Featured Article
North Korea Is Sitting on US$3 Billion Nobody Can Freeze
Binance has repaid its customers, but around US$3 billion stolen by North Korea still sits in bitcoin and ether no issuer can freeze. Automated laundering, a Polygon hard fork proposal, terrorism judgment creditors, and stalled sanctions now decide whether Pyongyang ever profits from the theft.
Explore by Topic
Adversaries
Tradecraft
Technology
Geopolitics
Latest Articles
Intelligence Brief: Japan’s Cyber Emergency, Refrigeration Attacks, and Crypto Theft
Japan is investing in cyber defenses while attackers interfere with medical refrigeration and cryptocurrency domains. This edition examines Android banking fraud, prolonged patch delays, Iranian hacktivism, and the U.S. battle over threat intelligence sharing, with analysis beyond the headlines.
COZY BEAR Empties Phones With Exploits Apple Already Fixed
A visitor opens a trusted Ukrainian website, taps nothing, and loses the contents of a phone. COZY BEAR poisoned a widely used analytics script, then hit unpatched phones with exploits Apple and Google had already fixed. The page is legitimate. The exploit is old. The intelligence is fresh.
Binance Survived Because It Was Rich Not Secure
Binance replaced US$6.34 billion from its own balance sheet while billions in customer funds fled. The aftermath exposed what the breach did not. DPRK stole at a scale no insurer will cover, frozen funds moved only where centralized issuers held the switches, and attribution became a liability.
CrowdStrike’s Kill Switch Cannot Yet Kill the Agent
On November 3, George Kurtz told national television that AI agents finally had an off switch. Eight weeks earlier, CrowdStrike’s own product chief said no such kill switch existed. What shipped cuts an agent off from its model at the gateway, while termination where it runs remains coming soon.
Amadeus Was Breached for Three Years and Japan Airlines Sent the Apology
By the time Japan Airlines told 92,000 customers their data was taken, the break-in was more than three years old. It was not the airline, but inside Amadeus, the provider running reservations for more than 130 airlines globally. This incident reached at least five carriers before anyone noticed.
Binance Explained Its Record Heist and the Answer Is Worse
Binance explained how North Korea stole US$6.34 billion, and the explanation is worse than the silence it replaced. A fake job interview, a poisoned coding assignment, the exchange’s own AI tooling, and an Ethereum delegation feature let PRESSURE CHOLLIMA drain wallets after withdrawals were frozen.
DarkBlinders Shows Why Threat Actor Naming is a Hall of Mirrors
A fake job from Dubai Airports, a video app that never works, and a gigabyte gone from a Kurdish government cloud. One Iran-nexus espionage operation carries seven vendor names, runs its command-and-control through GitHub, and keeps collecting in the gap between what the industry can see and prove.
Breaching Chainalysis Mapped the People Who Hunt Crypto Crime
Chainalysis identifies the people moving through the blockchain. A breach of its own systems reversed the lens, exposing identity data on the investigators, regulators, and compliance staff who track crypto crime. The firm calls the data non-sensitive and has not explained how the attacker got in.
Nihon Cyber Defence Is Selling Japan the Idea of Sovereignty
A former NSA director tells Japan to move faster, and the firm paying him sells the cure. Nihon Cyber Defence calls MIJXDR a fully sovereign, Made in Japan platform, then localizes it into Ukraine. Here, sovereignty is a label bought with public money, and the architecture is nowhere in sight.
FBI Names North Korea as the Thief but Binance Still Cannot Explain the Theft
The FBI has formally named North Korea for the US$6.3 billion Binance theft, the largest in history, confirming an attribution the tradecraft already pointed to. One question is answered. How the attacker turned Binance’s own signing systems against it is not.