Crypto Morning Brief: FBI Confirms North Korea Behind Binance’s Over $6 Billion Theft, Lazarus Has Stolen $11.87 Billion in Crypto Assets

Author: TechFlow

Yesterday's Market Updates

Binance Co-founder He Yi Warns Against Fake Announcement Scams

Co-founder of Binance He Yi posted a reminder, urging users to stay vigilant against new scam tactics amidst the chaos.

A post cited by He Yi states that scammers send small amounts of GRAM to users and insert fake Binance official announcements into the transfer message, claiming user assets are insecure and luring them to transfer funds to a so-called "Binance Vault." The post warns users not to click related links, connect wallets, or transfer funds to unfamiliar wallets.

Michael Saylor Posts Bitcoin Tracker Update Again, May Disclose Position Changes Next Week

Strategy founder Michael Saylor once again posted information regarding the Bitcoin Tracker, stating, "We can make the screen even more orange."

Based on past patterns, Strategy typically discloses changes in its Bitcoin holdings the day after such messages are posted.

CPC Central Committee: Resolutely Crack Down on Corruption Involving Virtual Currencies

According to a decision by the CPC Central Committee authorized for release by Xinhua News Agency, in response to novel and concealed forms of corruption, authorities must resolutely crack down on corrupt acts involving the internet, virtual currencies, cross-border funds, blockchain, and other tools.

The decision was adopted at the Fifth Plenary Session of the 20th CPC Central Committee on October 29, and calls for in-depth investigation of novel and hidden corruption methods such as anticipated returns, agreed proxy holdings, "white gloves," and revolving doors between government and business.

Analyst: Lazarus Cumulatively Stole $11.87 Billion in Crypto Assets, Equivalent to 45% of North Korea's GDP

According to on-chain analyst Darkfost, following Binance's recent hacking attack, the cumulative crypto assets stolen by the North Korean hacker group Lazarus have reached $11.87 billion.

Darkfost noted that based on economic data published by the Bank of Korea for 2025, this amount equals 45% of North Korea's Gross Domestic Product (GDP) and 35% of its Gross National Income (GNI).

Among these, the recent Binance hack represents the largest single attack by value for Lazarus to date. However, some of the stolen funds have been lost during subsequent money laundering processes, meaning the cumulative theft amount does not equate to the actual capital acquired by the organization.

Binance Restores Withdrawals for Select Assets on Ethereum and BSC

According to an official Binance announcement, the platform has resumed withdrawals for USDC, USDT, and ETH on the Ethereum network, as well as USDC, USDT, and BNB on the BNB Smart Chain (BSC) network.

Binance stated that more assets and networks will have their withdrawal functions restored in phases after security checks are completed. Previously, the platform had already enabled Bitcoin network withdrawals.

OpenAI Announces Shared Quota for Select ChatGPT Features with Codex

In an announcement, OpenAI stated that starting in December, usage quotas for ChatGPT Plus, Pro, and Business plans will be shared between ChatGPT and Codex. OpenAI is integrating AI agent capabilities from Work into the main ChatGPT interface. Usage is tracked in tokens, with quota consumption depending on the model and task complexity; complex tasks consume more. Instant chats do not utilize this shared quota. OpenAI expects that most users will not need to wait for quota resets more frequently than they currently do.

Trump Says U.S. Will Communicate with North Korea If It Is Found Responsible for Binance Hack

In video footage released by the White House rapid response team, U.S. President Trump responded to questions regarding the Binance hack, stating: "We are looking into it. We don't know if it was North Korea, but if it was, we will talk to them about it."

FBI Confirms North Korea Behind Over $6 Billion Binance Theft, Stolen Funds Laundered via DeFi

The U.S. Federal Bureau of Investigation (FBI) issued an announcement confirming that North Korea is responsible for the over-$6 billion crypto asset theft at Binance around October 29, classifying the malicious cyber operation under the designation "TraderTraitor."

Joint monitoring by the FBI, U.S. Secret Service (USSS), and IRS Criminal Investigation (IRS-CI) revealed that attackers are primarily converting the stolen assets into Ethereum (ETH), and plan to further launder the funds through decentralized finance (DeFi) protocols and instant swap services.

The FBI has called upon THORNode operators, RPC node providers, instant trading platforms, DeFi services, blockchain analytics firms, and other virtual asset service providers (VASPs) to intercept transactions involving North Korean hacker money laundering addresses and their derived funds, in order to prevent further transfers of the stolen assets.

Aave Halts New tBTC Deposits and Collateralized Borrowing, Existing Positions Unaffected

Aave announced that given Threshold Network's preemptive suspension of tBTC minting and redemption operations, the platform has restricted new tBTC deposits and new borrowing backed by tBTC collateral.

