Binance said Tuesday that a $6.3 billion hack of the world’s largest cryptocurrency exchange was the result of a “multi-stage campaign,” including a malicious software download and a fake job interview.
Hackers, whom both the FBI and outside analysts have linked to North Korea, moved billions of dollars’ worth of crypto out of Binance wallets Thursday, prompting crypto companies to freeze about $3 billion in assets.
In a lengthy post on the social platform X, Binance explained that an engineer initially downloaded tampered code to install a popular AI coding tool in June.
While the company’s security team detected the anomaly, replaced the device and updated credentials, the engineer and his colleagues on their wallet infrastructure team were exposed, Binance said.
In September, another engineer was contacted by an individual posing as a project director through a “legitimate job-hunting platform.” They arranged an initial interview with an HR representative and another interview with an individual purporting to be the CEO.
During the second interview, the engineer was instructed to download an assignment containing malicious code onto his work computer, which initiated a series of “unauthorized activities.”
“This was more advanced and deceptive than previously seen social engineering approaches,” Binance noted in Tuesday’s post.
Shortly before the hack, the attacker used the compromised computer to access an internal AI tool and gain control over two other computers, including that of the first engineer.
They logged into a third engineer’s computer on the day of the hack, using credentials obtained from the first engineer, and launched the attack.
Two blockchain intelligence firms quickly connected the hack to TraderTraitor, a North Korean hacking unit that has previously targeted the crypto industry. The FBI said Saturday it was also attributing the attack to North Korea.
North Korea denied involvement Tuesday, with the influential sister of leader Kim Jong Un calling the accusations “a trite provocation.”
“This is not the first time that the U.S. has attempted to spread misunderstanding of the DPRK in the international community, blindly linking the DPRK with the ‘cyber crime’ incidents whenever they occur on an international scale,” Kim Yo Jong said in a statement, using an abbreviation for the Democratic People’s Republic of Korea.
Binance vowed to cover all losses related to the hack, saying Tuesday it has replenished 98 percent of impacted assets. It also said it has taken “immediate action to contain the incident and strengthen the systems involved.”
“The entry points identified as having been used in the attack have been closed,” the company added. “Systems touched in the attack path have been rebuilt or replaced. We have also implemented tighter device controls, enhanced wallet-service risk controls and expanded AI-based behavioural anomaly detection.”
Conservative MP Bob Zimmer said his father was offered medical assistance in dying (MAID) toward the end of his life without asking for it, prompting the MP to question whether safeguards for the procedure are being followed.
Zimmer said on X that his family was preparing to bring his father home from the hospital, as he "was about to pass away and he wanted to be at home to be more comfortable."
I watched a nurse at our local hospital offer MAID to my Dad.
He was not asking for it, nor had he asked for it.
We were trying to get him home as he was about to pass away and he wanted to be at home to be more comfortable.
While they were waiting, a nurse "approached us and offered MAID to him," despite his father having not asked for the procedure, the MP for B.C.'s Prince George - Peace River - Northern Rockies riding said.
"I was disgusted. All the warnings about MAID we debated in the [House of Commons] and warned would happen with the change in legislation and the Liberals said would never happen [...] are happening," he said.
An official from the justice minister's office told The Epoch Times that the law allows for health practitioners to provide eligible Canadians with the option for MAID. He said if Zimmer suspected wrongdoing or malpractice, he could raise it with the B.C. Ministry of Health's MAID Oversight Unit, which could then investigate.
Zimmer's testimonial was in response to a Leger survey that found one in 10 Canadians know someone who has been offered MAID for a treatable condition. Those surveyed were also asked if they knew someone in Canada who died due to a long healthcare waitlist, and 18 percent of those people said "yes."
The federal government, meanwhile, has tabled legislation to allow Canadians to make advance requests for MAID. The MAID Safeguards Act would allow individuals to provide advance consent for euthanasia after receiving a diagnosis of an incurable illness expected to impair their future decision-making ability, such as Alzheimer's or other degenerative neurological disorders.
The Justice Department has said that if a person shows a "clear refusal or resistance to MAID," then the advance request would be invalid and the procedure would not be provided. An advance request would not guarantee approval for MAID.
The legislation would also indefinitely extend the exclusion of people whose sole underlying medical condition is a mental illness from MAID eligibility. The exclusion is currently scheduled to expire on March 17, 2027, after two extensions prompted by concerns from provinces, territories, and healthcare stakeholders.
A parliamentary committee recommended making that exclusion permanent in a June report. The report cited concerns about determining whether a mental illness is irremediable, distinguishing MAID requests from suicidal intent, and ensuring access to adequate mental-health services.
