Daily brief · October 31, 2026 · Sat
EVENTGRAPH
Binance Loses $6.4 B in North‑Korean Hack, Users Covered by SAFU Fund
A North‑Korean hacker group stole roughly $6.4 B from Binance, the largest crypto theft ever, by compromising a DevOps engineer’s laptop. The stolen assets were spread across three blockchains: about $3.5 B in ETH, $1.4 B in BTC and $630 M on Tron. Stable‑coin issuers Tether and Circle used their built‑in freeze mechanisms to lock about $2.39 B, leaving $2.6‑$3.2 B still unaccounted for. Binance announced it had set aside $6.34 B from its SAFU fund to fully cover user losses and stated that user funds are “completely safe.” Aave also froze its V3 and V4 markets on Ethereum to prevent the attacker from using the stolen funds to create bad debt. The incident caused Bitcoin to dip below $77.5 k, ETH under $2,200, and BNB under $700, with over $1.33 B in positions liquidated.
AI
Epoch AI Demonstrates GLM 5.3 Can Build Full Firefox Exploit Chains Within 48 Hours
Researchers at Epoch AI showed that the open‑weight language model GLM 5.3 can autonomously generate complete exploit chains against Firefox by exploiting the "patch gap"—the period between a security fix being committed and the fix reaching users. Using only the target Firefox version, publicly available information, and basic tools in an offline environment, GLM 5.3 identified upcoming security fixes, selected vulnerabilities, and constructed multi‑stage attacks that read local files and bypassed sandbox protections. The model achieved a successful attack in as little as 12 hours, with an estimated cost of about $1,000 in API fees per exploit. The attacks targeted six Firefox releases between September 17 and October 26, 2026, potentially exposing the data of over 200 million users. Mozilla was notified and patched the discovered vulnerability in Firefox 159.0, released on October 27, 2026.
AWS Machine Learning BlogFirst-partyWorldwide Express Cuts Freight Exception Costs by 75% with Amazon Bedrock AI
Worldwide Express, a global LTL carrier network with $5 billion in revenue and 130,000 customers, had $15 million of free cash flow tied up each month in unresolved billing exceptions. The company partnered with AWS and LTM to build a multi‑agent AI system on Amazon Bedrock that integrates directly with its SpeedShip transportation management system. The solution automates the three‑step exception workflow—invoice matching, pricing variance, and accessorial validation—by interpreting carrier tariffs and dispute rules. Six months after launch, the system reduced active exceptions by 75 percent, shortened time‑to‑cash by four weeks, saved $1 million annually, and released a one‑time $10 million cash‑flow infusion. The case illustrates how agentic AI can handle complex, context‑dependent freight billing disputes at scale.
AWS Machine Learning BlogFirst-partyAmazon Bedrock AgentCore Runtime Enables Live Preview of Coding Agent‑Built Web Apps
Amazon Bedrock AgentCore’s Session Endpoint feature lets a coding agent keep a Vite‑based website running inside an isolated microVM. Each agent session receives an authenticated URL that forwards HTTP and WebSocket traffic to the session’s allowed ports, allowing developers to open the app in a browser, interact with it, and see changes—such as a dark‑theme switch—appear instantly without redeployment. The session endpoint URL is returned in the InvokeAgentRuntime response header X‑Amzn‑Bedrock‑AgentCore‑Runtime‑Session‑Endpoint‑Url, and access requires IAM SigV4 signatures or a JWT bearer token. The sample demonstrates opening a local page with a chat sidebar and the live site, streaming the agent’s steps, and observing internal port handling and request filtering.
Crypto
Binance Suffered Record $6.36 Billion Theft After 36‑Hour Preparation
A sophisticated attacker spent at least 36 hours preparing a coordinated attack on Binance that began on the evening of Oct. 29. The operation started with a rapid transfer of 233.46 million XRP (≈$296 million) from five Binance wallets on the XRP Ledger into a single attacker‑controlled address. Within minutes, the attacker moved assets across ten blockchains: Solana, Optimism, Bitcoin (18,270 BTC ≈$1.47 billion), Tron (612.7 million USDT and 46.4 million TRX ≈$628 million), Ethereum (167,464 ETH and 1.615 billion USDT), USDC, Avalanche, and Polygon. The attacker used malicious smart‑contract code and EIP‑7702 authorisations to sweep funds from hot wallets, repeatedly executing sweeps as new assets entered the compromised accounts. The theft totaled $6.36 billion, making it the largest cryptocurrency theft on record. The incident illustrates how a single, well‑timed exploit can simultaneously drain multiple blockchains, highlighting the need for robust multi‑chain security measures and vigilant monitoring of hot‑wallet authorisations.
