Fifty Signatures and Twenty Minutes

Fifty Signatures and Twenty Minutes

The number is USD 6.36 billion, and the mechanism is more instructive than the number. TRM Labs' reconstruction of the October 29 Binance drain describes an operator that funded itself through three small Tornado Cash withdrawals on October 28, tested attack code on two wallets early on October 29, rehearsed the final version on a third, and four hours later installed the same code on a Binance hot wallet. The main burst began at 20:05 UTC and lasted about twenty minutes across ten chains, roughly four times the 2025 Bybit theft the FBI pinned on the same North Korean unit, TraderTraitor. At 20:20 UTC one transaction carried 50 EIP-7702 authorizations signed by the Binance hot wallet, each delegating the account to a sweeper contract only the operator could call. EIP-7702 lets an ordinary wallet temporarily act like a smart contract, and each authorization is bound to a nonce. Because the wallet's nonce kept advancing with legitimate withdrawals, signing 50 consecutive nonces in advance guaranteed one would land. Three minutes and 24 seconds later the sweep took 167,464 ETH and 63 tokens including 1.615 billion USDT (more: https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history).

TRM is explicit that phishing does not explain this. Wallets on nine other chains sent funds by ordinary signed transfers within half an hour, and a second Ethereum hot wallet moved 28,006 ETH with no delegation at all. TRM's assessment is that "the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains." That is a control-plane compromise, not a key leak. Binance has published no root cause; it told Wired the incident "may have involved a compromised laptop" but that "our subsequent investigation has uncovered additional points of breach." On attribution, TRM claims "high confidence" in TraderTraitor, Chainalysis says it watched Binance funds commingle in real time with proceeds of last month's North Korea-attributed hack, and Elliptic's Tom Robinson calls North Korea "likely," citing staff targeting, "a TraderTraitor hallmark." Neither Binance nor any law-enforcement agency has named a North Korean link, and that is what would settle it (more: https://www.wired.com/story/the-dollar63-billion-binance-hack-was-pulled-off-in-just-20-minutes/).

The recovery race is visible on-chain. Tether froze about 1.77 billion USDT and Circle 825 million USDC within about an hour. The attacker responded by dumping stablecoins before they could be frozen, selling roughly 325 million USDT for ETH at a discount above ten percent. The Octav and Arkham live tracker, following 354 attacker wallets across nine chains, puts the state at 47 percent frozen, 12 percent already swapped into unfreezable ETH and TRX, and 40 percent still free. The defensive guidance is concrete: monitor treasury wallets for EIP-7702 delegations, treat batched multi-nonce authorization requests as an indicator of compromise, and separate signing infrastructure by chain and wallet tier (more: https://go.octav.fi/binance-drain-dash).

Environment Variables Are the Loot

Northflank's status page is a timeline rather than a press release. A Wiz threat alert at 11:43 UTC on October 30, patches through the early afternoon, incident responders called in. By 13:58 the guidance was blunt: "Assume all environment variables have been decrypted. Disable/rotate all keys." By mid-afternoon customers were confirming their AI provider keys had been used, and by evening Northflank was telling everyone to review AI provider billing logs, noting the reports "may be consistent with the broader pattern of attacks targeting AI credentials." The shape matches the recent run of deployment-platform incidents: the platform is the entry point, and inference credentials are the prize because they convert directly into compute (more: https://status.northflank.com).

That makes srouter an awkward read on the same day. It is a self-hosted, OpenAI-compatible gateway that promises "Never hit rate limits again" by pooling around 60 free providers and 1,200 models behind one local endpoint, with a Thompson-sampling bandit picking upstreams and automatic failover. It has per-key rate ledgers, tiered fallback, prompt compression claimed at 20 to 40 percent, and an MCP server. Upstream keys sit AES-256-GCM encrypted in SQLite and agents see only one local bearer token. But the docs also say "There's no multi-tenant auth. Run this for yourself; don't expose it to the internet," and password reset codes print to the console. A database of dozens of provider keys on a developer laptop is exactly the artifact credential stealers are built to dump. The project's candor that "Intelligence degrades as the day progresses" as free caps exhaust is more useful than its tagline (more: https://github.com/baiibayu/srouter).

