XTimes
Editor’s Note
Yesterday Americans voted and gave control of the House and Senate to the Democrats who have said, if given the opportuning, a congressional investigation into Elon Musk’s recent decision to throttle Ukraine’s satellite service will be among their priorities.
Additionally, the targets of digital attacks have taken a turn. Six point three billion dollars left Binance in roughly twenty minutes — the largest heist in history, attributed by the FBI to a North Korean unit of perhaps a dozen people, and quite possibly assisted by AI. Supermarket refrigerators across six European countries were switched to defrost overnight, spoiling food from Sweden to Ireland, in the second such attack in a month. Snap Inc. settled with two teenagers just hours before its chief executive was due to testify, becoming the fourth company to pay rather than let a jury rule. And the Pentagon’s own watchdog declined to investigate the Starlink affair at all.
Also: OpenAI hired a former Secretary of the Army, Apple’s first foldable began cracking within hours of purchase, and the price of a gaming graphics card rose again because data centers bought the memory. Let's jump in.
Top Stories
$6.3 Billion in Twenty Minutes
On the evening of Thursday, October 29, attackers drained roughly $6.3 billion from Binance’s hot wallets — the largest cryptocurrency theft ever recorded, more than four times the previous record. According to Bloomberg’s reporting, the whole operation took about twenty minutes, and the sum is equivalent to nearly 20% of North Korea’s estimated annual economic output (Wealth Adviser).
On Saturday the FBI named the culprit: TraderTraitor, a North Korean state-sponsored group also tracked as Lazarus Group and APT38, which the Bureau previously blamed for the $1.5 billion Bybit theft. Experts believe the elite unit may have only about a dozen members. Binance suspended withdrawals Friday and resumed them in phases Sunday; co-CEO Richard Teng says the company has replenished roughly 95% of the stolen assets from its own funds, an insurance fund, and a $1 billion bitcoin reserve, and that “Binance will absorb the financial impact of these stolen funds, not our users” (CNBC). Customers withdrew a net $4.72 billion by Monday — about 3% of the $171 billion Binance holds. Stablecoin issuers froze roughly $3 billion of the stolen funds. North Korea’s government called the attribution “absurd rhetoric.”
Here's how they did it: Security researchers increasingly believe artificial intelligence is now central to these operations. TRM Labs senior investigator Nick Carlsen says techniques never previously seen in TraderTraitor’s work suggest the group is making extensive use of AI. The shift is measurable: earlier North Korean attacks generally involved “simple private key compromises,” while recent ones have “required weeks of targeted manipulation of complex blockchain mechanisms” (Claims Journal). The group’s strategy, which analysts call Big Game Hunting, uses AI to locate high-value targets, identify weaknesses, and craft the social engineering that gets an employee to open a door.
The speed is its own evidence. Researchers found the hackers laundered funds and destroyed evidence faster than human operators plausibly could, suggesting automation throughout (Axios). Teng said the attackers deployed a “self-destruct mechanism that destroyed tooling and traces” as they went: “This was a complex attack.” Binance initially attributed the breach to a compromised engineer’s laptop, then said it involved more than that; the attack appears to have been staged at least 36 hours in advance. In August, the South Korean firm Genians reported that another North Korean group, Kimsuky, was using its own AI tools to generate malware and phishing messages. The honest caveat: AI’s specific role in this particular theft remains unconfirmed.
Why it matters: For most of this year we have covered warnings about AI-enabled cyberattacks — the hundred-company letter in August, the “day after” planning in October, OpenAI’s Astra crossing a “critical” cyber threshold. This looks like the warning arriving, though not in the form anyone described. Nobody’s power grid went down. What happened instead is that roughly a dozen people, presumably working for a sanctioned state, used automation to steal a fifth of their country’s annual economic output in the time it takes to make coffee — money that funds a weapons program. The significance isn’t that AI invented a new kind of crime. It’s that a very small number of people can now operate at a scale that used to require a nation.
Fridges Go to 122°
It wasn't caused by global warming, but On Monday, November 2, supermarket refrigeration systems failed overnight across Sweden, Belgium, Luxembourg, Ireland, Estonia, and the Netherlands, forcing stores to throw out food in what appears to be a coordinated cyberattack (CNBC). The affected chains include Ahold Delhaize, Colruyt, Sweden’s ICA and Coop, Axfood, Carrefour Belgium, and Ireland’s SuperValu. Temperatures in some units reached 50°C — 122°F.
