Binance's $6.3B laptop problem, PhonePe's store and a Rs 300 crore silence
Binance reportedly lost $6.3 billion after one engineer's laptop was compromised, PhonePe turned Indus Appstore into a shopping aisle, and small Indian NBFCs lost about Rs 300 crore without a single name on record. Plus a Google account check worth thirty seconds and a Tesla robot waitlist that may not exist.
- Long Press · Daily Five31 Oct 202601 / 05
commentaryBinance lost $6.3 billion, and it may have started with one laptop
Binance was hit by a reported $6.3 billion theft on October 29, 2026, and the company's early read is that it began with one DevOps engineer's compromised laptop, per MediaNama. That's the detail worth sitting with. The vaults, the audits and the proof-of-reserves page all held up, and then one machine didn't. Chainalysis blames North Korea, which is their attribution and not a Binance finding, and Bitcoin slid over 3% on the news.
The questionHow did hackers steal $6.3 billion from Binance on October 29?
In one lineBinance says its initial investigation points to a compromised laptop belonging to a DevOps engineer, which attackers used to push unauthorized withdrawals through a service container. The theft is reported at about $6.3 billion on October 29, 2026, and Binance says it found no evidence that private keys were exposed.
The problem
Exchanges ask you to trust them with the keys, and the pitch is that serious security teams guard serious money. The weak spot in that pitch is rarely the cryptography. It's the people and the laptops around it.
What changed
Binance reported a breach on October 29 that CNBC calls the largest crypto theft on record. Binance says attackers got in through a DevOps engineer's laptop and used a service container to process unauthorized withdrawals, and that it found no evidence private keys were exposed. It froze about $3 billion with partners, suspended deposits and withdrawals, and promised compensation through its SAFU fund.
The catch
The laptop story is an initial finding and the probe is ongoing. The loss estimate swings between $5.9 billion and $6.4 billion depending on who is counting, and the North Korea link comes from Chainalysis alone.
What it means for you
Nothing reported so far says Indian users were hit. If your coins sit on an exchange, though, the only variable you control is how much sits there, and today's tip on checking who is signed into your Google account is the cheap version of the same lesson.
Questions people ask
Who is blamed for the Binance hack?
Chainalysis attributes it to North Korea, citing funds from September's Bitget hack that were mixed with the Binance proceeds. That is the analytics firm's call, not a Binance or government finding. Chainalysis first put the theft at no less than $5.912 billion and later posted $6.4 billion, so the final number is still moving.
Will Binance users get their money back?
Binance says it will compensate affected users through its SAFU fund and company funds. It has frozen about $3 billion with industry partners, suspended deposits and withdrawals, and promised a technical report and updated proof of reserves. None of that has been independently verified, and no date for reopening withdrawals has been given.
Were Indian users affected by the Binance hack?
No Indian users or Indian platforms have been reported as affected so far. The market impact was global: Bitcoin fell over 3% to $76,368, BNB dropped 5% and Coinbase shares fell 4.8%. Tether froze about $1.57 billion and Circle more than $800 million of the stolen funds.
SourcesMediaNama ↗CNBC ↗
- Long Press · Daily Five31 Oct 202602 / 05commentaryIndia
PhonePe renames Indus Appstore and starts selling top-ups
PhonePe renamed its Android app store from Indus Appstore to PhonePe Appstore on October 30, 2026, and added a web store plus gift cards and account top-ups, according to MediaNama. The rename is the easy part. In 2024 the pitch was zero commission, and in 2026 the pitch is a shopping aisle with no published rate card. 200 million devices sounds big until you notice it means pre-installs, not people.
The questionIs Indus Appstore now PhonePe Appstore on Android in India?
In one lineYes. On October 30, 2026, PhonePe renamed its Android app store from Indus Appstore to PhonePe Appstore and launched a web version at phonepeappstore.com. It now also sells gift cards and account top-ups, but it has not disclosed current commission rates or user numbers.
The problem
Google Play charges 15 to 30 percent, and every rival store hits the same wall of no users, so no developers, so no users. Pre-installs on cheap phones are the usual way around it.
What changed
PhonePe folded Indus Appstore into its own brand on October 30, launched phonepeappstore.com, and widened the store beyond apps and games to gift cards and top-ups. A Digital Top-ups feature for in-game items and dating app boosts is planned, with no date. Purchases run on PhonePe's existing payments rails.
The catch
PhonePe did not disclose current commission rates, revenue-share terms or developer fees, and did not say what happens to existing Indus listings or accounts. The company also booked a Rs 684.7 crore goodwill impairment in FY26, which is not a detail you'd put on a pitch deck for developers.
