Malaysia Airlines said Nov. 1 that some customer information processed through Amadeus, its reservation-system provider, between August 2023 and September 2026 may have been exposed, that its own IT systems were not compromised, and that there is no evidence financial data was accessed; it urged customers to watch for suspicious messages (The Business Standard (Reuters), Malay Mail). Reuters reported that Amadeus has acknowledged “a vulnerability affecting a travel booking display environment” but has not said how many customers were affected, and that Cathay Pacific and Japan Airlines have put their exposure at 53,000 bookings and 92,000 customers, respectively. Korean Air and Asiana said Oct. 23 that someone used login credentials issued for an Amadeus system account to access booking data, exposing booking reference numbers but not payment details; neither airline has disclosed how many customers were affected (Seoul Economic Daily).

• Indicators to watch · Amadeus statements or regulatory filings, additional airline notices including U.S. carriers, regulator inquiries in Korea and Japan, phishing that uses booking references

• B1South Korea’s October exports hit a record $115.3 billion, up 93.7%, as chip shipments more than tripleSeoul’s trade ministry said chip exports reached $56.4 billion (+259%), roughly half the total; shipments to the U.S. rose 185.8% to $24.9 billion and to China 133.6% to $26.98 billion, and the trade surplus was $42.5 billion. The ministry credited AI-infrastructure spending by big tech companies.
• C2KOSPI fell 16.2% in October on AI-spending payback worriesDigital Today reported that the KOSPI lost 16.2% and the KOSDAQ 15.4% in October, with the KOSPI closing Oct. 30 at 5,730.74 (-3.48%), and flagged the Nov. 3 midterms and the Nov. 6 U.S. jobs report as the next markers.
• A1Treasury 10-year at 4.94% and USD/KRW at 1,334.30 (official prints for Oct. 30)The Treasury’s daily par yield curve put the 10-year at 4.94% on Oct. 30, down 4bp vs the previous print (10/29), and the Bank of Korea’s ECOS put the Seoul close at 1,334.30 won per dollar, down 0.19%.

• B2FBI asks the crypto industry to block TraderTraitor laundering addressesThe FBI said it expects the stolen funds to move through DeFi and instant-swap services and asked node operators, instant exchanges and analytics firms to block related transactions. Binance co-CEO Richard Teng described a “complex attack” involving a compromised laptop and malware designed to delete evidence, NBC reported.

Intelligence gaps · unconfirmed

• Binance coverage: NBC and ABC Australia say 90% of stolen assets have been replaced; The National says 95%. The number of tokens in phase one (15, per a Bloomberg search summary) and the exact start time could not be confirmed from the original articles.
• The FBI’s original alert on fbi.gov could not be opened; its contents are confirmed through NBC, ABC Australia and Yonhap. We could confirm only that it was issued on Saturday, Oct. 31.
• North Korea test: the 12–13 hectare figure and the four categories are North Korean claims. Who oversaw the test (a name appeared only in a search summary) and Korean reports of mock South Korean military facilities as targets could not be verified and were not used; the Hwasong-11 identification is an analyst’s assessment.
• Trump’s “10 minutes” and “Pickaxe Mountain” remarks are confirmed only through a Gulf News live page; the full quote was not available. The content of Iran’s “seven conditions” was not confirmed.
• Al Mayeda: AFP says the attack happened “Friday evening,” which would be Oct. 30, but the exact time and location were not confirmed and do not match a Gulf News live-page timestamp. The RITI rescue was confirmed only as taking place on “Friday.”
• Kstovo: the governor did not name the facility; the refinery identification comes from Ukrainian Telegram channels. Drone counts differ in scope (more than 100 in the region per the governor; 235 nationwide per Russia’s Defense Ministry). Ukraine has not confirmed the strike. Euronews did not give a date for the Russian strikes that cut power to about 280,000 households, and its line that Ukraine had paused refinery strikes under U.S. pressure was not independently confirmed and was not used.
• Amadeus: it is unclear whether the credential misuse described by Korean Air and Asiana and the “booking display environment” vulnerability Amadeus acknowledged are the same incident. Korean carriers have not disclosed affected numbers.
• Not used: reports of a 20th South Korean tanker routing crude via the Red Sea (only Google News links, originals could not be opened); a single-source KBS report that U.S.-China-Russia summit talks include the Korean Peninsula; BBC items on India’s opposition rally and the DR Congo Ebola outbreak (originals could not be opened).
• Oil prices: the board’s Brent and WTI are EIA spot prices as of Oct. 27, while the $113.43 Brent quote is a futures price, so the two were not compared. USD/KRW differs between the quote tile (1,335.10, Yahoo Finance) and the board (1,334.30, BOK 3:30 p.m. close) because they are taken at different times.
• Grading note: on ‘us-gov-binance-hack-nk-attribution-nov20’, the FBI officially attributed the Binance theft to North Korea’s TraderTraitor on Oct. 31 ET (NBC News, ABC Australia, The National). No U.S. announcement of a strike on Iranian territory (‘us-strike-iran-territory-nov3’) and no announced extension of the Oleshky ceasefire (‘oleshky-ceasefire-extended-nov4’) appeared during this window.