The mechanism was simple and specific. Stephan Moelans, chief executive of the Belgian refrigeration company Sabcobel, told the Belga news agency that the units’ evaporators were switched into defrost mode. One Belgian manager rushed to his store south of Antwerp and found the fridges at 18°C. Coop reported unauthorized tampering at seven of its 800 stores; Carrefour called the impact on 15 of its 700-plus Belgian stores “extremely limited”; SuperValu said a specific model of refrigeration system was affected at 13 of its 223 locations (Al Jazeera).
It was the second such attack in a month. On October 11, intruders reached the refrigeration controllers at up to 700 French supermarkets and set them to defrost with the contents still inside. A store in Normandy reported units reaching 80°C. The heat melted equipment and in some cases started fires; sprinkler systems then caused water damage. A single Intermarché outside Paris disposed of several tons of product. Coopérative U chief executive Dominique Schelcher called it “unprecedented,” “unacceptable,” and “extremely serious” — and Wikipedia now describes it as the first cyberattack to have a real-world effect on a nation’s food supply chain.
The structural problem explains why it recurred. Supermarkets typically outsource refrigeration to third-party service companies and cannot manage the security of those systems themselves. After the French attack, investigators found the same vulnerabilities in supermarkets across Belgium, Germany, Luxembourg, the Netherlands, Portugal, Poland, and Spain. American readers should pay attention to a parallel finding: researchers at the security firm Armis identified ten vulnerabilities, collectively named Frostbyte10, in Copeland E2 and E3 controllers — the systems that manage temperature in supermarkets, convenience stores, and food service operations across the United States. Copeland operates in more than 40 countries and counts Kroger, Albertsons, and Whole Foods among its customers. It has issued a firmware update.
Why it matters: Cyberattacks have historically produced abstractions — stolen records, leaked emails, ransoms paid quietly. This produced rotting chicken. There is no ransom demand reported, no obvious profit motive, and no claimed attribution, which makes the purpose harder to read than the method. What’s clear is the shape of the exposure: the systems keeping a continent’s food cold are managed remotely by contractors, run on controllers with known flaws, and sit entirely outside the control of the businesses that depend on them. Every grocery chain in America has the same arrangement. The fix is firmware updates and network segmentation — unglamorous, cheap relative to the loss, and historically the last thing anyone gets around to.
The Watchdog Decides to Sleep
Two weeks ago, Elon Musk acknowledged that SpaceX had throttled Starlink service in Ukraine (after initially denying it) disrupting front-line operations for more than a week, on the grounds that Ukraine had violated the terms of service by using a civilian product for offensive drone strikes. Ukraine disputes the characterization. Since then, the effort to establish who actually ordered it has run into a wall.
Nine senators — five Democrats and four Republicans, led by Jeanne Shaheen and Thom Tillis — formally asked the Defense Department’s Inspector General to investigate. The Inspector General declined, telling lawmakers the disruptions are a matter for the Air Force and Space Force (Stars and Stripes). A congressional aide told the Associated Press the watchdog turned the request down despite being well equipped to handle it, and noted that concerns in Congress about Musk’s control of Starlink stretch back years — concerns that helped drive the creation of Starshield in the first place. Shaheen’s response: “It is concerning that the Inspector General has apparently decided not to investigate satellite communication disruptions that Ukraine relies on to protect its civilians.”
The accounts still contradict each other. Reuters reported the order came from inside the White House. The Wall Street Journal reported Musk ordered it himself, with two sources saying he and Trump discussed the matter — one placing that conversation before the throttling. Secretary of State Marco Rubio says the president “has nothing to do with the decisions that are made by Starlink and Starshield and by Mr. Musk.” Vice President Vance has hinted at coordination. Trump’s summary was characteristically brief: “The bottom line: he put it back.” SpaceX sent Congress a letter stating it made no changes to Starshield, changed Starlink because Ukraine was using it for offensive operations, and restored service to remain aligned with U.S. policy. Reporting in The Atlantic suggested Musk may have maintained the restriction to push Ukraine toward greater reliance on Starshield (Forbes).
