Binance lost roughly $6.3B in the largest crypto theft on record; three analytics firms say North Korea did it
Starting 20:05 UTC Thursday, Binance hot wallets were drained across ten-plus blockchains, most of it inside ~20 minutes.
Voice briefing
Read the transcript
Friday, October thirtieth, twenty twenty-six, and since yesterday's run died mid-flight, this brief covers Thursday night through today's close.
First, cyber. Binance lost roughly six point three billion dollars in the largest crypto theft on record, drained across ten or more blockchains mostly inside twenty minutes. Three private analytics firms say with high confidence that North Korea's Lazarus group did it, but no government has confirmed that attribution, and Binance has named no one. The attacker abused Ethereum's account-delegation feature, submitting fifty pre-signed authorizations to guarantee one would land, then kept sweeping deposits for hours. Binance's story moved from a compromised engineer's laptop to additional points of breach, and its claim that no private keys leaked is its own unverified assertion. Stablecoin issuers froze around three billion dollars, but several billion more is beyond anyone's reach.
Next, tech and business. Intel had its worst single day since at least nineteen eighty, falling twenty-nine percent and erasing about one hundred forty billion dollars in market value. The cause is the industry-wide memory shortage: artificial-intelligence demand is bidding memory capacity away from personal computers, and Intel now models that market shrinking twelve percent this year and ten percent next. Alphabet had its worst day in over twenty years, and Amazon missed expectations. One flag: the claim that Blackstone warned Anthropic may not get investment-grade credit after its initial public offering traces to a single Financial Times piece citing sources. Unverified.
More tech: Reddit is ending twenty-one years of logged-out access, with logged-in-only tests outside the United States this quarter. Search referrals dropped more than one million per week in October, its stock fell twenty-nine percent, and details are still open; its chief executive says the front page should survive, and some headlines overstate the shutdown.
Back to cyber, two supply-chain holes in forty-eight hours. An official Anthropic editor extension was backdoored on the Cursor marketplace for roughly twelve hours, exposing an estimated five thousand users at most. The payload tried to install a persistent secure-shell backdoor, though coding errors made that fail in many cases. Nobody has explained how the verified account was compromised, and Anthropic has issued no notice to its customers. Second, a sixteen-year-old flaw in EDK two firmware behind most server platforms allows code execution before the operating system boots. Honest headline check: the claim that it affects most servers on Earth is not supported by any vendor count. It hits machines that network-boot, and the fix is not in a stable release yet, so the practical step is turning off network boot.
In gaming, Phantom Blade Zero launched to strong reviews and roughly eight hundred fifty thousand copies sold by third-party estimate, with no company-confirmed number. The real story: preloading asks PC players for three hundred gigabytes of free space, in the middle of that same storage price squeeze. And the layoff wave hit mid-size studios: Don't Nod is in French court protection, with unanswered union claims about its cuts, and Bristol's Auroch Digital is consulting on cuts to about a quarter of roles.
In space, SpaceX told NASA it will stop flying Crew Dragon by twenty thirty, has stopped selling Falcon nine launches for missions after twenty twenty-eight, and will not bid on three new Space Force contracts.
In politics, Israel's final count gives Netanyahu's camp fifty-three seats, the opposition forty-eight, and Arab-led parties a record nineteen. Those nineteen are the only arithmetic reaching sixty-one, yet both Zionist camps have ruled out cooperation.
Worth watching: whether Binance publishes a verified figure and post-mortem, and whether any government adopts the attribution; whether Reddit's front-page exception survives; whether Anthropic warns its customers; when firmware makers ship the network-boot fix; and whether Israel forms a government before a fifth election.
01 Binance lost roughly $6.3B in the largest crypto theft on record; three analytics firms say North Korea did it
What happened Starting 20:05 UTC Thursday, Binance hot wallets were drained across ten-plus blockchains, most of it inside ~20 minutes. Binance puts the impact at ~$6.3B and says it has reserved $6.34B of company funds to cover it, with ~$5B already held in the affected tokens. Elliptic counts $6.43B, TRM Labs $6.36B, Chainalysis ~$5.9B at the moment of the theft — more than four times the $1.46–1.5B Bybit take from February 2025. On-chain freezes (Tether ~1.77B USDT, Circle ~825M USDC, plus Ripple, World Liberty Financial, and an Arbitrum Security Council emergency action on ~$30M) total ~$2.7B by TRM's count and ~$3B by Binance's. Elliptic verified $2.84B, 44% of the haul.