What it means for you
If you build apps for India, ask for the actual rate card before adding another listing. If you just install apps, don't expect to retire Play Store yet, because the announcement explained little about existing listings.
Questions people ask
Does PhonePe Appstore charge developers a commission?
PhonePe has not said. At its February 2024 launch the store charged zero platform fees and no in-app purchase commission, against Google's 15 to 30 percent. The rebrand announcement gave no current rates or revenue-sharing terms, only a claim of improved margins for developers, with no figures attached.
How many people actually use PhonePe Appstore?
Nobody outside PhonePe knows. The 200 million figure refers to devices where the store is available, largely through OEM pre-installation such as the Xiaomi partnership, not active users or downloads. No monthly active user numbers were disclosed. Adoption is reportedly highest in Uttar Pradesh, Maharashtra, Bihar, Karnataka and Telangana.
SourcesMediaNama ↗
- Long Press · Daily Five31 Oct 202603 / 05
tipCheck which devices are signed into your Google account
Open myaccount.google.com, go to Security & sign-in, and tap Manage all devices under Your devices, per Google's help page. Every phone, laptop and old tablet that has your Google account on it is listed there with a last active time. Most people have at least one they forgot about, and it takes thirty seconds to sign it out.
The questionHow do I see which devices are signed in to my Google Account?
In one lineGo to myaccount.google.com, open Security & sign-in, then choose Manage all devices under Your devices. Tap any device you don't recognise and tap Sign out. The list shows each device's last active time and rough location, including devices signed in within the last few weeks.
The problem
Your Google account is the key to your mail, photos, Drive and half your logins, and it quietly stays signed in on every old phone, office laptop and borrowed PC you ever used.
What changed
Google's account page lists devices and sessions signed in within the last few weeks, with last active time and approximate location. Tap one and choose Sign out, and its access to your account is removed.
The catch
Last active counts background syncing, so a device can look more recent than your last real use. Location can be a nearby town rather than the exact spot. Sessions with the same device name may be one machine or several, so sign out of all of them.
What it means for you
Do it now, and again after any laptop changes hands. Today's Binance story began with one engineer's laptop, and yours holds a lot less money but a lot more of your life.
Questions people ask
What does signing out of a device do in a Google Account?
Signing out removes your account's access from that device or session. If several sessions share the same device name, they may come from one device or several, so Google advises signing out of all of them to be sure no other device still has access. It is the quickest fix for a laptop you no longer control.
Why does Google show a recent last active time for a device I haven't used?
Last active is the last time the device or session communicated with Google's systems, which can be more recent than when you last used it because background syncing counts. Location is where it last communicated and may show a nearby place rather than an exact spot, so a slightly wrong city is not proof of a break-in.
SourcesGoogle Account Help ↗
- Long Press · Daily Five31 Oct 202604 / 05hot takeIndia
Rs 300 crore stolen from NBFCs and nobody will name one
Smaller NBFCs have reportedly lost about Rs 300 crore to AI-assisted cyberattacks over roughly two months, in figures first reported by The Economic Times and followed up by MediaNama, and neither RBI nor CERT-In has put a number or a name on it. We have six-hour reporting rules on paper. In practice the public keeps learning about these from leaks: CoinDCX called a breach report a false alarm and then admitted a Rs 152 crore loss three days later. A rule nobody can check is a hope with a deadline.
The questionHow much money have AI cyberattacks siphoned from small NBFCs in India?
In one lineAbout Rs 300 crore over roughly two months, according to The Economic Times citing sources, with more than 150 FIRs filed. Regulators have not confirmed the figure. CERT-In has issued advisories on API credential theft and AI agents, but none names an affected firm or states a loss.
The problem
Customers of a small NBFC have no way to know whether their lender was hit, because the incident rules require reporting to regulators, not to the public, and the regulators are not publishing names.
What changed
The Economic Times reported, citing sources, that around Rs 300 crore was siphoned from NBFCs with turnover of about Rs 1,000 crore or less over roughly two months, with more than 150 FIRs filed. CERT-In's October 9 advisory describes API credential theft that bypasses KYC checks, and its October 15 advisory covers unauthorised AI agents. Neither names a victim.
The catch
The figures are sourced reports, not regulator statements, and even the FIR count differs across sources (about 150 in MediaNama's questions to RBI). Which rules apply to which firms is itself unclear.
What it means for you
If you have a loan, deposit or app account with a small NBFC, check its official channels for notices and be wary of any call or link about your account this week. The honest answer to whether yours was hit is that you can't currently find out.