Asked at a Halloween event at Mar-a-Lago on Oct. 31 about a timeline for the Qatari-mediated talks, Trump said Washington is “not in that much of a hurry” because the U.S. has knocked out Iran’s navy, air force and anti-aircraft systems, adding, “They wanna make a deal … But they are not very reliable” (Washington Examiner, Al Jazeera). Gulf News reported that Trump also said remaining targets could be dealt with “in 10 minutes” and mentioned “Pickaxe Mountain.” On Sunday, Iran’s Foreign Ministry, citing a Supreme National Security Council resolution, designated the Royal Navy and Royal Air Force terrorist organizations and MI6 a hostile group, pointing to Britain’s July 13 move against the IRGC under its State Threats Act and to British bases and facilities used in the U.S.-Israeli war (Middle East Eye, citing Mehr; TASS). IRGC deputy for political affairs Yadollah Javani warned that any area enemy forces enter would become a “killing ground” and that Iran could deliver “heavy, devastating strikes” on U.S. warships (Sunday Guardian, citing Fars; Al Jazeera), and Mohsen Rezaei said diplomacy would open if Iran’s “seven conditions” are met (Gulf News). Foreign Minister Abbas Araghchi said talks with Qatari mediators continue on a plan to reopen Hormuz within two days if the U.S. cooperates (Al Jazeera).

• Indicators to watch · White House and Pentagon decisions around the Nov. 3 midterms, the text of Iran’s “seven conditions” and the outcome of the Qatari mediation, London’s response to the designations, UKMTO reports of new ship attacks

Nizhny Novgorod Gov. Gleb Nikitin said a “massive” drone attack overnight into Nov. 1 caused significant damage at an industrial facility in the Kstovo district, that more than 100 drones were destroyed and that there were no casualties, and he warned of temporary power cuts and reduced heating supply (Euronews, Ukrinform). Russia’s Defense Ministry said air defenses downed 235 drones nationwide overnight (Ukrinform). Ukrainian Telegram monitoring channels identified the target as Lukoil’s NORSI refinery, among Russia’s largest, which processes roughly 15 million to 17 million metric tons of crude a year and makes diesel and jet fuel; the Kyiv Independent said it could not immediately verify those reports. Euronews also reported that President Volodymyr Zelenskyy said Russian strikes on a combined heat and power plant in Kyiv and four substations in the Dnipro region left about 280,000 households without power.

• Indicators to watch · Russian statements on NORSI output, Ukrainian General Staff claims, Russian fuel-export measures, further strikes on Ukraine’s grid as temperatures drop, U.S. statements on energy-strike restraint

• B2Qatari LNG carrier Al Mayeda hit by “unidentified objects” in the Gulf; no injuriesAFP, citing Qatar’s state news agency, reported that the Nakilat-owned LNG carrier Al Mayeda was struck Friday evening while sailing in the Gulf, with no crew injuries or environmental impact and the ship in a “safe condition.” No one has been named as responsible.