The Conservative Party has opposed the expansion of MAID and called for stronger monitoring and public reporting, minimum national standards for oversight, and a review of the effectiveness and enforceability of existing MAID safeguards.
The Tories have also opposed advance consent for MAID, with Conservative MP Andrew Lawton requesting on Oct. 29 that the Liberals' bill be split into two so that advance consent and the indefinite exclusion of the mentally ill from accessing euthanasia can be voted on separately.
A total of 76,475 people received MAID in Canada between its legalization in 2016 and the end of 2024, according to Health Canada's latest annual report, released in late 2025. In 2024, MAID deaths accounted for 5.1 percent of all deaths in Canada.
Stevanato Group's third quarter beat expectations, but the more important news was its 2027 outlook. On Earnings Whispers' dollar-normalized basis, the company earned $0.18 per share, beating the $0.17 consensus by 5.9%. Revenue of $375.28 million topped the $363.84 million estimate by 3.1%. Earnings grew 12.5% year over year and revenue rose 5.9%. In its own reporting currency, Stevanato posted revenue of €326.1 million, up 8% both reported and organically. Adjusted diluted EPS was €0.16, up 14%, and IFRS diluted EPS was €0.15, up 15%. The gap between the dollar and euro growth rates reflects currency translation, not a conflict in the underlying results. Full-year 2026 guidance was maintained. The central tension is that management also said one large GLP-1 customer is cutting volumes, which will slow 2027 growth to low single digits, well short of the long-range plan of high-single to low-double-digit growth.
The quality of the beat deserves scrutiny. Profitability was clearly better. Adjusted EBITDA margin expanded 150 basis points to 27.2%, up from 26.0% in Q2 and 23.9% in Q1, and adjusted operating margin reached 19.4%. Free cash flow swung to €21.7 million from roughly -€32 million in Q2. Growth composition was weaker. High-value solutions, the premium franchise, grew just 1% after gains of 16% in Q2 and 17% in Q1, and fell to 46% of revenue. The strength came from other containment and delivery solutions, up 23% organically. Bulk syringes and cartridges drove part of that gain, but so did variable compensation tied to lower GLP-1 volumes. In effect, some revenue reflected payments for the GLP-1 shortfall rather than product demand. Gross margin also slipped 10 basis points to 29.1% as European utility costs and higher depreciation offset gains at the Latina and Fishers plants. Engineering revenue fell 12%.
The call confirmed that GLP-1 exposure is shrinking quickly. GLP-1 therapies fell to roughly 17-18% of revenue from 22-23% in Q2. The same customer cutting syringe volumes is also delaying engineering orders. As a result, management lowered 2026 engineering revenue guidance to €124-134 million and is now assessing strategic options for its visual inspection and assembly business. The offset is real, though. Non-GLP-1 biologics grew more than 30% in the quarter, lifting year-to-date growth to 13% from about 6% at midyear. Management now expects the BDS segment to grow organically by double digits at the midpoint for 2026, up from high single digits previously. Management said it has made meaningful progress backfilling the lost GLP-1 revenue but expects normalization only in 2028.
Operationally, the capacity buildout is starting to pay off:
Fishers broke even at the gross-profit level and shipped its first commercial EZ-fill vial order.
The Fishers device cleanroom is complete, with commercial device volumes expected within months.
The first high-volume Alba syringe line was qualified at Piombino Dese.
Ready-to-use cartridges are reportedly booked for most of 2027.
The 2026 capex budget was cut to €230-240 million from €270-290 million. That should support free cash flow, but it also suggests the company needs less capacity near term than once planned. Two execution risks remain for the fourth quarter. High-value mix must reach roughly 50% to hit the 47-48% full-year target. Energy costs also continue to rise faster than price increases can pass them through.
Investor sentiment heading into the report became more positive, rising from 0.11 to 0.22 on the -1 to +1 scale. That is a meaningful improvement but still only mildly positive, and it was measured before the 2027 commentary. Shares closed at $19.74 before the release, down 1.8% from the opening price after the August report. The stock sat about 9% above its 200-day moving average but 15% below its September 18 high of $23.25. It was also only 6.6% above the October 16 low of $18.51, meaning much of the late-summer rally had already unwound. The internal trend readings are mixed: sequential growth is positive, while AVWAP remains negative.
The bottom line is that Stevanato delivered a clean beat, steady 8% organic growth and real margin expansion. It also showed encouraging non-GLP-1 demand and progress on its new plants. Bears still have legitimate ammunition. High-value growth nearly stalled, part of the quarter's revenue came from shortfall compensation, and a single-customer GLP-1 cut has reset 2027 to low-single-digit growth. The investment case now depends less on 2026 delivery and more on how quickly biologics, Alba and device programs can fill the GLP-1 gap.
