South Korean National Security Adviser Wi Sung-lac said on Oct. 30 that the government is “deliberating on ways to strengthen and expand the Cheonghae Unit” to protect merchant shipping and secure oil supplies through the Strait of Hormuz, adding that the operating area and any additional forces had not been decided (Daily Hankook). A senior presidential official said expanding the unit’s operating area to Oman and adding patrol aircraft are “within the scope of review,” but that “the review is not finished and the outcome is still open” (The Financial News). The government said it would stay out of any war or combat and limit itself to the minimum needed to protect Korean citizens and economic interests, noting that South Korea depends on the Middle East for 60–70% of its crude and that Britain, France and Japan have already sent warships and patrol aircraft to the region (The Financial News, Daily Hankook).

• Indicators to watch · A decision on the expansion, Cabinet approval and submission of the extension motion, whether the motion’s operating area names the Gulf of Oman, Iran’s reaction

• B2Gold and silver slide, stocks close lower; bitcoin flat into the weekendCollected quotes for Oct. 30: gold $3,898.90 (-3.29%), silver $49.28 (-5.93%), S&P 500 7,580.07 (-1.82%), Nasdaq 25,437.00 (-2.86%), VIX 19.42 (+12.91%) and the 10-year yield 4.929% (-6bp). Bitcoin stood at $77,274 (+0.09%) on Oct. 31. These figures alone do not establish a cause.

• C2Elliptic says Binance loot surfaced in wallets used in an earlier Bitget hackTechCrunch reported that Elliptic attributed the Binance theft to North Korean hackers after stolen funds appeared in wallets tied to a previous Bitget attack, and that TRM Labs named the TraderTraitor unit, which has also been blamed for the $1.4 billion Bybit heist in 2025 and a $351 million Bitget theft in 2026.

Intelligence gaps · unconfirmed

• Oil price conflict: CNBC said December Brent, which expired Oct. 30, settled at $117.64 (+2.4%) and January Brent at $113.43. The collected Brent quote of $113.43 (+2.37%) matches the January contract, not December. Only collected quotes are used in the body.
• Hormuz: Reuters could not immediately verify the IRGC’s four-tanker claim, and CBS dated it to Thursday while AsiaOne (Reuters) reported it as announced on Oct. 30. October attack counts also differ: more than 30 per UKMTO (The National) versus 35 citing Al Jazeera (Khaama Press). Iran’s claims to have downed and captured a U.S. drone and destroyed a U.S. unmanned vessel are unverified.
• Qatar mediation: CBS’s source cited “indications of progress” and an expected weekend reply, while a senior Iranian official told Reuters the ideas were unacceptable. An Al Jazeera live-blog headline on a warning by Foreign Minister Abbas Araghchi could not be checked against the body text and was not used.
• Riyadh drone (Oct. 31): the coalition spokesman did not name the launcher (AFP); the Houthi label comes from Middle East Eye. AFP said Houthi strikes had closed Riyadh’s airport for two weeks, but we could not confirm whether scheduled passenger service has resumed.
• Cheonghae unit: the wider operating area and extra patrol aircraft are still under review; no timetable or defined sea area for a National Assembly motion has been announced. Wi’s remark on December defense talks in Washington comes from a single outlet (Daily Hankook).
• Oleshky: no official final evacuee count was confirmed, and reported ceasefire start dates differ.
• Binance: CoinDesk put the withdrawal restart about 40 hours after the announcement, crypto.news about 34 hours. North Korea attributions so far come from private analytics firms, not the U.S. government.
• Not used (unverified): a reported Oct. 31 strike on a Kyiv energy facility and reports of a Kaliningrad blackout and explosions in Ufa (the Kyiv Independent said it could not verify them); LS Cable’s reported rare-earth magnet plant MOU in Gumi (KED Global and UPI not opened); TSMC’s reported look at rare-earth-free motors (single Korean outlet); North Korea’s statement that sanctions do not work (Reuters text not opened); a data breach at the South Texas Project plant operator (GovTech text not opened); a Florida education data breach (unvetted source).
• The Quad meeting and the close of the G20 meeting came after collection time. SBS reporting on Seoul’s and Tokyo’s handling of the Yellow Sea issue could not be opened.
• Grading notes: for “nk-ballistic-launch-oct13-31,” South Korea’s JCS announced that North Korea fired about 10 short-range ballistic missiles from the Wonsan area on Oct. 29 (Reuters, Al Jazeera). No new disclosure matching “kr-financial-hack-new-disclosure-oct31” and no U.S. strike on Iranian territory matching “us-strike-iran-territory-nov3” were found in this window.

