Deconflict.com

Binance says roughly $6.3 billion was taken in Thursday’s attack. But the stolen funds aren’t the most important part of this story. The bigger question is how the attacker got Binance’s own systems to authorize the transfers. Some background first. Exchanges use hot wallets to process customer withdrawals quickly. These wallets are connected to the internet. Think of them as operating accounts that keep funds available for everyday transactions. Ethereum’s EIP-7702 lets a regular wallet delegate execution to smart contract code through a signed authorization. It gives wallets more flexibility. It also means that if someone gets a wallet to sign the wrong authorization, that wallet will run the attacker’s code. That’s what happened on Ethereum. The attacker submitted a transaction carrying 50 authorizations, all signed by a Binance hot wallet and all pointing it at the attacker’s contract. Each covered a different nonce, the counter Ethereum uses to sequence a wallet’s transactions. The wallet was busy processing withdrawals, so its nonce kept moving. Preparing 50 gave the attacker room for one to match when the transaction landed. One did. Minutes later, a single transaction moved ETH and dozens of other tokens out of the wallet. And because Binance’s systems kept routing customer deposits into that wallet, the attacker kept sweeping them out. The malicious delegation stayed active for nearly four hours before it was revoked. But Ethereum was only part of the theft. Researchers tracking the funds counted unauthorized transfers across ten blockchains. Most of those networks don’t support EIP-7702. There, the funds left through ordinary transfers carrying valid Binance signatures. That’s the real issue. Across every chain, the common thread is valid signatures from Binance-controlled wallets. Binance’s preliminary findings point to a compromised DevOps engineer’s laptop that may have given the attacker access to an internal service container. The company says it has found no evidence that private keys leaked, and that it has since identified additional points of breach. The full attack path hasn’t been published. An attacker may not need to steal a private key if they can compromise the system authorized to use it. On the recovery side, Binance says it has set aside more than $6.34 billion of company funds to cover user losses. About $5 billion of that is already held in the exact tokens that were taken. The rest is being bought through market and OTC channels to match the affected assets, which will take longer for low-liquidity tokens. Separately, about $3 billion has been frozen with help from industry partners, and Binance says it has begun recovering affected assets while working with law enforcement, issuers and blockchain intelligence firms to trace and freeze more. It also says user funds will ultimately be verified publicly through its Proof of Reserves. That’s a serious response, and it matters. But frozen is not recovered. Getting those funds back is a separate legal process, and it takes time. Takeaway: treating this as an EIP-7702 problem is too narrow. The feature helped carry out the Ethereum theft. It doesn’t explain the transfers on the other chains. Blocking it alone would not have stopped what happened elsewhere. Protecting private keys is essential. So is controlling who can request a signature, what they can authorize, and what independently stops a request that shouldn’t go through. A valid signature proves a transaction was signed. Kudos to the Binance security team and the stablecoin issuers who moved fast enough to freeze $3 billion within hours. #binance

Why a National Fraud Strategy Could Change How the U.S. Fights Financial Crime TL;DR Nasdaq CEO Adena Friedman has called for a U.S. National Fraud Strategy built around responsible public-private collaboration. Banks, payment networks, telecom providers, technology companies, and law enforcement each hold different evidence of the same fraud network. Existing models, including FS-ISAC, Section 314(b), and bank consortiums, show that trusted information sharing can expose patterns no single institution can see. A useful framework must protect privacy, preserve agency and institutional control, and show the source and status of shared intelligence. Deconflict adds verified law-enforcement context and controlled coordination to the wider financial-crime intelligence network. Nasdaq CEO Adena Friedman is calling for a national framework that brings financial institutions, law enforcement, telecommunications companies, payment networks, and technology providers together. The important question is what that collaboration should look like in practice. Financial crime increasingly operates as a network. A victim may interact with a fraudulent website. A telecommunications provider may see the phone infrastructure behind the scam. One bank sees an outgoing payment. Another institution receives it. A cryptocurrency exchange may see the next movement of funds. Law enforcement may already be investigating one of the people, accounts, or identifiers involved. Each organization sees something. Very few see everything. That was the central problem Nasdaq Chair and CEO Adena Friedman addressed in remarks this week at the American Banker Most Powerful Women in Banking and Finance Conference. She called for the United States to develop a National Fraud Strategy designed around responsible