Policy & Regulation · Latest

North Korean Lazarus Group Linked to $6.3 bn Binance Hack

Two blockchain analytics firms, TRM Labs and Chainalysis, have identified the North Korean state‑backed Lazarus Group (also known as TraderTraitor) as the likely perpetrators of the $6.3 bn (£4.7 bn) theft from Binance, the world’s largest cryptocurrency exchange. The group reportedly gained access to Binance’s hot‑wallet signing system, enabling automated transfers of funds. Binance’s co‑CEO Richard Teng said the breach was broader than an engineer’s laptop compromise and that about 80 % of the stolen assets have been recovered, with the remainder still missing. The incident follows a series of high‑profile cyber‑attacks attributed to North Korea, including the 2014 Sony Pictures hack and the 2022 theft of $620 m in crypto from Bybit, and underscores the country’s use of cybercrime to finance its regime.

Blackstone Lowers Expectations for Anthropic’s Credit Rating to Junk Status

Blackstone, the $9 billion investor in Anthropic, has reversed its earlier forecast that the AI firm would secure an investment‑grade rating by year‑end. The change follows a June BB+ rating from Kroll Bond Rating Agency, just below the BBB‑pass mark. Anthropic’s planned $800 billion compute expansion relies on borrowing costs tied to its credit rating; a junk rating would raise interest rates and limit lenders, especially pension funds and insurers that face junk‑debt caps. The company holds over $112 billion in cash and expects to raise roughly $100 billion more in its upcoming IPO, but the credit outlook remains uncertain until the final agency decisions post‑debut. Reason: The downgrade signals higher borrowing costs for a major AI player, affecting the broader AI funding landscape and the cost of capital for tech firms seeking large-scale investments.

Binance, FBI and Secret Service Investigate $6.4 B Hack, Circle and Tether Freeze $1.8 B in Stablecoins

Binance is collaborating with the FBI and the U.S. Secret Service after a hacking incident that stole $6.4 billion from the exchange. Circle’s CEO Jeremy Allaire said the company has frozen roughly $823 million in USDC linked to the attack, while Tether has frozen about $975.1 million in USDT. Blockchain analytics firms TRM Labs and Chainalysis attribute the breach to the North Korean group TraderTraitor, previously tied to the $1.5 billion Bybit hack. The coordinated freeze of more than $1.8 billion in stablecoins demonstrates how issuers can block stolen digital assets before they are moved, aiding law‑enforcement investigations worldwide.

Binance Seizes $3 bn of $6.3 bn Stolen in North Korea‑Linked Hack

Binance, the world’s largest crypto exchange, has frozen roughly $3 bn of the $6.3 bn ($4.7 bn) it says was siphoned off in a sophisticated hack that analysts link to a North Korean cyber‑crime unit. The exchange initially blamed a compromised engineer’s laptop but later confirmed a broader breach. U.S. authorities, including the Secret Service, FBI and the Treasury’s Financial Crimes Enforcement Network, are working to trace, freeze and recover the remaining stolen funds. Binance has assured users that their money is safe and that it will cover all losses, while also maintaining that deposits remain unaffected. The incident eclipses the $1.5 bn Bybit heist of 2025 and underscores the growing threat of state‑backed hacking in the crypto market.

Binance Sets Aside $6.34 B to Cover Hack Losses, CEO Confirms Customer Funds Safe

Binance CEO Richard Teng announced that the exchange has reserved more than $6.34 billion of company funds to reimburse all losses from a recent hack that targeted Binance’s hot wallet. Five billion dollars of that reserve is already held in the exact tokens stolen—USDC, USDT, BTC, ETH and BNB—while the remaining amount is being acquired through market and OTC channels. Teng said the attacker used a self‑destruct mechanism and an EIP‑7702 delegation to bypass Binance’s normal approval controls, and that the theft was carried out by a coordinated group rather than a single individual. Binance plans to restore withdrawals by Sunday, conduct a full security review of endpoints, cloud, key management and signing, and publish a full proof‑of‑reserves report by Monday. The attacker continues to move funds on Tron, with about 5.19 million TRX (≈$1.73 million) transferred to 12 addresses between 11:37 a.m. and 12:12 p.m. ET on Friday. The move underscores Binance’s ability to absorb a loss of this magnitude through its crypto‑based operating earnings and its commitment to protecting customer assets, which are held in cold wallets and only moved to hot wallets for withdrawals.

Utah Files 13 Felony Charges Against Kalshi After $115 Sports Bet Investigation

Utah prosecutors filed 13 felony counts against Kalshi and its founders, CEO Tarek Mansour and COO Luana Lopes Lara, after a state undercover agent placed 12 sports wagers totaling $114.87 on the platform between September 13 and September 26. The agent created a Kalshi account using a Utah residential address, phone number and locally issued debit card, and confirmed his Utah location via the platform’s location services before placing a $10 bet on a Dallas Cowboys‑New York Giants game. Kalshi allowed the transaction, collected a 44‑cent fee, and subsequently accepted 11 more bets across football, baseball, soccer and hockey. The charges include third‑degree felony counts of online gambling promotion, a second‑degree felony for a pattern of unlawful activity, and a misdemeanor gambling promotion charge. The case escalates a national dispute over whether federally regulated prediction markets must comply with state gambling laws, with the Commodity Futures Trading Commission (CFTC) already suing Utah to prevent enforcement of its restrictions.

TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor

Binance Reveals Additional Breach Points in $6 B Hack Linked to North Korean Group

Binance investigators have identified new attack vectors beyond an initially suspected compromised employee laptop in the roughly $6 billion theft. The exchange has not disclosed the extra breach points but confirmed that no wallet private‑key leakage occurred. TRM Labs attributes the incident to the North Korean‑linked group TraderTraitor, which also targeted Bybit in February 2025. Attackers moved the stolen funds across ten blockchains—Ethereum, Bitcoin, Tron, Solana, XRP Ledger, and others—within about 20 minutes, using EIP‑7702 to delegate control of a Binance hot wallet to a malicious contract. The operation involved 50 pre‑signed authorizations, one of which allowed the attacker to install transaction‑execution instructions and drain assets. Binance froze roughly $3 billion of the affected assets, pledged to cover all losses via its Secure Asset Fund for Users (SAFU) and corporate resources, and plans to resume withdrawals in about 45 hours while overhauling its withdrawal infrastructure. The incident highlights coordinated cross‑chain theft and potential compromise of Binance’s hot‑wallet signing infrastructure.

Polymarket Suffers Second Multi‑Million Dollar Breach in Four Months

Polymarket’s trading platform was shut down on Oct. 29 after a malicious third‑party script infiltrated the site’s login session, searching for trading tools and requesting signatures. Blockchain analytics firm Bubblemaps estimated that more than 700 users were affected, with about $3.46 million of assets compromised. Roughly $2.7 million was converted to POL and transferred out, while $750,000 remained on the platform. The October breach followed an earlier June attack in which a compromised vendor’s script used approved authorizations to drain approximately $3 million from users’ wallets via Polymarket’s own relayer. Both incidents demonstrate how external scripts can access a user’s browser context, obtain cryptographic signatures, and move funds, raising questions about the boundary between third‑party code and the platform’s internal signing mechanisms.

Binance Uncovers Multiple Breach Points in $6.3 B Hack, Freezes 30% of Assets

Binance estimates the Thursday security incident cost about $6.3 billion, with roughly $3 billion of the affected assets now frozen on‑chain. Initial investigations linked the breach to a compromised DevOps engineer’s laptop, but further analysis revealed additional points of entry. The exchange has reopened deposits while withdrawals remain suspended, and it will cover all losses from its SAFU emergency reserve and company funds. Binance CEO Richard Teng said the attack was complex and not attributable to a single individual, and the firm is working with law enforcement and blockchain intelligence partners to trace and recover the stolen funds.

Kenyan National Indicted in U.S. Student‑Aid Fraud Scheme

In May 2024, Francis Mogambi entered the United States after winning the Diversity Visa lottery. By October 2026, a Nebraska grand jury indicted him on ten counts, alleging that between November 2025 and May 2026 he and Kenyan associates stole the identities of U.S. citizens to enroll fictitious students in American colleges. The fake students received federal financial aid, which Mogambi diverted, keeping 30% and sending the rest to his Kenyan associates. Prosecutors say the intended loss in his case was $20,000 (£15,000). Mogambi was reportedly paid $2,000 a week and tried to recruit another participant, promising a business that would allow larger tax‑free cheque cashing. His indictment is part of Operation Ghostbusters, a broader U.S. investigation that has so far resulted in five indictments and 40 open cases, with hundreds of victims whose personal data was sold online for $4–$8 each. The Justice Department’s National Fraud Enforcement Division, led by Assistant Attorney General Colin M. McDonald, has vowed to prosecute those who steal taxpayers’ money and exploit the student‑aid program.

Binance Reports $6.3 B Loss After North Korean‑Linked Hacker Group TraderTraitor Steals Crypto

Binance says the hack has cost the exchange roughly $6.3 billion, with about $3 billion of cryptocurrency already frozen. The stolen assets include USDT, USDC, RLUSD, USD1, XUSD, USDT0, WBETH, XAUT, PAXG, USDP and ARB. Chainalysis, TRM Labs, Blockaid and other security firms point to the North Korean hacking group TraderTraitor as the likely culprit, a group also linked to the ByBit and Kelp DAO attacks. Binance has paused withdrawals while it revamps its security, but deposits remain active and withdrawals are expected to resume within 48 hours. The incident has prompted speculation that the breach could accelerate a shift from centralized exchanges to decentralized platforms such as Uniswap.