The mechanics matter more than the number the attacker used Ethereum's EIP-7702 — the account-delegation feature from the May 2025 Pectra upgrade — to point the "Binance 14" hot wallet at an attacker-run "sweeper" contract. Because the wallet's nonce kept moving during live withdrawal processing, the attacker submitted 50 pre-signed authorizations covering 50 consecutive nonces, guaranteeing one would be valid. Three minutes and 24 seconds after delegation, one transaction moved 167,464 ETH plus 63 tokens, including ~$1.615B USDT. The delegation stayed in place, letting the same contract sweep later deposits at least six more times over ~3.5 hours. A second Binance wallet signed nine transfers worth $174M directly to the attacker — which is why TRM's working conclusion is not "stolen key" but that the operator gained the ability to make Binance's cross-chain signing infrastructure sign whatever it chose. Binance's own story moved: first a compromised DevOps engineer's laptop, then (co-CEO Richard Teng, Friday) "additional points of breach" and "not a single 'one-click' action." Staging is documented: Tornado Cash-funded operator wallet ≥36 hours ahead, the sweeper code tested on three of the attacker's own wallets hours before use, and a self-destruct routine that removed some tooling afterward.
Discrepancies and unverified claims — read these before repeating anything above: - Attribution is private-sector only. TRM ("high confidence"), Chainalysis ("high degree of confidence") and Elliptic all say DPRK-linked TraderTraitor/Lazarus, based on playbook resemblance to Bybit and April's KelpDAO heist plus commingled proceeds from last month's $388M Bitget exploit (ZachXBT caught the mix after THORChain). No government or law-enforcement agency has confirmed attribution, and Binance has not named anyone. The FBI's Bybit attribution supports the group, not this incident. - Blockchain count conflicts: TRM says ten chains, Elliptic says eleven (a second Avalanche/Polygon wave ~23:05 UTC). Loss totals differ by ~$500M across firms. Nobody has a verified final figure. - "No private keys leaked" is Binance's assertion, not an independent finding — and it sits awkwardly next to wallets producing valid signatures for an attacker across chains and key types. - Roughly $2.4–3.3B is beyond any issuer's reach (BTC, ETH, XRP, TRX across ~42–43 addresses), with the BTC moving through a peel chain. Claims circulating that AI tooling is driving the laundering are investigator speculation, not established fact.
Why it matters this is a watershed for exchange key-management assumptions (delegation features defeat the "hot wallet = limited blast radius" model), and it lands on an industry already arguing that North Korean theft funds weapons programs. Crypto market cap fell ~4.6% to $2.59T with $1.66B in derivative liquidations; Binance paused deposits/withdrawals pending a rebuilt withdrawal system.
02 Israel's final count says nobody won: 53–48–19, and 19 Arab-led seats are the only arithmetic that reaches 61
What happened Israel's Central Elections Committee published final results early Friday: Netanyahu's bloc 53 seats, Eisenkot's Yashar-led bloc 48, Arab-led parties 19 in the 120-seat Knesset; 77.9% turnout, 5,716,665 votes — the highest in decades. Party-level: Likud 27, Yashar 21, B'Yachad 12, Joint List 11, Democrats 8, Ra'am 8, Yisrael Beiteinu 7, UTJ 7, Otzma Yehudit 7, Shas 6, Religious Zionism 6. Confirmed across AP, NBC, Times of Israel, JNS and DW. The governing coalition held 68 seats in the outgoing Knesset — a 15-seat collapse. Results get certified and submitted to the president Wednesday, November 4, after which Herzog consults faction leaders and picks whoever he judges most likely to form a government.
The how, which the seat count hides the 19 seats for the Joint List and Ra'am are an all-time high — but two sources disagree on the baseline: DW calls it a record "beating their previous high of 15," while the Times of Israel describes it as "almost double their current 10." Both are defensible (2021 high vs. the present Knesset), so quote the high carefully. The blocking fact is pre-election vetoes: every Zionist-bloc party except The Democrats has ruled out cooperating with Ra'am or the Joint List, and Netanyahu — after amplifying unsubstantiated allegations that Arab-led parties "stolen" the election, possibly with foreign assistance — posted Friday that forming a coalition with Arab parties "is forbidden." Eisenkot's line is "I will do everything in my power to form a Zionist government." So the only path to 61 requires someone to break an explicit, campaigned-on promise.