Questions people ask
Which NBFCs were targeted in these cyberattacks?
Reports say smaller NBFCs with turnover of about Rs 1,000 crore or less. One Delhi-based NBFC reportedly lost Rs 7.5 crore in one attack and Rs 7.25 crore days later. No affected firm has been officially named, and CERT-In's public notices do not identify any entity, threat actor, incident count or loss amount.
How fast must Indian NBFCs report cyber incidents?
CERT-In's 2022 directions require reporting within six hours, and RBI's July 2026 directions have NBFCs report through DAKSH within six hours. It is unclear whether those apply to the affected firms. Under the DPDP Act, breaches go to the Data Protection Board within 72 hours, but that obligation only takes effect on May 13, 2027.
Was customer data exposed in the NBFC attacks?
That is unclear. CERT-In's October 9 advisory describes API credential theft that bypasses KYC checks, and the reported losses are stolen funds, which points to money moving rather than data leaking. Whether personal data was exposed has not been established, and MediaNama has put the question to RBI.
SourcesMediaNama ↗
- Long Press · Daily Five31 Oct 202605 / 05hot take
Tesla's Optimus waitlist is for a robot due in late 2027
Tesla is reportedly planning to open Optimus reservations in early December 2026 at $20,000-plus, but Musk replied 'No' on X to the waitlist report, and the robot itself is not expected to ship for roughly another year, according to the San Francisco Standard. A reservation for a humanoid that Musk says still has issues to solve until about the end of 2027 is a marketing mechanic, not a purchase. Wanting one is fair. Calling it a launch is generous.
The questionWhen can you reserve and buy a Tesla Optimus robot?
In one lineReservations are reportedly planned for early December 2026 at a price above $20,000, per one industry source, but Elon Musk replied 'No' on X to the waitlist report. Musk says output could reach 20,000 robots per week around the end of 2027, and shipments are likely about a year away.
The problem
Humanoid robots make the best demo videos in tech, and demos are not products. Buyers have no way to tell the two apart until something ships.
What changed
One industry source, Modar Alaoui, told the SF Standard that Tesla plans to open reservations around his Humanoids Summit on December 1 and 2, at $20,000 or more, with a small share of units for consumers. Musk has confirmed production has started at Fremont and targets 20,000 robots per week by about the end of 2027.
The catch
The December date, the price, any deposit and the consumer allocation are all unconfirmed, and Musk's one-word 'No' on X appears to contradict the waitlist. Tesla did not comment.
What it means for you
Nothing has been announced about India availability or rupee pricing. Treat this as a 2027-and-later story, and don't pay anyone a deposit for a place in a queue that hasn't been confirmed.
Questions people ask
How much will the Tesla Optimus robot cost?
A price above $20,000 is expected, according to the San Francisco Standard's reporting, and Tesla has not confirmed it. It is unclear whether reserving one needs a deposit. Most early robots are expected to go to companies, with only a small number set aside for consumers, per industry expert Modar Alaoui.
Has Tesla started building Optimus robots?
Musk confirmed production has started, with parts of Tesla's Fremont factory, where the Model S and X were built, converted for Optimus. He said output should reach 20,000 robots per week by roughly the end of 2027, and that he expects the remaining technical issues to be solved around the end of next year.
SourcesSan Francisco Standard ↗
Taps
Quick hits. One line each, for when a long press is too much.
- IndiaMediaNama ↗
India's broadband base hits 1.108 billion; Jio and Airtel hold 83.96%
Up 6.47 million in September, though part of that is Airtel's M2M SIMs being counted since December 2025, per MediaNama.
- IndiaMediaNama ↗
Nasscom asks to delay GST rules for e-commerce deliveries to January 1, 2027
The industry body wants the revised rules postponed, per MediaNama. No government response has been reported.
- IndiaMediaNama ↗
Info Edge's Shiksha billings fell 27%, and it blames AI answers
Reported alongside Alphabet's results, where European publishers told the EC that AI Mode sends fewer than 5% of queries to outside sites, per MediaNama.
- GlobalTechCrunch ↗
Google's Suncatcher prototype satellite is online and ran Gemma 4 in orbit
Four TPUs on board, power for one at a time, about 20 minutes on a 1kW budget. Test output was a haiku, per TechCrunch.
- GlobalThe Verge ↗
OpenAI, Google, Microsoft and Anthropic back one robots.txt opt-out for AI training
Anthropic has started; Microsoft targets Feb 1, 2027, Google 2027, OpenAI 'coming months', per The Verge.