Loss of Control, 25–31 October 2026

Landscape cover for Hindsight Media Edition 006, Loss of Control: a painted brass control lever beside dials and a red warning lamp, next to the title and the five stories.

Edition 6 · 25–31 October 2026

A train is cleared to run into another in Spain; Israel and Brazil vote, then argue over who won; Wall Street asks when AI will pay; and $6.3bn leaves Binance in 20 minutes.

Published 1 November 20266 storiesRoast the Week22 min read

This week's stories are about what happens when the people in charge lose their grip on events.

In Spain, a train-control system failed on the Madrid–Seville line, and 22 minutes later a high-speed train that had been told it could run at normal speed hit another standing ahead of it. Sixty-nine people died, a month before an election.

Two elections tested who controls the outcome. In Israel, neither Benjamin Netanyahu nor his opponents won a majority, Arab-led parties won a record 19 seats, and Netanyahu's party claimed, without evidence, that the result had been stolen. In Brazil, Lula won a fourth term, and the man he beat crossed into Argentina, flew to Miami and briefly declared himself president-elect.

Money moved faster than anyone could stop it. Investors wiped about $500bn off Alphabet in a day, asking when the vast spending on Artificial Intelligence will pay. And hackers took about $6.3bn from the crypto exchange Binance in roughly 20 minutes; the FBI says it went to North Korea.

After the week closed, on Saturday evening, Europe's protest wave reached Germany, where youth rallies ended in looting in Frankfurt; a short update follows the five stories.

Loss of Control is about those moments, and about who answers for them afterwards.

01 of 06

Spain's second high-speed crash of the year kills 69, a month before an election

A train was cleared to run at normal speed towards another that had stopped on the Madrid–Seville line. The transport minister blames an error in the control room and says he will not resign.

4 min readLink to this story

Officials and emergency workers stand in a line on open ground near the crash site at Urda, beside a red Castilla-La Mancha emergency vehicle and a civil protection tent, on 29 October 2026.
Officials and emergency workers near the crash zone at Urda, Toledo, during the regional president's visit on 29 October 2026. Photo: D. Esteban González / JCCM, via Wikimedia Commons (resized) · CC BY-SA 4.0 · Source

At 08:53 on Wednesday 28th October, a Renfe AVE high-speed train ran into the back of an Iryo train that was standing at a signal1 near Urda, in the province of Toledo, about 120 kilometres down the line from Madrid.2 Both had left Madrid's Atocha station for Seville within ten minutes of each other. Spain's new accident investigators put the AVE's speed at impact, provisionally, at between 160 and 200 kilometres an hour.2

By Saturday the official count stood at 69 dead. Thirty-six had been identified, 34 people were still in hospital, 15 of them in intensive care, and 67 reports of missing people remained open.3 An early figure of 74 was corrected to 69 on Thursday.4 It is the deadliest rail crash in Spain since 2013, and the country's second on a high-speed line this year.

Twenty-two minutes

The Madrid–Seville line was Spain's first high-speed railway, opened for the Seville Expo in 1992. It is the last Spanish high-speed route still run with LZB, a German system that tells drivers how fast they may go and stops a train automatically if it has to. A contract to replace it with the European standard, awarded in 2021, has not been finished.5

On Friday the transport minister, Óscar Puente, set out what he said happened.1

At 08:31 the LZB system failed over a 63-kilometre stretch of the line, because of a communication fault between computers at the installation in Urda. The trains in that section stopped automatically. When LZB is down, trains are meant to run "on sight", at no more than 40 kilometres an hour, with drivers and the control centre in touch by telephone.5

At 08:36, Puente said, the control centre in Madrid run by Adif, the state company that manages Spain's tracks and signals, authorised the AVE to resume "a marcha normal": at normal speed. The LZB was still down, and the Iryo train was stopped ahead of it. At 08:41 the Iryo train was also cleared to move, but it could not restart. At 08:48 its driver told the control centre again that she could not move. The AVE kept going, and hit her train at about 08:53.1