Members of both parties have called for testimony under oath. Republican Brian Fitzpatrick told CNN that if Musk ordered the slowdown, “that is likely a violation of the law… We’ve gotta investigate. We’ve got to call the witnesses, got to bring them in, put them under oath, and get to the bottom of it.” Senator Adam Schiff: “Either the President was lying or Musk was lying, but the decision to slow down satellite speed and access has life or death consequences for Ukraine.” Senator Elizabeth Warren warned of “enormous risk” if one man is “dictating our foreign policy.”
And then there is the part that yesterday’s election decided. A group of Silicon Valley House Democrats wrote to White House chief of staff Susie Wiles demanding an “immediate, government-wide investigation,” and said plainly that this becomes a priority if they win the chamber: “We will ensure that the 120th Congress will closely scrutinize federal funding awarded to Mr. Musk” (CNBC). By the time you read this, you may know whether that condition was met. (We'll have more to write in future issues as this story evolves, or not.)
Why it matters: Strip away the partisan framing and a simple fact remains unestablished: nobody outside a very small circle knows who decided to degrade a nation’s wartime communications, and the institution built to answer exactly that kind of question has declined to ask it. Ukraine’s service was restored on October 24, which resolves the emergency and resolves nothing else. The capability remains, the ambiguity remains, and the only remedy currently being pursued is Ukraine’s reported effort to reduce its dependence on one man. We take this up in this week's Reflection.
Snap Settles, and Still No Jury Rules
On Monday, with jury selection underway in Los Angeles Superior Court and opening statements due within days, Snap settled with two teenagers who alleged that Snapchat’s design fostered compulsive use that contributed to anxiety, depression, and eating disorders. The plaintiffs are identified in court documents as S.J., 16, of Illinois, and K.D.B., 18, of Mississippi. Terms are confidential (Engadget).
Chief executive Evan Spiegel had been expected to testify — the first time a Snap chief executive would have taken the stand in a social media addiction case. Meta’s Mark Zuckerberg was also due to appear. Neither will.
The pattern is the story. These same plaintiffs had already settled with Meta, TikTok, and Google’s YouTube, leaving Snap as the last defendant standing. In an earlier case brought by a young woman who said the apps had harmed her as a child, Snap and TikTok settled before trial; the jury that did reach a verdict ruled against Meta and YouTube and awarded $6 million in damages — the only judgment anyone in this litigation has yet received. Readers will recall that in Issue #43 we covered Meta’s roughly $17 billion settlement with 47 states, which did impose real design requirements. But as a matter of adjudication, no court has yet determined whether these products are defectively designed. By setteling, every defendant has prevented that question from being answered.
Lawyers for the plaintiffs framed the settlements as progress: “Our ultimate goal is to hold these social media companies accountable for how their actions have impacted millions of children across the country, and these settlements allow us to keep building toward that goal.” Snap’s statement was shorter: “The Parties are pleased to have been able to resolve this matter in an amicable manner.” Documents surfaced in the ongoing litigation indicate Snap employees raised concerns about teen mental health risks dating back at least nine years; the company says those examples were cherry-picked and taken out of context (TechCrunch).
Why it matters: A settlement resolves a case and produces no knowledge. No findings of fact. No precedent. No public record of what the companies knew or when. For the plaintiffs, that is often the right choice — a confidential payment now beats an uncertain verdict years later, and nobody should fault two teenagers for taking it. But the cumulative effect of every defendant making the same calculation is that a question affecting tens of millions of children has now been asked four times in court and answered zero times. The companies are not evading the law. They are using it exactly as designed. That is a more interesting problem, and will be discussed more in this week’s Reflection.
Quick Picks
OpenAI Hires a General
OpenAI announced Monday that former Secretary of the Army Dan Driscoll will join as senior counselor for national security modernization, a newly created role advising company leadership on how advanced AI can strengthen national security and cybersecurity, with particular emphasis on working with U.S. allies (CNBC).
Driscoll was the 26th Secretary of the Army and an Iraq War veteran, and he resigned in September amid reported tensions with Defense Secretary Pete Hegseth over the service’s direction and the removal of senior officers. He is a longtime friend of Vice President JD Vance, whom he met at Yale Law School. The Financial Times described him as “the latest Trump official to join the AI giant.” Driscoll’s framing: “National security requirements are changing faster than at any time in the past fifty years… The people who serve deserve the very best tools we can put in their hands.” Sam Altman says the appointment will help advance international adoption of “democratic AI.”
