Shortly after 4 p.m. Eastern on Thursday, money began leaving the hot wallets of Binance, the world’s largest cryptocurrency exchange, on several blockchains at once. Ari Redbord of the blockchain-analytics firm TRM Labs told the BBC that most of it was gone in about 20 minutes. By Friday the exchange put the loss at $6.3 billion. Chainalysis, which traced the same transfers, puts it near $6.4 billion. Either figure is more than four times the $1.5 billion taken from Bybit in 2025, the previous record, and Chainalysis calls it the largest theft in the history of crypto.

The first thing to understand is what did not break. No blockchain was rewritten. The ledgers did what they are built to do: they recorded, permanently and in public, transactions that carried valid authorizations. What failed was the machinery inside Binance that decides which authorizations get made.

## How the money moved

Binance first said the incident “may have started with a compromised DevOps engineer’s laptop.” By Friday, co-chief executive Richard Teng had widened that account. “This was not carried out by one person,” he said in a video posted on X. “Our subsequent investigation has uncovered additional points of breach.” He said the attackers used “a self-destruct mechanism that destroyed tooling and traces as they went.”

Teng also named the route. The attackers used EIP-7702, an Ethereum feature that lets an account delegate its execution to smart-contract code, to take control of a hot wallet. The delegation, he said, “did not pass through our normal approval controls.” Chainalysis gives an outside view of the same step. A wallet funded through the Tornado Cash mixer submitted valid signed authorizations that let a Binance hot wallet run code the attacker had deployed. The attacker then called that wallet and swept out its assets. Other affected Binance wallets, the firm says, appeared to send funds through ordinary signed transfers.

The theft was fast because it was prepared. Redbord said the attacker’s operator wallet was funded about 36 hours earlier and that the authorizing signatures were prepared in advance. “That speed is the product of long preparation,” he told the BBC. Chainalysis says the thief rushed $500 million of stablecoins, which issuers can freeze, into a wallet built to swap them. Over nearly 20 minutes it converted $325 million of them into $285 million of ether, then pushed the remaining $175 million to stopover wallets. Freezes began at 5:14 p.m. Eastern.

## Who did it

TRM Labs says it has “high confidence” that TraderTraitor, the North Korean unit also known as Lazarus, carried out the theft. Chainalysis reached the same assessment after watching Binance funds mix on-chain with money stolen from Bitget last month, a theft already attributed to North Korea. Both are private forensic judgments, not criminal charges. The Secret Service says it is working “around the clock” with the U.S. Attorney’s Office for the District of Columbia to trace and recover the money, and that its investigation “remains in its early stages.” The FBI says it is “aware of the incident.” North Korea has always denied carrying out such hacks.

## What Binance has promised, and what it has shown

Binance says it has set aside more than $6.34 billion of company money, including its Secure Asset Fund for Users, to cover the loss. About $5 billion of that is already held in the same cryptocurrencies as those stolen, and the exchange says it is buying the rest on the market and over the counter. Roughly $3 billion has been frozen with help from token issuers and analytics firms; Binance counts that separately from its replacement fund. It says it has found no evidence that wallet private keys were leaked.

Withdrawals remain switched off. Binance’s second incident update, published Friday, set a target of restoring them in phases, token by token, within about 34 hours, subject to security testing. It promised an initial proof-of-reserves update within 12 hours, followed by a full report Monday, Nov. 2, and further technical findings in about 48 hours.

Teng has insisted that the stolen money belonged to the firm. “We never use any customer funds so they are not impacted,” he said. CoinDesk examined Binance’s published reserve data and found that the compromised wallets had previously been listed among the assets backing customer balances. The two accounts need not contradict each other: a hot wallet can hold money Binance treats as its own while also counting toward the reserves that customers are told back their balances. But the overlap is why Monday’s report matters.

According to the BBC, Bitcoin fell about 4 to 5 percent from roughly $80,000 after the theft became public. That is a small move by the standards of earlier hacks. The harder test will come when withdrawals reopen and customers decide whether to stay.

## Where things stand

Established: about $6.3 billion was taken from Binance hot wallets on Thursday, about $3 billion has been frozen, and withdrawals are suspended. Promised: full replacement from company funds, phased withdrawals and a reserves report on Monday. Alleged: North Korean authorship, on the evidence of two analytics firms. A pledge is not a restoration, a snapshot is not an audit and an attribution is not an indictment. We will report each item when its status changes.