Timeline of 28 October 2026 from 08:31 to 08:53: train control fails; at 08:36 the AVE is cleared to run at normal speed with the Iryo train ahead; 08:41 the Iryo train is cleared but cannot move; 08:48 its driver reports she is still stopped; 08:53 the collision, at a provisional 160 to 200 km/h.
Document. Visual 001 — Twenty-two minutes. The timeline is the transport minister's account of 30 October; investigators say every hypothesis remains open. Graphic: Hindsight Media. Timeline: Óscar Puente, press conference, 30 October 2026, as reported by Cuadernos Manchegos, Al Jazeera and CBS News/AP; speed: AITAT, 29 October 2026 · © Hindsight Media · Source

"For the moment, the evidence points to what happened being due to a failure at Adif's control centre," Puente said.1 On Wednesday he had called the order "inexplicable" and said the drivers were not to blame.6 The controller involved has been taken off duty, which the ministry says does not assign responsibility.1

That account is the minister's. The investigation belongs to the AITAT, an independent authority that took over from Spain's old rail accident commission in July. Its first note says every hypothesis remains open, and its final report is due within a year. A court in Orgaz, near Toledo, has opened a separate criminal inquiry, under secrecy, and holds the trains' recorders.2 Still unexplained is why the 08:48 call did not stop the AVE, and why the lineside signals, which work without LZB, did not.

"The easy thing for me is to leave"

The crash came four weeks before a general election. Pedro Sánchez, the Socialist prime minister, called it on 5th October for 29th November, and polls published just before the crash put the conservative People's Party (PP) ahead, with the far-right Vox close enough to give the two a majority.7

"Today all of Spain is grieving," Sánchez said on Wednesday. "It is unacceptable for a country like Spain to suffer two high-speed rail accidents in the same year."6 Three days of national mourning followed, and the main parties suspended campaign events.8

By Friday Puente was facing calls to resign. He refused. "The easy thing for me is to leave," he said. "But that isn't in keeping with my character." He added that Sánchez had not asked him to.1 He said the LZB system had suffered 170 incidents this year, about three-quarters of them from outside causes such as cable theft and vandalism.1

The opposition leader, Alberto Núñez Feijóo, said that "Spaniards are asking tough questions that demand answers". Vox's leader, Santiago Abascal, wrote: "We, too, are in mourning – but do not expect us to stay quiet."9

The second crash of the year

On 18th January, at Adamuz in Córdoba, on the same corridor, an Iryo train derailed and was struck by a Renfe train coming the other way. Forty-six people died. The investigators' preliminary finding, in April, was a broken rail.10 Before this year, Spain's worst rail accident of recent decades was at Angrois, outside Santiago de Compostela, in July 2013, when a train took a curve at more than twice the speed limit and 79 people died.11

The regional president, Emiliano García-Page, said everything indicated that the causes of the two crashes this year were unrelated.8

Where it stands

The line between Madrid and Andalusia is closed while carriages are lifted and the search goes on.3 Puente is due to answer questions in Congress on Tuesday 3rd November.3 What remains unknown is why an order to run at normal speed was given with the safety system down, whether anyone tried to stop the AVE in the five minutes after the Iryo driver's call, and how far a disaster in Toledo changes an election that the government was already expected to lose.

↑ Back to contents

02 of 06

Israel votes for a deadlock, and Arab parties hold the balance

Neither Benjamin Netanyahu's bloc nor his opponents won a majority. Arab-led parties won a record 19 seats, and Netanyahu's party says the election was stolen. The police say there is no evidence.

4 min readLink to this story

Election banners for Yashar and The Democrats on the roof and front of a building in Florentin, Tel Aviv, above a passing bus, the day before the vote.
Campaign banners in Florentin, Tel Aviv, on 26 October 2026, the day before Israel's election. Photo: Nizzan Cohen / Wikimedia Commons (resized) · CC BY 4.0 · Source

Israel's first general election since the Hamas-led attacks of 7th October 2023 ended without a winner. When the Central Elections Committee published its final count early on Friday 30th October, the parties that support Benjamin Netanyahu had 53 of the 120 seats in the Knesset, Israel's parliament, his Jewish-majority opponents had 48, and two Arab-led parties had 19.1 A government needs 61.