Trump told Kansas City radio station KCMO that the Iran war is “going to get wrapped up soon” and that “we need a guarantee there’ll never be a nuclear weapon,” without saying how it would end (CBS via Yahoo News; Reuters via The Times of Israel). Qatari mediators returned to Tehran on Oct. 30 to convey edits to a draft peace proposal first presented the previous Sunday; CBS cited a source describing “indications of progress” and said Iran was expected to respond by the weekend, but a senior Iranian official told Reuters that Qatar had offered only “unacceptable” ideas and that Tehran’s nuclear position would not change. According to CBS, Tehran wants the U.S. first to lift its blockade of Iranian ports, drop sanctions on oil and gas sales and allow access to frozen assets. At sea, the IRGC Navy said on Oct. 30 that four tankers using what it called unauthorized routes caught fire and exploded, including one carrying more than 2 million barrels of crude that it said struck a mine; Reuters could not immediately verify the claims, while UKMTO said an outbound crude tanker was hit by an unknown projectile (AsiaOne/Reuters, CBS). The National reported that UKMTO logged more than 30 attacks on ships around Hormuz in October, more than double September and the most of any month since the war began on Feb. 28, for 145 incidents in total.

• Indicators to watch · Iran’s formal reply to the Qatari draft, new UKMTO alerts and damage confirmations, White House and Pentagon statements around the Nov. 3 midterms, whether U.S.-Iran talks convene in Doha or Istanbul

• B2G20 foreign ministers scrap the family photo and look set to end without a joint statementReuters reported that U.S. hosts canceled the traditional photo in Atlanta after European delegates refused to stand with Russian Foreign Minister Sergei Lavrov, with roughly a third of members including Australia and Canada objecting, and that the meeting is expected to close with a chair’s statement rather than a joint declaration. Britain’s foreign secretary told Lavrov, “Only yesterday your drones attacked and killed 15 people,” and Rubio urged members to coordinate on energy, food and trade disruptions (Reuters via Cyprus Mail).
• B2Oleshky evacuees reach the Belarus border, Russia says, as the local ceasefire nears its Sunday endCNN reported that Russia’s Defense Ministry confirmed on Oct. 31 that evacuees from occupied Oleshky had reached the Belarus border, and Ukrainian ombudsman Dmytro Lubinets said on Telegram that his delegation had set off with them. Twenty-five buses with 750 seats were used, and the truce, since widened across the Kherson region, is set to expire Sunday (CNN via KQ2).

• B2Seoul’s security adviser says allied defense chiefs meet in Washington in DecemberDaily Hankook reported that National Security Adviser Wi Sung-lac said South Korean and U.S. defense ministers will meet in Washington in December, that Seoul is demanding accountability for the North’s landmines while keeping its offer of military talks, and that it will maintain sanctions and export controls on Russia despite friction with Kyiv.
• B2Quad foreign ministers meet on the G20 sidelines in AtlantaThe Tribune reported that the foreign ministers of India, the U.S., Japan and Australia were set to meet on the G20 sidelines with maritime security, supply chains and technology on the agenda, and that India’s Jaishankar lined up bilaterals including with South Korea. Results were not available at collection time.