intelligence sharing and collaboration among financial institutions, law enforcement, telecommunications providers, payment networks, technology companies, and other participants in the financial system. Her argument deserves attention because it moves the financial-crime conversation beyond a familiar question: Which institution has the best fraud technology? The harder question is becoming: How do institutions combine what they independently know without losing control of sensitive information? Financial crime has outgrown institutional boundaries The financial system has become more interconnected. Payments settle faster. Consumers move between banks, fintechs, wallets, and payment applications with little friction. Digital assets introduce additional rails. Criminal organizations use the same connectivity to operate across institutions and jurisdictions. Friedman described this as an "age of convergence," where AI, digital payments, tokenization, and always-on financial services are dissolving many of the boundaries that once separated different parts of the financial system. As those boundaries weaken, fraud and cybercrime can move through the system faster as well. That creates a structural limitation for institution-by-institution fraud prevention. A financial institution can have excellent transaction monitoring and still only see the transactions occurring within its environment. A telecommunications company can detect suspicious device or phone activity without knowing what happened at the bank. A bank can investigate an account without knowing another bank is reviewing related activity. And a financial institution may have no visibility into the fact that a law-enforcement agency is already investigating a relevant wallet, counterparty, or identifier. Better analytics inside each organization matter. But they do not automatically create visibility across organizations. Nasdaq is proposing collaboration, not another regulator One of the more important parts of Friedman's proposal is what she did not call for. She did not propose creating another regulator or another federal enforcement agency. She also did not frame the answer as simply adding another compliance obligation. Instead, she proposed a National Fraud Strategy built around several practical ideas: responsible information sharing, common practices, broader participation across industries, legal protections that make organizations more comfortable collaborating, joint suspicious activity reporting, and a stronger feedback loop between financial institutions and law enforcement. That distinction matters. Financial institutions already generate enormous amounts of fraud and AML information. Law enforcement already generates investigative intelligence. Telecommunications companies have network intelligence. Payment companies have transaction data. Technology providers have their own signals. The problem is not always that the information does not exist. Often, the problem is that relevant information exists in different places and cannot easily be connected at the moment it would be most useful. We already know information sharing can work A National Fraud Strategy would not need to begin from zero. Friedman pointed to two existing models. The first is FS-ISAC, which gives financial institutions a trusted framework for sharing cyber-threat intelligence. The second is Section 314(b) of the USA PATRIOT Act, which provides a legal framework through which eligible financial institutions can voluntarily share information related to suspected money laundering and terrorist financing. Nasdaq has also demonstrated what cross-institution intelligence can reveal through Verafin. Friedman said Verafin's consortium encompasses roughly 2,800 banks and has supported more than 130,000 collaborative investigations. In one example she described, activity that initially appeared to involve a handful of unrelated fraud alerts ultimately connected more than 1,000 accounts across over 45 financial institutions. No single institution had enough information to reconstruct the broader network on its own. That is the point. The value of collaboration is not simply adding more data to an alert. It is revealing relationships that only become visible when different vantage points are connected. But information sharing needs boundaries More information sharing is not automatically better information sharing. Financial institutions and law-enforcement agencies operate under legal, privacy, supervisory, and investigative constraints. Sensitive information cannot simply be pooled into a central repository because it might someday be useful. Any serious national fraud-information framework therefore needs to answer some difficult operational questions. Who contributed the intelligence? How recently was it verified? Who is permitted to see it? What exactly is being disclosed? Can an organization identify that another participant holds relevant information without seeing the underlying information itself? Can the contributing organization decide whether additional information should be released? Is there an attributable record of what was exchanged? When intelligence comes from law enforcement, can the receiving institution establish that the agency and investigator are actually who they claim to be? These are not secondary implementation details. They are what determine whether organizations will participate in the first place. The