Turnout was 77.9%, with 5.7 million votes cast.1 Polling day, Tuesday 27th October, came four days after two Palestinian gunmen killed two Israeli soldiers at a base in Hebron; the army closed the crossings between the occupied West Bank and Israel for the vote.2

Bar chart of Knesset seats after the 27 October 2026 election: Netanyahu's bloc 53 (Likud 27, Otzma Yehudit 7, United Torah Judaism 7, Shas 6, Religious Zionism 6), the opposition 48 (Yashar 21, B'Yachad 12, Democrats 8, Yisrael Beytenu 7) and Arab-led parties 19 (Joint List 11, Ra'am 8), all short of the 61 needed.
Document. Visual 002 — Short of 61. Final count of 30 October, before official publication on 4 November. Chart: Hindsight Media. Data: Central Elections Committee final count, 30 October 2026, as reported by The Times of Israel · © Hindsight Media · Source

Three blocs, no majority

Israel elects the Knesset in a single national vote, with seats shared in proportion to votes among parties that pass 3.25%.1 Politics is counted in blocs.

Netanyahu's Likud remained the largest party, with 27 seats. With its partners, the ultra-Orthodox Shas and United Torah Judaism and the far-right Otzma Yehudit and Religious Zionism, it has 53, eight short of a majority.1

Against him, Yashar, a new party led by the former army chief Gadi Eisenkot, won 21. A joint list led by two former prime ministers, Naftali Bennett and Yair Lapid, won 12; Yair Golan's Democrats won 8; and Avigdor Liberman's Yisrael Beytenu won 7. Together they have 48.1

The Joint List won 11 seats and Ra'am 8. Their 19 is the most Arab-led parties have ever won; they had 10 in the outgoing Knesset.3 Arab citizens make up about a fifth of Israel's population.4 Without their parties, neither side can reach 61. With them, the opposition could.

"The public voted for change," Eisenkot told supporters in Tel Aviv on election night. "The coalition of failure has lost the people's trust." Netanyahu, speaking in Jerusalem after 3am, said: "The right-wing bloc has a clear, decisive majority among the Zionist public."5 He means the Jewish parties alone. The phrase is the argument now under way: whether seats won by Arab-led parties count towards a government.

"Stolen"

On Wednesday Netanyahu's Likud party issued a statement: "The elections in Israel were stolen by Arab parties that support terror and the elimination of the Jewish state." It asked the police, the Shin Bet security service and the elections committee to investigate.3 On Thursday Netanyahu shared a party post on X calling it "Ra'amgate": "They stole the election in Israel!"6

The claims have three strands, and they are different things.

The police said election day had seen very few irregular incidents, and that there was "no investigative- or intelligence-based supporting evidence for the claims".7 The committee's acting director general said it had received "a list of claims, not evidence".6

Separately, the committee's chairman, the Supreme Court justice Noam Sohlberg, asked the Shin Bet to look into suspicions of foreign interference. He wrote that he "cannot attest to the substance of these suspicions" but had "an obligation to investigate them thoroughly".6 He wants its findings within about a week.4 Qatar, named by Netanyahu's allies, called the allegations "ridiculous and dangerous".6

And seven Ra'am activists were arrested on suspicion of buying votes on polling day. Ra'am denies it. "There will be nothing, because there is nothing," said its leader, Mansour Abbas.6

Nothing published so far supports the claim that the result was stolen. "They are doing this because they lost," Eisenkot said.4 The Joint List called the accusations racist.6

The question for the opposition

An independent Arab party has joined an Israeli government only once. In June 2021 Ra'am joined the coalition of Bennett and Lapid that ended Netanyahu's 12 years in office; it fell a year later.8 Eisenkot has signalled that he is open, with conditions, to working with Arab-led parties, according to the Associated Press.4 The Joint List's leader, Yousef Jabareen, said that anyone who wanted to offer "a substantive and genuine alternative" to Netanyahu "will have to talk to us".3

The opposition can't govern without the Arab parties, and not all of its own members would govern with them. One way round that is a minority government that Arab members support from outside. Another, according to unconfirmed Hebrew media reports on Saturday, a bill to bring back direct elections for the prime minister, which Israel tried between 1996 and 2001.9 Such a bill would itself need 61 votes.