U.S. Impact Assessment

• Crypto compliance after the FBI attributionWith the FBI naming TraderTraitor and expecting the funds to move through DeFi and instant-swap services, U.S. exchanges, DeFi front ends, node operators and custodians are now on notice to screen for the flagged addresses. Compliance teams should check exposure to those addresses, watch for large ether inflows, and brace for phishing that impersonates Binance during the withdrawal restart.
• Travel data exposure for corporate travelersDisclosures from five Asian carriers tied to Amadeus mean booking records for U.S. employees flying those airlines since August 2023 may be exposed. Travel managers should warn staff about airline-impersonation emails and texts that cite real booking references and ask travel-management companies to confirm their exposure.
• Gulf shipping and force protectionIran’s terrorist designation of Britain’s navy and air force and an IRGC deputy’s threat against U.S. warships add to the risk picture in the Gulf, where a Qatari LNG carrier and a crude tanker were struck this week. Operators with crews, cargoes or contractors in the region should review routing, war-risk cover and evacuation plans ahead of the Nov. 3 midterms.
• Defense posture on the Korean PeninsulaNorth Korea’s plan to field four cluster-warhead types by year-end adds an area-attack option to its tactical missile force facing U.S. and South Korean bases. Defense contractors and firms with staff near military installations in South Korea should not rely on JCS launch announcements alone, since this test surfaced only through North Korean media.

Edition archiveRSS

• Sunday, Nov 1 · Morning Edition · 04:37 ET · CurrentThe FBI formally pins the record $6.3 billion Binance theft on North Korea as Pyongyang touts a cluster warhead for its tactical ballistic missiles, while Iran brands Britain’s navy and air force terrorist groups and Trump says he’s “not in that much of a hurry” on a deal
• Saturday, Oct 31 · Evening Edition · 17:42 ETIran floats a conditional two-day reopening of Hormuz even as its supreme leader orders a response “without geographic limits,” Rubio says Trump hasn’t decided on new strikes, and the G20 foreign ministers wrap up without a joint statement
• Saturday, Oct 31 · Morning Edition · 05:42 ETAttacks on ships around Hormuz hit a wartime monthly high as Trump says the Iran war will be “wrapped up soon,” Binance finds more entry points behind its $6.3 billion theft, and Seoul weighs stretching its Cheonghae naval unit toward Oman
• Friday, Oct 30 · Evening Edition · 17:44 ETTankers keep getting hit around the Strait of Hormuz as Qatari mediators carry a U.S. letter into Tehran, a tech rout hands the S&P 500 its worst day since June, and the Secret Service joins the hunt for Binance's stolen $6.3 billion
• Friday, Oct 30 · Morning Edition · 05:40 ETA small boat attached explosives to a tanker in the Strait of Hormuz, Binance was hit by a roughly $6.3 billion hack that blockchain analysts tie to North Korea, and AI-spending worries sent South Korea's KOSPI down 3.48%
• Thursday, Oct 29 · Evening Edition · 17:46 ETIran's Revolutionary Guards say three tankers hit mines on Hormuz's southern route and Houthi missiles are downed over Riyadh, as a Russian drone kills at least 14 at a Dnipro rail station and Florida discloses a student-aid breach that may affect 4.9 million people
• Thursday, Oct 29 · Morning Edition · 05:42 ETNorth Korea fires about 10 short-range ballistic missiles six days after Seoul offered military talks, as DHS says it is working to contain a leak of 40,000-plus employee records and Trump says Vance's Iran outreach was about medical aid, not peace talks
• Wednesday, Oct 28 · Evening Edition · 17:40 ETIran dismisses Qatar's draft deal as 'unacceptable ideas' amid reports that U.S. and Israeli officials expect a week of strikes after the midterms if talks fail, while a leak exposes more than 40,000 DHS employees and the Fed holds with two votes for a hike
• Wednesday, Oct 28 · Morning Edition · 05:36 ETThe U.S. has reportedly told Gulf allies to brace for a short, intense Iran campaign after the Nov 3 midterms as oil rebounds, while three South Korean financial firms, including crypto exchange Bithumb, disclose hacks
• Tuesday, Oct 27 · Evening Edition · 17:39 ETA cyberattack forces ambulance diversions at New Mexico's only Level 1 trauma center, the Houthis claim a missile hit on Saudi Arabia's largest refinery, and Iran threatens 'legal action' against every ship run by Sinokor, the biggest crude carrier through Hormuz
• Tuesday, Oct 27 · Morning Edition · 05:44 ETA local truce takes hold in occupied Oleshky even as Russian missiles hit Kyiv's Southern Bridge and a student dorm, the Houthis fire ballistic missiles at Saudi Arabia's Eastern Province hours after the Tehran talks, and CISA confirms PHP2Shell is under attack
• Monday, Oct 26 · Evening Edition · 17:45 ETIran and three Mecca pact powers agree to keep talking after a first four-way meeting in Tehran and oil eases, but the Saudi-led coalition widens strikes on Houthi missile sites and North Korea parks self-propelled guns in plain view of the South
• Monday, Oct 26 · Morning Edition · 05:47 ETMediators converge on Tehran and oil eases, but a Houthi missile again targets Riyadh and South Korea reports its first hacking-related customer data leak at an insurer
• Sunday, Oct 25 · Evening Edition · 17:44 ETTrump says it's decision time on Iran, 'finish it off' or make a deal, but rules out a strike Sunday, as the Houthis claim a ballistic-missile barrage on Riyadh's newly reopened airport and CENTCOM's commander says Hormuz shipping lanes are clear of mines