Watchlist next 12–48 hours and beyond

• Sat, Oct 31
  Outcome of the Quad foreign ministers’ meeting in Atlanta and whether the G20 meeting ends with a chair’s statement
• This weekend
  Iran’s reply to the Qatari draft (CBS said it was expected by the weekend) and any new UKMTO alerts
• Sun, Nov 1
  Whether Binance restarts withdrawals; expiry of the Oleshky local ceasefire and any extension
• Mon, Nov 2
  Binance’s full proof-of-reserves report; Asian markets reopen Sunday evening ET
• Tue, Nov 3
  Midterm elections, and any White House or Pentagon moves on Iran around them
• Through November
  Seoul’s decision on widening the Cheonghae unit’s mission and whether an extension motion goes to the National Assembly

Edition archiveRSS

• Saturday, Oct 31 · Morning Edition · 05:42 ET · CurrentAttacks on ships around Hormuz hit a wartime monthly high as Trump says the Iran war will be “wrapped up soon,” Binance finds more entry points behind its $6.3 billion theft, and Seoul weighs stretching its Cheonghae naval unit toward Oman
• Friday, Oct 30 · Evening Edition · 17:44 ETTankers keep getting hit around the Strait of Hormuz as Qatari mediators carry a U.S. letter into Tehran, a tech rout hands the S&P 500 its worst day since June, and the Secret Service joins the hunt for Binance's stolen $6.3 billion
• Friday, Oct 30 · Morning Edition · 05:40 ETA small boat attached explosives to a tanker in the Strait of Hormuz, Binance was hit by a roughly $6.3 billion hack that blockchain analysts tie to North Korea, and AI-spending worries sent South Korea's KOSPI down 3.48%
• Thursday, Oct 29 · Evening Edition · 17:46 ETIran's Revolutionary Guards say three tankers hit mines on Hormuz's southern route and Houthi missiles are downed over Riyadh, as a Russian drone kills at least 14 at a Dnipro rail station and Florida discloses a student-aid breach that may affect 4.9 million people
• Thursday, Oct 29 · Morning Edition · 05:42 ETNorth Korea fires about 10 short-range ballistic missiles six days after Seoul offered military talks, as DHS says it is working to contain a leak of 40,000-plus employee records and Trump says Vance's Iran outreach was about medical aid, not peace talks
• Wednesday, Oct 28 · Evening Edition · 17:40 ETIran dismisses Qatar's draft deal as 'unacceptable ideas' amid reports that U.S. and Israeli officials expect a week of strikes after the midterms if talks fail, while a leak exposes more than 40,000 DHS employees and the Fed holds with two votes for a hike
• Wednesday, Oct 28 · Morning Edition · 05:36 ETThe U.S. has reportedly told Gulf allies to brace for a short, intense Iran campaign after the Nov 3 midterms as oil rebounds, while three South Korean financial firms, including crypto exchange Bithumb, disclose hacks
• Tuesday, Oct 27 · Evening Edition · 17:39 ETA cyberattack forces ambulance diversions at New Mexico's only Level 1 trauma center, the Houthis claim a missile hit on Saudi Arabia's largest refinery, and Iran threatens 'legal action' against every ship run by Sinokor, the biggest crude carrier through Hormuz
• Tuesday, Oct 27 · Morning Edition · 05:44 ETA local truce takes hold in occupied Oleshky even as Russian missiles hit Kyiv's Southern Bridge and a student dorm, the Houthis fire ballistic missiles at Saudi Arabia's Eastern Province hours after the Tehran talks, and CISA confirms PHP2Shell is under attack
• Monday, Oct 26 · Evening Edition · 17:45 ETIran and three Mecca pact powers agree to keep talking after a first four-way meeting in Tehran and oil eases, but the Saudi-led coalition widens strikes on Houthi missile sites and North Korea parks self-propelled guns in plain view of the South
• Monday, Oct 26 · Morning Edition · 05:47 ETMediators converge on Tehran and oil eases, but a Houthi missile again targets Riyadh and South Korea reports its first hacking-related customer data leak at an insurer
• Sunday, Oct 25 · Evening Edition · 17:44 ETTrump says it's decision time on Iran, 'finish it off' or make a deal, but rules out a strike Sunday, as the Houthis claim a ballistic-missile barrage on Riyadh's newly reopened airport and CENTCOM's commander says Hormuz shipping lanes are clear of mines
• Sunday, Oct 25 · Morning Edition · 05:50 ETTrump says a U.S. strike on Iran could come 'maybe tomorrow' while floating a 'big, beautiful agreement,' as Houthi missiles and drones fly at Riyadh and Khamis Mushait and Musk says SpaceX throttled Ukraine over 'offensive' Starlink use
• Saturday, Oct 24 · Evening Edition · 17:43 ETA U.S. intelligence memo warns Iranian plots against Americans abroad have reached 'advanced stages' as the State Department thins out Gulf embassies, Houthi ballistic missiles fly at Riyadh, Taif and Yanbu, and Ukraine says its Starlink speed caps are gone