On Saturday evening thousands rallied in Tel Aviv's Habima Square to urge the opposition to form a Jewish-Arab coalition, while counter-protesters supporting Netanyahu demanded that Israel not have a government with "terrorists".10

What happens next

The results go to President Isaac Herzog on Wednesday 4th November, and the new Knesset is sworn in on Tuesday 10th November.1 Herzog then has a week to ask the member most likely to succeed to form a government. That person gets up to 42 days; a second candidate gets 28; then the Knesset itself gets 21. If all of that fails, Israel holds another election.11 Netanyahu remains prime minister of a caretaker government until then.

Between 2019 and 2022 Israel held five elections in four years, and this was its sixth since 2019. What is unresolved is whether the parties that won the most seats against Netanyahu will accept the votes they need to replace him, or whether Israel is heading for a seventh.

↑ Back to contents

03 of 06

Lula wins Brazil's run-off, and the loser leaves the country

Luiz Inácio Lula da Silva won a fourth term by 4.4 million votes. Two days later Flávio Bolsonaro, ordered to hand in his passports, crossed into Argentina and flew to Miami, calling himself Brazil's true president-elect for about an hour.

4 min readLink to this story

A painted night scene of a car crossing a river bridge between two countries, with a private jet's lights in the sky above.
AI illustration. Flávio Bolsonaro crossed from Brazil into Argentina on 27 October and flew on to Miami. Hindsight Media

Luiz Inácio Lula da Silva, of the left-wing Workers' Party, won Brazil's presidential run-off on Sunday 25th October, beating Flávio Bolsonaro of the right-wing Liberal Party, the eldest son of the former president Jair Bolsonaro, by nearly 4.4 million votes.1 By the electoral court's count, Lula took 51.8% of valid votes to Bolsonaro's 48.2%, on a turnout of almost 81%.2

Bolsonaro had led the first round three weeks earlier, by 47% to 45%. It is the first time since the end of Brazil's military dictatorship in 1985 that the runner-up in the first round has gone on to win.1 Lula, who is 81, will begin his fourth term on 5th January 2027.1 "This election was a defeat for denialism, a defeat for lies," he told supporters on São Paulo's Avenida Paulista that night.3

Two extra hours

About three minutes before the polls closed, a Supreme Court justice, Cristiano Zanin, kept them open for another two hours. Both campaigns had asked for it: Lula's side because of bus problems in São Paulo and Salvador, Bolsonaro's because of heavy rain in the south.1 Fewer than 35,000 votes, about 0.03% of the total, were cast in the extra time, according to Time.4

Bolsonaro said that because of the extension it was "impossible to recognise the election result". "I wasn't the one who lost," he said. "The system won."4 His own party recognised Lula's victory, as did the electoral court and international observers.5

A border, a jet and a letter

On Monday a different Supreme Court justice, Alexandre de Moraes, ordered Bolsonaro to surrender his passports within 24 hours and barred him from leaving the country, in a money-laundering investigation. The order cited a risk that he would flee. Bolsonaro, who denies wrongdoing, said in a video that he would hand them over and had "never thought about leaving the country".4

He did not hand them over. On Tuesday the Federal Police cancelled his ordinary and diplomatic passports.6 At 22:50 that night, Argentina's migration agency later said, he crossed the bridge from Foz do Iguaçu to Puerto Iguazú with his wife and two daughters, "with valid travel documents". Argentina's government had said earlier the same day that it had no record of his entry.7 A Brazilian diplomat told the Associated Press he had travelled on an Italian passport; he has had Italian nationality since 2023.4

