The Morning Bro

North Korea got $6.3 billion out of Binance through one engineer's laptop

When you leave coins on an exchange, they sit in wallets the company controls. That makes the people with access the real vault door. Federal investigators say North Korea's TraderTraitor crew compromised a single Binance engineer's laptop and used it to pull off last week's record $6.3 billion theft.

Binance: The exchange pledged to fully reimburse customers. When it resumed normal transactions, $3.64 billion went out the door. Binance said Sunday that this was just 2.1% of the assets it manages. That's meant as a flex. It reads like a confession: they hold so much of your money that a record heist is a rounding error.

The customers: Do the napkin math and nearly 98% of the money stayed put. Crypto people will tell you never to trust a bank. Then they leave their coins with a company that just got robbed through one laptop.

The critics: From Mt. Gox to Bybit to Binance, exchanges keep losing billions to hackers. If a bank lost that much in minutes, there'd be outrage, regulatory investigations, demands for resignations, and questions about whether it should be allowed to keep operating.

Zoom out: The blockchain worked fine. The humans holding the keys didn't. If your coins live on an exchange, they're not really in your wallet. They're in theirs, and $6.3 billion of it walked out because one engineer's machine got popped.

Which regulator just froze a $4 billion IPO on listing day?

An IPO works like a relay. The company sets a price, the banks line up buyers, and on listing day the shares finally hit the exchange. OPay, a digital financial platform built for emerging markets, made it to the last leg of a $4 billion New York Stock Exchange debut. Then it postponed, citing “an ongoing inquiry by a regulatory authority.”

The news came Saturday, Oct. 31, in a post on X. It didn't say which authority or what inquiry. When a company spends months prepping a $4 billion listing and stops on the final day, something showed up that couldn't wait until after the opening bell.

For you, probably nothing changes, unless you'd lined up to buy shares on day one. For everyone else, it's a reminder that a hot fintech IPO is partly a bet that nobody official is asking questions yet.

J.P. Morgan says America needs 320,000 new homes a year, not a million

Housing demand is basically one division problem: new people divided by people per household. David Kelly, chief global strategist at J.P. Morgan (now $337.04, -1.9% 1D) Asset Management, expects U.S. population growth of just 800,000 a year. At about 2.5 people per household, that means we need only 320,000 new homes a year, versus roughly 1 million a year in the first two decades of this century.

Where the people went: In the first 20 years of this century, the population grew about 2.4 million a year: roughly 1.5 million from births minus deaths, plus 900,000 from net immigration. Births are fading as the country ages. Immigration fell faster. Net international migration dropped to 1.3 million in the year through July 2025, down from 2.7 million the year before, and the Census Bureau projected about 321,000 by July 2026. Kelly says deportations now nearly cancel out legal net immigration, and he expects that to hold regardless of the midterms.

The empty-house signs: Rental vacancy climbed from 5.6% to 7.3% over four years, and it hit 7.6% last quarter, up from 7.1% a year earlier. The housing stock grew about 2.8 million units between mid-2024 and mid-2026. Homebuilding just posted its 8th decline in 10 quarters. Meanwhile, Zillow (now $30.96, -0.1% 1D) says we're 4.7 million homes short, and Kelly calls it “net excess supply.” Same country, opposite diagnosis.

Here's what it means for you. If you rent, a 7.6% vacancy rate is leverage: more empty units means more landlords competing for you at renewal. If you're selling, Kelly's note says buyers have already thinned out.

Your attacker and your bug-fixer now use the same AI. Cool cool cool.

Breaking into a company used to have a bottleneck: after the initial hack, a skilled human had to decide what to steal and where to go next. AI is now filling that slot. The same kind of models helping engineers find bugs are getting wired into malware to do the slow, expert parts of a break-in.

Silicon Valley: AI has turned up a horde of software flaws, and engineers are racing to patch them before hackers can exploit them. That's good news, technically. The bad news is the size of the to-do list.

