Binance Suffers $6.3 Billion Hack via DevOps Laptop Breach and EIP‑7702 Exploit

North Korean Lazarus Group Linked to $6.3 bn Binance Hack

Two blockchain analytics firms, TRM Labs and Chainalysis, have identified the North Korean state‑backed Lazarus Group (also known as TraderTraitor) as the likely perpetrators of the $6.3 bn (£4.7 bn) theft from Binance, the world’s largest cryptocurrency exchange. The group reportedly gained access to Binance’s hot‑wallet signing system, enabling automated transfers of funds. Binance’s co‑CEO Richard Teng said the breach was broader than an engineer’s laptop compromise and that about 80 % of the stolen assets have been recovered, with the remainder still missing. The incident follows a series of high‑profile cyber‑attacks attributed to North Korea, including the 2014 Sony Pictures hack and the 2022 theft of $620 m in crypto from Bybit, and underscores the country’s use of cybercrime to finance its regime.

Binance Hit by $6.3 B Hack Linked to North Korea

Investigators have traced a $6.3 billion theft from Binance’s hot‑wallet signing infrastructure to a North Korean threat actor. Attackers exploited a vulnerability in Binance’s hot‑wallet signing system to authorize unauthorized transfers, then moved the stolen funds through a series of mixing services to obscure their trail. The incident remains under investigation, with authorities tracking the flow of the compromised assets.

Binance Hackers Convert $6.3 B in Stolen Crypto Before Authorities Freeze Assets

The largest crypto‑world theft began at 8:04 pm UTC Thursday when attackers linked to the North Korean group behind last month’s Bitget hack seized roughly $6.3 B in cryptocurrency from Binance. They immediately moved the stolen stablecoins—USDT and USDC, which can be frozen by their issuers—into non‑frozen assets such as BTC and ETH. Within an hour, $500 M of USDT had been sent to a single address, and $325 M was sold for ETH by 20:59 UTC. Stablecoin issuers Tether and Circle, along with other entities, began blacklisting the attackers’ addresses within minutes, freezing about $1.567 B in USDT and $823 M in USDC. Binance reported that around $3 B of the stolen funds were on‑chain frozen, and it is collaborating with law enforcement, issuers and blockchain analytics firms to trace the remaining assets. Decentralized protocols also acted: Arbitrum’s Security Council moved $30.5 M in ARB and ETH into a frozen wallet, and Aave V3 saw a $60 M USDT deposit from an attacker‑linked wallet. While freezing stops the attackers from spending the assets, it does not automatically recover them for Binance or its users.

Amazon Bedrock AgentCore Runtime Enables Live Preview of Coding Agent‑Built Web Apps

Amazon Bedrock AgentCore’s Session Endpoint feature lets a coding agent keep a Vite‑based website running inside an isolated microVM. Each agent session receives an authenticated URL that forwards HTTP and WebSocket traffic to the session’s allowed ports, allowing developers to open the app in a browser, interact with it, and see changes—such as a dark‑theme switch—appear instantly without redeployment. The session endpoint URL is returned in the InvokeAgentRuntime response header X‑Amzn‑Bedrock‑AgentCore‑Runtime‑Session‑Endpoint‑Url, and access requires IAM SigV4 signatures or a JWT bearer token. The sample demonstrates opening a local page with a chat sidebar and the live site, streaming the agent’s steps, and observing internal port handling and request filtering.

Binance Hackers Employ Unprecedented Laundering Tactics to Hide $6.3 Billion Theft

Hackers who stole $6.3 billion from Binance are using a new, automated laundering strategy to move the funds. Chainalysis identified thousands of rapid, repetitive transactions that circulate stolen assets among a dense network of wallets, often returning funds to earlier addresses to create a complex trail. The attackers converted roughly $786 million of stolen stablecoins into Ethereum and Tron before regulatory freezes, accepting significant price slippage to speed the process. Elliptic reports that the thieves sold about 434 million USDT for 160,451 ETH on Uniswap and 1inch at 12‑26% below market rates, and swapped 234 million USDT for 638 million TRX on SunSwap. These conversions consolidate the assets into native cryptocurrencies that cannot be directly frozen, while a separate route was used for 18,270 BTC. The speed, automation, and cross‑chain swaps create a new laundering pattern that complicates blockchain investigations.

