This Crypto AI & Robotics newsletter consists of the following:
Snippet Partner: Umia Finance + Slop Cash
What The Simpsons Got Right About This Week’s Hacks
If you have any questions feel free to reach out to me on X or message my business X account ‘Khala Research’
AI makes code cheaper to produce, increasing the importance of careful review + ongoing maintenance… very topical given this weeks hacks!
Slop Cash (Umia’s first announced external project from elizaOS creator Shaw Walters and Drew Pierson) is building a funding system around that work
Projects fund monthly pools that reward merged code changes and accepted reviews. Results face a 14-day review period before funders authorise payments from wallets they control:
As AI expands attackers’ capabilities, funding useful software maintenance becomes increasingly relevant. Slop’s impact will depend on the quality of contributions and review.
Its treasury rules hold auction proceeds in a smart contract, give teams a defined monthly allowance and require a decision market for additional spending. Proposed Slop team allocations combine time-based vesting + price milestones, with project assets held under the governed legal entity.
$SLOP governs Slop Cash’s treasury; code acceptance and contributor payments remain separate. I like the focus on verifiable work + controlled spending, although smart-contract, governance and execution risks remain. Sustained funding and useful contributions will be the real test.
This newsletter goes out weekly to 7.4k+ subscribers.
Please don’t hesitate to message me directly for sponsorship or partnership enquiries.
What The Simpsons Got Right About This Week’s Hacks
In a 1995 episode of The Simpsons, Lisa’s fiancé makes a call from his wristwatch. Scenes like that earned the show its reputation for predicting the future. This week it was Homer’s fridge that made me do a double take.
The 2023 episode “It’s a Blunderful Life” opens at Thanksgiving, 60 years in the future. Lisa tells her family why they light candles and takes them back to the week Springfield lost power. Marge opens an empty fridge, certain that Homer has eaten everything. He’s buried the food in the snow to keep it cold, as a backup plan.
Several incidents this week show eerily similar connections:
On Monday, a supermarket in Sjöbo, Sweden, said someone had set its fridges and freezers to 50°C overnight. Staff were throwing food away. Last week I wrote about backup power for the house; a generator could keep those freezers powered, but it couldn’t fix the setting
Four days earlier, attackers had taken roughly $6.3bn from Binance’s hot wallets (that’s the largest hack in crypto history, the next was ByBit for $1.5bn which was also only last year).
On Sunday night and into Monday, emergency apps in Ukraine and Russia sent false warnings, causing concerns over misinformation on a global scale
Chainalysis, which traces stolen crypto, says an intruder used what it calls “offensive agentic techniques” in a separate breach. The Swedish freezers did exactly what their controls told them to do. If a compromised account sends a warehouse robot into an occupied aisle, I’d want the person standing there to have a stop button that works even while the attacker is logged in
We still date stories by saying they happened ‘during the first COVID lockdown’. That phrase brings back the queue outside the supermarket or the neighbour who left shopping on the doorstep.
I suspect we’ll live through outages that become reference points in much the same way. Decades from now, someone might tell their grandchildren about the week the card machines went down and the shopkeeper who trusted them to pay later
What happened at Binance
Binance dates the compromise to 20:05 UTC on 29 October. Attackers took approximately $6.3bn in token assets from its hot wallets, and the exchange suspended withdrawals while it investigated and secured affected infrastructure:
On 31 October, the FBI attributed the theft to North Korean activity it calls “TraderTraitor”. That attribution applies to Binance. It does not identify who was behind the refrigeration attacks or the emergency-app compromises.
Binance has committed to covering the losses. Its 2 November update says approximately 95% of the affected assets have been replenished, with ten named assets fully backed and verification available for its 31 October reserves snapshot. Withdrawals began reopening in phases on 1 November, with further assets and networks still being restored.
Binance can replace the assets it lost before it can safely resume withdrawals. For a customer with a payment to make, recovery means being able to send the money. The timetable for that mattered just as much as the promise to cover the loss.