architecture of information sharing matters as much as the amount of information being shared. Law enforcement has a distinct role in the intelligence network Much of the financial industry's existing information-sharing infrastructure connects financial institutions to other financial institutions. That is enormously valuable. But law enforcement holds a different category of information. An investigator may know that a wallet appears in an active investigation. Another agency may already be working the same subject. A prosecutor may have relevant legal process underway. An investigator may possess context that does not exist in transaction data, behavioral models, sanctions lists, or commercially available intelligence. That information carries its own constraints. An investigative match is not proof that someone committed a crime. It should not automatically cause an account closure, transaction block, or other adverse decision. But it can provide meaningful additional context. For a financial institution already reviewing a wallet, account, or counterparty, knowing that relevant verified investigative intelligence exists may change how the institution prioritizes the review, documents the matter, or determines whether further investigation is appropriate. For law enforcement, knowing that another verified agency is already investigating the same identifier can expose overlap before two agencies spend weeks working parallel cases without knowing the other exists. Those are different problems, but they originate from the same structural issue: fragmented intelligence. From information sharing to intelligence coordination This is where the conversation around a National Fraud Strategy becomes especially important. Sharing more information is useful. The larger opportunity is building an operating model where relevant intelligence can move between authorized organizations with provenance, permissions, and accountability attached. That means moving beyond informal phone calls, disconnected email chains, and periodic information exchanges toward infrastructure capable of supporting persistent collaboration. The model should allow institutions to: identify relevant overlap without automatically exposing the underlying information; understand where intelligence came from; distinguish verified information from analytical inference; communicate with authenticated counterparts when additional context is appropriate; control what is disclosed and to whom; preserve an auditable record of the interaction; and continue using their existing investigation, compliance, and case-management systems. This does not require every organization to use the same fraud platform. In fact, a useful national strategy should assume the opposite. Banks will continue using different transaction-monitoring systems. Investigators will use different case-management platforms. Financial institutions will rely on different fraud, identity, blockchain, and sanctions providers. The collaboration layer has to work across that diversity. Where Deconflict fits Deconflict was built around this information gap. Participating law-enforcement agencies can identify potential investigative overlap without contributing raw case files or investigative narratives. Financial institutions can receive relevant Verified Intelligence alongside the compliance and investigative systems they already use. When further communication is appropriate, verified participants can coordinate through an attributable, auditable channel. That is complementary to the infrastructure already operating across the financial system. Blockchain analytics remains useful for understanding on-chain activity. Transaction monitoring evaluates financial behavior. Fraud platforms detect patterns. Consortiums can reveal activity across participating financial institutions. Deconflict adds another vantage point: verified investigative intelligence originating from participating law-enforcement agencies and the ability to connect authorized parties when relevant overlap exists. The institution still makes its own decision. Investigators retain control of their information. Legal process still applies. The objective is not to centralize every piece of financial-crime information. It is to make the right piece of intelligence discoverable by the right authorized participant at the right time. The next generation of financial-crime infrastructure will be collaborative Friedman's proposal reflects a broader change already happening across financial crime. The industry spent years improving detection inside individual institutions. That work continues. But the next challenge is increasingly about what happens between institutions. Criminal networks already take advantage of fragmentation across banks, telecom providers, payment platforms, digital-asset companies, and jurisdictions. The institutions fighting those networks cannot afford to remain equally fragmented. A National Fraud Strategy could help establish the legal frameworks, participation standards, and operating principles necessary to change that. Technology will be part of the answer. But the larger shift is organizational. The financial system is moving toward a model in which protecting one institution increasingly depends on what the broader network can see together. That is a harder problem than building another fraud model. It may also be one of the most important financial-crime problems left to solve. About Deconflict Deconflict provides Verified Intelligence for Financial Crime. Deconflict connects participating law-enforcement agencies and regulated financial institutions so authorized teams can identify relevant investigative overlap, add verified investigative context to existing workflows, and coordinate securely when appropriate. Learn more at deconflict.com. Source Nasdaq, "Nasdaq Chair and CEO Adena Friedman Calls for Unified, Public-Private Collaboration to Combat the $579B Global Financial Fraud Epidemic," October 20, 2026. Read Adena Friedman's full remarks on Nasdaq. nasdaq.com/newsroom/nasdaq-c…