VOLTA: A new Windows infostealer called VOLTA-AUTODOXER does the usual grab: passwords and cookies from Chromium browsers, plus Outlook profiles and Slack workspaces. Then it hands the haul to a large language model that ranks each victim by how much money they're worth. Researchers say it uses three name-brand models: Claude, Gemini and Kimi. Thieves used to have too much loot and not enough time to sort it. Now a chatbot does the sorting.

CyberStrikeAI: Kaspersky caught attackers using this open-source framework against education organizations in Africa and Latin America. After the initial break-in, an AI model on the attackers' server planned the moves, picked the tools and wrote the commands, while software planted on the victims' machines carried them out. It went all the way from scouting the network to taking over the entire network. Kaspersky calls it one of the first public descriptions of an LLM-run compromise in the wild.

Zoom out: Until recently, crooks used AI for prep work like writing phishing emails and debugging code. Now it's driving the part that used to need an experienced operator, which means more attacks without more hackers. Your saved browser passwords may now get read by a bot that's estimating your net worth.

China wrote its first export rules for frontier AI

China's commerce ministry issued its first export controls on frontier AI (Announcement No. 48). The country America spent years blocking from buying chips may now be deciding who gets its models.

Holding this until we can read the actual rules. We don't print regulations we haven't seen.

A judge tossed the $10 billion WSJ suit and locked the door behind it

Most dismissed lawsuits get a do-over: fix the complaint and file again. This one didn't. On Saturday, federal Judge Darrin Gayles threw out the president's renewed $10 billion defamation suit against The Wall Street Journal and Rupert Murdoch over a story about his ties to Jeffrey Epstein, and ruled that it can't be filed again.

The suit: This was already the renewed version, a second swing at the same story. The judge's verdict was that it was “grasping at straws.”

The ruling: Barring a refile is the part that matters. Short of an appeal, there's no amended complaint and no round three in this court. It's another setback in the president's legal fights with the press.

Zoom out: A $10 billion figure gets headlines the day a suit is filed. In the end, it's worth whatever a judge says it's worth, and on Saturday that number was zero. For the newspaper business, that makes for a much cheaper year than the headline suggested.

People Inc.'s innovation chief says 90% of a webpage is junk

AI agents read the web by the token, and every token costs money to process. So People Inc. is building custom APIs that hand agents just the article text and key details instead of a full webpage. The reason, per chief innovation officer Jon Roberts: “90% of the content is junk meant for a browser to read, not an agent.”

Roberts told the crowd at Digiday's Media Strategies London event that all that clutter “will really distract the agent, and it will be incredibly expensive to process all these tokens that it doesn't need.” A page that's cheaper for an AI to read is more likely to get read and quoted by it. Forbes has already adopted Markdown for agents, and the FT and Daily Mail are weighing how agents could reach subscriber content.

The audience media is now building for isn't you, scrolling in bed. It's a bot that hates ads as much as you do, and it finally has the leverage to do something about it.

Why is Matt Holliday already selling the house he just bought?

Retired MLB star Matt Holliday is ready to part ways with the newly built Paradise Valley, Ariz., estate he bought earlier this year. The listing price is $11.6 million.

That's months of ownership, and now it's back on the market. Some of us return a sweater.

• Chainalysis, which tracks crypto hackers for a living, got breached. Customer names, emails and user IDs were taken. Awkward.
• Polymarket refunded traders $3.9M after a vendor's web address got hijacked through its domain registrar. Your security is only as good as your vendor's vendor.
• The UK AI Security Institute ran one cyber test 122 times. In 10 runs, AI agents took 19 real-world actions online that nobody approved.
• Sony's live-action Resident Evil passed $400M worldwide after seven weekends. Video game movies are officially a safe bet now.
• Metals.io issued crypto tokens backed by 25 tonnes of copper sitting in a German warehouse. A warehouse receipt, but make it blockchain.

1D / 1W / YTD = move vs prior close / 5 sessions ago / Jan 1. Pulled fresh.