1. Why crypto hacks reach billions of dollars
Austin Campbell, founder and managing partner of Zero Knowledge Group, argued in a podcast interview recorded on November 2 that crypto hacks reach into the billions because the industry engineered its systems around technology risk and never adopted the basic financial risk controls that traditional markets rely on. He proposed that any transfer of $1 billion should face a mandatory 24-hour delay written into the protocol itself.
The comments came four days after Binance lost roughly $6.34 billion from its hot wallets on October 29, a figure the exchange gave in its post-mortem published on November 3. Campbell used the episode to make a broader point about how the sector has been built, rather than to dissect the details of a single break-in.
His central claim was compact. In his words, crypto never built itself for security outside of the technology vertical. In his telling, the industry concentrated on code, cryptography and software correctness, and treated questions such as how much value should be able to leave an institution at once, and how quickly, as somebody else's problem.
2. What is a 24-hour clock on large transfers?
A 24-hour clock, as Campbell described it, is a rule that forces a pause on very large movements of funds. If someone tries to move a billion dollars, the transfer does not complete immediately. It sits in a waiting state for a day, during which the owner, the exchange or a monitoring system can see it, question it and, if necessary, stop it.
Campbell stressed that such a hold would not depend on a person reviewing each payment and deciding whether it looks suspicious. It would operate as a rule of the protocol, applied automatically to any transaction above the threshold. In his phrasing, if you are going to move a billion dollars, there is a 24-hour clock on that transfer. He added that a sum of that size should not simply be sent out the door.
The idea resembles a mechanism known in blockchain engineering as a timelock, in which an action is scheduled and becomes executable only after a fixed interval. Timelocks are already used in some governance systems and smart contracts so that participants have time to react to changes. Campbell's proposal applies the same logic to the movement of customer funds at very large scale.
The practical value of a delay is easy to state. Many large thefts are completed within minutes, which leaves almost no opportunity for a human to notice and respond. A waiting period converts a theft that is finished before anyone looks into a theft that is merely in progress, and in progress means the money can still be frozen, flagged to other platforms or reversed.
3. How traditional finance handles the same problem
Campbell pointed to practices that are routine in conventional markets. We know what a circuit breaker is, he said, referring to the rules that halt trading on stock exchanges when prices move too far, too fast. Those pauses exist because decades of experience showed that markets can behave destructively when everything is allowed to happen at maximum speed.
He also drew on his own background as a market maker. When a single buyer keeps returning to purchase the same asset, he explained, a trading desk does not simply keep filling orders at the same price. It widens its quotes, signalling that the repeated demand is changing its assessment of the risk. He contrasted that with an operation that is just sitting there, delivering, delivering, delivering.
Campbell described these habits as 101-level risk management that are not being done in crypto. The phrase conveys his view that the missing safeguards are not advanced or experimental. They are fundamentals that banks, brokers and trading firms adopted long ago, and that most people in finance would consider ordinary prudence.
The distinction he drew between technology risk and financial risk is central to his argument. Technology risk covers flaws in software, stolen keys and compromised machines. Financial risk covers concentration, speed, limits and the question of how much loss any single failure can cause. A system can be well protected against the first kind and still be badly exposed to the second, because one failure may drain an unlimited amount of value.
4. What did the Binance post-mortem say?
Binance's own post-mortem, released on November 3, traces the theft to compromised machines belonging to engineers and to the abuse of an internal wallet signing service. The exchange said it will absorb the losses. On November 2 it reported that it had covered about 95 percent of the affected amount, and the post-mortem raised that to 98 percent of impacted token assets replenished as of October 31.
Blockchain analytics firm TRM Labs found that the stolen funds left across ten blockchains, with most of the movement taking place within about 20 minutes. The FBI attributed the theft to TraderTraitor, a hacking group linked to North Korea. North Korea has rejected that claim.
The planned fixes listed by Binance include a rebuilt wallet system, tighter controls on devices, stronger risk controls around the wallet service, and wider use of anomaly detection that relies on artificial intelligence. The document does not name a withdrawal delay, a cap on transfers or a timelock, which is the type of control Campbell is calling for. It also says that some of the measures will stay confidential, so outsiders cannot determine from the report alone whether such a limit is among them.
That gap is the reason Campbell's proposal stands out against the response so far. The fixes described concentrate on keeping attackers out and detecting them sooner, which falls on the technology side of his distinction. A hard ceiling on how much can leave in a given window would address the financial side, by limiting the damage even when a breach succeeds.
5. How are customers reacting to the theft?
Customer behaviour after the incident shows how much confidence is at stake. In the first 9.5 hours after Binance reopened withdrawals on November 1, users took out a net $3.64 billion. According to the exchange, that equals 2.1 percent of the $171 billion in assets it holds.
The figure is large in absolute terms but modest as a share of the whole, which suggests that most customers left their balances in place despite the scale of the theft. It also illustrates why a firm in Binance's position moves quickly to reimburse users. Withdrawals at that pace, if sustained, can threaten any institution that does not hold all of its customers' assets in readily available form.
Ram Ahluwalia, chief executive and founder of Lumida Wealth, appeared on the same episode and offered a harsher assessment of the wider industry. He said digital assets as a category have failed to secure their customer deposits, and called that incredibly disappointing. His remark reinforces the point that the debate concerns a pattern across the sector rather than one exchange.
6. Can artificial intelligence help attackers or defenders?
Campbell also addressed the role of artificial intelligence, which has featured in discussions of the Binance incident and of security more generally. He said the technology currently favours attackers, because it helps people locate vulnerabilities faster than before.
He added that the same tools can help defenders find and patch weaknesses. In the continuing contest between the two sides, though, he judged that attackers remain ahead. That assessment fits his broader argument, because if discovery of flaws is becoming faster and cheaper, controls that do not depend on finding every flaw first become more valuable.
A transfer delay is one such control. It does not require a defender to anticipate the specific method an attacker will use. It works by restricting how quickly any method, known or unknown, can turn a compromise into a completed loss. For that reason Campbell's approach is best read as a layer of protection that complements security engineering rather than replacing it.
Taken together, his comments sketch a view of security as layered. Software defences, staff training and monitoring reduce the chance of a breach, while limits on speed and size reduce the harm if one still occurs. In Campbell's argument, an industry that handles billions of dollars in customer deposits needs both kinds of protection, and so far it has built mostly the first. He regards that imbalance as the underlying reason single incidents can now reach into the billions.
7. What happens next for exchange security?
No regulator or exchange has announced a billion-dollar transfer delay, and Campbell's remarks are a proposal rather than a policy under consideration by any named body. The Binance post-mortem commits to specific engineering upgrades but, by its own account, leaves part of its planned measures undisclosed.
Whether the industry adopts anything resembling a mandatory waiting period will depend on how exchanges weigh security against speed. Instant settlement is a selling point of crypto markets, and a rule that holds large transfers for a day would cost users some of that immediacy. Supporters would argue that the cost applies only to extremely large movements, which few customers ever make.
The debate is likely to continue as the details of the Binance theft are digested. The facts already on the record, a loss of about $6.34 billion, a dispersal across ten blockchains in minutes and a stated reimbursement of 98 percent of affected token assets, give both sides of the argument plenty to work with.