Worth noting the thread: Driscoll left the Pentagon that was, in the same period, standing up a four-star Autonomous Warfare Command and commissioning Elon Musk and Palmer Luckey to study the future of war. The revolving door between the Defense Department and the AI industry is now turning in both directions at once.
Crack-Gate
Apple’s first foldable, the iPhone Duo, went on sale October 23. Within hours, owners began reporting that the inner screen had cracked along the crease. “Felt a little bit of resistance, then, almost a cracking noise and now there’s a massive line through the display,” wrote one Australian buyer. Another had owned the phone for only six hours before it cracked (Forbes).
Apple acknowledged the problem on October 26: “We are aware of an issue impacting the inner display on a small number of iPhone Duo units. If users experience issues with their iPhone Duo display, they should contact AppleCare for a replacement.” It has not said what is causing the failures, how many units are affected, or what happens to owners whose screens fail after the warranty lapses.
The repair prices are what make this more than a product story. Without AppleCare+, replacing the inner screen costs $999. The outer screen is $379, the battery $229, the back glass $199 — and a category called “other damage” runs $1,499, roughly three-quarters the price of the phone. Independent repair expert Ricky Panesar of iCorrect had predicted around £850 and was startled: “We haven’t seen that level of pricing ever. It’s shocking, to be perfectly honest.” Samsung charges the equivalent of £594 for the same repair on the Galaxy Z Fold 8 — but Samsung is on its eighth generation of foldable, and Apple is on its first.
Panesar has studied the reports and believes the cause is mechanical: the damage appears in the same place every time, and he suspects a small hook in the hinge catches as the phone opens and closes, pressing on the screen from below until it gives. If so, no software update fixes it. iFixit’s teardown gave the Duo a 5 out of 10 repairability score — the best it has ever awarded a foldable — and traced the damage to where a cable gap meets the hinge’s central support. Panesar’s advice is unusually blunt for him: “I think this is the first device I’ve ever said you must get AppleCare.” It was the first product launch under Apple’s new chief executive, John Ternus. Samsung, it is worth recalling, delayed the original Galaxy Fold in 2019 after review units broke.
The AI Boom Reaches the Gaming PC
Graphics card prices are rising again in November, and the reason is this newsletter’s main subject. Board-partner sources report increases of $329 to $494 on the RTX 5090 DV2, $374 to $419 on the RTX 5080, $150 on the RTX 5070 Ti, and $90 to $135 on the RTX 5070 (eTeknix).
The cause is memory. AI infrastructure is consuming a growing share of the world’s memory supply, pushing GDDR7 prices up roughly 40% and driving TSMC wafer costs higher alongside them. The RTX 5090 launched in January 2025 at $1,999; the German retail tracker 3D Center finds RTX 50 series prices up 66% on average over the past year, with the 5090 up 132%. Street prices now vary so wildly between retailers and regions — from around $3,300 to well over $9,000 for the same card — that the dispersion is itself evidence of a market that no longer functions normally. Reports that Nvidia has effectively discontinued the 5090 persist; Nvidia denies them.
It’s a small story with a clear moral. Every argument about AI infrastructure eventually arrives somewhere concrete, and here it is: a teenager saving for a graphics card is bidding against a data center for the same memory chips, and will likely lose.
✔ Our next Singularity Circle will occur this Saturday, November 7, 2026, at 10:00 AM Pacific Time. As usual, a Zoom link will be sent to eligible members in advance of the gathering.
✔ Exponential Times will return on November 11th with all the latest technology news.
The Optimist’s Reflection
The Instruments Still Exist
By Todd Eklof
Two separate stories this week may not be as unrelated as they first seem.
On Monday, with a jury half-selected and opening statements days away, Snap settled with two teenagers who claimed its product was designed to addict them. The company's chief executive had been scheduled to testify. Now he won't. The settlement terms are confidential. Snap was the fourth company to settle with these same plaintiffs — Meta, TikTok, and YouTube had already paid. Four companies, four settlements, and not one finding of fact about whether any of what it was all about is true.
And last week, nine senators — five Democrats, four Republicans — asked the Pentagon’s Inspector General to investigate who decided to slow Ukraine’s satellite internet during a war. The Inspector General declined. Not “investigated and found nothing,” but declined.
