Kain Warwick says Synthetix clawed back stolen SNX; chain shows 8.4M

Synthetix founder Kain Warwick says his team took back the SNX stolen from Binance by using a power it had held for years and never used. “And so we switched the token state, the token authority out. That’s a solid rug,” Warwick said on Unchained’s Uneasy Money podcast, which he co-hosts.Unchained, Uneasy Money: What the $6B Binance Hack Revealed About Who Can Freeze Stolen Funds, 6 November 2026. He said the team created an approval and moved the tokens to the Synthetix DAO, and put the haul at about 9 million SNX.

The Ethereum record matches his account step by step, with a smaller number. At 20:24:23 UTC on 29 October, in the main theft transaction, 8,405,741.58 SNX left a Binance hot wallet for the attacker’s address.SNX theft, recovery and onward transfer: decoded Ethereum transactions, TokenState authority history and balances, our analysis of Ethereum mainnet. That is 1.45% of SNX’s total supply of 581.4 million. The FBI has attributed the hack to North Korea’s TraderTraitor group, CoinDesk reported.CoinDesk, Arbitrum’s council moved $30 million of Binance hack funds without the hacker’s key, 3 November 2026. Binance’s own findings trace the theft to a fake job interview, as we reported on 5 November.The S-Curve, How a fake job interview reached Binance’s signing service, 5 November 2026.

Four calls in one transaction

At 23:03:47 UTC, 2 hours 39 minutes after the theft, a Safe multisig that owns the SNX token contracts sent one transaction with four calls. It made itself the token’s balance authority, wrote an allowance letting itself spend the attacker’s 8,405,741.58 SNX, handed the authority back to the Synthetix contract, and pulled the tokens across with an ordinary transfer. The attacker’s address has held no SNX since. The Safe needs 4 of its 7 owners to sign.

Crystal Intelligence, a blockchain analytics firm, logged the same move at 23:03 and valued the 8.4 million SNX at about $1.5 million.Binance Hack: North Korea, Where $995M Went & What to Do Now. Synthetix wrote on X on 30 October: “The tokens are secured in the protocolDAO Safe and will be sent back to Binance on request. We have notified Binance.”Synthetix recovers SNX, Newton tokens locked as Binance haul hits walls (Cryptopolitan).

Why nobody tried before

Warwick said that in 2019, at the time of an earlier hack, he argued in the Synthetix Discord that because the system runs on proxy contracts the DAO could do anything to any part of it, but that it never would. Synthetix had since taken the view that there was nothing it could do about stolen SNX, he said. The team had always assumed a recovery meant rewriting the token’s state, and the approval route never occurred to them; he said he searched the old record and found no sign they had considered it. An AI model suggested it in seconds, he said, and when he objected, a colleague told him “Opus is pretty convinced that it would work”.

The record bears out that part. The SNX token’s balance authority changed 72 times between March 2018 and August 2024, each time during upgrades, and was never handed to the owner Safe before 29 October.SNX TokenState AssociatedContractUpdated logs, 2018 to 2026 (our analysis of Ethereum mainnet).

Warwick put 10 to 15% of all SNX on Binance, which is why any Binance incident wakes him up.

The second use, and where the SNX went

Synthetix used the same four calls again at 00:26:23 UTC on 3 November, moving 428,167.52 SNX from another address to the Safe. Phemex News reported that those tokens, worth about $76,000, came from the Mercado Bitcoin hack.Synthetix Governance Reclaims 428K SNX from Mercado Bitcoin (Phemex News).

Two minutes later the Safe sent all 8,405,741.58 SNX to a wallet with no public label, which still held it on 11 November. That wallet had received 58,397,244 SAND from another Safe the day before, and has gathered other tokens since 31 October, including one sent from the attacker’s address. Crystal logged The Sandbox pulling 58.4 million SAND back from the attacker.

Synthetix was not among the key holders in our 10 November account of who could freeze the Binance loot, and how long each key took, which covered stablecoin issuers, Aave’s guardian and Arbitrum’s council.The S-Curve, Who could freeze the Binance loot, and how long each key took, 10 November 2026. Arbitrum’s 12-member Security Council briefly rewrote a core contract to move hack funds from an address it did not control, as we reported on 5 November.The S-Curve, How Arbitrum’s council moved coins it held no key for, 5 November 2026. Warwick said that move changed the calculation: a team that holds “the power to do it and not do it” can no longer keep a straight face.