Week of Sunday, November 1, 2026

Binance, an exchange with more than 300 million registered users by the BBC's count, had about $6.3 billion stolen on Thursday October 29th, most of it in roughly 20 minutes. Chainalysis and TRM Labs, two firms that trace cryptocurrency, put the total at $6.36 to $6.4 billion, and the FBI says more than $6 billion. It is the largest crypto theft on record, roughly four times the February 2025 theft from the exchange Bybit, which the FBI put at about $1.5 billion.

It was planned. TRM traces the groundwork back at least 36 hours: the thieves funded the account they used to run the theft through a service that hides where money came from, then tested their code on the day. The money moved in one burst, with a second wave about three hours later.

Binance's early finding, relayed by ABC and the BBC, is that the attacker may have gained access through a compromised laptop belonging to a DevOps engineer, an employee who builds and runs the company's systems. ABC reports the investigation has since found additional points of breach, without saying where, and the technical report Binance promised is not out. TRM's own read is that the systems that approve payments out of Binance's wallets were compromised across several blockchains. Binance has not published a root cause.

On Saturday the FBI, with the Secret Service and IRS Criminal Investigation, attributed the theft to TraderTraitor, a North Korean group, though President Trump said the same day that Washington was not yet certain North Korea was involved. Chainalysis and TRM reached the same conclusion from the money trail, which mixed with funds stolen from the exchange Bitget in September. It is the third large exchange theft in 20 months tied to the same group.

Tether and Circle, the companies that issue the two largest digital dollars, froze about $1.8 billion of the stolen money within the hour and about $2.4 billion by that night, per TRM and the BBC. Frozen is not recovered, and TRM says the thieves still hold more than 420,000 ether and 18,270 bitcoin, two digital currencies that no company can freeze. Binance says it has replaced 95% of the stolen assets from its own funds, about $6 billion, and began resuming withdrawals in phases on Sunday.

Cursor, a code editor with built-in AI assistants, reported on October 29th that a tampered copy of the Claude Code add-on, which belongs to Anthropic's AI coding assistant, sat in Cursor's add-on store for about eleven hours. Anthropic told Microsoft it did not build the tampered copy and that its own systems were not compromised, and the official versions elsewhere were untouched. Up to 5,000 users could have installed it, per Cursor as reported by The Hacker News, a security news site. How the attacker published under Anthropic's name is unknown.

According to Microsoft, the add-on copied basic details about the machine and the names of the settings where developers keep passwords and keys, planted a key that lets the attacker log in later, and opened a hidden connection back to the attacker's server. The add-on kept working normally. Cursor says the login step failed on most machines, but the planted key and the restart settings were still in place. Microsoft says removing the add-on does not remove them and recommends rotating credentials from a clean device. No attacker has been named.

Separately, Wiz, a cloud security company, counts at least nine AI developer platforms that disclosed incidents in October. These are the hosting services where developers run their apps and keep the keys those apps use. The ways in differed: stolen credentials at some, a weakness in the build systems at Railway, a third-party vendor at another. Railway had an attacker in its build systems for about 38 hours from October 20th and says up to 1.85% of its customer workspaces may have had their stored settings decrypted. It gave vendors including GitHub, Anthropic, OpenAI and Stripe the keys on its platform to revoke, and believes the target was AI keys. Zeabur had 321,810 accounts and about 3.2 million stored settings exposed through internal credentials left in plain text. Its admin keys never expired and had not been changed since January 2024. Zeabur is shutting down by December 31st.

A stolen key is spendable. Wiz watched two stolen cloud AI credentials used for 800,000 and 1.7 million requests, likely more than $100,000 of usage at list price. Nothing in the evidence ties the extension to the platform breaches: the methods and the weeks differ, and neither incident has a named attacker. What they share is the place developers keep their keys.

Every product sold in the US that sends or receives radio signals needs an equipment authorization from the Federal Communications Commission, and that authorization rests on tests from a lab the FCC recognizes. On October 29th the FCC voted 3-0 to recognize only labs located in the US or in a country that has a recognition or trade agreement with the US. Taiwan and Hong Kong qualify; China does not. A US-owned lab testing inside China is barred the same way.

The dependence is large. In 2007 the US did 31% of this testing and China 13%. In 2025, by FCC Chairman Brendan Carr's statement, the US did 3.6% and China 82.3%.

The new rules start on December 1st, 2028. Any application received on or after that day has to rest on testing done under them, and there is no general waiver. Products already authorized keep selling. The rule itself takes effect 60 days after it is published in the Federal Register, which had not happened as of October 31st. The FCC estimates the change will add about $79.3 million a year in testing costs, assuming labs in other qualifying countries charge 20% more than China and US labs charge 400% more.