Blackstone Lowers Expectations for Anthropic’s Credit Rating to Junk Status

Blackstone, the $9 billion investor in Anthropic, has reversed its earlier forecast that the AI firm would secure an investment‑grade rating by year‑end. The change follows a June BB+ rating from Kroll Bond Rating Agency, just below the BBB‑pass mark. Anthropic’s planned $800 billion compute expansion relies on borrowing costs tied to its credit rating; a junk rating would raise interest rates and limit lenders, especially pension funds and insurers that face junk‑debt caps. The company holds over $112 billion in cash and expects to raise roughly $100 billion more in its upcoming IPO, but the credit outlook remains uncertain until the final agency decisions post‑debut. Reason: The downgrade signals higher borrowing costs for a major AI player, affecting the broader AI funding landscape and the cost of capital for tech firms seeking large-scale investments.

Tether Reports $1.5 B Q3 Operating Profit and Nearly Doubles Excess Reserves to $7.95 B

Tether announced a third‑quarter operating profit of $1.5 billion, with its excess reserves rising to $7.95 billion – almost double the $4.1 billion reported in June. At the end of September the company held $191.5 billion in assets against $183.5 billion in liabilities, leaving a reserve surplus of $7.95 billion. Assets include $132.4 billion in direct and indirect U.S. Treasury bill holdings, comparable to South Korea’s $134.2 billion exposure and exceeding the United Arab Emirates’ $116.1 billion. Over the first nine months of 2026, Tether generated $4.5 billion in net operating profit, largely driven by Treasury bills and reverse repurchase agreements. Bitcoin reserves were valued at $8.37 billion, up from about $5.8 billion at the end of June. USDT remains the largest stablecoin, representing roughly 60% of the $297.3 billion stablecoin market, and its user base has surpassed 700 million, largely in emerging markets.

Binance, FBI and Secret Service Investigate $6.4 B Hack, Circle and Tether Freeze $1.8 B in Stablecoins

Binance is collaborating with the FBI and the U.S. Secret Service after a hacking incident that stole $6.4 billion from the exchange. Circle’s CEO Jeremy Allaire said the company has frozen roughly $823 million in USDC linked to the attack, while Tether has frozen about $975.1 million in USDT. Blockchain analytics firms TRM Labs and Chainalysis attribute the breach to the North Korean group TraderTraitor, previously tied to the $1.5 billion Bybit hack. The coordinated freeze of more than $1.8 billion in stablecoins demonstrates how issuers can block stolen digital assets before they are moved, aiding law‑enforcement investigations worldwide.

Reddit CEO Steve Huffman Blames Google’s AI Mode for Loss of Over One Million Weekly Search Referrals

Reddit’s shares fell more than 25 % after the company reported that it lost over one million Google search referrals per week in October, citing Google’s new AI Mode and AI Overviews as the cause. Huffman said AI Mode does not drive traffic to Reddit or to any other site, describing it as a fundamental shift in how Google operates. Reddit claims user demand for its platform has not changed, but Google has stopped sending users there. In response, Reddit is testing login walls outside the U.S. to curb scraping and reduce its dependence on the open web, while continuing data‑licensing talks with AI providers. The incident highlights a structural risk for any business that relies on Google for traffic.

Worldwide Express Cuts Freight Exception Costs by 75% with Amazon Bedrock AI

Worldwide Express, a global LTL carrier network with $5 billion in revenue and 130,000 customers, had $15 million of free cash flow tied up each month in unresolved billing exceptions. The company partnered with AWS and LTM to build a multi‑agent AI system on Amazon Bedrock that integrates directly with its SpeedShip transportation management system. The solution automates the three‑step exception workflow—invoice matching, pricing variance, and accessorial validation—by interpreting carrier tariffs and dispute rules. Six months after launch, the system reduced active exceptions by 75 percent, shortened time‑to‑cash by four weeks, saved $1 million annually, and released a one‑time $10 million cash‑flow infusion. The case illustrates how agentic AI can handle complex, context‑dependent freight billing disputes at scale.

