Hackers Pull a Record $6.3 Billion Out of Binance, a Vendor's Script Drains Polymarket Wallets, and Mistral Gives Away a Trillion-Parameter AI
By Noah Smith, Owner & Consultant, KeyChange Technologies · October 30, 2026
Here is your AI and IT news for Friday, October 30, 2026: the biggest crypto heist on record, a website add-on that turned into a wallet drainer, and a trillion-parameter AI model anyone can download. Yesterday's roundup is here if you missed it.
📌 The AI and IT news at a glance
- Hackers pull a record $6.3 billion out of Binance in about 20 minutes, and blockchain investigators point at North Korea.
- A performance-monitoring script on Polymarket's site is hijacked to drain customer wallets, forcing an hour-long trading halt.
- Heart-monitor maker iRhythm's breach grows to 8.2 million patients in a new federal filing.
- Moldova suspends 82 government services after what officials call the country's largest cyberattack, likely AI-assisted.
- CrowdStrike catches Chinese hackers running AI agents against 200+ organizations at once.
- Mistral releases its trillion-parameter Large 4 as open weights, Europe's biggest free-to-download model.
- An OpenAI-backed holding company agrees to buy ADT for $15.3 billion.
- OpenAI scraps a planned cut to ChatGPT Pro and doubles usage limits instead after subscriber backlash.
🔝 Top story
Hackers pull a record $6.3 billion out of Binance
On Thursday evening, Binance, the world's largest crypto exchange, confirmed a "security incident" and suspended deposits and withdrawals while it investigates. Blockchain analytics firm TRM Labs says about $6.36 billion moved out of Binance wallets across ten blockchains, with most of it gone within roughly 20 minutes of the first transfer at 20:05 UTC. That would make it the largest crypto theft on record, about four times the $1.5 billion Bybit heist of February 2025. Stablecoin issuers including Tether and Circle moved quickly and have frozen roughly $2.7 billion of the stolen funds, according to TRM, but that still leaves billions in the attacker's hands.
TRM attributes the attack "with high confidence" to TraderTraitor, a North Korean hacking unit, and believes the attackers most likely compromised the systems Binance uses to sign transactions from its "hot" (online) wallets rather than simply phishing an employee. Important caveats: Binance has not confirmed a loss figure, a root cause, or who did it, and there is no official government attribution yet. Binance co-founder Yi He wrote that "user funds are safe" and that Binance "will cover all hacking losses," but the company has not said when withdrawals will resume.
In short: Attackers drained an estimated $6.3 billion from Binance's online wallets on October 29, and the exchange froze deposits and withdrawals while it investigates.
What it means for your business: If your company holds any crypto on an exchange, or accepts it as payment, today you cannot move funds held at Binance, and that is the real risk of keeping assets on someone else's platform. Expect a wave of "Binance support" phishing emails and texts over the next few weeks; warn your staff.
My take: The scale is wild, but the lesson is old: whoever controls the signing keys controls the money, and pre-approved permissions are the scariest kind. The same principle applies to the admin accounts and standing approvals in your own business. Also note the part that worked: freezes by the stablecoin issuers clawed back billions within hours. Fast containment beats a perfect wall.
Source: TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
🛡️ IT and security
A vendor's website script is hijacked to drain Polymarket wallets
Earlier on Thursday, prediction market Polymarket switched to "cancel-only" mode just after 2:00 p.m. ET Thursday after traders reported unauthorized withdrawals. The culprit was not Polymarket's own code. DebugBear, a UK company whose Real User Monitoring script many sites embed to measure page speed, said it was dealing with an "ongoing security incident" that compromised that service, and it told customers to remove its embed code from their websites. Because the script ran inside Polymarket's pages, a tampered version could act on users' sessions.
Blockchain data cited by The Block suggests the attacker took about $2.65 million in tokens. Polymarket said "one of our third party vendors was compromised," reported it to police, said the issue was resolved by about 3:00 p.m. ET, and promised to reimburse all affected customers. Polymarket's separate US exchange was reportedly not affected.
In short: A hacked third-party monitoring script on Polymarket's website was used to steal about $2.65 million from users before trading was paused.