A private Gulfstream jet operated by an Argentine company took the family overnight, via Guayaquil in Ecuador,7 to Miami, where it landed on Wednesday morning.8 US officials said the State Department would grant them visas.4 "This act of leaving Brazil is shameful," Lula said.8

That afternoon Bolsonaro released a letter calling himself "o verdadeiro presidente eleito do Brasil", "the true president-elect of Brazil". It alleged fraud, without evidence, thanked Argentina's president, Javier Milei, and Donald Trump, and carried an obsolete coat of arms reading "Estados Unidos do Brazil". About an hour later it was replaced by a version that called him "the leader".9 A family ally, Paulo Figueiredo, blamed ChatGPT: "When generating the document, AI ended up including an earlier version of the text."5

Trump said: "I think the election was a disgrace in Brazil," and would not say whether he recognised Lula's victory.5 He is an ally of the Bolsonaros: in July 2025 he announced a 50% tariff on Brazilian goods, calling Jair Bolsonaro's trial "a Witch Hunt that should end IMMEDIATELY".10

The family business

Four years ago Lula beat Jair Bolsonaro by an even narrower margin, 50.9% to 49.1%.11 Bolsonaro did not concede, and a week after Lula took office, on 8th January 2023, thousands of his supporters stormed Congress, the Supreme Court and the presidential palace. In September 2025 the Supreme Court convicted Jair Bolsonaro of plotting a coup to stay in power and sentenced him to 27 years and three months; he is now under house arrest on health grounds.12 Flávio, a senator, stood in his place.

Where it stands

Lula's victory is settled. What is not is how he governs with a hostile Congress and a Supreme Court that is itself a political issue. In April the Senate rejected his nominee for the court, by 42 votes to 34, the first such rejection in more than a century,13 and Moraes's order against Flávio Bolsonaro has given the defeated candidate the reason he cites for leaving. No arrest warrant or extradition request has been reported, and he remains in Miami, saying he is a victim of political persecution.

On Saturday 31st October the US Secretary of State, Marco Rubio, said: "We didn't facilitate anything," and that the president had decided to let Bolsonaro enter the country. Trump said: "I think he got treated very shabbily, very shabbily, so he can stay here as long as he wants." Reuters reported that he had been admitted under humanitarian parole, a status that usually lasts a year.14

↑ Back to contents

04 of 06

Wall Street starts asking when the Artificial Intelligence boom will pay

Alphabet lost about $500bn of stock-market value in a day and Intel more than a quarter of its own, in a week when the biggest technology companies showed how fast their spending on AI is growing.

3 min readLink to this story

A painted data centre campus at dusk with cranes beside it and a faint falling red line in the sky.
AI illustration. The companies building data centres for AI doubled their spending in a year. Hindsight Media

The biggest technology companies reported their results this week, and the numbers were, by most measures, very good. Alphabet's revenue grew 25% to $127.6bn in the three months to September;1 Microsoft's grew 19% to $92.3bn;2 Amazon's cloud business grew 39%.3

Investors sold anyway. On Thursday 29th October Alphabet, Google's parent company, closed down 12.6%, which took about $500bn off its stock-market value. Only one company has lost more in a single day: Nvidia, in January 2025.4 On Friday Intel fell 28.6%, and the Nasdaq, the index where most big technology companies are listed, had its largest one-day fall since 5th June.5

What changed was not whether the companies are making money. It was how much they are spending to keep making it, and how soon that spending pays.

Spending that has doubled

The boom in Artificial Intelligence runs on data centres: buildings full of specialised chips that train and run AI models. The companies building them report that spending as capital expenditure, or capex.

In the three months to September, Amazon spent $77.3bn on property and equipment, against $35.1bn a year earlier.3 Alphabet spent $51.4bn, against $24.0bn.1 Microsoft's additions came to $39.4bn, against $19.4bn.2 Across the three, spending has more than doubled in a year.