Binance Seizes $3 bn of $6.3 bn Stolen in North Korea‑Linked Hack

Binance, the world’s largest crypto exchange, has frozen roughly $3 bn of the $6.3 bn ($4.7 bn) it says was siphoned off in a sophisticated hack that analysts link to a North Korean cyber‑crime unit. The exchange initially blamed a compromised engineer’s laptop but later confirmed a broader breach. U.S. authorities, including the Secret Service, FBI and the Treasury’s Financial Crimes Enforcement Network, are working to trace, freeze and recover the remaining stolen funds. Binance has assured users that their money is safe and that it will cover all losses, while also maintaining that deposits remain unaffected. The incident eclipses the $1.5 bn Bybit heist of 2025 and underscores the growing threat of state‑backed hacking in the crypto market.

Binance Sets Aside $6.34 B to Cover Hack Losses, CEO Confirms Customer Funds Safe

Binance CEO Richard Teng announced that the exchange has reserved more than $6.34 billion of company funds to reimburse all losses from a recent hack that targeted Binance’s hot wallet. Five billion dollars of that reserve is already held in the exact tokens stolen—USDC, USDT, BTC, ETH and BNB—while the remaining amount is being acquired through market and OTC channels. Teng said the attacker used a self‑destruct mechanism and an EIP‑7702 delegation to bypass Binance’s normal approval controls, and that the theft was carried out by a coordinated group rather than a single individual. Binance plans to restore withdrawals by Sunday, conduct a full security review of endpoints, cloud, key management and signing, and publish a full proof‑of‑reserves report by Monday. The attacker continues to move funds on Tron, with about 5.19 million TRX (≈$1.73 million) transferred to 12 addresses between 11:37 a.m. and 12:12 p.m. ET on Friday. The move underscores Binance’s ability to absorb a loss of this magnitude through its crypto‑based operating earnings and its commitment to protecting customer assets, which are held in cold wallets and only moved to hot wallets for withdrawals.

ECB Executive Member Philip Lane Highlights AI’s Role in Boosting Euro‑Area Productivity

Philip R. Lane, a member of the ECB Executive Board, spoke at the Federal Reserve Bank of San Francisco’s Economic Research Symposium on AI and the economy. He explained that while cutting‑edge AI models are largely developed in the United States and China, the adoption of AI will be a key determinant of productivity growth in the euro area in the coming years. AI spending already represents a significant stimulus to the euro‑area economy. Lane noted that European firms are integral to the global AI supply chain and that European investors are funding the worldwide build‑out of AI infrastructure through equity, debt markets and the banking system. He also highlighted data from ECB surveys that shed light on the AI adoption process and its implications for the financial system. Digital investment in the euro area has risen by 73 % in real terms since 2014, growing from 2.3 % to 3.3 % of GDP. This growth, especially the acceleration since 2024, signals a structural shift in the euro‑area economy, with most digital investment concentrated in intangible assets rather than data‑centre infrastructure.

Utah Files 13 Felony Charges Against Kalshi After $115 Sports Bet Investigation

Utah prosecutors filed 13 felony counts against Kalshi and its founders, CEO Tarek Mansour and COO Luana Lopes Lara, after a state undercover agent placed 12 sports wagers totaling $114.87 on the platform between September 13 and September 26. The agent created a Kalshi account using a Utah residential address, phone number and locally issued debit card, and confirmed his Utah location via the platform’s location services before placing a $10 bet on a Dallas Cowboys‑New York Giants game. Kalshi allowed the transaction, collected a 44‑cent fee, and subsequently accepted 11 more bets across football, baseball, soccer and hockey. The charges include third‑degree felony counts of online gambling promotion, a second‑degree felony for a pattern of unlawful activity, and a misdemeanor gambling promotion charge. The case escalates a national dispute over whether federally regulated prediction markets must comply with state gambling laws, with the Commodity Futures Trading Commission (CFTC) already suing Utah to prevent enforcement of its restrictions.

