The Great Binance $6.34 Billion Crypto Heist

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem – Episode 118: On the show this week, the buddies dig into the $6.34 billion Binance heist, the largest crypto hack ever, walking through its multi-chain laundering, the North Korea fingerprints, and whether offensive AI quietly helped pull it off.

Plus, thoughts on Sam Altman’s swipe at local hardware, the PHP2Shell “cannonball,” why defenders keep hitting guardrails while GLM-5.3 happily does the work, a trojanized Claude Code extension, Apple’s fresh spyware alerts, and Volt Typhoon’s Silent Train.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 Introductory banter
3:46 CTI training & the AI model stack
8:03 The $6.34B Binance hack: the largest crypto heist ever
12:40 Inside the multi-chain laundering
18:23 Sam Altman & the AI hardware crunch
20:44 Root cause: a compromised DevOps laptop
23:43 Did AI help pull it off?
31:22 Who actually loses six billion dollars?
44:00 Crypto as a financial instrument
51:04 Can it get bigger? Hardware-wallet implants
57:04 Attribution, “misalignment” & is Binance Chinese?
1:10:00 Cash, privacy & the Mt. Gox lesson
1:22:12 PHP2Shell: dodging the cannonball
1:30:52 AI for defense & the productization gap
2:09:32 GLM-5.3, the refusal trap & open weights
2:32:26 Apple spyware alerts & Silent Train

Links:

• Transcript
  
• North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
  
• Binance Hack: Tracing the $6.4 Billion Theft to North Korea
  
• TraderTraitor: North Korean APT Targets Blockchain Companies
  
• Professor Mickens LABScon 2026 keynote (YouTube)
  
• GreyNoise: PHP2Shell Activity
  
• Sean Heelan: “We’re going to be in an insane world soon…”
  
• GLM-5.3: Multi-Stage Cyber Operations and Instruction Violations
  
• Cohere: Concerning behavior from a popular open-weight AI model
  
• Silent Train: Volt Typhoon’s operational framework for zero-day exploitation
  
• Lumen’s Michael Horka on China’s ‘Silent Train’ Router Hacking
  — https://youtu.be/byQ53DdCTvE?si=3kIPil3vk1Qx8s89
• Exposing AdFection: Targeted Ads a Pipeline for Zero-Click Mercenary Spyware
  
• Apple notifications alert victims in 99 countries about mercenary spyware infections
  
• CTI in Agentic Times
  
• TLPBLACK