The trigger was faked data. On October 2nd the FCC pulled recognition from two Chinese labs after finding 33 and 38 incorrect or false test reports, and moved against two more over reports copied between unrelated products. Beijing's commerce ministry answered Friday night, saying the measure "seriously disrupted the stability of global industrial and supply chains," per the South China Morning Post. DroneXL, a drone industry news site, citing the ministry's statement and Reuters, adds that the ministry says it repeatedly proposed a recognition agreement with the US and will take further measures if the US proceeds.

About 250 maritime watchmen, the gate security and cargo-watch staff at the terminals, belong to International Longshore and Warehouse Union Local 26, roughly 2% of the longshore workforce at the two ports. Their contract with the Pacific Maritime Association, the employers' group for terminal operators and shipping lines, expired in July 2025, and after more than a year of talks, with a federal mediator now involved, the union has authorized a strike. A walkout threatened for November 1st was pushed back by an extension the two sides signed Friday, which runs to 5 p.m. Pacific on Wednesday. The employers say their offer includes raises and pension improvements, while the union has not published its demands.

What gives 250 people so much leverage is the picket line. The employers name six container terminals that together handle about 85% of Long Beach's cargo and about a third of Los Angeles's, and they say other union members "are not expected to cross any Local 26 picket line," which would stop work at those terminals, though the union has not said so. Port-wide security by Long Beach Harbor Patrol and police would continue either way.

The two ports carry roughly 26 to 27% of US container imports by weight and about a third by value, and they are already running at record volume, with September the busiest month on record for both at 2.04 million 20-foot container units combined. On October 27th, 34,592 import containers were waiting for rail, according to a tally by The Dwell from the ports' daily rail reports, and rail-car shortages have been reported. As of November 1st no shipping line had announced a diversion plan, and there is no evidence of spare capacity at another West Coast port.

The last time the ports stopped over a labor fight was September 2002, when the employers locked out the longshore union and all 29 West Coast ports closed for 11 days, until a federal court order under the Taft-Hartley Act, which lets the government halt a strike, reopened them. The 2014-15 contract fight never closed the ports, but it brought months of slowdowns and congestion before a deal in late February 2015.

Fitch Ratings, one of the three big credit rating agencies, said late Friday October 30th that it had revised the outlook on France's long-term rating to Negative from Stable and affirmed the rating at A+. The rating is the grade lenders price against, and the outlook is the agency's signal of where that grade is likely headed, with Negative pointing toward a downgrade. A+ puts France level with Portugal and Belgium and six notches above junk, by Bloomberg's count. The move was unscheduled, two months after Fitch's regular August review, and it came after European markets closed, so no price has yet moved on it.

Fitch's reasons, as reported by Le Monde, the French daily, and Bloomberg, are "weaker growth, higher borrowing costs and a wider deficit" since August, plus "persistent political fragmentation and a challenging social backdrop" that make budget repair harder to deliver. It now sees French debt reaching about 124% of GDP in 2028, up from 115.7% in 2025, and the 2027 deficit at 5.5% of GDP against the government's 5.0% target. Fitch says the 10-year yield rose from 4.1% at its August review to 4.9% by the end of October, after touching about 5.1% on October 22nd, the highest since 2002, and France now borrows at a higher rate than lower-rated Italy. Third-quarter output shrank 0.1%, per the national statistics office as reported by Le Monde.

The budget decides what comes next. The National Assembly votes Tuesday afternoon, November 3rd, on the revenue half of the 2027 finance bill, with more than 2,600 amendments filed, and Prime Minister Lecornu has no majority and faces the risk of a no-confidence vote. Finance Minister Roland Lescure said the government "takes note" and keeps its 5% target, and warned that without the turnaround in the budget "we are headed straight for a wall." Moody's affirmed its own negative outlook on October 23rd, saying its rating assumes a deficit-cutting 2027 budget passes, Morningstar DBRS, a fourth agency, turned negative in September, and S&P, at A+ with a stable outlook, has a scheduled review on November 27th.

The last two cuts to France's rating, Fitch's in September 2025 and S&P's a month later, both landed on a Friday, and after Fitch's the 10-year yield rose about 0.07 percentage points at Monday's open before going broadly flat. Fitch has also said that France's A+ rated banks are sensitive to a sovereign downgrade of more than one notch, because their ratings are capped by the sovereign's.

