Five Ways to Celebrate a Whitepaper

Contribution by Peter

“I’ve been working on a new electronic cash system that’s fully peer-to-peer, with no trusted third party.”

With that sentence, on 31 October 2008, one Satoshi Nakamoto kicked off a new thread on a mailing list whose subscribers were mostly cryptographers. He wanted to share a whitepaper with them: “The paper is available at: http://www.bitcoin.org/bitcoin.pdf”.

Beyond that, Satoshi’s message contained only the abstract of the work he had gradually committed to paper over the course of a year and a half. There was no prophetic glimpse of a Dutch newsletter commemorating his work eighteen years later, nor any prediction that bitcoin would grow into a rival to gold. In the history of ‘crypto’ whitepaper announcements, this may well be the driest of them all.

A few months later, bitcoin saw the light of day and grew into one of the most talked-about phenomena of the past twenty years, with a loyal following of holders who see key founding principles in Satoshi’s whitepaper: a decentralised monetary system that anyone in the world can use without permission, whatever their reason. For them, Whitepaper Day is an annual holiday to pause and reflect on that.

Given the circumstances, this year’s edition may well be the most subdued yet. Almost everything around it seems to be on fire. The world, the internet, the markets, politics. The crypto world itself, thanks to the biggest exchange hack ever. The papers are full of alarmist headlines that push bitcoin’s origin story to the edge of relevance.

All the more reason to pause for a moment and look at the ways Satoshi’s writing is being celebrated, eighteen years on.

The first is the classic, missionary celebration, in which Satoshi is thanked for the work he delivered. For the revolution he started. For the technology and the community that grew up around it. And for the new opportunities that so many discovered, and cashed in on, through bitcoin.

That group now also includes traditional capital. Hence the ironic celebration: bitcoin became a huge success, but couldn’t stop the very crowd it originally rebelled against from becoming its biggest holder.

In reality, of course, it’s the clients of banks and asset managers who own the bitcoin. Wall Street is simply an easy and widely used route to owning it; in total, nearly $100 billion worth of bitcoin is parked in US bitcoin funds.

The very fact that bitcoin has seeped into every capillary of the financial world inspires in some a sense of wonder that calls for a very minimalist celebration. At its heart is the realisation that it took just 9 pages to launch a movement with global influence.

That movement began differently for every bitcoin holder. So Whitepaper Day also invites reflection, a kind of personal celebration. MEXC tapped into this by inviting people on X to write page ten of the whitepaper. What would you put on it? A flood of anecdotes followed, with people sharing their own ‘first time’, lessons learned or hopes.

Perhaps the 🎃 Halloween celebration is the most fitting one this year. Fear loomed large over this edition. Right on 30 and 31 October, the Crypto Fear & Greed Index sank to its lowest level in months, driven in part by news of the massive Binance hack. There’s an awkward paradox in that, of course: a celebration of decentralisation overshadowed by the fallout from problems at a single player. Eighteen years after a paper meant to make trust redundant, it was one central party that set the mood.

More on that... after the break!

More Alpha

Are you a Plus member? Then we’ll carry on with the following topics:

1. Binance heist: The biggest crypto hack ever
2. Cat-and-mouse game over Binance billions
3. Council of State tears into Box 3 plan, advises delay

After that come the news snacks, a handy roundup of the news that really mattered this past week.

1️⃣ Binance heist: The biggest crypto hack ever

Contribution by Peter

You can do a surprising number of things in twenty minutes. A power nap. A guided meditation. A brisk walk. Some language practice. Watch a presentation. Whip up a quick meal. Or... steal more than $6 billion from Binance’s vaults. The loot, spread across ten different blockchains, is the haul from the biggest crypto theft ever: more than four times what the Bybit hack netted in early 2025.

North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History | TRM Labs

On October 29, 2026, an attacker moved about $6.36 billion out of Binance wallets across ten blockchains, the largest crypto theft on record, and TRM attributes it to North Korea’s TraderTraitor, with evidence pointing to a compromise of Binance’s hot wallet signing infrastructure. About $2.7 billion has been frozen, but the attacker still holds roughly $2.4 billion, and TRM is tracking the funds and alerting partners through the Beacon Network.

TRM LabsTRM Team

The attacker drained the so-called hot wallets. They’re called hot because they’re connected to the internet, for example to process customer withdrawals. The bulk of customer funds sits in their offline counterparts, cold wallets, which are naturally much harder to access.

The initial investigation pointed to a hacked laptop belonging to a technical employee. Through that entry point, the attacker was eventually able to submit transactions as if Binance itself were executing them. The exchange is still investigating exactly how the attack unfolded.

Binance pays up

Binance says it will cover all losses itself. The exchange has set aside more than $6.3 billion for this from its own funds and from reserves built up for emergencies. On Sunday, Binance reported that it had replenished almost all of the stolen crypto. The remaining shortfall consists of smaller, illiquid tokens.