Binance co-CEO Richard Teng said on Oct. 30 that the attack was “complex” and involved multiple breach points beyond the employee laptop first suspected, and that the attackers abused Ethereum’s EIP-7702 account-delegation feature to take control of a hot wallet without going through normal approvals, then used a self-destruct mechanism to erase evidence (CoinDesk). Binance said it “will absorb the financial impact of these stolen funds, not our users,” and has reserved more than $6.34 billion, including $5 billion already held in the same tokens that were taken, with the rest being bought on exchanges and over the counter (CoinDesk, crypto.news). About $3 billion remains frozen on-chain through work with law enforcement, blockchain analytics firms and token issuers; withdrawals are to reopen in phases once security checks are complete, with Sunday as the target, and full proof-of-reserves results are due Monday, Nov. 2 (crypto.news, CoinDesk). TRM Labs attributed the theft to North Korea’s TraderTraitor unit and Elliptic also blamed North Korean hackers (TechCrunch), but no official U.S. government attribution had been announced as of collection time.

• Indicators to watch · Whether withdrawals reopen on Nov. 1, the Nov. 2 proof-of-reserves report, any FBI or Treasury attribution, further recovery of frozen funds

Secretary of State Marco Rubio, South Korean Foreign Minister Cho Hyun and Japanese Foreign Minister Toshimitsu Motegi met in Atlanta on Oct. 30 on the sidelines of the G20 foreign ministers’ meeting and reaffirmed their “resolute commitment” to North Korea’s complete denuclearization and full implementation of U.N. Security Council resolutions, stressing enforcement of sanctions on revenue sources for the North’s nuclear and ballistic missile programs and commending the Multilateral Sanctions Monitoring Team (Yonhap via The Korea Times; Korea JoongAng Daily). The three called on Pyongyang to join efforts to ease tensions and build lasting peace, and signed a memorandum establishing a Trilateral Arctic Pacific Partnership to explore maritime and economic cooperation in the Pacific Arctic. Rubio raised concerns about Chinese activity in the South China Sea, East China Sea and Yellow Sea and about Russia-China cooperation, and the ministers stressed peace and stability across the Taiwan Strait and agreed to deepen cooperation on critical mineral supply chains, small modular reactors and AI (Korea JoongAng Daily). A day earlier, on Oct. 29, North Korea fired about 10 short-range ballistic missiles from the Wonsan area into the sea off its east coast, according to South Korea’s Joint Chiefs of Staff (Reuters, Al Jazeera); Pyongyang has rejected a joint South Korea-U.N. finding that it planted the mines behind a Sept. 21 DMZ blast, and Seoul has proposed military talks (Al Jazeera).

• Indicators to watch · North Korean state media reaction to the trilateral meeting and the talks offer, further ballistic launches, any Chinese response on the Yellow Sea, the outcome of the Quad foreign ministers’ meeting

• B2U.S. enforces the blockade of Iranian ports with more than 10,000 personnel, 12 destroyers and two carriersThe National said the U.S. has more than 10,000 personnel in the region enforcing the naval blockade of Iranian ports, backed by 12 destroyers, two aircraft carriers and stepped-up air operations. Tehran is demanding that the blockade and oil and gas sanctions be lifted first (CBS).

