Binance loses an estimated US$6.3 billion as the FATF takes Côte d'Ivoire, the DRC, Bulgaria and Monaco off its grey list

On 28 October 2026 OFAC designated 10 individuals and one entity that it says support North Korea's IT worker schemes, in which workers use fraudulent documents, stolen identities and fabricated personas to win jobs at legitimate companies, with most of their wages taken by the regime for its weapons programmes. The First Financial and Technical Development Center, a DPRK-controlled entity in Russia, and six of its IT workers were designated under E.O. 13722. The Russian intermediaries Vitold Viktorovich Obertas and Ilya Aleksandrovich Boykov and the delegation leaders Kim Ki Hyok and Kim Hyo Dong were designated under E.O. 13687. Treasury says Obertas handled nearly US$2 million in cryptocurrency conversions since January 2025 and Boykov the equivalent of US$3.5 million in cryptocurrency transactions since 2024. Treasury adds that workers have used corporate network access to deploy malware, exfiltrate data and extort businesses. The SDN entries for the E.O. 13687 designations carry digital currency addresses.

On 28 October 2026 OFAC designated the Ministry of Defence of the Republic of Rwanda and Zigama Credit and Savings Society, a Rwandan financial institution, under E.O. 13413, as amended. Treasury says the Rwanda Defence Force, which the ministry oversees, has deployed thousands of troops in North and South Kivu, where it operates alongside M23 and supplies it with equipment, logistics and training. It says Zigama operates on behalf of Rwanda's security services, has facilitated payments to entities in China and elsewhere for military equipment, helped transport gold from M23-controlled territory to Kigali through one of its branches, and facilitated transactions worth tens of millions of dollars for M23 and the Congo River Alliance. OFAC had designated the Rwanda Defence Force on 2 March 2026. No general licence was issued.

On 26 October 2026 the UK added 15 individuals to its Sudan sanctions regime (UK list references SUD0047 to SUD0050 and SUD0062 to SUD0072), each subject to an asset freeze, a travel ban and director disqualification. They include nine figures linked to the Rapid Support Forces, three Sudanese Armed Forces generals, a Gezira state police director and two militia commanders. The UK entries carry no dates of birth or identity documents. Of the 15, only one was already listed by the EU, and none is on the OFAC or UN lists.

On 27 October 2026 OFAC announced a US$1,529,685 settlement with Extreme Networks, Inc., a North Carolina-based cloud networking provider, for nine apparent violations of its Ukraine/Russia-related sanctions. Between September 2018 and March 2022 the company exported networking equipment and related services from the United States to JSC Moskovskiy Mashinostroitelniy Zavod Avangard, a Russian defence manufacturer that was blocked by operation of law because it is majority owned by the designated JSC Concern Almaz-Antey. OFAC determined that the apparent violations were voluntarily self-disclosed and egregious.

On 28 October 2026 Bank Negara Malaysia published penalties on four firms. AmBank (M) Berhad and AmBank Islamic Berhad were each fined RM276,000 for failing to submit cash threshold reports promptly, lapses the central bank traced to technology implementation problems linked to weak oversight of system changes; the group found the breaches in its own review, has since filed the missing reports and strengthened its controls. TML Remittance Center was fined RM113,100 and Smile Honesty Forex RM8,400 for customer due diligence failures.

On 29 October 2026 attackers moved an estimated US$6.3 billion in digital assets out of Binance hot wallets, according to the exchange's own estimate. Binance says its initial investigation points to a compromised DevOps engineer's laptop that let the attacker reach a service container and submit unauthorised withdrawals, and that it has found no evidence of a wallet private-key leak. Withdrawals were paused while the withdrawal service is rebuilt; on 30 October co-CEO Richard Teng said Binance aimed to restart them within 40 hours, and deposits are operating normally. Binance says it will cover all user losses, puts verified frozen assets at about US$3 billion and has promised a full post-mortem. Tether said it froze more than US$1.567 billion in USDT and Circle more than US$800 million in USDC; Ripple, First Digital, World Liberty Financial and the Arbitrum Security Council also froze linked funds. The attacker borrowed about US$44.6 million in WETH on Aave, which froze markets as a precaution. Independent blockchain investigators attribute the attack to North Korea's TraderTraitor unit, assessed as part of the Lazarus Group; as of 30 October no US authority had confirmed the attribution or designated any address linked to it. The previous record, the US$1.5 billion Bybit theft of February 2025, was attributed by the FBI to TraderTraitor.

At the close of its plenary on 30 October 2026, the FATF removed Bulgaria, Côte d'Ivoire, the Democratic Republic of the Congo and Monaco from its list of jurisdictions under increased monitoring, FinCEN told US financial institutions the same day. FinCEN's notice reports no additions to the list. The FATF's call for action is unchanged: countermeasures for Iran and the DPRK, and enhanced due diligence for Burma (Myanmar) without disrupting humanitarian, non-profit or remittance flows. FinCEN asked institutions to take the FATF's decisions, and the reasons for them, into account when assessing risk, and said due diligence should not be used for wholesale or indiscriminate de-risking.