General Motors agreed on October 29th to pay $220 million to 36 state attorneys general, led by Washington and Oregon, over Smart Driver, a program that ran from 2016 to 2024 and enrolled millions of drivers. The states allege the cars recorded trips, start and end times, hard braking, hard acceleration and speeding, and that GM sold the record to data brokers under contracts saying it was for insurance products. Verisk Analytics bought from 2015 and LexisNexis Risk Solutions from 2019, the latter with precise location, and both turned it into driver ratings they sold to insurers, some of whom used them in part to set rates. No insurer is named. Oregon's complaint alleges GM made over $20 million nationwide from those sales, so the $220 million is up to eleven times what the data brought in. GM admits no violation or liability.

The states allege dealership staff clicked through the terms on customers' behalf, were paid bonuses for enrollments, and that dealerships were ranked by how many drivers they enrolled, and that the OnStar app told more than 370,000 drivers they were not enrolled when they were. The states say GM later unenrolled them without saying so and left their data with the brokers and insurers. GM ended the program after the New York Times reported on it.

The settlement, 36 state judgments effective November 30th, requires GM to get the driver's clear consent before it collects or shares location or driving data, with pre-ticked boxes, silence and broad terms of use no longer counting. It must also delete retained data and ask the third parties that received data before January 2025 to delete it, and the privacy program obligations run to January 2046. The Federal Trade Commission's separate order, finalized in January, bans GM from giving location and driving data to consumer reporting agencies for five years, with no payment.

A day earlier, the FTC sent study orders to nine companies including Delta, United, Uber, DoorDash, Target and Walmart, asking whether the price of a ticket, ride, delivery or product varies by person based on loyalty status or personal data, and whether gig-worker pay offers do. The orders compel answers but are not an enforcement action, and responses are due within 45 days of receipt.

On September 1st Honeywell Aerospace agreed to pay $2,042,518 to settle allegations under the False Claims Act, the federal law against false billing to the government, which lets a whistleblower bring the case and keep a share. The Justice Department alleged that from April 2020 through December 2023 a business unit billed the Department of Defense while one of its networks did not meet NIST 800-171, the federal standard for protecting sensitive government information on contractor systems, as the contract required. A former employee, Rachel Tenney, brought the case and receives $375,823. The claims are allegations only, with no finding of liability, and the Justice Department's release does not name the network or say which controls were missing.

The whistleblower's complaint, which the court unsealed in redacted form on August 24th, fills in some of it. As described by two cybersecurity practitioners who read it, it concerns a separate network, internally called the Gray Network, that held sensitive defense and intelligence-related work under quantum computing contracts, and it alleges the network lacked protections the rest of Honeywell had. Antivirus ran on workstations but not servers, the company could not account for every device on the network, access could not be tied to authorized people, and alerts from security tools reached no one trained to act on them. After the SolarWinds breach became public in December 2020, the complaint says, unexplained remote sessions and more than 1,200 megabytes moving to a compromised server were investigated and closed over Tenney's objection. Whether the attackers took any government data is unknown. The complaint names Honeywell International as the defendant, while Honeywell Aerospace, spun off on June 29th, paid the settlement.

Three weeks after the settlement, on September 22nd, a shareholder named Russ Green sued Honeywell Aerospace, chief executive James Currier and finance chief Joshua Jepsen in federal court in Arizona under federal securities fraud law, on behalf of people who bought shares between June 29th and September 1st. The complaint alleges the company left out two things: that a small share of suppliers had an outsized effect on sales and were supply-constrained, and that it was under investigation over the cybersecurity requirements. It quotes the August 5th quarterly filing's reference to "a number of other lawsuits, investigations, and claims" and alleges the company never disclosed the investigation itself. These are the plaintiff's allegations.

On August 6th, after the company cut its guidance, the stock fell $47.17, or 23%, and on September 1st, the day of the settlement release, it fell $3.87, or 2.45%. About 23 of the roughly 25.6 percentage points of alleged decline come from the supply-related guidance cut, so the cyber theory rests on the smaller drop. The court docket for the securities case, as last updated October 23rd, shows only the complaint, summonses, a judge's recusal and a scheduling order.

The Justice Department has settled well over five such cases since 2022, from about $0.5 million to more than $9 million, so Honeywell's $2 million sits in the lower middle. Aerojet Rocketdyne paid $9 million after settling on the second day of trial, and MORSECORP paid $4.6 million after reporting a far better security score than a consultant found. D&O Diary, a blog on directors' and officers' liability, notes that the securities suit itself comes from alleged contractual noncompliance rather than a breach, and that the open question is whether a generic risk disclosure is misleading when an undisclosed investigation already exists.