In both cases, a mechanism meant to establish the truth was available and, in both cases, it wasn't used.
To be clear, nobody broke a law by settling a lawsuit; settlement is a legitimate and often wise choice, and I don’t fault two teenagers for taking certain recompense over an uncertain verdict. An Inspector General has discretion about what to investigate. So it isn’t that anyone behaved illegitimately, but that we now have a pattern where the questions that most need answering are precisely the ones our responsible institutions are failing to answer.
All of this reminds me of something I recently learned about the East India Company from a NYT article.
The Company was chartered in 1600 to trade spices and textiles. By the 1760s it ruled Bengal, collected taxes from twenty million people, and fielded an army roughly twice the size of Britain’s. Edmund Burke called it “a state in the disguise of a merchant,” and warned Parliament that “this cursed Company would, at last, like a viper, be the destruction of the country which fostered it at its bosom.”
What eventually happened wasn't a sudden reckoning, but a long, unglamorous, and frequently failed campaign of institutional assertion.
Parliament passed the Regulating Act in 1773, after a famine in Bengal killed perhaps a third of the population while Company officials speculated in grain. It didn’t work well. So, Parliament passed Pitt’s India Act in 1784, creating dual control. That worked better but still not so great. Burke spent seven years impeaching Warren Hastings, the Company’s governor-general, in a trial that gripped London and ended in acquittal. Then the charter renewals came, in 1813 and 1833, each one stripping away another monopoly. And finally, in 1858, after a rebellion the Company could not contain, the British state dissolved it and took the Indian government directly. (Not a great outcome for the company or India.)
That is two hundred and fifty years from charter to dissolution, and nearly a century from the first serious attempt at control to the last. It involved multiple acts of Parliament, a failed impeachment, and the loss of an empire’s worth of credibility before anyone finished it.
The historian William Dalrymple, who has written four books about the Company, and is the writer of the aforementioned NYT article, draws a comparison between then and now. States can master corporations — even corporations with private armies. The instruments to dismantle entrenched corporate power, he said, still exist, although they are not, at this time, being used.
But, if deemed necessary, we can do so. We have antitrust law, product liability law, securities disclosure, inspectors general, congressional subpoena power, and juries. Every one of these instruments was forged in response to some previous concentration of private power that outran public control. They work. We have used them before.
What this week's news reminds us of, however, is that having such instruments and deploying them are different matters. Four juries could have ruled on whether social media products are defectively designed but didn't get that far. An Inspector General could have established who throttled a nation’s wartime communications but wasn't willing to go there. None of this was wrong. The decisions not to move forward were legal in both instances. So, the question is when, if ever, is the right time to use such mechanisms?
We still need to know if social media companies ought to be considered innately defective or harmful after the facts have been carefully scrutinized by jurists. We still need to decide how much power one individual can have in shaping politics and matters of national security. The balancing act in a democratic society is knowing when the answers to such questions matter enough that government authorities must take a stronger hand in getting them.
Edmund Burke lost his attempt to hold East India Company accountable to society and by his government. He spent seven years on his impeachment, yet Hastings walked. Even so, the argument Burke made — that a private company exercising the functions of a state must be answerable to the public — became the settled conviction of the Anglo-American world, and it became so because he kept making it long after he lost. The Regulating Act failed and was followed by Pitt’s Act. Pitt’s Act was insufficient and was followed by the charter reforms. Each attempt was inadequate but over time these various attempts finally added up.
Perhaps that's how we finally end up getting the answers and outcomes we need. Not through one dramatic reckoning, but a long dialectic argument conducted in public over years and decades, in which the instruments get used badly, then better, then fine-tuned enough to get the job done.
Yesterday Americans voted, and among the many things it decided, if they are true to their promise, is that House members will investigate who decided to degrade Ukraine’s communications and, perhaps, get to the greater question about who should and shouldn't make such decisions.
Maybe they will. Maybe not. Or maybe the investigation will go nowhere, as Burke’s impeachment did.
Fortunately, because of the mechanisms our forebears have already struggled to put into place and fine-tune for us, the instruments we need to do so already exist. We don't have to reinvent the wheel. We just need to use them when necessary. Determining when exactly that might be is another question.
Exponential Times is published weekly by Singularity Sanctuary. To subscribe or learn more, visit singularitysanctuary.com.