Emily Compagno said it best: “This election is about who the government will go after — criminals, or you?” Let me tell you my experience of Democrats using the power of our government to come after people like you.
I was a chiropractor living and working four blocks from the Capitol for almost thirty years. I was loved by my patients. I gave seven years of pro bono Tuesday chiropractic services for drug addiction at the world-famous N Street Village Women’s Shelter. I taught free Tai Chi on the Capitol grounds and in Lincoln Park on Capitol Hill for nearly thirty years. I forgave thousands in charges to poor patients who needed care when Medicaid ignores chiropractic.
Of course I went down to the Capitol on January 6. Hundreds of Capitol Hill residents did. No gates were up. Police let people in.
Months later, around August 21, attorney David Webber represented the widow of a J6 police officer who had committed suicide nine days after the protest. Webber said the vicious blows that I had struck to the officer’s head caused a concussion, for which he took his own life nine days later.
I was deluged with calls from news outlets. A sergeant “with a task force responsible for the protection of high government officials” gave me his direct number if I saw mob activity outside my house. Two Antifa-looking people were already taking photos outside my office. I wanted to go to the press, but my WaPo Pulitzer Prize–winning sister told me the media wouldn’t report what I said if I defended myself too well.
Over the next three years, Webber changed his story six times:
I got the assault weapon from Taranto.
I got a steel bar from Taranto.
I got a cane from Taranto.
I had my own weapon.
I snatched Officer Smith’s baton from him and smashed him multiple times with it.
At my trial, Webber claimed that I shoved Smith’s baton — causing bruises to his eye orbits and concussion. (Then did I give the baton back to Smith while he was concussed, if no one said he ever lost it?)
Smith’s bodycam shows us passing one another in 1.5 seconds in a jostling crowd that began six seconds earlier, when I stopped a man from striking an officer. During my criminal trial for “misdemeanor trespass,” Prosecutor Jeffrey Kiok told Judge Gia Cobb twice that I did not assault Officer Jeffrey Smith. He said I put my hands up in defense, and he would have prosecuted me had I hit Smith.
I went to jail for two months at Ft. Dix, since J6 misdemeanors were elevated to felonies — a first in American history. Webber waited three years before he started my civil trial, mine the only one for J6 people. When Judge Reyes saw Smith’s bodycam video, she cried out, “What?! I thought he actually hit him!” as she made an overhand chopping motion. The jury heard how Webber had changed his story six times. They heard his “medical expert” say that I had taken the baton, hit Smith multiple times, given it back in 1.5 seconds, and concussed him.
I was a dead man when Judge Reyes did not dismiss the case and sent it to a D.C. jury. I’ll never forget the looks of body-shaking hatred my “impartial” jurors gave me from across the courtroom — despite the video and Webber’s changing story. My lawyer said assault cases like this usually settled for a dollar in damages with a guilty verdict. My jury returned in an hour: guilty — with a judgment of $500,000. I was numb. One female juror popped up and pranced out, so pleased with herself for the justice she had meted out to me.
I lost probably the most prestigious chiropractic practice in the world. I lost most of my patients. I lost two literary agents. I lost 98 percent of my society, since many were Democrats either wanting to believe the media lies or terrified of the Soviet crackdown they saw chew up my life like a bone. Since then, people I make friends with later ghost me. I closed my practice with nothing to sell and left the city.
In a mediation session, a judge mediator had said, “Look, I agree with you that in another jurisdiction like Oklahoma, they would have thrown this case out.” The courts ensure change of venue for cases like mine and J6 cases where we see what Emily Compagno alluded to: The left flips the script on guilt and innocence. For us, you have to harm person, property, or information. For them — guilt is rejecting one-party rule. Nothing I did for that city mattered to them. They could have looked at the video. They could have cared. To them, I got a fair trial...as they will say with you.
I had lived in D.C. since 1963. I worked to bring to America chiropractic’s breakthrough of brain-first health care. It would change health care and social welfare — the cost and the ineffectiveness of which are what divides left and right.
Mind your vote. Democrats are sadists — for vicious rulers who can get away with anything, and their people and media ignore it.
Do you want them to be able to do to you what they did to me — and then turn around the next day and do it all over again?
For that they have Chinese brokers and middlemen who turn the loot into useable funds, which Kim Jong Un’s regime will undoubtedly spend on weapons and missiles, sources told the Post.
“There’s not much to buy in Pyongyang. What North Korea needs to advance its missile program and its nuclear weapons development program is stuff that exists outside North Korea.
North Korean leader Kim Jong Un attends a meeting in Pyongyang in a photo released Oct. 24, 2026. Experts say Chinese brokers help his regime turn stolen crypto into spendable cash.KCNA VIA KNS/AFP via Getty Images “Stealing cryptocurrency gives North Korea a sort of international slush fund that it can move around the world without using banks, and it can pay people off, and buy the stuff that it needs,” Geoff White, author of “The Lazarus Heist” which investigates North Korea’s hackers told The Post.