The technical investigation also remains incomplete. Binance’s 30 October statement said an initial lead involved a compromised laptop, but investigators had found additional breach points. At that stage, it reported no evidence that private keys had leaked.
For me, the practical lesson is to understand how much depends on one provider being available. The same question applies to an exchange, a bank account or the infrastructure running a business: how long could I function if access stopped today?
Six scenes from Springfield
The blackout in “It’s a Blunderful Life” ; she tells the story of the power outage at Thanksgiving 60 years later with several scenes that mirror some of the real life events taking place today:
Two more crypto theft reports
Four days after the Binance hack, Andy flagged two more cases involving assets held on exchanges. One was at Brazil’s Mercado Bitcoin. The other concerned an unnamed EU organisation with accounts at several exchanges:
Mercado Bitcoin suspended deposits and withdrawals on 2 November after acknowledging a security incident. Hypernative’s initial analysis identified more than $40m in suspicious transfers across at least ten blockchains. The exchange said customers had suffered no losses and no data had leaked, but had not confirmed the amount taken.
ZachXBT now puts the suspected theft from the EU organisation’s accounts at more than $133m. His 2 November alert put the figure above $106m. On 3 November he traced over $27m in additional withdrawals, some of which took place after his first alert. The account holder’s identity and how the accounts were accessed remain unknown
The attacks that reached beyond finance
Late on 1 November, Ukraine’s Air Alert app sent false warnings involving radiation, chemical threats and fighting in Kyiv:
Russia’s emergency ministry app was also compromised, with false nuclear warnings reported overnight. The Record’s reporting includes notifications received by its own reporter and statements from the app operators and authorities.
These were compromises of public-facing applications. Authorities said broader warning infrastructure remained operational; Russia’s ministry also confirmed that its main warning system was unaffected. There is no evidence here that missile-launch controls were accessed.
Marge hears a storm forecast and knows which job she wants done before it hits… In Kyiv, people received a warning on a phone app they normally use to decide when to take shelter. A convincing false alarm can cause confusion in the moment and make the next genuine warning harder to trust.
The supermarket incidents are more tangible still.
On 2 November, refrigeration problems linked to apparent cyberattacks affected retailers in Sweden, Belgium, Luxembourg, Ireland and Estonia.
Stores discarded chilled and frozen food. The Sjöbo shop said its equipment had been set to 50°C. AP’s reporting
The BBC’s video report covers food being dumped across several European countries. Al Arabiya’s footage from Belgium brings it down to the shop floor, where staff are throwing away stock after cooling systems were disrupted. For customers, the consequence is an empty cabinet. For the retailer, it is an immediate loss of stock and sales.
France had already experienced a refrigeration attack in October, before both Binance and last week’s newsletter. CERT-FR’s alert, first issued on 12 October, identifies compromised remote controllers and recommends removing exposed management interfaces from the public internet, securing remote access and updating equipment.
Homer’s improvised fridge works because he pays attention to the thing he actually needs to keep cold. I’d want the same check in a shop. A thermometer with its own alarm could tell staff the food was warming up even if the main control panel was carrying out its instructions exactly as sent.
Where AI enters the picture
The clearest direct connection in this week’s disclosures comes from Chainalysis.
On 30 October, it said an external actor had used offensive agentic techniques to gain unauthorised access earlier in the month:
Customer user IDs, names, email addresses and organisational roles were accessed. It reported no evidence of access to investigation content, authentication credentials or session tokens, and explicitly said the incident was unrelated to Binance.
The company has not published enough detail to establish which model or tools were involved, or how much of the intrusion was autonomous. Its description is still notable for an industry that increasingly expects agents to operate software and coordinate work.
The NCSC’s assessment through 2027 expects AI to make parts of cyber intrusion more effective and efficient, including vulnerability research, exploitation and social engineering. It also expects the window between a vulnerability being disclosed and exploited to shrink further.
My concern is the effect on systems that already struggle to keep up with basic maintenance. An organisation may have thousands of devices, several suppliers and equipment that stays in service for years. Faster reconnaissance and exploitation put more pressure on the time available to identify and fix weaknesses.
