David Marcus

Cooking Headless Money @Lightspark. Ran Payments/Crypto & @Messenger at @Meta, led @PayPal + 3 startups.

[David Marcus @davidmarcus]

@levie Very well put.

[David Marcus @davidmarcus]

@Jason @profgalloway @karaswisher Psychopaths indeed. Disgusting.

[David Marcus @davidmarcus]

I don’t know how I missed this until now, but this is disgusting, and a clear call for violence. That same insane rhetoric is what cost Charlie Kirk’s life. I already had no respect for Galloway, but this right here is crossing a line he should’ve never crossed.

[Western Lensman @WesternLensman]

Scott Galloway calls Elon Musk a "traitor to the West" and invokes the executions of the Rosenbergs after WW2.

"We lined up the Rosenbergs against a wall. This is a traitor to the West, and he should be held to the same standards as every other traitor in the West."

*Applause*

These people are absolutely unhinged.

[David Marcus @davidmarcus]

@soupsranjan @sardine This is very cool.

[David Marcus @davidmarcus]

@dps It's so so good.

[David Marcus @davidmarcus]

@alexandr_wang LFG

[David Marcus @davidmarcus]

I’ve been so obsessed with how money evolves in a world where UI and human approval loops disappear. Last time a shift of this magnitude happened was early PayPal era when people started buying online. Agent commerce/payments will be so much bigger.

[Lightspark @lightspark]

Every payment flow we use today assumes a person on the other end, tapping a button.

@davidmarcus at @money2020 on what happens when the interface disappears.

[David Marcus @davidmarcus]

🤔

[Reid Hoffman @reidhoffman]

Narrative violation?

[David Marcus @davidmarcus]

@dansenor sadly not surprising just one bit.

[David Marcus @davidmarcus]

How slowly California counts votes continues to be a never-ending source of amazement and wonder.

[David Marcus @davidmarcus]

@ilyasu Hero.

[David Marcus @davidmarcus]

I believe in Democracy. Last night, people loudly opined on what they wanted, and that’s the way it should be. That said, when either side puts party over country, bad things happen to the latter. And that, I’m very worried about.

[David Marcus @davidmarcus]

Thanks @binance for sharing all these details. Incredibly helpful to the entire industry.

[Binance @binance]

https://t.co/sU9dUqLQDH

[David Marcus @davidmarcus]

@justinrezvani I’m so sorry for your loss Justin.

[David Marcus @davidmarcus]

It takes hard work to get to compete with the very best people in your field. And when you’re there, it keeps on making you better and pushing you harder. For me, it’s fuel and it brings me a lot of joy, particularly when it’s vs. people you respect.

[David Marcus @davidmarcus]

Andy Grove’s “only the paranoid survive” is far too quaint for the AI-age. When it comes to moving fast, product iteration, and competition, I can’t remember a time I’ve felt this level of intensity and sense of urgency. It’s wild.

[David Marcus @davidmarcus]

In 2014 I went nearly a week without sleep. I was running PayPal and attackers were inside our corporate network. They'd compromised an eBay employee's laptop, got onto the VPN, taken over a domain controller and made themselves domain admins. eBay and PayPal were one company then, on one Windows network. They stole 145M eBay user records, then came for the segregated vault holding PayPal's card credentials. We fought them off. They never got in, but they got close. Too close.

Yesterday Binance lost ~$6.3B in what looks like the same way. A DevOps engineer's laptop, then a service inside the withdrawal stack, then withdrawals the signer approved because they came from a trusted source. Hot wallets emptied in under four hours. No key was stolen.

Nobody broke cryptography or a ledger. They found someone with access and used the trust that came with it. Banks get hit exactly the same way.

2016: attackers inside Bangladesh Bank used its own SWIFT access to send $951M of payment orders to the NY Fed. $81M was lost. The rest was held because an unrelated sanctions filter tripped on the word "Jupiter". That was luck, and it only worked because wires took days to settle.

June 2025: an IT employee at C&M Software, which connects Brazilian banks to Pix, sold his credentials for about $2,700. Attackers used them to send fake Pix transfers out of six institutions' reserve accounts at the central bank. ~$140M in under three hours.

August 2025: stolen vendor credentials at Sinqia, another Pix connector. ~R$710M out of HSBC and one other institution in a single afternoon. The central bank froze most of it, after it had already moved.

Same attack every time. Speed is what changed. When settlement took days, a filter, a correspondent bank or someone in ops could catch a bad payment. Pix, FedNow, SEPA Instant and blockchains settle in seconds. Payment security was mostly built for the slow world.

PayPal's card and user data survived 2014 because domain admin on the corp network couldn't unlock it quickly enough, and our alerting caught the unusual activity on the network. That's the model. Approval policy no laptop or vendor login can reach. Velocity and anomaly limits enforced outside the system that sends. Dynamic caps on what any one wallet, account or service can move per hour. All of it in real time.

About $3B of what left Binance has been frozen, almost all of it stablecoins. The $1.4B in bitcoin is sitting in 19 wallets and nobody can touch it. I don't think that's the problem. For decades the ability to reverse a wire or a card charge let a lot of weak security slide. You either stop the transfer before it's signed or you eat the loss.

Nothing about the technology failed here. The chains processed exactly the transactions they were handed. Binance's own systems handed them the wrong ones because an engineer's laptop was compromised. That's operational security. eBay in 2014, Bangladesh Bank and two Pix connectors all failed at it on their own rails.

In 2014 the attackers never reached the vault. If they had, the fraud losses would have been the small part. PayPal existed so people could pay without handing their card details to every merchant on the internet. We held those details so they didn't have to. Losing them would have broken the one thing the company was built on, and I'm not sure we would have recovered.

I expect blockchains and digital assets to become the standard way money moves. Every custodian of digital assets, or of fiat on a real-time rail, is in that position now. The controls have to adapt to settlement in seconds, crypto or not.

[David Marcus @davidmarcus]

You know it’s a contested and tight midterm election cycle when you annoyingly receive 50 texts a day. Can’t wait for it to be done.

[David Marcus @davidmarcus]

The most difficult part of “enterprise” partnerships when you’ve spent a long time in consumer is how frustratingly slow things can be at times. But when you find scaled partners that totally jive with you at the perfect time, it feels magical.

[David Marcus @davidmarcus]

Enabling people to get paid instantly no matter where they live and work is one of the most fulfilling use cases of the money infra we built at @lightspark. Thrilled to support @LootRushInc in this mission. A truly remarkable team.

[Lightspark @lightspark]

Work went global years ago. Money stayed local.

@LootRushInc built a global account for a generation of freelancers, creators, and entrepreneurs to get paid from anywhere and pay anyone in their local currency.

We're proud to power their growth 🤝