Mark Carney closed the 21st EU-Canada summit in Montreal on Friday with a line built to be quoted: “Today, we move toward Associate Membership for Canada, and we launch a new Alliance for the Future.” He said he had accepted European Council President António Costa’s invitation to attend the European Council in June 2027, “where we intend to conclude these negotiations.” He added that the European Commission and Canada’s federal cabinet would meet together in Canada in March.

The European Council’s own summary of the agreement is more careful. It says the two sides will “work towards an even closer EU-Canada association” and “define, by the 2027 EU-Canada summit, the concept of an ever-closer association of Canada to the EU, short of full membership.” The phrase “associate member” does not appear in that summary.

The difference is not a drafting accident. A week before the summit, POLITICO reported, citing six diplomats, that Germany, France and at least six other member states were resisting “associate membership” as the name for the arrangement. Those diplomats said the objection was to the label, not to closer ties. The EU treaties open membership only to European states and contain no category called associate membership. As Euronews noted when Ursula von der Leyen floated the idea in her State of the Union speech in September, there is no playbook for creating one.

Opening the summit on Thursday, von der Leyen called the idea “association without accession.” In his closing remarks, Carney described “the deepest possible partnership, short of accession – because of our geography.”

What the status would contain is still under negotiation. One diplomat described to POLITICO a stock-take that would ask whether Canada had expanded beyond its existing Horizon Europe Pillar II association and joined the Erasmus exchange program, built undersea cables and stockpiled critical raw materials with the EU, and explored pension-fund investment. AP reported progress on digital trade and on European investment in Canadian critical minerals and artificial intelligence. Carney said the Alliance for the Future would use “a variable geometry of like-minded nations” on AI, energy, critical minerals and quantum technology.

The motive is not hidden. Canada has long depended on trade with the United States, and tariffs and political pressure from Washington have pushed Carney to diversify.

That leaves two calendars. Ottawa’s ends in June 2027 with a concluded negotiation. The EU’s published text ends at a summit in 2027 with a definition. If the two meet, Canada gets a status no country has held. If they do not, it gets a famous phrase and a working group.

On Thursday the Houthi military spokesman, Yahya Saree, posted a list on X: Ras Tanura refinery, by ballistic missile; an Aramco facility at Abqaiq; King Khalid International Airport in Riyadh, by multiple missiles; King Fahd International Airport in Dammam, by drone; the Rabigh refinery on the Red Sea; and a military headquarters in the Najran region. That made six attacks, and he described all of them as successful.

Saudi Arabia confirmed none of them as hits. The Saudi-led coalition said it had intercepted two ballistic missiles fired toward Riyadh. The kingdom’s Civil Defence said shrapnel from the interception wounded one citizen and damaged a house and a vehicle. On Friday the coalition said it had downed a drone launched toward the Mecca region and a cruise missile aimed at western Saudi Arabia. Al Jazeera reported no independent corroboration of the Houthi claims. The Houthis, for their part, said Saudi airstrikes had killed 27 people in areas they control. That figure is also unverified.

Neither side’s statements settle the matter, but the physical record offers a partial check. The Houthis say they hit Ras Tanura twice this week. The refinery can process 550,000 barrels a day and stands beside one of the kingdom’s two main export terminals. After the first claim, on Tuesday, Bloomberg reported that Saudi Arabia had contained a fire near the terminal. On Oct. 14, two regional officials told the AP that a Houthi strike had damaged the top three floors of Aramco’s headquarters in Dhahran, with no casualties. Drone attacks on pumping stations in September shut the East-West pipeline, which lets Saudi crude bypass the Strait of Hormuz, for two weeks. Saudi Arabia later reported that flows had recovered to 5.8 million barrels a day by Oct. 6.

The diplomatic record points the other way. Earlier this week senior Saudi and Iranian officials met in Tehran, with Turkey and Pakistan represented, and agreed to resolve regional differences through dialogue. The missiles kept coming. Eight months into the Iran war, the Houthis are behaving as if Tehran’s diplomatic tone and their own target list are separate decisions.

Our method for covering this conflict is simple. A Houthi claim is a claim. A coalition interception report is also a claim, from the other side. The harder evidence is whether crude keeps leaving Ras Tanura and Yanbu on schedule. OilPrice reports that the attacks have become a major driver of oil prices over the past two months, so that is the record we will keep checking.