Refusals as Obfuscation, Papers as Output

A researcher at nullpt.rs built a Playwright crawler that hooks canvas and fingerprinting-adjacent browser APIs and across 10,000 sites found an obfuscated script whose function names reference ricin dosages for water supplies, ANFO blast overpressure, and CRISPR gene-drive propagation. None of it does anything. Invisible Unicode characters, decoded by subtracting 917504 from each code point, yield a fake "system override" prompt padded with Tiananmen Square references, "likely as a way to combat Chinese models." The behavioral test confirmed the purpose: one assistant refused to deobfuscate on biological-safety grounds, and GLM-5.3 "complied!" The payload is "your standard anti-bot script" collecting navigator.webdriver, hardwareConcurrency, and WebGL renderer strings. A urlscan pointed at a domain tied to servicepipe.ru, a Russian DDoS and bot-protection vendor (more: https://nullpt.rs/fingerprinting-bioweapons).

The finding travelled fast on Chinese-language X, where the summary added the sharpest line: the more strictly a model follows certain safety rules, the more easily this obfuscation disrupts it. The post notes there is no proof the developer intended this and no evidence it works against all models. Obfuscation used to target compilers, decompilers, and human patience; this variant targets a refusal classifier and costs nothing to add. A vendor statement, or a diff showing when the strings arrived, would settle intent (more: https://x.com/mylifcc/status/2116002400679113071).

The same week IEEE Spectrum published Benjamin Skuse's account of trying to get AI-generated papers past an IEEE journal. The framing numbers are grim: an estimated 57 percent of 2025 academic articles showed detectable LLM influence, up from 12 percent in 2023. Round one used free ChatGPT and Gemini 3 Flash. The managing editor flagged it quickly, but not on substance: "nothing seemed majorly scientifically" wrong, "it was just that so many hallucinated references immediately cast doubt on the entire work." Round two used FARS, a Singapore startup's Fully Automated Research System. It wrote a proposal in 21 minutes, ran an experiment overnight, and produced a submission-ready paper in two hours with no fake references. It was rejected for a reference list dominated by preprints and a figure label reading "lhewl." IEEE's ethics director said "building a detection tool today may not be effective with the AI-created paper of tomorrow." Ivan Oransky's line is the keeper: publish-or-perish is the kindling, paper mills the gasoline, AI the accelerant. Detection by artifact caught the first paper. The second failed only on taste (more: https://spectrum.ieee.org/ai-generated-scientific-papers).

Le Chonk Ships, and the Engine Room Gets Louder

Mistral released the weights of Mistral Large 4, the one-trillion-parameter mixture-of-experts it calls "Le Chonk," under a modified MIT license whose single condition is that model-as-a-service businesses buy a separate commercial license. The preview launch came with a CEO claim of beating Chinese models and no benchmarks; the release post has benchmarks, all vendor-run: 41 percent on Terminal-Bench 4.0 and 48 percent on the Artificial Analysis Coding Agent Index, "effectively tied with the leading open-weight model, GLM-5.3, while using 47% fewer tokens per task on average." The security disclosure is the unusual part. A 96.6 percent refusal rate on malicious cyber requests sits next to this: "Though we observed the model refusing to comply with black-box attacks against live targets, we see a potential for uplift to conduct real attacks." Pricing figures are missing from the captured post and the technical report is "coming soon," so independent receipts are still the thing to wait for (more: https://mistral.ai/news/mistral-large-4-oss). StepFun's Step-3.7-Flash GGUF is trending on Hugging Face as the week's other open-weight drop, though the listing carries no evaluation to weigh (more: https://huggingface.co/stepfun-ai/Step-3.7-Flash-GGUF).

The more consequential work is below the model layer. A community recipe runs DeepSeek-V4.1-Flash on four B200s using NVIDIA's decode megakernel plugin for SGLang, which fuses the whole decode step into one kernel per GPU. NVIDIA ships it for GB300 only; the port is "two lines: accept sm_100 with 148 SMs." Over a 12.5-hour production window it delivered 783 versus 536 tokens per second per user at one request, 462 versus 328 at two to eight, and a tie above nine concurrent streams. Then the caveat: "The megakernel hung our production twice," and the author's own instruction is "do not run this recipe in production" until a fix is confirmed (more: https://github.com/caiovicentino/deepseek-v4.1-flash-megakernel-4x-b200).