Defenders can use AI too. Chainalysis says it is using language models to support a broader security review. The outcome will depend on whether faster detection and remediation reach the systems that need them.
Smithers spots the overloaded socket at the plant. His warning carries less weight than Burns’s authority to ignore it. I’d ask the same question of a system that lets an AI agent transfer funds or control equipment. If a compromised account issues an instruction beyond the agreed limit, what actually stops the transfer or the machine?
Visual timeline
Major incidents + disclosures
Relevant service outages
These are availability incidents. The provider notices reviewed do not establish a cyberattack; partial product failures should not be described as an internet-wide outage.
The EU estimate incorporates ZachXBT’s 3 November update. The register covers 16 selected incidents or disclosures and seven provider outages. Counts describe different populations and must not be added together. Related airline disclosures are grouped to avoid counting the same supplier incident twice.
The 12 October French refrigeration alert and the 20 October Google Cloud banking disruption predate the reporting window. The February FICOBA case and the December–January La Banque Postale incident also remain outside it. No new French-bank hack is included as confirmed.
The French bank rumour
Springfield puts a name to the blackout long before anyone checks the evidence. In the suspected $133m+ theft, ZachXBT can trace withdrawals while the account holder’s identity remains unknown. He suspects a large financial institution in Western Europe. The claim that it was a French bank remains unverified, but rumours are circulating:
Rumour or not, this isnt the first time it’s happened… there are genuine older cases. France disclosed unauthorised access to its FICOBA bank-account registry in February, affecting information associated with around 1.2 million accounts.
That is distinct from a bank’s payment systems being taken over. La Banque Postale’s major denial-of-service incident ran from December 2025 into January 2026; the bank said its core systems and data remained intact.
What I take from this week
Last week’s household plan still makes sense to me: a modest buffer of essentials, tested backup power for the things that matter, securely stored records and more than one way to access money and information.
For crypto I already own, self custody reduces dependence on an exchange’s withdrawal service, while putting responsibility for keys and recovery on me. It also leaves other dependencies in place, including connectivity, wallet software and, for stablecoins, the issuer.
For businesses building with agents or robotics, I would put the same care into what happens after a compromise.
Can access be revoked quickly?
Can a machine remain safe without its cloud connection?
Can staff verify a critical instruction through an independent channel?
Has recovery actually been rehearsed?
The opportunity for the companies and protocols I cover is to make those questions easier to answer with evidence. A useful product should reduce the number of things that can go wrong, limit the damage when they do, or shorten recovery time.
That’s the connection between a crypto exchange and a supermarket freezer. Both depend on software being allowed to take consequential actions. As we give machines more responsibility, the controls around that authority deserve as much attention as the capability itself.
I still want to see what these systems can build, but I also want to know what keeps working when something breaks.
One to watch
If you watch “It’s a Blunderful Life” (season 35, episode 7), keep an eye on Burns’s electric trapdoor. It fails during the blackout, so Smithers has to crank it by hand. By the time he gets it open, the family has stepped aside
That’s the test I’d borrow for a freezer, a wallet or a robot. When the main system fails, can somebody take over in time for it to matter?
Lisa’s family lights candles to remember the blackout. If an outage becomes one of our own family stories, I hope what sticks is the neighbour who knocked on the door when a phone call wouldn’t go through.
That’s a wrap for this issue of Sammy’s Snippets. I hope you enjoyed it
Please leave me any questions or thoughts here - I will respond to everyone!
If you found this interesting, please consider subscribing to this Substack and following me on X for more related insights
Disclaimer: The content of this newsletter is for informational purposes only. I am commenting on the underlying activity of what I am observing in the market to keep my audience updated and informed.
Nothing in this newsletter constitutes financial advice or a recommendation to buy or sell any asset. Always do your own research before making any investment decisions.
I hold positions in many of the assets discussed in this newsletter. Valuations are approximate snapshots and move quickly. Verify all market data independently before acting