Fancyfied Essays

The Call Nobody Trained You To Make

By Lisa Francoeur · Founder, Fancyfied™ · · 5 min read

On October 29, three billion dollars stopped moving because a small number of people decided it should. They had hours. Most professionals are never prepared for the moment judgment has to outrun information.

At 20:05 UTC on Thursday, October 29, 2026, money began leaving the largest cryptocurrency exchange in the world. By 20:23:24, a single transaction had taken 167,464 ETH and 63 different tokens. Sweeps continued at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56. When it stopped, $6.36 billion was gone across ten separate blockchains, according to blockchain intelligence firm TRM Labs.

For scale, Chainalysis reports that the entire cryptocurrency industry lost $3.4 billion to theft in all of 2025. North Korean operations, which Chainalysis estimates have taken $6.75 billion cumulatively across a decade, were nearly matched in a single evening.

One night versus a year of theftBar comparison: the entire cryptocurrency industry lost 3.4 billion dollars to theft in all of 2025, while 6.36 billion dollars was taken in a single night on October 29, 2026.All of 2025, industry-wide theft$3.4BOne night: October 29, 2026$6.36B
One night versus a year. Sources: Chainalysis (2025 industry total), TRM Labs (October 29 incident).

The technical story is genuinely interesting. It is not the story I want to examine.

Roughly $3 billion of that money stopped moving, by Binance’s own account. Not because security caught it. The transfers executed cleanly. It stopped because executives at a handful of companies decided, within hours, to freeze assets that did not belong to them. TRM Labs puts Tether at approximately $1.77 billion in USDT and Circle at approximately $825 million in USDC, with Ripple, World Liberty Financial and Arbitrum’s Security Council intervening separately.

Consider what that decision actually demanded.

You are told money is moving. You do not yet know with certainty whose it is, what share is legitimate, or whether you are reading the situation correctly. You hold the technical ability to stop it. If you move too slowly, the funds are gone permanently. If you move too broadly, you immobilize money belonging to people who did nothing wrong, and you establish a precedent you will answer for in front of regulators for years.

And this is not freezing in the reversible sense. Of the USDT Tether froze across 2025, BlockSec’s analysis shows 55.6 percent, roughly $698 million, was permanently destroyed through the function Tether calls destroyBlackFunds.

You have perhaps an hour.

The sweep, 20:05 to 23:56 UTCTimeline of the October 29 attack: money began leaving at 20:05 UTC, a single transaction at 20:23 took 167,464 ETH and 63 tokens, and sweeps continued until 23:56. 6.36 billion dollars moved across ten blockchains.20:0520:2320:4120:5921:0421:4422:3923:56First movement 20:05 UTC → final sweep 23:56. Most of it gone in about 20 minutes.
The sweep, minute by minute. Source: TRM Labs.

The scale of what was decided in one sitting

BlockSec’s figures put Tether’s lifetime freezes before this week at $5.69 billion across 9,597 addresses. Across all of 2025, a record year, the company froze $1.26 billion.

In a single night, Tether froze roughly $1.77 billion. More than the entire prior year. Close to a third of everything the company had frozen in its existence, decided under time pressure, in one sitting.

One night versus a year of freezingBar comparison: Tether froze 1.26 billion dollars across all of 2025, and roughly 1.77 billion dollars in a single night on October 29, 2026, close to a third of its lifetime total.All of 2025, Tether freezes$1.26BOne night: October 29, 2026~$1.77B
A year of freezing, decided in one sitting. Source: BlockSec (2025 total), TRM Labs (October 29 freeze).

That is not a technology problem. That is a judgment problem, and almost nothing in conventional professional development prepares a person for it.

The information was there. The judgment was not.

There is a second finding in TRM’s analysis that sharpens the point considerably.

The attacker spent at least 36 hours staging. They deployed attack code and tested it on two wallets. They rehearsed the final version on a third. Then they routed the test funds back to themselves and waited.

Small, anomalous transfers from institutional wallets to an unfamiliar address, followed by a return. In that industry, that is close to the loudest signal that exists.

Nobody acted on it.

This is the pattern that should unsettle any executive reading it, because it is not unique to cryptocurrency. The data was available. Someone could have seen it. The failure was not detection capability. It was that no one was positioned, authorized or prepared to act on an ambiguous signal before it resolved into a certainty.

By the time it resolved, there was nothing left to decide.

Why standard preparation fails

Most leadership development assumes time. Gather information, consult stakeholders, weigh options, decide. It is a sound process, and it is built for conditions that are absent in the moments that actually test you.

The decisions that define a career tend to share three characteristics. They are irreversible. They arrive with incomplete information. They come with a clock.

Under those conditions people do not rise to their analysis. They fall to their defaults.

Whatever a person has already settled about who they are and what they will not do is what executes, because there is no time to reason toward it.

Three disciplines that separate those who hold

  1. Name the decision before you need it.

    Not the team or the function. The person, their backup, and what happens when both are unreachable. Most organizations have never written this down, and the night it matters is a poor time to discover that.

  2. Decide the principles, not the cases.

    You cannot anticipate the specific incident. You can settle in advance what takes priority when protecting one group harms another, and how wrong you are willing to be in which direction. That work done in calm conditions is the difference between acting and freezing.

  3. Rehearse the conditions, not the content.

    Knowing the policy is not the same as having sat with partial information, a visible clock, and a senior colleague asking why you have not decided yet. The second is a distinct skill, and it is trainable.

Underneath all three sits something more basic: knowing your own defaults. Under pressure, some people seize control and others wait for permission. Neither is wrong. Both are patterns. The cost of not knowing yours is that it runs you instead of the other way around.

This is about to matter considerably more

The trend line is not improving. Chainalysis reports North Korean actors stole $2.02 billion in 2025, a 51 percent increase year over year, and accounted for a record 76 percent of all service compromises. Their 2026 total passed $1 billion before this incident.

Meanwhile, major banks are building stablecoin infrastructure, and each one inherits precisely the authority Tether and Circle exercised in October. Each will eventually seat a person in that chair.

Those people will be trained exhaustively on how the technology works. Many will not spend a single hour on how to decide.

That gap is not technical. It is whether a person has done the work of knowing what they stand on before the ground moves. That is what Authentic Intelligence® is built to develop, and it looks optional right up until the morning it isn’t.