Napster Corp. taught the music industry what happens when real listeners take songs without paying. This week the U.S. Department of Justice sentenced a man for the reverse: listeners who never existed, collecting real money🎵 The charge is what DOJ calls its first-ever “super intelligence assisted” streaming fraud. Super intelligence... I guess regular AI got a promotion while the rest of us weren’t looking. Michael Smith got 18 months and forfeited about $8.09 million. According to U.S. Attorney's Office for the Southern District of New York, he ran thousands of bot accounts from 2017 to 2024, at times as many as 10,000 at once, opened with fake emails and fraudulently obtained debit cards. They streamed hundreds of thousands of AI-generated songs billions of times. In April 2023, his bots played his catalog 80.9 million times on YouTube Music family plans, while Taylor Swift’s entire catalog got 9.3 million. I never knew this aspect of it, streaming royalties actually come out of a shared pool, so every fake play took money from an artist whose song was actually heard. He also knew how to stay hidden. In his own email he said he needed “a TON of songs fast” to get around the platforms’ anti-fraud policies, and he spread the streams across thousands of tracks so no single song looked unusual. Plain version (i.e. cop version): he made the crime small everywhere anyone was looking. Whatever name the technology gets, that pattern is one we work every day. Fraud gets cut into pieces small enough that each organization sees nothing worth escalating, and it only shows when someone lays the pieces side by side. The intelligence (even if it's "super") exists. The coordination doesn’t. justice.gov/usao-sdny/pr/nor…

🚨Oh boy, here we go again! Estimates say about $93 million has been drained from more than 300 wallets, and the common details so far say it's the reseller of where the hardware came from. Ledger has confirmed that one affected customer’s device, bought through CryptoBilis (a reseller covering Indonesia, Malaysia and the Philippines), contained an unauthorized hardware implant. Ledger says its own systems and direct sales were not compromised. It has not said the implant caused the losses. 💽Mark Karpelès, the former Mt. Gox CEO, published a teardown of a Nano X he received from Malaysia. Flawless shrink wrap. Inside, where the screen padding should sit, a second board with an LTE module, an eSIM and a microcontroller. His analysis says it reads the display during setup and sends the seed phrase out over cellular, and that Ledger’s authenticity check would still pass because the secure chip is untouched. Those are his findings, and his unit has not been tied to CryptoBilis. Two things stand out to me as an investigator. The money moved fast, as it always does. Most of the loss was USDT on Tron (shocker, right? 🙄), and Tether froze about $10 million across 20 wallets once the drain addresses went public. The rest started shifting into assets with no issuer to call. Like we always say, how quickly someone reports to the issuer decides what is recoverable. The seller changed hands too. Its former founders say CryptoBilis was sold in March and that an NDA kept them from saying so. Corporate records that surfaced this week list a new sole shareholder with a registered address in... China. Nobody has shown the new owner did anything wrong, and an ownership change on its own proves nothing. Still, “authorized reseller” tells you who a seller was when it was approved, and very little about who runs it today. If a victim walks into your office holding one of these devices: ✅ Do not set it up. Ledger advises this for anything bought from CryptoBilis in the last 90 days ✅ Preserve the device and packaging as evidence ✅ If it was already funded, move assets to a new device bought direct, with a new seed phrase ✅ Get the USDT addresses to Tether quickly Losses like this surface in many places at once, with each victim reporting to a different local office and the same collection addresses sitting in every file. Deconflict exists so investigators can see they are chasing the same wallets before the funds move. 🚔 Free for law enforcement, and it always will be. 👉 If you have worked a hardware wallet theft, what did your first 24 hours look like? Source: highboy.blog/supply-chain-at…