What it means for your business: Every outside script on your website (analytics, chat widgets, ad tags, speed monitors) runs with the same power as your own code. If one of those vendors is breached, your customers are the ones who get hit.
My take: This is the story I would forward to whoever manages your website. Ask for a list of every third-party script on your checkout, login, and account pages, and cut anything nobody can justify. Fewer scripts means fewer vendors who can hurt your customers on your behalf.
Heart-monitor maker iRhythm's breach grows to 8.2 million patients
iRhythm Technologies, the company behind the widely prescribed Zio wearable heart monitor, now says its data breach affected 8,179,772 people, according to a filing with the US Department of Health and Human Services. Earlier disclosures had put the figure at a minimum of about 360,000. The attacker downloaded patient information from business applications hosted by a third party between June 3 and June 8, then tried to extort the company by threatening to publish it.
The stolen data includes names, addresses, dates of birth, email addresses, phone numbers, iRhythm account numbers, device serial numbers, insurance numbers, and dates of service. The heart monitors themselves were not affected; this was a theft of the business records around them.
In short: A federal filing shows iRhythm's June breach exposed the personal and insurance details of about 8.2 million patients, more than 20 times the earlier estimate.
What it means for your business: Breach numbers tend to grow, sometimes dramatically, as investigations finish. If a vendor tells you "a small number" of your records were involved, plan for the final count to be larger.
My take: Notice where the data lived: in externally hosted business applications, not in the medical device. Your most sensitive data is often sitting in a SaaS tool someone signed up for years ago. Know which vendors hold your customer data and how they lock it down.
Source: The420.in: iRhythm Says Data Breach Affected 8.2 Million People
Moldova shuts off 82 government services after its largest cyberattack
Moldova's Electronic Government Agency suspended 82 digital public services and disconnected more than 30 information systems after attackers extracted personal data from government systems. Officials put the number of people affected at about 750,000, while the agency said the attempts "targeted about one million people" between October 19 and 23. The exposed data may include ID details, birth dates, family information, health insurance status, disability and benefit status, driver's license details and photos, vehicles and companies owned, and financial details such as IBANs and tax debts. The agency says bank card data was not affected.
The head of Moldova's Cybersecurity Agency called it the largest cyberattack the country has recorded and said AI was likely used, including to find the weaknesses. Attackers reportedly exploited services that could be reached without logging in. Prime Minister Vasile Tofan said there are indications of a broader campaign involving foreign state actors, without naming a country, and President Maia Sandu called a National Security Council meeting.
In short: Attackers likely using AI pulled personal data on up to a million Moldovans from government systems, forcing 82 public services offline.
What it means for your business: Anything you expose to the internet without a login is now being scanned faster and more thoroughly, thanks to AI. Old forms, lookup pages, and APIs nobody remembers are exactly what attackers find first.
My take: "Accessible without authentication" is the line to underline. Have someone list every page and service your company runs that answers without a password, and confirm each one is meant to.
Source: RFE/RL: Moldovan President Calls Security Meeting After Massive Data Breach
CrowdStrike catches Chinese hackers running AI agents against 200+ organizations at once
This is today's one technical story, and it earns the slot because it is a clear, documented case of AI agents doing the hacking at scale. CrowdStrike says a China-linked group it calls VAPOR PANDA used an AI "agent framework" called ARTEX to run intrusions against more than 200 organizations in at least 14 countries over 11 days starting October 17. A lead agent coordinated planner and worker agents that moved each break-in forward, tried several attack paths in parallel, and switched tactics when one failed. The group mainly used the Chinese DeepSeek model, and one intrusion alone consumed about 1.4 billion tokens. A human operator stayed in the loop, steering at key decision points.
CrowdStrike confirmed hands-on-keyboard activity inside nine organizations, including government ministries and US pharmaceutical, defense, financial, and telecom firms. In one case the attackers used authentication keys left unrotated since a 2022 directory export. The operator also told the agents to hunt for Windows machines that did not have CrowdStrike's security agent installed.
In short: A Chinese state-linked group used a team of AI agents to attack 200+ organizations simultaneously, breaking into at least nine.
What it means for your business: Small hacking teams can now run many attacks at once, so being "too small to bother with" is less of a defense. Old credentials and unprotected machines are what these agents look for first.
