Kiwi News: handpicked crypto news for builders

The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor." The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages. How You Can Help: FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets. A list of addresses associated with this activity is available here: https://www.fbi.gov/investigate/cyber/al…

It should now be abundantly clear that ETH on Ethereum L1 is a very different beast from stablecoins like USDC and USDT, or ETH on e.g. Arbitrum. It is time to ask really hard questions: Which “beast” do people really want, and when? And how much capacity should there be to move instantly between them? Clearly, we still want strongly censorship-resistant assets like ETH and Bitcoin. But in many cases, having an entity that can intervene in the event of a hack can be a positive. However, the way that power is exercised can feel arbitrary. Is Paolo asleep? Do you have a direct line to Jermey so suddenly they block without court order. I think it would be good to have assets and rollups that offer an additional layer of protection, but under clear, transparent, consistently applied rules that protect smaller users too, not just the well-connected.

Did you know Twitter links can reveal which device was used to share them? Check the URL ending: s=46 → iPhone s=20 → Web Browser s=19 → Android Try it yourself by copying a tweet link. Technology is interesting, isn't it?

BREAKING: France just voted to tax the internet. French lawmakers approved a tax of €0.055 (5.5 cents) for every gigabyte of data that companies like Netflix and YouTube send to French users. It’s a tax on the companies, not users directly, but the cost could get passed on to subscribers. The vote was 11 to 10, with only 35 of 577 lawmakers present. Supporters say it could raise up to €10 billion a year. The French government opposed it, warning it would hit smaller French companies hardest; VLC says it would cost it over €1 million a year.

BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit. Thanks to all other signers involved. Exploiter address 0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5 Trsanction hash: 0xb69c81774f507d46ce776aeaed8b4d31df96dd66ce6fd05073481011835355d6

Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence. Read more: https://www.chainalysis.com/blog/binance…

By design, a Morpho Blue market can't protect its users: it can't freeze the market to mitigate risk, act on the interest rate curve or implement rate limiting, and it has no Umbrella junior tranche to protect deposits. When an isolated market breaks, its lenders take 100% of the loss. If you're a Morpho user facing an adverse event, they will just tweet and let you sink, as they did during the dozens of vault blowups that led to dire user losses. Ask anyone who was in a curator vault during Stream/Elixir. Users won't trust an infra with real size if it doesn't care about them or support them. That's why, even with infinite VC funding, deployed incentives, a competitor that lost its best contributors and paid partnerships, Morpho only added a pathetic +$2.15B in active loans this year. For comparison, I did as much in one week at the Plasma launch.

CryptoBilis update We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026. No CryptoBilis buyer has reported a loss of funds to us. IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Here’s what to do: Already using it? Move your funds to a newly created wallet with a new seed as soon as possible. Do not reuse the old seed in any wallet, hardware or software. If you don’t have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with. Not set up yet? Don’t set it up, and never enter your existing wallet backup on it. We haven’t received the device to confirm this report, but based on the customer’s description, we’re treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives. On October 9, 2026, we removed CryptoBilis as a reseller following reports of tampered Ledger devices sold through it. Since then, we have been inspecting Trezor devices that customers bought from CryptoBilis and have found no signs of tampering on any of the four devices we’ve received so far. NEVER share your wallet backup (recovery phrase) with anyone. Trezor Support will never ask for it. If you are affected by this incident, please keep your CryptoBilis device and contact Support to receive a new Trezor hardware wallet: https://trezor.io/support#open-chat We're investigating and will post updates here as soon as we know more. Thank you to the customer who reported this through our responsible disclosure program, and to @SEAL_911 for working alongside our teams on the response. Reports and engagement like this help us protect everyone else. For more information, visit our blog: https://trezor.io/blog/news/implant-repo…

It's state-sponsored military cyber warfare against normal engineers working from home. Crypto spent billions building multisigs, KMS enclaves, and MPC clusters, but the adversary isn't trying to crack prime numbers. They find one tired DevOps dev on LinkedIn, send a poisoned PDF, and walk straight through the front door with full sudo rights. You can audit your smart contracts fifty times, but the human endpoint is always running zero-day vulnerabilities. Damn, Lazarus is good at breaking people.

Smoking gun. Attacker confirmed as North Korea.

Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified. The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete. As an immediate precaution, Binance has: - temporarily suspended deposits and withdrawals while security checks are completed; - revoked the affected address authorisation; - engaged law enforcement and blockchain intelligence partners to trace and recover funds. Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice. Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions. https://www.binance.com/en/support/annou…

Using Ethereum leaves a trail. Your transactions are public, and your wallet shares your address and location with servers every time you open it. Most people have no idea how much that adds up to. So we wrote a field guide for anyone who uses Ethereum and wants to understand their privacy. How to D̶i̶s̶a̶p̶p̶e̶a̶r̶ on Ethereum explains, in plain language: What other people can learn about you Where that information leaks Which tools protect you, and what they don’t You don’t need to be technical to read it. It’s a first edition, printed for .@EFDevcon. We’re handing out copies at our private event in Mumbai this week. Details tomorrow. DM us for early access/ event invite