A LocalLLaMA poster rebuilt bpx03's QEngine for two RTX 5090s by changing one CMake architecture flag and measured 370 to 439 tokens per second decoding Qwen3.8-Flash-Next, rising to 504 on code with the KV cache in pinned host RAM, against 214 to 293 for Strata. The write-up is candid that this is near best case: QEngine's expert cache adapts to recent prompts and the benchmark repeats them, so the fair multiplier is 1.4 to 1.9 times Strata. The KV-in-RAM mode is the real finding, with idle long conversations returning warm instead of re-prefilling (more: https://old.reddit.com/r/LocalLLaMA/comments/1xjx0ez/qwen38flashnext_on_2x_rtx_5090_with_504_toks/).

OpenBonsai attacks the weights side. Prism ML never released its BF16-to-ternary pipeline, so nobody could compress their own fine-tunes. This Apache-2.0 framework combines Hadamard rotations, sequential GPTQ to ternary, calibration on self-generated reasoning traces, and scale distillation against the BF16 model. Qwen3.5-9B goes from 18 GB to a 1.997 GB GGUF in five hours on one 5090. The results are honestly below Prism's: GSM8K at 65 versus 77 for both the original and Bonsai 2, and HumanEval at 34 of 50, flagged as "likely optimistic" because some calibration prompts paraphrase HumanEval (more: https://old.reddit.com/r/LocalLLaMA/comments/1xie29o/i_opensourced_openbonsai_compress_your_own_bf16/).

Sovereign on the Landing Page, Hybrid on the Desk

webAI's manifesto reads like a political platform for local-first AI. "Your data is your crown jewel." Success is to be measured "not by user counts, clicks, or parameter counts, but by specialized models deployed." There is no customer, benchmark, hardware spec, or price in the document, so the claims are aspirations (more: https://www.webai.com/manifesto). The product page fills in the shape: shared "spaces," "Personas" built as domain experts from private data, and an "Intelligence Delivery Network" on which models "run, connect, and improve on hardware only you control." How that network respects access control is the first question a buyer should ask (more: https://www.webai.com/platform/webai-app).

A LocalLLaMA thread titled "Local is going to explode at enterprises" was built on a tweet, and the replies did the work. Someone deploying enterprise AI for a living says local is "very much not the norm," that most companies "lack the ML + IT rigor" to run self-hosted stacks, and that fewer than ten percent will go that route. The strongest counter-argument was a threat-model one: a cloud VM can be encrypted against its host, but an LLM API endpoint is "clear text in, clear text out," and whoever holds the serving logs can read, retain, and train on every query. That is the serious case for local (more: https://old.reddit.com/r/LocalLLaMA/comments/1xhvf1z/theory_local_is_going_to_explode_at_enterprises/).

Open WebUI remains the practical center of that case, and 0.12.5 landed four days after 0.12.4. The headline is a Sessions tab in Admin Analytics listing every chat's tokens, errors, and tool calls with timing. Knowledge-base commands run up to ten times faster, and an unreachable MCP server no longer kills the whole chat. The release "contains security fixes" that are not listed, with advisories to follow once CVEs are assigned (more: https://old.reddit.com/r/OpenWebUI/comments/1xifzrv/open_webui_0125_a_session_explorer_that_shows/).

The hybrid pattern, frontier model plans and local model types, got a cost table and a hostile reception. One poster built the same five-level platformer twice on an M5 Max: Opus 5.5 alone cost USD 2.52 and 16 minutes; Opus planning while three local Qwen 3.8 27B workers wrote code cost USD 0.62 and 42 minutes, cut Opus output eight-fold, and passed 24 of 25 checklist items instead of 25. The thread's verdict was "a resounding NO": the cheaper game looked visibly worse, and many suspected an advertisement for the harness. The useful suggestion was to rerun with Haiku 5.5 as the typist, which would test whether the saving comes from locality or just from a smaller model (more: https://old.reddit.com/r/ClaudeAI/comments/1xfgyl1/same_game_built_twice_opus_alone_vs_opus_planning/).