Chinese laundering crews are believed to have taken over after the hackers’ initial transfers within 20 minutes of the hack last week, according to Nick Carlsen, an investigator at blockchain intelligence firm TRM Labs.
The speed of the theft was astonishing. Most of the Binance funds moved across 10 blockchains in about 20 minutes, according to TRM. Attackers then raced to swap assets issuers were able to freeze for unsanctioned cryptocurrencies beyond their control.
Nick Carlsen, right, receives the FBI Director’s Award from Christopher Wray in 2017. He now tracks the money men helping North Korea cash out stolen crypto.Courtesy of Nick Carlsen
“From that point on, it’s almost exclusively Chinese money laundering teams that are actually doing all of the transactions,” he told The Post.
In its first three and a half days, the laundering operation then used about 12,000 digital wallets—roughly one new wallet every 25 seconds—according to blockchain analytics firm Elliptic. The transfers complicated tracking but have not make the money untraceable.
Kim Jong Un, center right, and his daughter, center left, watch a drone exhibition in North Korea on Oct. 29, 2026. The FBI has blamed North Korean state-backed hackers for the $6.3 billion Binance theft.KCNA via KNS via AP
Binance has said it has set aside money to cover any losses to its customers.
Dictator Kim Jong Un’s sister, Kim Yo Jong, rejected the accusation as a “grave political provocation” in a statement carried by state media.
Carlsen said the stolen money adds to the regime’s coffers, helping fund its spending priorities.
“These massive inflows of hard currency go to the regime, allowing it to pursue its priorities,” he told The Post. “Lately the highest priorities are weapons development and internal improvements.”
The security experts pointed out North Korea’s hackers may not necessarily be stationed in the country, which helps operators blend into other countries’ internet traffic.
Kim Yo Jong, sister of North Korea’s leader Kim Jong Un, attends a wreath laying ceremony at Ho Chi Minh Mausoleum in Hanoi, Vietnam, March 2, 2019. She rejected the hacking accusation in a statement by North Korean State media.REUTERS “We know that North Korean hackers have pitched up in China and been working from there,” White said.
Carlsen said TRM had observed overlap between the Binance laundering and a Chinese network handling earlier North Korean thefts. The money men work for a percentage, eventually exchanging crypto for yuan in Chinese bank accounts or access to payment cards.
“There’s this entire parallel banking system that allows the Chinese to access hard currency overseas, and that’s the networks the North Koreans hide their activity in,” he said.
Author Geoff White, pictured with “The Lazarus Heist” and “Rinsed,” told The Post stolen crypto gives North Korea an “international slush fund” to finance purchases overseas.
White pointed out China’s restrictions on making overseas transfers has helped create demand for underground services. From China, the laundered money will likely be moved again.
White pointed to Ramon Abbas, the Nigerian Instagram influencer known as Hushpuppi, known for flaunting luxury clothing and his enviable life in Dubai.
“By night, he was working with all sorts of criminal elements including with North Korean hackers, to move money around to launder money and to facilitate fraud,” White said.
US prosecutors said Abbas supplied Romanian and Bulgarian bank-account details in a conspiracy to launder money from a Maltese bank heist attributed to North Korean hackers. Arrested in Dubai in June 2020, he was sentenced to 135 months in US prison in November 2022.
North Korean banker Sim Hyon-Sop, shown on a reward poster released July 24, 2025, is accused of laundering stolen crypto to pay for goods for Kim Jong Un’s regime.U.S. Dept of State Carlsen sees more opportunity in targeting the money men than catching hackers protected by their home state.
“From several past recent hacks we’ve identified Hong Kong and China-based individuals that are handling the laundering,” he said.
A 2023 prosecution accused North Korean banker Sim Hyon Sop of working with Chinese and Hong Kong traders to convert stolen crypto into dollar payments for goods for the regime, using Hong Kong front companies.
Nick Carlsen, left, at the Demilitarized Zone in South Korea in 2003. He has spent his career tracking North Korea, from the Army to the FBI and now TRM Labs.Courtesy of Nick Carlsen A separate indictment alleged Sim and Chinese intermediaries procured a Russian helicopter for North Korean customers in 2019. The contract listed a $300,000 price and delivery to a North Korean port.
Carlsen said getting the funds back would only be possible with Chinese co-operation.
“If the Chinese government crack down on illicit banking, period, this would be basically impossible for the North Koreans,” he said. “But if they even just narrowly target the individuals handling these thefts, the North Koreans would be stuck with crypto assets that they can’t sell.”