By midday Friday, the University of Florida’s Election Lab had counted 47,922,669 early votes in next Tuesday’s midterms, AFP reported. The previous midterm record for ballots cast before Election Day was 45.9 million, set in 2022.

The increase is sharpest where the Senate is in play. More than 6.3 million Texans had voted early by Wednesday, against 4.2 million at the same point four years ago, a 50 percent increase, according to an AP analysis. North Carolina’s election board reported early voting up nearly 37 percent. South Carolina passed its entire 2022 early-vote total on Monday, with five days of early voting still to go. In Kansas, where Republican Sen. Roger Marshall faces a hard race, advance ballots were running about two-thirds ahead of 2022 last week. Georgia had more than 2.5 million mail and in-person ballots by 6:30 a.m. Friday, a state midterm record, before early voting closed that evening. Minnesota passed its own midterm record with nearly 729,000 ballots, and more than 938,000 voters there have requested absentee ballots.

In states that record party registration, registered Democrats accounted for about 44 percent of early voters, Republicans 31 percent and unaffiliated or minor-party voters 25 percent, according to Election Lab figures.

Now the limits. Party registration does not reveal how anyone voted. Republicans have recently been more likely to vote on Election Day, which could narrow or reverse the early Democratic edge. And a record early vote does not necessarily mean a record total turnout, because some voters are simply voting sooner than they used to. Election Lab director Michael McDonald has pointed to rising participation among Black and Hispanic voters in states that report race and ethnicity, especially in heavily Hispanic communities along the Texas border. That is a turnout fact. It is not yet a margin.

The officials running the vote are making their own arguments with the numbers. “Georgians continue to head to the polls in record numbers because they trust the system,” said Georgia Secretary of State Brad Raffensperger. In Minnesota the record arrived amid what the Star Tribune described as concerns about possible federal interference.

Thirty-six governorships, control of the Senate and the House are on Tuesday’s ballot. The 47.9 million early votes are real ballots, and none of them settles a race.

The announcement says DoorDash and Instacart “share a mission to help local businesses succeed.” The terms are plainer. DoorDash will pay $65 for each Instacart share, an equity value of about $17 billion. That is a 26 percent premium to Instacart’s close on Oct. 22, the last trading day before reports of a deal. At least 75 percent of the price will be paid in cash. Holders may elect $65 in cash, 0.3372 DoorDash shares, or $48.75 plus 0.0843 shares, with proration so that stock never exceeds a quarter of the total. Holders of about 19 percent of Instacart’s shares have already agreed to vote in favor.

The companies expect to close at the end of 2027 or in the first half of 2028, once the Hart-Scott-Rodino waiting period ends and approvals including those in Canada and Israel arrive. A timetable that long tells you something: the advisers are planning for a full investigation, not a quick approval.

The overlap is obvious. YipitData figures provided to Reuters, based on more than 3 million consumers’ email receipts, gave DoorDash 65.1 percent of U.S. delivery orders last year, counting restaurant, grocery and retail together. Uber Eats had 25.8 percent and Instacart 9.1 percent. Instacart’s small share of that combined count understates its weight in groceries, which is the market this deal is about.

DoorDash’s defense is already in the announcement: “the biggest online retailers and grocers are racing ahead, building their own delivery fleets, warehouses, membership programs and AI shopping assistants.” Read that as Walmart, Amazon and Target. If the relevant market is everyone who will bring you groceries, the combination looks modest. If it is apps that send a shopper into your local supermarket on your behalf, it covers most of that market. The case will turn on which definition the regulators accept.

The timing is awkward. On Wednesday, a day before the announcement, the FTC ordered DoorDash, Instacart, Uber, Walmart, Target and several airlines to explain how they use personal data to set prices and pay workers. “Consumers deserve to know whether companies use their web surfing habits or other personal data to estimate the highest price they can charge each consumer,” said FTC Chairman Andrew Ferguson. Instacart has a record here. A December 2025 study by Consumer Reports and the Groundwork Collaborative found that its algorithmic price experiments could produce differences as high as 23 percent on some products, and Instacart ended the practice after the criticism. Also in December 2025, it paid $60 million to settle separate FTC allegations over deceptive advertising, refunds and subscription enrollment, while denying wrongdoing. Groundwork’s president, Lindsay Owens, called the merger “obviously illegal.” That is an advocate’s position, not a ruling.