The FBI said Saturday, Oct. 31, that the North Korean state-sponsored unit it calls TraderTraitor was responsible for the Binance theft, that the group has been converting the stolen assets mostly into ether, and that it expects further laundering through DeFi and instant-swap services (NBC News, ABC Australia). The bureau urged node operators, instant exchanges, DeFi services, blockchain-analytics firms and other virtual-asset providers to block transactions tied to addresses the group is using (ABC Australia). Yonhap reported that the theft took place on or about Oct. 29 and that the FBI, the Secret Service and IRS Criminal Investigation were involved in the case. Binance resumed withdrawals in phases on Sunday, starting with the bitcoin network; NBC and ABC put the share of stolen assets it has replaced at 90%, while The National reported 95%. Asked about the hack at Mar-a-Lago, Trump said: “I’m not concerned. We’re learning about it. We don’t know if it’s North Korea, but if it is, we’ll talk to North Korea about it,” and Yonhap noted that no meeting with Kim Jong Un is scheduled (The Korea Times (Yonhap), SBS).

• Indicators to watch · Treasury sanctions tied to the laundering network, further FBI address releases, Binance’s phase-two withdrawals and full-coverage notice, any North Korean state-media response, White House statements on outreach to Pyongyang

KCNA reported Nov. 1 that research institutes under North Korea’s Missile Administration tested a cluster warhead for tactical ballistic missiles on Oct. 31 to assess its combat use and destructive power (The Korea Times (Yonhap), NK News). The agency claimed the warhead can “turn into ashes” a target area of 12 to 13 hectares at its highest density, said cluster warheads come in four categories, and said units will be able to use all of them, depending on operational aims and targets, by the end of the year; the performance claims have not been independently verified. Yonhap reported that the missile was fired from the northwestern county of Chongju toward the Yellow Sea and that South Korea’s Joint Chiefs of Staff tracked preparations and kept a combined readiness posture with U.S. forces but did not announce the launch at the time, so the test became public through KCNA the next day. A South Korean analyst identified the missile as a Hwasong-11 variant (Yonhap).

• Indicators to watch · North Korean state-media reports of further tests or deliveries to units, whether and how the JCS announces launches, launches toward the Yellow Sea, INDOPACOM assessments

• B2Gen Z-led cost-of-living protests in 34 German cities turn violent in FrankfurtReuters reported that protests against living costs and compulsory military service drew about 18,000 people across 34 German cities on Oct. 31, per police; in Frankfurt at least two stores were looted and Molotov cocktails were thrown at emergency services, and barricades burned in Hamburg. Hesse’s interior minister warned against following France’s protest model.
• —Oleshky local ceasefire set to end Nov. 1 at 22:59 Kyiv time: no extension confirmedWe found no official announcement from either side during this window of an extension or of further evacuations.