Bar chart of capital spending in July to September 2025 and 2026: Amazon $35.1bn to $77.3bn, Alphabet $24.0bn to $51.4bn, Microsoft $19.4bn to $39.4bn.
Document. Visual 003 — Spending that has doubled. Cash spent on property and equipment, as each company reports it. Chart: Hindsight Media. Data: Amazon, Alphabet and Microsoft quarterly results, 28–29 October 2026 · © Hindsight Media · Source

Meanwhile Alphabet's search revenue, its largest business, rose 12% to $63.35bn, slower than the 17% of the previous quarter.4 And Alphabet spent more cash than its businesses brought in: its free cash flow, what is left after investment, was minus $9.1bn for the quarter.1 Amazon's free cash flow over the past year was minus $42.4bn.3

Neither company is slowing down. Alphabet kept its forecast of $195bn to $205bn of capital spending this year.6 Amazon expects about $220bn this year,3 and its chief executive, Andy Jassy, said it would "spend meaningfully more in 2027".7 TechCrunch put the four biggest spenders' plans for 2026, including Meta's, at more than $740bn, and said Big Tech had borrowed $326bn this year, three times as much as last year.8 Analysts expect the total to pass $1tn next year.6

Intel's different problem

Intel's fall had a different cause. Its results beat forecasts, but it told investors to expect $15bn to $16bn of revenue this quarter, against the roughly $17.1bn analysts had pencilled in.9 Its chief executive, Lip-Bu Tan, said the company's "immediate priority is to unlock additional supply to meet extraordinary demand": Intel cannot make enough of the server chips that data centres want, and its finance chief said he expected the slowdown in personal computers to continue at least through the first half of next year.10

"Companies that are performing and meeting the very lofty expectations that have been set are doing well," said Oliver Pursche of Wealthspire Advisors.5 This week the expectations were the problem.

Anthropic goes public

The week began with a filing that showed the same arithmetic from the other side. On Monday 26th October Anthropic, one of the companies whose models the data centres are built for, published its plans to list its shares on the Nasdaq. Its revenue in the first half of 2026 was $16.3bn, up from $1.2bn a year earlier, and it made an operating loss of $693m. Since the end of 2025 it has committed to about $417bn of new spending on computing capacity and data centres.11

Its filing says: "We do not expect our revenue will continue to grow at comparable rates, and we cannot assure you that it will continue to grow at all."11 That is the standard caution of a company preparing to sell shares. It is also the question this week's investors were asking of everyone.

Anthropic makes Claude, the AI model Hindsight Media uses to research and draft each edition.

Where it stands

The companies say demand for computing is greater than they can supply, and their cloud businesses are growing fast enough to support that. Investors who sold this week were not saying AI does not work. They were asking whether revenue will catch up with spending that is growing faster, financed increasingly with debt. Whether this week was a pause or a turn depends on that.

↑ Back to contents

05 of 06

The largest crypto theft ever took about 20 minutes

Hackers took about $6.3bn from Binance, the world's largest cryptocurrency exchange. The FBI and three firms that trace blockchain payments blame North Korea, whose crypto thefts help pay for its weapons.

4 min readLink to this story

A painted open vault door with streams of glowing coins flowing out into a dark network.
AI illustration. About $6.3bn left Binance's wallets in roughly 20 minutes. Hindsight Media

At 20:05 UK time on Thursday 29th October, money began to leave Binance, the world's largest cryptocurrency exchange. Over the next 20 minutes or so, about $6.36bn in bitcoin, ether and other tokens was moved out of the exchange's wallets on ten different blockchains, according to TRM Labs, a firm that traces payments on blockchains.1

Binance gave its own figure as about $6.3bn. Another tracing firm, Elliptic, called it "almost certainly the single largest known theft of any kind".2 The previous record for a crypto theft, set at the exchange Bybit in February 2025, was about $1.5bn.3

How it was done

A cryptocurrency exchange keeps most of its customers' money offline, in "cold" storage, and a working float online in "hot" wallets, so that withdrawals can be paid automatically. On a blockchain, whoever can sign for a wallet can move its money, and there is no bank to reverse the payment.