For Instacart holders, the detail to watch is the election mechanics, not the synergy slide. The stock cap means holders who want DoorDash shares may receive cash instead. A wait of up to twenty months also gives the FTC plenty of time to make personalized pricing the central question of the review. The bid is a press release and a definitive agreement; it is not yet an approved merger.

For two decades, memory makers had good reason to fear Apple as a customer. According to The Wall Street Journal, Apple required most-favored-customer clauses, audited suppliers’ books to enforce them, and sometimes refused delivery of cheaply ordered flash when market prices fell. Kioxia executives, the Journal reported, joked that they felt like Charlie Brown trying to kick the football.

That relationship has reversed. TechInsights, the research firm cited by the Journal, estimates that demand from AI data centers has pushed NAND flash prices up about fivefold over the past year. Two years ago, Apple bought nearly twice as much flash as Microsoft, Amazon, Meta and Google combined; now those four buy roughly twice as much as Apple. NAND fell to about 5 cents a gigabyte in 2023 and now sells for more than 30 cents. TechInsights expects Apple to spend about $25 billion on NAND this year for roughly the volume that cost about $6 billion in 2025. Those are estimates; Apple does not report a separate figure for flash spending.

The cloud companies are winning the bidding because flash is a smaller share of a data center’s cost than of a phone’s, and because they can depreciate it over several years. Meta, Microsoft and Amazon have signed long-term contracts with Kioxia that commit them to higher prices in exchange for guaranteed supply. Those terms protect the supplier even if the market turns.

Apple has passed some of the cost on. It has raised prices on more than a dozen products this year and attributes the increases to the memory shortage. The 256GB iPhone 18 Pro went on sale in China at 9,999 yuan, 1,000 more than the previous model. Its storage upsell is also less profitable. TechInsights estimates that Apple’s gross profit on a $200 upgrade from 256GB to 512GB fell to $134 on the iPhone 18 Pro, from $185 on last year’s model.

Samsung’s results on Thursday show where the money went. Third-quarter revenue was KRW195.3 trillion and operating profit was KRW107.4 trillion, a 55 percent operating margin. Samsung says it is the first technology company to exceed KRW100 trillion in quarterly operating profit. Its Device Solutions division, which includes the chip business, earned KRW106.5 trillion of that. The Device eXperience division, which makes phones and appliances, lost KRW0.8 trillion. One company sits on both sides of the memory trade, and only one side is making money. Investors sold anyway: the shares closed 4.13 percent lower on Thursday after operating profit came in slightly below LSEG estimates.

Apple reports its September quarter on Monday, Nov. 2. Analysts expect $1.99 a share on $113.4 billion of revenue, after Apple guided to growth of 9 to 11 percent. The September figure matters less than the December guidance and the gross margin, where a flash bill roughly four times last year’s will show up if Apple cannot keep passing it through. A record quarter and a squeezed margin can arrive in the same release.

Every important album now gets a twentieth birthday, and most get the same present: a remaster, a colored-vinyl variant, and a deluxe edition stuffed with the demos the band was right to bury. ‘The Black Parade,’ My Chemical Romance’s 2006 rock opera, turned twenty last week. On Friday the band released a short film instead.

‘Prelude to The End’ was made with the visual artist Lauren Tsai. According to Stereogum, it fuses Tsai’s own fictional world, ‘The Dying World,’ which premiered as a short film at the Annecy animation festival in 2025, with the band’s mythology. It is scored to the album’s opening track, ‘The End.’ Tsai voices the protagonist, Astrid. Billie Eilish plays Astrid’s friend, Phoebe Bridgers her sister and the video-game director Hideo Kojima a teacher. The film also uses a live recording of Pascal Dusapin’s violin concerto ‘Flying River,’ performed by the Utopia Orchestra at the Fondation Louis Vuitton under Giuseppe Mengoli, with Daniel Lozakovich as soloist.

Read that cast list again. A twenty-year-old record once filed under emo now sits beside contemporary French concert music, a Japanese game auteur and two of the most influential songwriters of the generation that grew up after it. The film makes an argument without stating it: ‘The Black Parade’ always had more in common with opera than with the mall stores that sold its merchandise, and the people it shaped went on to work in every medium.