Memory That Pays for Its Tokens

IBM Research's ALTK-Evolve post makes a narrow claim. A stock τ²-bench ReAct agent on GPT-4.1, "an older, non-reasoning model," reaches 67.5 percent Pass^4 on the retail split, top of the leaderboard snapshot, "without updating model weights." The only change is a block of behavioral guidelines appended to the system prompt, distilled by the same model from its own successes and failures on training tasks. In retail the full set delivered the jump, Pass^4 57.5 to 67.5; in airline a 14-guideline core was more reliable, Pass^4 35 to 45. With a frontier model doing both extraction and acting, airline Pass^4 went 55 to 70. The cost is input tokens, not turns: retail's 292-guideline prompt raises per-conversation cost from about USD 0.084 to 0.139. The comparison that lands is against a system fine-tuned on synthetic retail data at 61.4 percent, which the post uses to argue that benchmark fine-tuning "is expensive, brittle, and doesn't transfer to the next domain" (more: https://huggingface.co/blog/ibm-research/altk-evolve-bc).

agent-memory, an editor's pick now at v0.0.12, takes the opposite bet for coding agents. It is "a portable, local-first Memory Bank" in which one repository owns one shared Markdown memory bank, tracked in Git. Retrieval is not vector search; the skill "navigates bounded topic maps through the CLI." MCP is "outside planned scope," and memory is treated as untrusted data, the right default for anything an agent writes and later reads. The stated mission is to take what worked in Cline's Memory Bank, small ordinary files and no service dependency, and add lifecycle discipline, because "the product is not 'save more chat and vector-search it.'" (more: https://github.com/robertelee78/agent-memory).

Imagining Before Acting, and Poisoning the Imagination

"Train An Imaginative Agent" makes one omni model do two jobs. BAGEL, 14 billion parameters with 7 billion active, serves as both policy and world model: it proposes an action, generates an image of the predicted result, feeds that image back as the next observation, and reasons over imagined frames before committing. Supervised traces teach linear rollouts, counterfactual branching, and forward comparison of whole plans; a second stage runs GRPO reinforcement learning on three-box Sokoban. Imagination beats an action-only model from the same backbone by 36 points on Pacman and 38 on Sokoban, and a model trained on two-box Sokoban reaches 40 percent on four-box puzzles versus 2 percent without it. After RL, success on hard sets rises to 50.3 percent for branching while imagined actions per episode fall. The ablations prove the images matter: blank or stale frames collapse performance, and oracle frames add 29 to 44 points in three of four environments. Inference cost is unmeasured and RL ran only on Sokoban (more: https://arxiv.org/abs/2610.26845v1).

TAPDreamer is the attack on exactly that loop. World action models predict visual futures and actions from the same encoder, and the authors observe that "current WAM pipelines implicitly trust the visual representation on which world prediction and action generation are built." The threat model is modest: white-box access to the public VAE encoder and six demonstration frames from one task, nothing else. A fixed patch covering 6.5 percent of the camera frame is optimized for 500 Adam steps to maximize the change in encoder output, then frozen and reused across tasks and models. On FastWAM, success drops from 97.65 percent to zero across all 40 LIBERO tasks and from 90.86 to zero across all 50 RoboTwin tasks. The frozen patch transfers to DreamWAM at around 1 percent success and Motus at 10.6 percent with no target feedback. Attention spreads the damage: change outside the patch footprint rises to 79 percent of the final latent. Everything is simulated, a patch does not transfer across positions, and the proposed defenses are untested. An imagination loop that trusts a shared encoder inherits that encoder's adversarial surface (more: https://arxiv.org/abs/2610.06814v1).

The Prospectus, the Spouse, and the Kill Chain

A video from James Lee's channel argues that Dario Amodei may be "compromised," and the useful way to read it is to sort what the record supports from what the speaker infers. Supported: Anthropic publicly filed an S-1 on October 26, 2026, and the claim that roughly 80 of its 261 pages address catastrophic risk against 48 describing the business matches independent reporting on the filing. Supported: Claude runs inside Palantir's Maven Smart System and was used in the US campaign against Iran, and a February strike on a girls' school killed more than 150 people. The clips are Amodei's own words: "we don't know exactly how these models were used" and "overall the use of these models is appropriate. I think it's good on net." Also supported, by a Wall Street Journal profile and follow-ups: Cami Clark, Amodei's wife, holds no formal Anthropic role but acts as a strategic adviser, and introduced early investor Eric Schmidt; a separate report says she pitched Jeffrey Epstein on a startup in 2012. The speaker's additions, that she is courting Ivanka Trump and Jared Kushner as investors and that Amodei is "a Trojan horse," are assertions. An unpaid adviser with investor relationships at a company this size raises a governance question, not a character one: whether that influence is disclosed to the shareholders about to price it. The S-1 is where that would be answered, and nothing in the video quotes it on the point (more: https://www.youtube.com/watch?v=YMEY3MmlUkg).