Binance said its first findings suggested the attack began with a compromised laptop belonging to one of its engineers, which let the attacker submit unauthorised withdrawals.4 By Friday it said it had found "additional points of breach", and that there was no evidence any wallet's private key, the secret that controls it, had leaked.5

TRM's reconstruction shows how carefully it was prepared. The attacker's own wallet was funded through a mixer, a service that hides where money came from, at least 36 hours earlier. On Ethereum, the attacker had Binance's hot wallet sign 50 authorisations in advance that handed control of its funds to the attacker's code; once one was used, the wallet's whole balance left in about three and a half minutes.1

Within an hour Tether and Circle, the companies that issue the two largest "stablecoins", digital tokens pegged to the dollar, began freezing the stolen tokens they control. By Friday about $2.7bn had been frozen. The rest, more than 420,000 ether and 18,270 bitcoin, worth about $2.4bn, cannot be frozen, because no company issues them.1

Bar chart of the largest cryptocurrency thefts by value at the time: Binance $6.36bn (October 2026), Bybit $1.5bn (February 2025), Ronin Network $620m, Poly Network $611m, BNB Chain bridge $570m, Coincheck $530m.
Document. Visual 004 — Four times the old record. US dollars at the time of each theft; Binance's figure is TRM Labs' estimate. Chart: Hindsight Media. Data: TRM Labs; FBI; BleepingComputer; Decrypt · © Hindsight Media · Source

The trail to North Korea

All three of the best-known tracing firms, TRM Labs, Chainalysis and Elliptic, attribute the theft to North Korea. TRM names the unit the FBI calls TraderTraitor and says: "We make this judgment with high confidence."1 Chainalysis's evidence includes stolen Binance funds being mixed, as they moved, with money from a $387m theft at the exchange Bitget in September that had already been linked to North Korea.6 Elliptic attributes it to "DPRK-linked actors", using the initials of the Democratic People's Republic of Korea.7

Until Saturday no government had said so; Binance's co-chief executive, Richard Teng, had said: "Our investigation has not attributed responsibility to any individual."2 Then, on Saturday 31st October, the FBI said that North Korea was responsible and named the same unit, TraderTraitor. It said North Korean actors were laundering the stolen money, mainly by converting it into ether, and that it expected it to be "further laundered" in stages; it published the addresses involved and asked exchanges to block them.8 North Korea routinely denies such thefts.9

The FBI blamed the same North Korean unit for the Bybit theft.3 North Korea has been stealing from crypto companies for years: in 2022 the FBI linked its Lazarus Group to the $620m theft from the Ronin Network, the system behind an online game.10 The money matters to a country under heavy sanctions. In the last report of the UN's panel on North Korean sanctions, in 2024, one member state said cyber activity earned North Korea about half its foreign currency, and another said 40% of its programmes for weapons of mass destruction were funded "by illicit cybermeans".11 Eleven governments, including Britain's, said last year that North Korea aims to steal "billions of dollars for its unlawful weapons of mass destruction and ballistic missile programs".12

"When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity," said Ari Redbord of TRM Labs.13

Who pays

Binance has 335 million registered users.2 On Friday its two chief executives said: "Binance will absorb the financial impact of these stolen funds, not our users," and that more than $6.34bn of company money had been set aside.14 "Your money is safe and we're covering every loss," Teng wrote. At first Binance did not say where the money would come from.2

Withdrawals were suspended on Thursday, and Binance's target for restarting them moved several times. Deposits continued. Bitcoin fell to a six-week low.13

On Saturday Binance said it had already replaced 90% of the stolen assets, by buying new tokens with its $1bn Secure Asset Fund for Users, part of its futures insurance fund and its own treasury.8 The remaining 10% are less widely traded tokens that will take longer to buy. It said it was on track to reopen withdrawals on Sunday 1st November.9

Where it stands

The stolen bitcoin and ether that were not frozen are now moving through the laundering routes North Korea has used before, and recovering frozen tokens is a legal process. "A technical freeze may happen quickly, while returning funds can take months or years," said Eric Jardine of Chainalysis.15 Binance has published a new snapshot of its reserves, so users can check that their assets are backed one for one.8 Whether customers leave once they can withdraw will be the first test of whether an exchange can lose $6bn in an evening and carry on as before.

