SundaySunday, 1 November 2026

North Korea's crypto war chest grows, Germany's streets turn angry, and India's tax machine keeps humming

North Korea's state hackers have now recovered 90% of a $6.3 billion Binance theft, the FBI confirmed, raising hard questions about what sanctions actually do. In Germany and France, cost-of-living protests turned violent on the same day, a signal that household pressure is becoming a political force. And India's GST collections jumped nearly 23% in October, the kind of number that gives the government room to spend.

4 stories8 min readConcept: Sanctions evasion
01

FBI confirms North Korea stole $6.3bn from Binance; exchange says 90% already replaced

Binance Hack 2026TradeCentral banksDiplomacy

The FBI has attributed the largest cryptocurrency theft on record to TraderTraitor, a North Korean state-sponsored hacking group. Binance says it has already replaced 90% of the stolen tokens and that withdrawals are resuming. The remaining 10% are less liquid assets that will take longer to source. The same group was behind a $1.5 billion Bybit hack last year.

$6.3bn
record high for a single crypto theft
Total stolen from Binance
90%
Share of losses Binance says it has replaced
$1.5bn
Bybit hack by same group, 2025
Why it matters

North Korea funds its weapons programmes largely through cyber theft, because sanctions have cut it off from conventional banking. A $6.3 billion haul, quickly converted back into usable assets, is a meaningful addition to that war chest. For crypto markets, the speed of Binance's recovery is reassuring in the short run, but the episode shows that a centralised exchange holding large reserves is a single point of failure. The broader financial read is that any asset held on a centralised platform carries a custody risk, the risk that the platform itself is the weak link, that traditional finance does not face in the same way.

IB perspective

The number that matters here is not $6.3 billion in isolation but what it buys. North Korea's entire annual export revenue, on most estimates, is well under $2 billion. A single hack has therefore handed the regime several years' worth of hard currency in one operation. That money flows into ballistic missile tests, nuclear development and the kind of conventional military spending that keeps the Kim government in power. Financial sanctions, the policy of cutting a country off from the global banking system to change its behaviour, rest on the assumption that the target cannot find another way in. Crypto has punched a large hole in that assumption.

The honest pushback is that Binance recovered quickly, so the net damage is limited. That is partly true. But recovery does not undo the theft: Binance used its own reserves to plug the gap, which means the cost was spread across the exchange and, indirectly, its users rather than falling on North Korea. The deeper problem is structural. Every time a state actor pulls off a heist at this scale and walks away with most of the proceeds, it confirms that crypto is a viable sanctions-evasion channel. The question worth sitting with, and it would make a strong Paper 1 evaluation question, is whether tighter regulation of crypto exchanges changes this calculus or simply pushes the activity to platforms that are harder to monitor.

02

Cost-of-living protests turn violent across Germany as France marches on the same day

France Cost-of-Living Crisis 2026ElectionsCentral banksTrade

Shops were looted in several German cities, including Berlin, Hamburg and Frankfurt, as cost-of-living protests turned violent. On the same day, hundreds of thousands of people protested across France over similar pressures. The two countries acting in parallel marks a new intensity in a wave of European social unrest that has been building through 2026.

3+
Major German cities hit by violent protests, including Berlin, Hamburg and Frankfurt
hundreds of thousands
Protesters in France on the same day
Why it matters

When protests turn violent in two of the eurozone's three largest economies on the same day, it stops being a domestic story. Governments under this kind of pressure tend to respond with fiscal loosening, spending more or cutting taxes to ease household pain. That matters for bond markets, where investors are already watching eurozone deficits closely. A government that spends its way out of social unrest pushes up borrowing, which raises the extra return investors demand to hold that country's debt. Germany's constitutional debt brake makes large fiscal responses legally difficult, which could make the political pressure harder to defuse.

IB perspective

What is driving people onto the streets is a real-wages squeeze: prices have risen faster than wages for long enough that households feel permanently worse off. Real wages are what your pay actually buys after you account for inflation. When real wages fall, consumer spending tends to fall too, because people have less purchasing power, the ability to buy goods and services with their income. In an AD/AS model, that is a leftward shift of aggregate demand, the total spending in the economy, which pushes output down and can tip a country into contraction. France's GDP already shrank in Q3 2026, so the protests are partly a symptom of an economy that is already contracting.

Germany's situation is different and, I'd argue, more politically dangerous. Germany has a constitutional rule called the debt brake that limits how much the government can borrow in normal times. That means the standard political response, a big spending package to ease household pain, is legally blocked without a parliamentary supermajority to suspend the rule. The government is therefore caught between a population demanding relief and a legal framework that prevents the easiest form of relief. Past episodes of sustained real-wage squeezes, France in 2018 with the gilets jaunes movement, show that protests can force policy changes even when governments resist. The difference is that in 2018 France had more fiscal room. Whether Germany's coalition can hold together under this pressure is the question the next few weeks will answer.