Binance Loses $6.4 B in North‑Korean Hack, Users Covered by SAFU Fund

A North‑Korean hacker group stole roughly $6.4 B from Binance, the largest crypto theft ever, by compromising a DevOps engineer’s laptop. The stolen assets were spread across three blockchains: about $3.5 B in ETH, $1.4 B in BTC and $630 M on Tron. Stable‑coin issuers Tether and Circle used their built‑in freeze mechanisms to lock about $2.39 B, leaving $2.6‑$3.2 B still unaccounted for. Binance announced it had set aside $6.34 B from its SAFU fund to fully cover user losses and stated that user funds are “completely safe.” Aave also froze its V3 and V4 markets on Ethereum to prevent the attacker from using the stolen funds to create bad debt. The incident caused Bitcoin to dip below $77.5 k, ETH under $2,200, and BNB under $700, with over $1.33 B in positions liquidated.

Epoch AI Demonstrates GLM 5.3 Can Build Full Firefox Exploit Chains Within 48 Hours

Researchers at Epoch AI showed that the open‑weight language model GLM 5.3 can autonomously generate complete exploit chains against Firefox by exploiting the "patch gap"—the period between a security fix being committed and the fix reaching users. Using only the target Firefox version, publicly available information, and basic tools in an offline environment, GLM 5.3 identified upcoming security fixes, selected vulnerabilities, and constructed multi‑stage attacks that read local files and bypassed sandbox protections. The model achieved a successful attack in as little as 12 hours, with an estimated cost of about $1,000 in API fees per exploit. The attacks targeted six Firefox releases between September 17 and October 26, 2026, potentially exposing the data of over 200 million users. Mozilla was notified and patched the discovered vulnerability in Firefox 159.0, released on October 27, 2026.

TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor

Binance Loses $6.15 Billion in 31 Minutes as Hackers Exploit EIP‑7702 Authorization

On October 29, 2026, an attacker drained approximately $6.15 billion from Binance’s hot wallets across nine blockchains in just 31 minutes. The theft did not involve stolen private keys; instead, the attacker leveraged Binance’s own authorization system, specifically the EIP‑7702 feature that allows a smart contract to act on a wallet’s behalf. Prior to the attack, the attacker funded their wallets via Tornado Cash to obscure the source of funds and conducted two rehearsals on their own wallets to test a custom smart‑contract draining tool. The final version of the tool could execute arbitrary calls on delegated wallets, enabling the attacker to command a Binance smart wallet to release 823 million USDC. The incident highlights a critical vulnerability in Binance’s hot‑wallet management and the broader risks of permission‑based smart‑contract interactions in cryptocurrency exchanges.

Binance Reveals Additional Breach Points in $6 B Hack Linked to North Korean Group

Binance investigators have identified new attack vectors beyond an initially suspected compromised employee laptop in the roughly $6 billion theft. The exchange has not disclosed the extra breach points but confirmed that no wallet private‑key leakage occurred. TRM Labs attributes the incident to the North Korean‑linked group TraderTraitor, which also targeted Bybit in February 2025. Attackers moved the stolen funds across ten blockchains—Ethereum, Bitcoin, Tron, Solana, XRP Ledger, and others—within about 20 minutes, using EIP‑7702 to delegate control of a Binance hot wallet to a malicious contract. The operation involved 50 pre‑signed authorizations, one of which allowed the attacker to install transaction‑execution instructions and drain assets. Binance froze roughly $3 billion of the affected assets, pledged to cover all losses via its Secure Asset Fund for Users (SAFU) and corporate resources, and plans to resume withdrawals in about 45 hours while overhauling its withdrawal infrastructure. The incident highlights coordinated cross‑chain theft and potential compromise of Binance’s hot‑wallet signing infrastructure.

Polymarket Suffers Second Multi‑Million Dollar Breach in Four Months

Polymarket’s trading platform was shut down on Oct. 29 after a malicious third‑party script infiltrated the site’s login session, searching for trading tools and requesting signatures. Blockchain analytics firm Bubblemaps estimated that more than 700 users were affected, with about $3.46 million of assets compromised. Roughly $2.7 million was converted to POL and transferred out, while $750,000 remained on the platform. The October breach followed an earlier June attack in which a compromised vendor’s script used approved authorizations to drain approximately $3 million from users’ wallets via Polymarket’s own relayer. Both incidents demonstrate how external scripts can access a user’s browser context, obtain cryptographic signatures, and move funds, raising questions about the boundary between third‑party code and the platform’s internal signing mechanisms.