The company is taking these steps to calm nerves and reassure customers that their funds are safe and available. On Sunday morning, Binance put its money where its mouth is: withdrawals were gradually reopened. In the first ten hours, customers withdrew a net $3.64 billion. That’s roughly 2 percent of the assets customers hold on the exchange.

Binance’s reassurances seem to be working, as doom-mongers are in the minority on social media. But they’re out there, with the collapse of FTX as their cautionary tale. They point out that far from all assets on the platform can be withdrawn yet, that there’s no proof all reserves are actually available, and that Binance would be in deep trouble if more deposits head for the exit.

The evidence behind this camp’s claims is highly speculative. Still, they have a point that’s hard to brush aside: the true extent of the damage often only becomes clear in the weeks and months after the event.

The loot isn’t back yet

Meanwhile, the hunt for the perpetrators is under way, with US law enforcement among those involved; even President Trump has been briefed on the incident. According to the FBI, the attack can be attributed to North Korea.

Part of the loot has been frozen. But that doesn’t mean Binance has its money back. What’s more, the hackers still control billions in crypto that they’re trying to launder.

That kicks off the next phase: can law enforcement and crypto firms stop the perpetrators from cashing out? In the following article, Erik follows the money trail and examines whether the intended laundering route can be blocked.

2️⃣ Cat-and-mouse game over Binance billions

Contribution by Erik

On Saturday, the FBI stated in a press release that North Korea is responsible for the Binance theft of more than $6 billion. The hardest public evidence had already been supplied a day earlier by Chainalysis, which saw funds from the Binance hack commingling with the loot from Bitget, the September hack already attributed to North Korea.

The Binance haul is four times the previous record and spread across ten blockchains. According to Chainalysis, the laundering operation shows patterns it hasn’t seen before, pointing to extensive automation.

The laundering playbook

Every theft is followed by a well-worn laundering playbook, in which the first hour is crucial. Stablecoins can be frozen by their issuer; ETH and bitcoin can’t. So the Binance hacker immediately sent $500 million in stablecoins to a swap wallet and, within twenty minutes, converted $325 million into $285 million worth of ETH, happily swallowing a 12% loss.

Why not all $3.3 billion in stablecoins? Figures from analytics platform TRM suggest three reasons: the market couldn’t absorb it, Tether and Circle had already frozen funds within forty minutes, and the hacker’s sweeper script kept depositing fresh funds into a wallet Tether had already frozen.

As a result, some $2.7 billion in stablecoins was frozen. What remained: more than 420,000 ETH and 18,270 BTC, around $2.4 billion that no one can freeze.

Then the obfuscation begins. In the days that follow, the hackers swap the ETH that came from the stablecoins, plus the XRP and other coins, into bitcoin. THORChain is the go-to venue for this: it’s the largest exchange that pays out native bitcoin directly, with no intermediary able to halt an individual transaction.

On bitcoin, the peel chain begins: across a long chain of transactions, the loot is repeatedly split into a small piece and a large remainder, hundreds of times over, so analysts have to track hundreds of addresses instead of one. Chainalysis CEO Jonathan Levin expects the hackers to use tens of thousands of addresses in total over the coming weeks.

The final destination lies off-chain: Chinese OTC brokers who buy stolen crypto at a discount and settle in yuan, goods or payments to North Korean front companies, as happened with the DMM loot via the Cambodian marketplace Huione Guarantee. That channel has limited capacity; offloading $2.4 billion takes anywhere from months to years.

As mentioned, North Korea has seven major hacks to its name in two and a half years (see table). Of the roughly $3 billion from the six previous cases, an estimated less than 5 percent has been kept out of the hackers’ hands. The rest has either been funnelled towards fiat or still sits at addresses the hackers fully control. The defenders have learned to freeze faster, and the North Koreans have learned to swap faster.

The FBI asks THORChain nodes to block

After two days, more than six hundred addresses linked to the hack had been identified, nearly all of them on Ethereum. The FBI is calling on node operators of THORChain and other DeFi services to block transactions from those addresses. Unlike with Bybit, the request this time comes before the big swap: the 420,000 ETH and 233 million XRP are still sitting idle.

Can THORChain block the swaps? In early October, co-founder Chad Barraford explained it himself on the Unchained podcast. He argues it’s both difficult and undesirable. THORChain has no function to reject a specific address or an individual transaction: the protocol isn’t built as a service with an administrator who approves transactions. Building such a function requires a two-thirds majority of validators, which takes anywhere from a few days to a couple of weeks. And by the time a block is in place, the hackers will long since have moved on to new addresses.

Asked whether it’s possible in principle, Barraford is unequivocal: if two-thirds of validators want to censor, the community can. But that’s the slow route. The fast one, halting trading on a single chain with three votes, already exists and was used in February 2025. It was reversed after half an hour. So THORChain’s problem isn’t that it can’t, but that a majority doesn’t want to.