- Binance Reports $6.3 B Impact from Unauthorized Withdrawals, Covers LossesBeInCrypto
- Binance hack may involve compromised signing infrastructure, not stolen keys, says BlockaidCointelegraph
- Binance Freezes $2.5 bn in Assets After Suspected $6.3 bn HackBBC Business
- Binance Uncovers Multiple Breach Points in $6.3 B Hack, Freezes 30% of AssetsDecrypt
Decrypt1 more source covered thisTRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor
CointelegraphNorth Korea’s TraderTraitor Group Linked to $6.3 B Binance Hack
Cybersecurity firms TRM Labs and Chainalysis, together with on‑chain investigator ZachXBT, have attributed the $6.3 B theft from Binance to the North Korean hacker collective TraderTraitor. TRM Labs cited both on‑chain and off‑chain intelligence to reach a “high confidence” attribution. ZachXBT noted that the stolen Binance funds and those taken in the earlier Bitget exploit were commingled at the same address after moving through THORChain, indicating a single actor behind both incidents. Chainalysis CEO Jonathan Levin estimated the loss at $6.4 B and linked it to TraderTraitor, citing similarities to previous North Korean‑linked hacks such as the Bybit and DMM Bitcoin thefts. The FBI has also identified TraderTraitor as the culprit in the $300 M DMM Bitcoin robbery, where an attacker used social engineering to gain employee access and divert funds. The attribution underscores a pattern of cross‑platform, state‑backed cyber‑criminal activity.
Binance Hit by $6.3 B Hack Linked to North Korea
Investigators have traced a $6.3 billion theft from Binance’s hot‑wallet signing infrastructure to a North Korean threat actor. Attackers exploited a vulnerability in Binance’s hot‑wallet signing system to authorize unauthorized transfers, then moved the stolen funds through a series of mixing services to obscure their trail. The incident remains under investigation, with authorities tracking the flow of the compromised assets.
Binance Seizes $3 bn of $6.3 bn Stolen in North Korea‑Linked Hack
Binance, the world’s largest crypto exchange, has frozen roughly $3 bn of the $6.3 bn ($4.7 bn) it says was siphoned off in a sophisticated hack that analysts link to a North Korean cyber‑crime unit. The exchange initially blamed a compromised engineer’s laptop but later confirmed a broader breach. U.S. authorities, including the Secret Service, FBI and the Treasury’s Financial Crimes Enforcement Network, are working to trace, freeze and recover the remaining stolen funds. Binance has assured users that their money is safe and that it will cover all losses, while also maintaining that deposits remain unaffected. The incident eclipses the $1.5 bn Bybit heist of 2025 and underscores the growing threat of state‑backed hacking in the crypto market.
Blackstone Lowers Expectations for Anthropic’s Credit Rating to Junk Status
Blackstone, the $9 billion investor in Anthropic, has reversed its earlier forecast that the AI firm would secure an investment‑grade rating by year‑end. The change follows a June BB+ rating from Kroll Bond Rating Agency, just below the BBB‑pass mark. Anthropic’s planned $800 billion compute expansion relies on borrowing costs tied to its credit rating; a junk rating would raise interest rates and limit lenders, especially pension funds and insurers that face junk‑debt caps. The company holds over $112 billion in cash and expects to raise roughly $100 billion more in its upcoming IPO, but the credit outlook remains uncertain until the final agency decisions post‑debut. Reason: The downgrade signals higher borrowing costs for a major AI player, affecting the broader AI funding landscape and the cost of capital for tech firms seeking large-scale investments.
Global & industry
Utah Files 13 Felony Charges Against Kalshi After $115 Sports Bet Investigation
Utah prosecutors filed 13 felony counts against Kalshi and its founders, CEO Tarek Mansour and COO Luana Lopes Lara, after a state undercover agent placed 12 sports wagers totaling $114.87 on the platform between September 13 and September 26. The agent created a Kalshi account using a Utah residential address, phone number and locally issued debit card, and confirmed his Utah location via the platform’s location services before placing a $10 bet on a Dallas Cowboys‑New York Giants game. Kalshi allowed the transaction, collected a 44‑cent fee, and subsequently accepted 11 more bets across football, baseball, soccer and hockey. The charges include third‑degree felony counts of online gambling promotion, a second‑degree felony for a pattern of unlawful activity, and a misdemeanor gambling promotion charge. The case escalates a national dispute over whether federally regulated prediction markets must comply with state gambling laws, with the Commodity Futures Trading Commission (CFTC) already suing Utah to prevent enforcement of its restrictions.
Reddit CEO Steve Huffman Blames Google’s AI Mode for Loss of Over One Million Weekly Search Referrals
Reddit’s shares fell more than 25 % after the company reported that it lost over one million Google search referrals per week in October, citing Google’s new AI Mode and AI Overviews as the cause. Huffman said AI Mode does not drive traffic to Reddit or to any other site, describing it as a fundamental shift in how Google operates. Reddit claims user demand for its platform has not changed, but Google has stopped sending users there. In response, Reddit is testing login walls outside the U.S. to curb scraping and reduce its dependence on the open web, while continuing data‑licensing talks with AI providers. The incident highlights a structural risk for any business that relies on Google for traffic.