North Korea’s TraderTraitor Group Linked to $6.3 B Binance Hack

Cybersecurity firms TRM Labs and Chainalysis, together with on‑chain investigator ZachXBT, have attributed the $6.3 B theft from Binance to the North Korean hacker collective TraderTraitor. TRM Labs cited both on‑chain and off‑chain intelligence to reach a “high confidence” attribution. ZachXBT noted that the stolen Binance funds and those taken in the earlier Bitget exploit were commingled at the same address after moving through THORChain, indicating a single actor behind both incidents. Chainalysis CEO Jonathan Levin estimated the loss at $6.4 B and linked it to TraderTraitor, citing similarities to previous North Korean‑linked hacks such as the Bybit and DMM Bitcoin thefts. The FBI has also identified TraderTraitor as the culprit in the $300 M DMM Bitcoin robbery, where an attacker used social engineering to gain employee access and divert funds. The attribution underscores a pattern of cross‑platform, state‑backed cyber‑criminal activity.

Binance Suffered Record $6.36 Billion Theft After 36‑Hour Preparation

A sophisticated attacker spent at least 36 hours preparing a coordinated attack on Binance that began on the evening of Oct. 29. The operation started with a rapid transfer of 233.46 million XRP (≈$296 million) from five Binance wallets on the XRP Ledger into a single attacker‑controlled address. Within minutes, the attacker moved assets across ten blockchains: Solana, Optimism, Bitcoin (18,270 BTC ≈$1.47 billion), Tron (612.7 million USDT and 46.4 million TRX ≈$628 million), Ethereum (167,464 ETH and 1.615 billion USDT), USDC, Avalanche, and Polygon. The attacker used malicious smart‑contract code and EIP‑7702 authorisations to sweep funds from hot wallets, repeatedly executing sweeps as new assets entered the compromised accounts. The theft totaled $6.36 billion, making it the largest cryptocurrency theft on record. The incident illustrates how a single, well‑timed exploit can simultaneously drain multiple blockchains, highlighting the need for robust multi‑chain security measures and vigilant monitoring of hot‑wallet authorisations.

Binance Freezes $2.5 bn in Assets After Suspected $6.3 bn Hack

Binance announced that it has frozen more than $2.5 bn (£1.87 bn) of digital assets to prevent theft while it investigates a security breach. Deposits and withdrawals are temporarily suspended, and the company has pledged to cover all losses. Former CEO Changpeng Zhao confirmed the incident appears to be a hack. Two other platforms, Tether and Circle, have also frozen roughly $1.7 bn of stolen assets, with Circle reporting over $800 m linked to the incident. The combined amount of assets frozen—around $42 bn—could be the largest crypto‑related theft on record. Binance said it is working with law enforcement and will publish a full post‑mortem once the investigation concludes.

Binance hack may involve compromised signing infrastructure, not stolen keys, says Blockaid

Blockaid co-founder Ido Ben-Natan told Cointelegraph that the suspected $2.5 billion-plus Binance hack likely involved manipulation of the exchange's transaction-signing system rather than theft of private keys. The analysis points to "key misuse," where attackers authorized malicious transactions by compromising signing infrastructure. Blockaid's onchain analysis identified 50 EIP-7702 authorizations bundled into one transaction, one of which matched the account's required nonce. The affected account was delegated to an unverified sweeper contract allowing token drainage. Ben-Natan noted similarities to the February 2025 Bybit attack, which also involved compromised developer credentials.

Tether, Circle, Ripple and World Liberty Financial freeze $2.6 billion linked to suspected Binance breach

Stablecoin issuers Tether, Circle, Ripple and World Liberty Financial froze over $2.6 billion in digital assets tied to a suspected Binance security breach involving nearly $6 billion in outflows. Tether froze $1.567 billion in USDT and Circle froze $823 million in USDC. Ripple froze $200 million and World Liberty Financial restricted $27 million. The freezes followed Kairos Research estimating about $5.7 billion leaving Binance hot wallets via a security breach in late October.

SEC Charges Two Entities in $130 Million Fraud Involving False SEC Filings

The SEC charged BG Wealth Sharing Ltd and DSJ Exchange Pty Ltd with orchestrating a fraud scheme using false SEC filings to boost investor confidence. From October 2025 to June 2026, the entities raised over $130 million from tens of thousands of retail investors by promising risk-free returns from crypto trading signals. The complaint alleges the defendants submitted false Form ADV and Form D filings to create a false appearance of SEC registration and legitimacy.

Polymarket halts trading after security incident, users report unauthorized withdrawals

Polymarket paused trading and relayer actions after users reported unauthorized fund withdrawals. A wallet flagged as the suspected attacker holds about $2.65 million in POL after multiple USDC.e-to-POL swaps through Relay. Hudson Rock found a DebugBear-hosted script with wallet-draining code hard-coded to the same address. The platform's frontend may be compromised, with the trading API in major outage and the exchange in cancel-only mode.

Kalshi raises $1 billion at $40 billion valuation, non-sports revenue tops $1 billion annualized

Prediction market platform Kalshi closed a $1 billion Series G funding round at a $40 billion valuation, co-led by Wellington Management and Sequoia Capital. The company's non-sports markets now generate over $1 billion in annualized revenue, according to The Wall Street Journal. This round confirms completion of financing first reported in September, following a $1 billion Series F at a $22 billion valuation in May. Kalshi also reported approximately $15.8 billion in trading volume over the past 30 days. The expansion comes amid legal challenges, including partnerships with the NBA and S&P Dow Jones Indices, and regulatory disputes with the CFTC and Utah state authorities.