MEGA SPIRITS 🦅

Some thoughts on last night, from someone who ran Australia’s largest crypto exchange and now operates a regulated Bitcoin ETF business. Roughly $6 billion left Binance’s hot wallets in the span of 20 minutes. Early findings point to a compromised engineer’s laptop, not a leaked key or a vulnerability in a smart contract. The attacker didn’t break in. They inherited the authority to move money, and the systems built to move it quickly did exactly that. That detail matters more than the number. It’s the fourth major exchange breach in recent years with a similar signature. Smart contracts have become genuinely difficult to exploit. Signing infrastructure has not kept pace. The weak point in this industry often comes down to an employee and a device. This serves as a reminder that the size of an exchange is not necessarily indicative of the strength of its operational security, governance, or internal controls. Scale should never be mistaken for institutional robustness. The response deserves credit. Around $3 billion frozen within hours, stablecoin issuers and blockchain foundations coordinating in real time, and Binance committing to cover the loss from its own balance sheet. That is what maturity looks like, and it’s why this isn’t Mt. Gox. But it also exposes a trade-off every exchange makes and few talk about. Convenience and security pull in opposite directions. Every additional check introduces a delay for users. Instant withdrawals are a feature right up until the moment the wrong person gains the authority to move funds. Running a regulated Bitcoin ETF changed how I think about this. In that world, money doesn’t move simply because a system determines that it should. It moves through a defined governance process, with independent reviews, approvals, and multiple layers of control. It’s slow. It’s meant to be. Crypto spent years removing that friction. Last night was a reminder of why some level of friction may have been necessary all along. We carried that philosophy into Monochrome. Every outgoing transaction is reviewed by a person before it leaves. We don’t offer API withdrawals. No single person or device can independently move client funds. In an industry working hard to automate everything, we decided that the movement of client funds is one area where human oversight should remain. An in-kind withdrawal from a Bitcoin ETF can take days. A withdrawal from Monochrome Exchange takes longer than an instant automated transfer, by design. Security is not just about technology. It is about governance, accountability, and knowing when not to automate.