What the FBI is asking for, then, isn’t a technical favour but a political choice. As long as that choice isn’t made, the 420,000 ETH are ready to flow through THORChain into bitcoin at any moment. All the hackers have to do is press the button.

3️⃣ Council of State tears into Box 3 plan, advises delay

Contribution by Peter

The cabinet should postpone the overhaul of Box 3 until 2030. For once, that’s not the argument of yours truly, but of the Council of State, which today published its advice on the cabinet’s plan. The government’s advisers consider introducing a capital gains tax in 2028 irresponsible and strongly urge the cabinet to go back to the drawing board. Not to tweak what’s currently on the table, but to draft an entirely new bill that wouldn’t take effect until 2030.

The media are describing the Council of State’s verdict as damning. The plan falls apart on almost every front. The cabinet is moving too fast and working carelessly. The result would be unworkable, with all the consequences that entails for the Tax Administration, banks, financial institutions and citizens alike. The common thread: the way the cabinet is currently going about this is unacceptable.

Council of State scathing about rush on Box 3, budget talks under further pressure

The advisory body believes the plan should not go ahead because it is too rushed and not carefully thought through.

NOS NieuwsNOS Nieuws

In the latest version of the plan, State Secretary Eelco Eerenberg tried to take some of the sting out of the debate by broadening the exemption from the unrealised gains tax – the tax on paper profits – to all financial instruments. Gains on those are only taxed once you realise them; in other words, a capital gains tax. But ‘financial instruments’ is legal jargon for traditional investment products such as shares, bonds and derivatives. Cryptocurrencies and gold, to name but two, fall outside that definition.

The Council of State also flags this distinction:

“For example, the proposed distinction means that holding crypto-assets directly will be taxed on the basis of unrealised gains, while holding crypto-assets through an investment fund will be taxed on the basis of realised gains.”

In the following paragraph, the advisers politely but emphatically urge the cabinet not to go down that road:

“It is questionable whether the practical implementation constraints are proportionate to the inequality arising from the chosen hybrid design. [..] Applying a capital gains tax and an unrealised gains tax side by side on the basis of the aforementioned distinction is vulnerable. The fact that this is proposed for a short period does not change that. The Division therefore advises against introducing this distinction.”

For the crypto sector, which raised this issue through the Dutch Association of Crypto Service Providers, this is recognition of the fundamental design flaw in the tax plan. But it’s too early to breathe a sigh of relief; this is advice to the cabinet, not a court ruling that blocks the plans.

This week, the House of Representatives continues its deliberations on the file. We’ll then find out whether, and how seriously, lawmakers take this “damning verdict” to heart. The Council of State is already bracing for its advice to be ignored:

If, notwithstanding this advice, the government wishes to provide for the introduction of a capital gains tax via the amending bill [..], the Division advises introducing it for all Box 3 asset components no earlier than 2030.

Duly noted!

🍟 Snacks

To wrap up, a few quick snacks:

• Google is testing a new cloud service for secure crypto storage. The service, Google MPC, is aimed at banks and other financial institutions. Using the underlying technology, they can split control over access keys so that no one can move funds on their own or without others knowing. With this, Google is entering a market currently dominated by crypto firms such as Fireblocks and BitGo, leaning on its reputation and existing ties with banks, investment firms and insurers.
• Dutch households hold €3.2 billion in crypto with Dutch providers. That’s according to the first figures De Nederlandsche Bank has published on the subject. At the end of June, €1.5 billion of that was in bitcoin. Total Dutch crypto holdings are higher, as DNB doesn’t count balances on foreign platforms or in self-custody wallets. Investments via exchange-traded products are also excluded. So it remains unclear how much crypto the Dutch hold in total.
• Galaxy Research and Bitwise are bullish on bitcoin. Galaxy sees mounting evidence that the bottom is behind us. Among other things, it points to the behaviour of long-term holders, who make up an ever-smaller share of sellers. Bitwise looks further ahead and, in its base case, expects a bitcoin price of $1.6 million by 2036. To get there, bitcoin would need to capture a quarter of the store-of-value market, currently dominated by gold.
• The crypto market is getting ahead of Anthropic’s IPO. On the decentralised trading platform Hyperliquid, traders are speculating on the future share price of the company behind AI model Claude. They do so by buying derivatives that let them bet on price movements without owning any shares. On Hyperliquid, the price is hovering around $1,800, implying an estimated valuation of $1.8 trillion. In other words, crypto is already offering a price signal before the official listing price is even known.

Thank you for reading!

To stay informed about the latest market developments and insights, follow our team members on X:

• Bart Mol (@Bart_Mol)
• Peter Slagter (@pesla)
• Bert Slagter (@bslagter)
• Mike Lelieveld (@mlelieveld)

We appreciate your continued support and look forward to bringing you more comprehensive analysis in our next edition.

Until then!