Two recent cases show how attacks on banks have evolved with AI. In South Korea, at least nine banks were targeted in cyberattacks that CrowdStrike linked to a suspected attacker using AI tools. Hackers used an AI penetration-testing tool named ARTEX alongside LLMs to break in and extract data automatically. In Italy, fraudsters reportedly used a WhatsApp message and an AI-cloned voice to impersonate senior leaders and steal €95 million from a private bank. Some of the unrecovered funds were later moved through foreign accounts and converted into cryptocurrency. One is a cyberattack. The other is an impersonation fraud. Even though the attacks looked completely different, both left the affected banks with the exact same loopholes: the information needed to catch the threat was spread across various teams and systems. The FBI recorded over 22,000 AI-related complaints in 2025 alone, accounting for nearly $893 million in reported losses. As AI makes attacks faster and far more convincing, banks are left sifting through a maze of disconnected signals. Every system sees its own small piece of the puzzle but none of them can answer the single question that actually matters when money is moving: is there verified intelligence here that helps us make a fast, confident decision? Right now, finding out if law enforcement or another institution is tracking that same subject usually means relying on manual outreach, delayed subpoenas, or guesswork. We built Signal to fix that. Instead of adding another platform to manage, Signal operates alongside the tools your compliance, fraud, and risk teams already use every day. When an alert fires or a counterparty is reviewed, Signal automatically checks if verified law enforcement intelligence exists on that specific identifier or wallet. It brings critical context straight to your analysts, helping you: Identify high-risk overlaps early Reduce alert fatigue Make confident, defensible decisions AI gives threat actors speed and scale, but they still rely on information silos to get away with it. By bringing verified intelligence directly into your existing stack, Signal gives your team the complete picture before the money ever leaves the vault. See how Signal adds verified law enforcement intelligence to your existing workflow: lnkd.in/dBgGWaPn Source: reuters.com/world/suspect-be…

Deconflict Academy is live. Our founder spent 22 years in law enforcement, including time with the U.S. Secret Service. He saw firsthand how often investigators were asked to take on emerging forms of crime without enough time, training, or budget to prepare. Cryptocurrency investigations are a good example. The cases are not waiting for an agency’s next training cycle. Investigators may encounter a crypto wallet in a fraud case, a scam victim’s transaction history, or an exchange record in a financial-crime investigation, often before they have had formal training on what they are looking at or where to begin. Sending someone away for a multi-day course is not always possible. Training budgets are limited. Caseloads do not slow down. And not every agency has access to a dedicated digital-assets investigator. We built Deconflict Academy around that reality. ✅ Free for law enforcement. Investigators can access courses without asking their agency to fund another training program. ✅ Built for the work. The courses are designed to give investigators practical foundations they can apply in cases, not just high-level theory. ✅ Self-paced. Learn when time permits, whether that means completing a module between cases or working through an entire course over time. ✅ Certificate of completion. Investigators receive a certificate after finishing the course. ✅ Written by people who understand the mission. The content is developed by law-enforcement veterans with experience across agencies including DHS and DOJ. This is not about turning every investigator into a cryptographer. It is about giving more people a practical starting point: how to recognize the issue, ask better questions, preserve the right information, and know when to bring in additional resources. Training should not depend solely on an agency’s budget, location, or ability to send someone away for a week. Deconflict Academy is one part of our effort to make useful intelligence, tools, and training more accessible to the people working financial-crime cases every day. The Academy is free for law enforcement.

Today, we’re launching Deconflict 2.0: a new brand identity, a new logo, and five new products. This launch is about helping law enforcement investigators and financial institutions do their work with better information, practical tools, and less friction. Here’s what’s new: Deconflict Academy gives law enforcement investigators free access to courses they can take at their own pace, with a certificate of completion. The courses were written by law enforcement veterans with experience at agencies including DHS and DOJ. AI-Powered Threat Intelligence gives compliance teams a dedicated environment to search for relevant intelligence and bring more context into their reviews. Investigative Agent helps users examine a crypto wallet and organize the available context around it, giving investigators a clearer place to start. OSINT Agent helps develop public-source leads from an identifier and brings the findings into a report for investigators to assess. E-Signature helps law enforcement investigators, Assistant U.S. Attorneys, and prosecutors send and sign legal requests, making the process easier to manage and document. We built these products for people who need to find relevant information, understand what it means, and take the next step. Deconflict 2.0 brings more of that work together. Thank you to the investigators and compliance professionals who helped shape this launch, and to the team at @zypsy for helping bring our new brand identity to life. deconflict.com