U.S. Impact Assessment

• Energy and shippingOctober brought the most attacks on ships around Hormuz since the war began, and the IRGC is singling out tankers on routes it hasn’t approved. U.S. refiners, traders and operators with Gulf exposure should recheck routing rules, war-risk cover and procedures for hull-attached explosives. The EIA’s Brent spot price stood at $123.10 as of Oct. 27, down 3.92% from the prior print, and does not yet reflect moves after Oct. 28.
• Crypto and software supply chainBinance describes several entry points and abuse of Ethereum’s EIP-7702 delegation feature, and CISA has confirmed in-the-wild exploitation of a max-severity GitLab flaw with a federal deadline this Sunday. U.S. exchanges, fintechs and contractors running self-managed GitLab should confirm patch status, tighten developer endpoint controls and look for any path that lets a hot wallet move funds outside normal approvals.
• Indo-Pacific alliancesThe new Trilateral Arctic Pacific Partnership and Rubio’s raising of Chinese activity in the Yellow Sea add a maritime track to U.S.-Japan-South Korea cooperation, and Seoul’s review of a wider Cheonghae mission would put another ally’s ships closer to Hormuz. Companies with Korean and Japanese partners in shipping, energy and critical minerals should watch for follow-on programs and any response from Beijing.
• Rates and the yenThe Bank of Japan’s first finding that underlying inflation has reached 2% puts a December hike in play, which matters for yen-funded positions and cross-border borrowing costs. Treasury’s daily par yield curve put the 10-year at 4.94% on Oct. 30, down 4 basis points from the prior print.

Sources 22

• Y
  Yahoo News (CBS News)Trump predicts Iran war will end soon as Qatar pushes for a deal
  B
• T
  The Times of Israel (Reuters)Qatari mediators return to Tehran to push for US-Iran peace deal, official says
  B
• A
  AsiaOne (Reuters)Iran's IRGC Navy says 4 tankers catch fire in Strait of Hormuz
  B
• T
  The NationalAttacks on ships transiting Hormuz in October highest since start of war
  B
• C
  CBS NewsTankers strike mines in Strait of Hormuz, Iran says, as Hegseth fires top general
  B
• T
  The Financial News (Korea)Presidential office reviews expanding Cheonghae unit's operating area and adding patrol aircraft, under a no-combat principle (title translated)
  B
• D
  Daily HankookPresidential office weighs expanding Cheonghae unit to secure Hormuz oil route, rules out war involvement (title translated)
  B
• T
  The Korea Times (Yonhap)S. Korean, US, Japanese FMs reaffirm 'resolute commitment' to complete denuclearization of NK
  B
• K
  Korea JoongAng DailySeoul, Washington and Tokyo reaffirm North Korea denuclearization stance
  B
• S
  Seoul Economic DailyBank of Japan Holds Rate at 1.25% as Underlying Inflation Meets 2% Goal
  B
• C
  CoinDeskBinance uncovers wider breach in $6.3 billion exploit, targets Sunday withdrawal restart
  C
• c
  crypto.newsBinance reserves $6.34B after hack, targets phased withdrawals
  C
• T
  TechCrunchNorth Korean hackers blamed for stealing record $6.3B in Binance breach
  C
• C
  CNBCOil jumps 2%, settles at 6-month highs on fears of escalation in Iran
  B
• F
  Free Malaysia Today (AFP)Saudi says intercepted 'hostile drone' in Riyadh region
  B
• M
  Middle East EyeSaudi-led coalition forces intercept Houthi drone over Riyadh region
  C
• C
  Cyprus Mail (Reuters)No family photo, little harmony as G20 divisions deepen
  B
• T
  The Tribune (India)Jaishankar's Atlanta diplomacy: Quad meeting and several bilaterals on G20 sidelines
  B
• K
  KQ2 (CNN)Hundreds evacuate Ukrainian city of Oleshky under Melania Trump-brokered ceasefire
  B
• B
  BleepingComputerCISA says max severity GitLab flaw now exploited in the wild
  C
• Y
  Yahoo News (Reuters)North Korea fires around 10 ballistic missiles toward sea off east coast, Seoul says
  B
• A
  Al JazeeraNorth Korea fires missiles as row over landmine blast intensifies
  B