↑ Back to contents

06 of 06

Europe's protest wave reaches Germany, and turns violent there too

More than 320,000 marched in France on the third weekend of protests, and youth rallies in German cities ended in looting in Frankfurt.

2 min readLink to this story

Painted illustration of young protesters, some in Halloween costumes, on a German shopping street at night as a police water cannon sprays them.
AI illustration. Illustration of Saturday night's protests in Germany. Hindsight Media

This update was added on Sunday 1st November, after the edition's reporting week closed, because of what happened on Saturday evening.

Europe's youth-led protests over schools and the cost of living, last week's lead story, had their third weekend on Saturday 31st October, and for the first time Germany was one of the main scenes.

In France, more than 320,000 people marched, by the Interior Ministry's count; the organisers counted nearly half a million.1 The marches were largely peaceful, but police fired tear gas in some cities, and there were more than 500 arrests after clashes in Toulouse, Lyon and Marseille. The Interior Minister, Laurent Nuñez, said a police officer had been injured by a Molotov cocktail.2 Five days earlier the government had offered its first concessions, including caps on some class sizes and student grants that rise with inflation; students said it was not enough and have called a national day of protest for Thursday 5th November.3

In Germany, a campaign group called Gen Z regelt ("Gen Z takes charge") called rallies against underfunded schools, the cost of living, spending cuts and military service. Officials in Frankfurt, Munich and Berlin counted as many as 18,000 people in those cities, about half the organisers' estimate.2 "We are against compulsory military service and we are in favour of a fairer distribution of the burden," said a spokesperson, Lina Friedrich.2

After dark there was violence in Berlin, Cologne and Hamburg as well as Frankfurt, and police said they had used water cannon against protesters throwing fireworks, stones and bottles at emergency workers. In Frankfurt, rioters looted shops on the main shopping street, threw Molotov cocktails at emergency services and smashed the windows of a gun shop; police said they had seized two weapons. Roman Poseck, the interior minister of the state of Hesse, said about 100 "clearly identified left-wing extremists" had infiltrated the march, and added: "France must not be held up as a model in this regard."2

There were also clashes in Rome and Turin, and in Portugal police cleared a new protest camp against a rental bill.2 The next test is France's national day on 5th November.

↑ Back to contents

That’s the reporting. Now, a word about the week’s most confident statements.

Roast the Week

Your money is safe. Your victory letter is not.

1 min readLink to this roast

About $6.3bn left Binance's wallets in roughly 20 minutes.1 The next day its co-chief executive told customers: "Your money is safe."2

And it is. It's never been safer. It's in North Korea, says the FBI,3 and nobody's getting it out of there.

In Miami, Flávio Bolsonaro, who lost Brazil's election by 4.4 million votes, released a letter calling himself "the true president-elect of Brazil". About an hour later the letter was replaced with one calling him "the leader".4 A family ally blamed ChatGPT.5

So of everyone involved, the only one convinced he'd won was a chatbot.

Meanwhile Alphabet reported revenue of $127.6bn, up 25%,6 and lost about $500bn of its value the next day,7 because investors worried it was spending too much on AI.

Still, it could have been worse. At least Alphabet's AI didn't announce that Alphabet had won.

Cartoon of a beaming executive giving a thumbs-up in front of an empty, wide-open vault while a figure runs off with sacks of money. Caption: Binance, after $6.3bn left in 20 minutes: “Your money is safe.”
AI illustration. Roast the Week. Hindsight Media

↑ Back to contents