My take: The detail that should stick: the attackers went looking for computers without security software. Your protection is only as good as your least-covered machine. Make sure every device, including that old server in the closet, has endpoint protection, and rotate keys after any scare.
Source: CrowdStrike: VAPOR PANDA Uses ARTEX to Scale Global Campaign
🤖 AI
Mistral gives away its trillion-parameter Large 4
French AI lab Mistral released the open weights for Mistral Large 4, nicknamed "Le Chonk," on Hugging Face on October 29, three weeks after a preview. It has about 1 trillion parameters, activates 52 billion per task, and accepts text and images. Mistral says three more weeks of training raised its Terminal-Bench 4.0 coding score from 28% to 41%. A compressed version runs on four Nvidia B200 or B300 GPUs, and smaller versions, including one for laptops, are promised in the coming months without firm dates.
The license is a modified MIT license: businesses can use, modify, and commercialize the model, but companies that resell it as a hosted AI service need a separate commercial license. Through Mistral's API it lists at $0.70 per million input tokens and $2.10 per million output tokens. Mistral is keeping a specialized cybersecurity version restricted to vetted partners and says it is tightening guardrails after seeing possible uplift for real attacks.
In short: Mistral made its 1-trillion-parameter Large 4 model freely downloadable under a business-friendly license.
What it means for your business: If you need AI that runs in your own environment or in Europe for privacy or compliance reasons, there is now a near-frontier option you can host yourself, though running it takes serious hardware.
My take: For most small businesses this is not a reason to buy GPUs. It is a reason to expect cheaper, more private AI options from your software vendors, and a useful bargaining chip when your AI contracts come up for renewal.
Source: TNW: Mistral releases open weights for its 1 trillion-parameter Large 4 model
An OpenAI-backed holding company is buying ADT for $15.3 billion
Thrive Holdings, a private equity spin-out of Thrive Capital that buys companies to hold long-term and rebuild with AI, agreed on Thursday to buy home security company ADT for $10 per share. That values ADT's equity at about $7.6 billion and the whole company, including debt, at $15.3 billion. OpenAI is both an investor in Thrive Holdings and a partner that supplies its companies with AI models and engineers.
The companies said ADT will be the foundation of Thrive's smart home security business and promised new products, but announced no specific AI features. The deal is expected to close in the first quarter of 2027, pending shareholder and antitrust approvals.
In short: An OpenAI-backed firm agreed to take ADT private in a $15.3 billion deal to rebuild the home security giant around AI.
What it means for your business: "Buy an established company and rebuild it with AI" is becoming a real strategy with real money behind it. In traditional service industries, your competitors may soon have deep-pocketed, AI-first owners.
My take: I would watch how this affects ADT customers' data and privacy terms over the next year; neither company has said anything specific about it yet. For everyone else, the takeaway is that AI is moving from software into old-line service businesses.
Source: TechCrunch: OpenAI-backed Thrive Holdings acquires ADT
🧰 Tools for vibe coders and everyday business AI
OpenAI scraps a ChatGPT Pro cut and doubles limits instead
OpenAI had planned to reduce the usage included in its $200-a-month ChatGPT Pro plan after October 29 while keeping the price the same. After a wave of subscriber complaints, it reversed course on Thursday and doubled usage limits for the $100, $200, and $500 Pro tiers and Business Premium, effective immediately. "We are doubling all usage limits for all Pro 100/200/500 tiers and Business Premium, effective today," said Tibo, who works on ChatGPT and Codex.
The change mainly affects ChatGPT Work and Codex, which share usage allowances. OpenAI still has not published the exact numerical limits for each tier.
In short: OpenAI cancelled a planned Pro usage cut and doubled limits for Pro and Business Premium subscribers.
What it means for your business: If your team leans on ChatGPT Work or Codex, you just got more room at the same price. It is also a reminder that AI plan terms change often, sometimes overnight.
My take: Good news, but "limits we won't publish" is not a great foundation to build a workflow on. Track how much your team actually uses, and keep a second AI tool you are comfortable with in case the terms swing the other way.
Source: BleepingComputer: OpenAI doubles ChatGPT Pro usage limits after backlash over planned 50% cut