03

India's GST collections surge 23% to a record Rs 2.31 lakh crore in October

India Growth and RBI 2026TradeCentral banks

India's gross goods and services tax collection reached Rs 2.31 lakh crore in October 2026, a 22.9% jump from the same month last year. Revenue from domestic sales rose 16% and import-related GST climbed 42%. The April-to-October total now stands at Rs 14.78 lakh crore, up 13.2% year on year. Maharashtra recorded the highest single-state collection at Rs 35,150 crore.

Rs 2.31 lakh crore
22.9% year on year
October GST collection
42%
Year-on-year rise in GST from imports
Rs 14.78 lakh crore
April-October cumulative GST, up 13.2% YoY
Why it matters

Strong tax receipts give the Indian government two things at once: room to spend without blowing its deficit target, and a signal to bond markets that the fiscal position is under control. The 42% jump in import-related GST is particularly telling, it suggests import volumes are rising, which points to strong domestic demand. For the RBI, buoyant consumption data makes it harder to justify cutting interest rates soon, since the economy does not obviously need the stimulus. The Centre also released an additional Rs 1.09 lakh crore in tax transfers to states on the same day, putting more money into regional budgets ahead of winter spending.

IB perspective

A 23% jump in a single month's tax revenue is striking, but the more interesting figure is the 42% rise in GST collected on imports. Import taxes go up when either import volumes rise or import prices rise, or both. Given that global commodity prices have been volatile in 2026, some of that jump reflects higher prices on goods coming in. But a 42% move is too large to be explained by prices alone, which means import volumes are genuinely up. Rising import volumes are a sign of strong domestic demand, the total spending by households, firms and government inside the country. That is good news for growth but it also widens the trade deficit, the gap between what a country buys from abroad and what it sells.

For the government, the timing is useful. The Centre transferred an extra Rs 1.09 lakh crore to state governments on the same day, funded by the stronger tax take. States spend that money on roads, schools and welfare, which feeds back into demand. The risk in this picture is that strong demand, if it persists, keeps inflation above the RBI's 4% target and delays any interest rate cut. One month of strong GST data is not proof of a sustained trend, and October includes the Diwali festival season, which reliably boosts consumption. The cleaner test will be November's numbers, when the festival effect fades.

04

Bulgaria votes in presidential runoff as Ukraine war splits the electorate

Ukraine, US Diplomacy 2026ElectionsDiplomacyConflict

Bulgarians are choosing between two presidential candidates with sharply different positions on the war in Ukraine and on ties with Russia. The runoff follows a first round with record-low turnout. Bulgaria is a NATO and EU member but has historically close cultural and economic ties with Russia, making the vote a proxy contest over which camp the country aligns with.

record low
Turnout in the first round of the Bulgarian presidential election
Why it matters

Bulgaria sits at the eastern edge of the EU and NATO, and its presidential stance on Russia matters for alliance cohesion. A president sympathetic to Moscow would complicate EU sanctions decisions, since Bulgaria has a vote in the Council, and could slow weapons transit routes that run through the Balkans. Energy is the sharpest pressure point: Bulgaria was heavily dependent on Russian gas before 2022 and the cost of switching suppliers has fed the cost-of-living squeeze that is driving low turnout. The result will not change Bulgaria's formal treaty commitments, but it will shape how enthusiastically those commitments are met.

IB perspective

Bulgaria's vote is a good illustration of what political scientists call a security dilemma playing out inside an alliance rather than between adversaries. The classic version is two states that each arm up out of fear, making each other less safe in the process. The version here is softer: a small NATO member whose population is genuinely divided over whether the alliance's confrontational stance toward Russia makes Bulgaria safer or more exposed. That division is not irrational. Bulgaria shares no border with Ukraine, it relies on Russian energy more than most EU members, and it has a large Orthodox Christian community with cultural ties to Russia that predate the Cold War.

The record-low first-round turnout is the detail I find most telling. Low turnout in a high-stakes election usually means a large share of the electorate has concluded that neither option represents them. In Bulgaria's case, that probably reflects exhaustion with a choice framed as pro-West versus pro-Russia, when many voters want cheaper energy bills and less corruption regardless of geopolitical alignment. The precedent that comes to mind is Hungary under Orbán, where a government that positioned itself as a bridge between Brussels and Moscow has repeatedly used that stance to extract concessions from both sides. Whether Bulgaria's next president tries the same playbook depends entirely on who wins today.

Concept of the day

Sanctions evasion

Sanctions evasion is when a country or group that has been cut off from the normal financial system finds ways around those restrictions, usually through unofficial channels, front companies, or, increasingly, cryptocurrency. The point is to keep accessing money and goods that the sanctions were meant to block. When evasion works at scale, it weakens the whole logic of using financial pressure as a foreign-policy tool.

In practiceIn Story 1, North Korea's TraderTraitor group stole $6.3 billion from Binance and has already replaced 90% of those tokens. That is sanctions evasion in practice: a country under some of the world's tightest financial restrictions has just replenished its hard-currency reserves through a single cyber operation, bypassing every bank and border control in the process.