their perceptions of the election. Bensoussan was struck by how supporters of the Republican candidate, Susan Collins, were less willing to speak with him about whom they planned to vote for, which made him less eager to bet on the race and more suspicious of the polls, which have generally shown Democrat Troy Jackson in the lead.
Fine, great. Pretty soon, though, the money will be bigger, things will be a bit more professionalized, and hedge funds will be paying alternative data providers for satellite images of candidate lawn signs to predict election results. In some sense were are still in the infancy of for-profit election analysis: People look at polls, and they go door-to-door asking people who they are going to vote for. Surely as prediction markets get bigger the methods will get more powerful and more subtle?
You received this message because you are subscribed to Bloomberg’s Money Stuff newsletter. If a friend forwarded you this message, sign up here to get it in your inbox.
ledger of accounts
