This week we trace Binance's $6.3 billion hack to a single fake job interview and an unvetted AI coding tool, with ZachXBT already naming a French bank as collateral damage. For operators in crypto, iGaming and payments, the line between a hiring process and a custody control has never been thinner.
Spain's new Royal Decree 813/2026 quietly rewrote AML rules for gambling operators: since October 28, 2026, a verified player account no longer clears a withdrawal. Operators must now match every card, bank account or e-wallet used for deposits and withdrawals to the gaming account holder. Existing players get six months to fix mismatches, during which they can deposit but not cash out, and unmatched accounts face closure after that window. Inglorious breaks down what the decree actually requires and where the support-desk fallout will land first.
Binance hot wallets bled somewhere between $2.8 and $5 billion in under an hour on Thursday, by varying on-chain counts, in what may be the largest crypto theft on record. Binance has confirmed nothing. This piece reconstructs the on-chain sequence, the EIP-7702 delegation mechanism used to drain the wallets, and the three contradictory statements Binance issued in 13 minutes, then narrows to what matters for European operators: exposure and liability, not the final headline number.
Onchain investigator ZachXBT has named French banking group Crédit Mutuel Arkéa, which he says holds $235 billion in assets, as the alleged victim of a crypto theft now estimated above $133 million. He first flagged $106 million in suspicious exchange withdrawals on Monday, raised the figure to $133 million on Tuesday after finding another $27 million, and now warns OTC activity not yet counted could push losses higher. Bitquery traced roughly $63 million in stablecoins converted into Ether within four hours across Kraken, Crypto.com and OKX accounts; Kraken and Crypto.com say they have restricted or blocked the related funds.
The bank has not confirmed its involvement, and ZachXBT has not said how attackers got access. The number keeps climbing with each day someone doesn't ask for comment.
Why It Matters
If your exchange relies on post-withdrawal freezes rather than pre-withdrawal velocity checks, attackers get a multi-hour window to convert stablecoins into volatile assets before any account gets flagged.
Block has agreed in principle to a $764 million DOJ settlement resolving a federal anti-money-laundering investigation, the company disclosed alongside quarterly results. In the same period, bitcoin gross profit from Cash App trading fell 50% after the company cut trading fees.
Two separate hits landing in one earnings call: a nine-figure AML settlement and a halved revenue line from the product the investigation likely centers on.
Why It Matters
If your platform runs both a payments app and a crypto on-ramp under one AML program, regulators will treat weaknesses in one as evidence against the whole stack, not just the crypto side.
South Korea's ruling party has formally proposed delaying the country's crypto income tax, with the party leader arguing the Digital Asset Basic Act, a comprehensive legal framework for crypto, needs to pass first.
Sequencing over cancellation. The tax isn't dead, it's waiting on legislation that doesn't exist yet.
ZachXBT says attackers exploited French bank Crédit Mutuel Arkéa for more than $133 million. He states a "high degree of confidence" that the perpetrator is not North Korea's Lazarus Group.
The number is the headline. The attribution is the subplot, because it rules out the usual state-actor narrative investigators default to.
Why It Matters
If your compliance team's threat model assumes large-scale bank exploits trace back to state actors like Lazarus, this case argues for widening the suspect pool before filing a SAR.
Gambling Commission research found that UK punters who repeatedly use unlicensed operators also continue to use licensed ones in parallel, rather than migrating away from the regulated market entirely. The finding undercuts the standard industry argument that tighter affordability and deposit rules simply push players to the black market.
The data complicates a talking point operators have leaned on for years. If the two markets overlap rather than substitute, the Commission has less reason to treat channelisation as the trump card against new restrictions.
Why It Matters
If your lobbying against affordability checks rests on a straight migration-to-black-market argument, this research gives the Commission grounds to discount that argument in future consultations.
The Malta Gaming Authority confirmed on October 29, 2026 that it is scaling back its proposed Recognition Notice disclosure requirements after industry pushback. Instead of five years of regulatory correspondence, full corporate ownership structures and exact financial data, operators will now only need to submit ultimate beneficial ownership details and material licensing or fitness issues, with deposit volumes reported in ranges rather than precise figures. The MGA also scrapped plans for a standardized legal opinion template and will treat B2B suppliers differently from B2C operators.
The climbdown doesn't erase the underlying problem: Malta rated Recognition Notice money laundering risk medium-high in its 2023 National Risk Assessment, versus medium for regular gambling licences, after identifying 111 Malta-incorporated Recognition Notice holders in 2021, 46 of them B2C. Monitoring still starts this year, covering 2025 data, rolled out to B2C operators first and staggered across holders rather than applied all at once.
Why It Matters
If your operation runs under a Malta Recognition Notice, lighter disclosure cuts your compliance workload now but the medium-high AML risk rating means reporting obligations will tighten again once the staggered monitoring exercise identifies gaps.
ASIC chair Sarah Court said last Friday that the regulator is not convinced prediction markets belong under financial services law rather than betting rules, stating the products have "all the features of a bet." The blog post signals ASIC will keep treating prediction market contracts as gambling products rather than licensing them as derivatives or financial instruments.
No new licensing path, no carve-out. Operators banking on a financial-markets classification in Australia just got told to stop waiting.
Why It Matters
If your prediction market platform is structured to access financial services licensing rather than gambling licensing, Australia just closed that route and operators eyeing similar dual-classification arguments in Europe lose a precedent they could have cited.
Binance says the $6.3 billion cyberattack it suffered last week was a multi-stage campaign built on fake job interviews, malicious software downloads disguised as technical tests, and compromised AI tooling used by engineers.
The vector was not a smart contract bug or a cold wallet slip. It was recruitment process turned into a delivery mechanism for malware.
Why It Matters
If your exchange or crypto firm runs technical interviews through downloadable take-home exercises or unvetted AI coding assistants, those workflows are now a documented path to a nine-figure breach.
Binance lost about $6.36 billion across ten blockchains on 29 October after an engineer's compromised laptop gave an attacker access to a service container used to submit withdrawal transactions. TRM Labs and Chainalysis link the attack to North Korea. Tether and Circle froze roughly $3 billion of the stolen funds, and Binance suspended deposits and withdrawals for about 45 hours before replenishing roughly 95 percent of affected assets by 1 November. When withdrawals reopened, customers pulled $4.65 billion against $1.01 billion in deposits within nine and a half hours, a net outflow of $3.64 billion.
No private key leaked.
Why It Matters
If your exchange or custodian treats endpoint security as an IT ticket rather than a custody control, then a single compromised laptop can authorize withdrawals that look valid to every downstream system, leaving transaction monitoring no window to intervene.
The FCA has finalised a new regulatory regime for ESG rating providers operating in the UK, requiring firms to meet standards on transparency, governance and conflicts of interest. The rules bring ESG raters under direct FCA supervision for the first time.
No more unregulated black-box scoring. If a provider wants its ratings used by UK investors, it now needs FCA authorisation to keep selling them.
Why It Matters
If your fintech sources ESG data to build investor-facing products, you now need to confirm your rating provider holds FCA authorisation or risk relying on a dataset that could lose market access.