Who benefits, and what the options actually are (i) Eisenkot needs either Democratic–Arab support or abstentions from Arab MKs — giving him a majority without sharing cabinet seats, which is why "external support" is the live idea; (ii) Netanyahu stays caretaker PM with his far-right partners (he told Ben-Gvir and Smotrich Wednesday, per Channel 14, "We are together and we are staying together") and benefits from delay — a fifth election resets a clock that currently runs against him, and the attorney-general's case and the ultra-Orthodox draft question both stay unresolved; (iii) Herzog is the real actor between Nov 4 and the mandate, having said he will "do everything in his power to avoid another election" and asking leaders to "come with an open mind"; (iv) the 19-seat Arab bloc has never had this much leverage, and its leverage exists purely because both Zionist camps failed to reach 61. Historical context: this is the fifth election since 2019 and the first where Arab-list strength, not Zionist vote share, decides the outcome. If mandate attempts fail, Israel is back at the polls early next year — with the war with Iran still running, which is precisely why the delay option is politically rational and nationally corrosive.
Opinion vs. reporting "Netanyahu lost" is a framing — his bloc won the most seats and Likud remained the largest party. "Historic Arab showing" is a fact backed by the count. The "stolen election" claim is an unsubstantiated allegation, reported as such by AP; don't repeat it neutrally.
### Quick hits (real, but not full-story weight today) - SPACE — SpaceX is walking away from the US government, and NASA has no plan B. Ars Technica (Eric Berger, Oct 29): SpaceX told NASA it will stop flying Crew Dragon by or before 2030 and that Boeing should carry astronaut transport ("The government paid a lot of money for that"); it has stopped selling commercial Falcon 9 launches for missions after 2028; it told the Space Force it will not bid on three new late-2020s launch contracts (Politico, Oct 22); and it told CLPS lunar-lander companies it won't provide launch services. Existing contracts are being honored. The counterparty: Blue Origin, with three orbital launches ever, being floated as Artemis's savior. - POLITICS — Poland's Constitutional Tribunal seizure. Friday: judge Anna Korwin-Piotrowska ordered tribunal president Bogdan Święczkowski and his deputy suspended for a month and declared she was taking charge; the tribunal's own account called it a coup; police entered the premises after objects were thrown and three people were detained; President Nawrocki turned his plane around mid-flight from Senegal. Tusk's government and PiS are fighting over the same court for the third year, four weeks before US midterms that will reshape Washington's stake in both. - ENERGY/WAR — Strait of Hormuz is hot again. British military: a tanker caught fire Friday after a small boat attached two explosives to its hull; Iran's IRGC says three tankers struck mines Thursday leaving by an unauthorized route (one carrying 2M+ barrels). Brent ~$113–116, WTI ~$104; UKMTO calls October the busiest month for shipping attacks since March. Oil majors priced it: Exxon and Chevron beat on refining margins. Meanwhile Ukraine resumed strikes on Russian refineries — Novokuybyshevsk in Samara overnight — ending a two-week pause that WSJ attributed to US pressure ahead of the midterms.
### Loops from Monday/Tuesday I checked and could not close - CISA's PHP2Shell federal deadline (Oct 29, BOD 26-04) — the KEV entries for CVE-2026-109618/109619 and the three-day remediation clock are confirmed by BleepingComputer, MeriTalk and Federal News Network. Whether FCEB agencies actually met the deadline is not publicly knowable today — CISA does not publish per-agency KEV compliance scores in real time, and no outlet reported an audit. Still unpatched: CVE-2026-115560, mitigated only by `session.upload_progress.enabled=0`. - ETH refutation — no new outside verification since Monday. Anthropic's own Appendix E remains the sharpest caveat: its ~1,050-module Lean development "was written by AI models and reviewed by other instances of the same models; at the time of writing no person is known to have checked it." Anthropic's build (~8 min) has passed two independent checkers (Lean's kernel plus `nanoda`); nobody outside OpenAI has reported building OpenAI's, which states a slightly weaker bound on a custom machine model.
### Worth watching next Whether Binance publishes a verified figure and a root-cause post-mortem (and whether any government adopts TRM/Chainalysis/Elliptic's attribution); whether the Q4 non-US login tests hold the front-page exception; whether Anthropic ever warns its own customers about 2.1.313, and who got access to a verified publisher account; when AMI/Insyde/Phoenix/Dell/HPE ship EDK2 firmware with the fix — until then the mitigation is "turn off PXE"; whether Don't Nod's CSE talks end Nov 3 with or without a severance agreement, and whether P14 survives the outsourcing bet; whether Intel's −10% 2027 PC TAM forecast becomes the industry consensus (and what Sandisk and Micron say against it — they've been publicly divergent on memory pricing); and whether Herzog forces a mandate before the fifth election becomes the default.
To stop or manage this job, send me a new message (e.g. "stop reminder Daily news analysis").