Aave emphasized that protocol contracts remain unaffected, existing user positions are unchanged, and borrowers can still repay loans and withdraw assets normally. Once Threshold completes security maintenance, Aave will reinstate these new deposit and borrowing features.

Prior to this, Threshold stated that due to ongoing security maintenance, it has temporarily paused new BTC deposits, tBTC minting, and new Bitcoin redemption requests via the Threshold app.

Today's Market Overview

Recommended Reading

Strategy Reports $19.53 Billion Q3 Net Profit, Holds Nearly 850K BTC; Saylor Plans Up to $30B via Preferred Shares to Continue Buying

https://www.techflowpost.com/article/34994

This article focuses on Strategy's strategic shift from simply hoarding Bitcoin to building a "digital credit" system. Michael Saylor stated that the company plans to leverage its balance sheet and use financing instruments like preferred shares to create a potential credit line of up to $30 billion to continue purchasing BTC, rather than relying solely on common stock dilution. Strategy's third-quarter net profit reached $19.53 billion, including $20.91 billion in unrealized gains on digital assets at fair value; as of October 25, the company holds 848,517 BTC. Among these, STRC preferred shares will serve as a key financing channel. Management envisions raising $1 to $2 billion monthly, retaining some cash for dividend payments and liquidity needs before deploying the remainder to accumulate more Bitcoin. Strategy is attempting to transform its Bitcoin reserves into underlying assets for credit expansion, but the continuous dividend payments on preferred shares also mean heavier cash flow pressures. Whether it can form a sustainable financing flywheel in the future still depends on balancing the value of BTC assets against financing costs.

Circle Announces Shutdown of CCTP V1 on Dec 1: Noble Chain Excluded from New Version, USDC Service Ends in January

https://www.techflowpost.com/article/35003

This article focuses on Circle's major adjustments to the Cross-Chain Transfer Protocol (CCTP): CCTP V1 will be completely decommissioned on December 1, 2026, with daily cross-chain limits gradually reduced starting October 31. Since the new CCTP is incompatible with legacy contracts, all cross-chain bridges, aggregators, and wallets must proactively complete technical migration, otherwise USDC cross-chain services may be interrupted. Of greater note, the Cosmos ecosystem chain Noble will not connect to the new protocol. Circle plans to terminate the USDC contract and cross-chain routing on that chain on January 12, 2027, providing manual redemption channels for untransferred assets. This adjustment indicates that Circle is actively scaling back non-core networks, prioritizing cross-chain security, compliance, and liquidity control, which may also prompt multi-chain ecosystems to redistribute USDC liquidity.

Microsoft Report: 3 of 8 North Korean Hacker Groups Deeply Using AI, Can Batch-Generate Phishing Bait in Minutes

https://www.techflowpost.com/article/34997

Microsoft's latest threat intelligence report indicates that among the eight monitored North Korean hacker groups, three have deeply integrated AI into their daily attack workflows, covering phishing, identity impersonation, malicious code generation, and software supply chain attacks. Between August and September 2026, one group created over 100 customized PDF phishing documents targeting South Korea, with some scenarios requiring only minutes to batch-generate dozens of bait files. Attackers also leveraged AI coding tools like Cursor to assist in developing malware and deployed the open-source AI penetration framework ARTEX. Microsoft pointed out that while these groups have not yet achieved fully autonomous attacks, AI has significantly lowered the cost and barrier to entry for cyberattacks. Cybersecurity is shifting from traditional human-vs-human defense to a competition between AI-assisted attacks and automated defenses, prompting enterprises to strengthen supply chain audits, endpoint monitoring, and multi-factor authentication.

After $2.7 Million Hack, Polymarket Promises Full Reimbursement: Victims Over $10K Must Sign Waiver and Complete KYC

https://www.techflowpost.com/article/34994

This article reveals that Polymarket's international site suffered a security breach via a third-party service provider, resulting in over 710 compromised wallets and approximately $2.7 million in stolen assets. The platform subsequently halted trading and pledged full reimbursement. However, the compensation plan has sparked controversy: users with losses under $10,000 can receive direct financial compensation, while those exceeding $10,000 must sign a settlement and liability waiver, relinquishing future civil claims and litigation rights, and some users are required to submit passports or ID documents to complete KYC. The core controversy lies in the platform simultaneously promising full compensation while demanding large-scale victims waive legal recourse and privacy rights. This incident not only tests Polymarket's security capabilities but also exposes that decentralized platforms still rely on traditional legal frameworks and centralized governance to handle liability and compensation during genuine crises.