• C2Korean Air and Asiana say Amadeus account credentials were used to access booking data (Oct. 23 disclosure)Seoul Economic Daily reported that Amadeus notified Korean Air on the night of Oct. 20, that booking reference numbers were exposed through unauthorized use of an Amadeus system account between August 2023 and September 2026, and that payment data was not included. The number of affected customers has not been disclosed.
• —Seoul’s review of a wider Cheonghae mission: no new developments confirmedWe found no announcement during this window on an extension motion or a decision on the unit’s operating area.

Watchlist next 12–48 hours and beyond

• Sun, Nov 1, 3:59 p.m. ET
  Oleshky local ceasefire ends (22:59 Kyiv time); watch for an extension or further evacuations
• Mon, Nov 2
  Binance phase-two withdrawals and a formal coverage figure; Asian markets reopen
• Tue, Nov 3
  Midterm elections; White House and Pentagon decisions on Iran and the outcome of Qatari mediation
• Fri, Nov 6
  U.S. October jobs report
• November
  Further North Korean cluster-warhead tests and whether the JCS announces them; London’s response to Iran’s designations
• November
  Whether Amadeus discloses a total count and whether more airlines, including U.S. carriers, issue notices

Sources 25

• T
  The Korea Times (Yonhap)N. Korea tests cluster bomb mountable on tactical ballistic missiles
  B
• N
  NK NewsNorth Korea tests cluster warhead, plans military use by end of 2026
  C
• N
  NBC NewsFBI says North Korea was behind the $6.3 billion Binance crypto hack
  B
• A
  ABC News (Australia)FBI blames North Korea for the Binance crypto hack, expects further laundering of assets
  B
• T
  The NationalBinance to resume withdrawals after covering 95% of $6.3bn crypto heist
  B
• T
  The Korea Times (Yonhap)Trump says US will talk to N. Korea if it is behind Binance hack
  B
• S
  SBSTrump Says He Will Talk to North Korea If Confirmed Behind Binance Hack
  B
• W
  Washington ExaminerTrump on Iran negotiations: 'We're not in that much of a hurry'
  C
• G
  Gulf NewsMiddle East conflict: Trump says US still has to 'take care' of one or two targets in Iran
  C
• M
  Middle East EyeIran designates Britain's Royal Navy, RAF as 'terrorist' groups, report says
  C
• T
  TASSIran designates UK’s Royal Navy, Royal Air Force as terrorist organizations — MFA
  C
• A
  Al JazeeraIran war live: Tehran eyes 2-day Hormuz plan; Trump says talks ‘going fine’
  B
• T
  The Sunday GuardianUS-Israel-Iran War Latest News: IRGC Commander Warns Iran Ready for Any Enemy Attack, Threatens Devastating Strikes on US Warships
  C
• T
  The Business Standard (Reuters)Malaysia Airlines says customers may be affected by Amadeus breach
  B
• M
  Malay MailMalaysia Airlines warns customers of data exposure in Amadeus cybersecurity breach
  C
• S
  Seoul Economic DailyKorean Air, Asiana Report Data Breach at Booking System Operator
  C
• T
  The Korea Times (Yonhap)Korea's monthly exports hit $115.3 bil. in Oct. on strong chip sales
  B
• K
  Korea JoongAng DailySouth Korea exports hit record $115.3 billion in October on chip demand
  B
• E
  EuronewsRussia says 'massive' drone attack targeted 'industrial enterprise' amid reports oil refinery hit
  B
• T
  The Kyiv IndependentRussian oil refinery in Kstovo ablaze after reported overnight drone strike
  C
• U
  UkrinformDrones attack Lukoil refinery in Russia
  C
• A
  Arab News (AFP)Qatari gas tanker struck in Gulf: state media
  B
• T
  The Manila Times (AFP)Oman rescues 25 from burning ship, Iran halts tankers
  B
• T
  The Korea Times (Reuters)Rioters loot stores in Frankfurt as Gen Z-led protests in Germany turn violent
  B
• D
  Digital TodayOctober nightmare for KOSPI faces rebound test on U.S. midterms
  C