The anniversary business rarely makes that kind of argument. Mostly it sells an object back to people who already own it. Treating an album as a world that other artists can enter, rather than a catalog item to repackage, is the better tribute, and arguably the only one worth producing.

Also out Friday: ‘Perfecth,’ the ninth studio album from Queens of the Stone Age. Official Charts describes it as inspired by kintsugi, the Japanese art of repairing broken ceramics with gold. Repair as an aesthetic suits a band nearly three decades into its career. Whether the record earns the metaphor depends on the music, not the press notes, and we will judge that after we have spent real time with it.

Halloween weekend suits both releases. One band dresses its past up as something stranger than nostalgia; the other insists that the cracks are the point. Readers: which anniversary in your collection deserved better than a box set? Write in, and we will run the best answers.

Within a day the industry had its talking points. The blockchain held. Bitcoin fell only about 5 percent. Binance will make everyone whole. Each statement is roughly true. Taken together, they distract from what happened.

Start with the reassurance. Binance says it has reserved more than $6.34 billion of company money and already holds about $5 billion of it in the same cryptocurrencies as those stolen. A firm that can find six billion dollars in a day is not a scrappy startup. It is a custodian large enough to matter to the whole market, and whether its customers are made whole now depends on the size of its own balance sheet and the cooperation of the token issuers who helped freeze about $3 billion. When a bank is robbed, deposit insurance and capital rules, written in advance by someone other than the bank, decide who is made whole. Here, the institution making the promise is also the only one judging whether it has been kept.

Next, the claim that customer money was untouched. “We never use any customer funds,” Richard Teng said. CoinDesk found that the compromised wallets had previously been counted among the assets backing customer balances. Perhaps both statements are true in Binance’s accounting. But if the house’s money and the backing for customer balances can sit in the same hot wallet, the distinction exists only in the books. Monday’s full proof-of-reserves report will show those books: assets, presented the way Binance chooses, at a moment Binance chooses. A snapshot is not an audit, and a list of reserves without a full account of liabilities is half a balance sheet.

Then the method. The theft did not require breaking any encryption. It required an authorization, prepared in advance, that “did not pass through our normal approval controls,” using EIP-7702, a feature that lets an account hand its execution to code. Bank supervisors have spent a century on exactly this question: who may sign, within what limits, and who checks the signature. Crypto promised to make that question obsolete. Its biggest custodians have instead hidden it from view.

My contrarian point is the one the market’s calm obscures. The modest fall in Bitcoin is being read as maturity. I read it as concentration. When one firm can absorb the largest theft in the industry’s history without a run, the reason is not decentralization. It is the absence of it.

So supervise exchanges like the banks they have become: independent audits of signing controls, segregation of customer assets verified by outsiders, and published liabilities alongside published reserves. Do it before the next twenty minutes.

One kind of diplomacy announces the destination and hopes the road will appear. Mark Carney practiced it elegantly in Montreal. “Today, we move toward Associate Membership for Canada,” he said, and named June 2027 as the month to finish. The summary published by Europe’s institutions says the two sides will define the concept by the 2027 summit, “short of full membership.” It does not use his phrase.

I do not blame Carney for wanting the word. A country squeezed by its largest trading partner needs to show voters it has somewhere else to go, and “member,” even with a qualifier, makes that case in one word. Nor do I blame the governments resisting it. The treaties contain no such category, and inventing one for Canada invites every partner already tied to the EU to ask what its own arrangement is called and why it is worth less.

But the order matters, and Canada has it backward. A title granted before its contents are fixed becomes a ceiling, not a floor. Once Ottawa has “associate member” in a communiqué, Europe has much less reason to concede anything that costs it: Horizon Europe access beyond Canada’s existing Pillar II association, pension-fund access, joint stockpiles of critical minerals, or a voice where standards are written. The political prize will already have been paid.

The better strategy is to make the name expensive. Secure broader Horizon Europe access beyond Pillar II and participation in Erasmus first. Get the undersea cables financed and the raw-materials stockpile signed. Make the June 2027 European Council a ratification of arrangements that already exist rather than a ceremony naming one that does not. If Europe then wants to call the result associate membership, the term will mean something, and the next country to ask for it will know the price.

In September, Carney said, “The nomenclature, the precise nomenclature, is a question for Europe,” and added, “What matters is the substance.” He was right then. He should hold Europe, and himself, to it now.