Binance Withdrawals Resume, Plus 3 Tech Stories
The Binance $6.3 billion theft is the biggest technology story today, but the useful question isn’t whether cryptocurrency is scary. It’s what happens when a company that holds other people’s assets loses access to its own systems, pauses withdrawals, and then asks customers to trust its recovery plan. Also today: school districts can request enforceable AI privacy terms from Microsoft, Applebee’s shipped a database credential inside its Android app, and Google Sheets is making AI-filled cells a little easier to audit.
Binance is reopening the exit after a $6.3 billion theft
Binance began restoring withdrawals in phases on November 1, starting with major networks and assets including Bitcoin, Ethereum, BNB, Solana, XRP and several stablecoins. On Monday, Reuters reported that customers had withdrawn a net $3.64 billion over about nine and a half hours. That’s a large number, but it represented about 2.1 percent of the exchange’s assets, so the available evidence doesn’t support calling this a run.
The underlying failure is still being investigated. Binance says its internet-connected “hot wallets” were compromised on October 29. A hot wallet keeps funds available for routine deposits, trades and withdrawals. That convenience is exactly why exchanges use one, and exactly why it needs tight limits and multiple independent approval controls. Binance’s preliminary account says a compromised DevOps engineer’s laptop may have let attackers enter a service container and submit unauthorized withdrawals. The company says it has found no evidence that wallet private keys leaked, and it has promised a fuller technical report. Those qualifications matter. We have an early explanation, not a finished postmortem.
Binance says it will cover the loss through its SAFU emergency fund and corporate treasury, and that it had replenished about 95 percent of the affected assets by Sunday. Partners have also frozen roughly $3 billion on-chain. That includes stablecoins whose issuers can block specific addresses, a reminder that “on the blockchain” does not always mean beyond anyone’s control.
I think the distinction readers need is simple: a promise to make customers whole is valuable, but it isn’t deposit insurance. A proof-of-reserves snapshot can show that certain assets exist at a point in time, but it can’t by itself reveal every liability or prove that the operational controls are sound. The real test is whether Binance completes withdrawals, publishes a credible incident report, and explains which control failed badly enough to permit billions of dollars in unauthorized transactions.
If you use Binance, don’t follow “recovery” links from email, text messages or social-media replies. Open the official app or type the site address yourself, confirm that your asset and network are supported, and expect delays while services return. Moving funds to a wallet you control reduces exchange risk, but it replaces that risk with your own responsibility for keys, backups and recovery phrases. A small test transfer before a large one is boring advice. Boring is good when a wrong address is permanent.
Technology is rarely just about the technology
Some of the most important technology stories aren’t product launches at all. They’re about health, privacy, education, law, accessibility, work, and what happens when technology reaches ordinary people. Browse more Raymond Tec News for the stories worth understanding without the hype.
School AI privacy promises can now become contract terms
Beginning November 1, any U.S. school district can ask Microsoft to add a National AI Safety and Privacy Standard to a new or existing agreement. Microsoft negotiated the standard with the American Federation of Teachers and United Federation of Teachers. It says student and educator data won’t be used to train AI models, sold or repurposed; schools retain control over retention and deletion; and AI systems can’t make decisions without human oversight.
That last word, agreement, is the important one. Technology companies publish responsible-AI principles all the time. A contract gives a district something it can enforce, including the ability to end an agreement or seek damages if a vendor breaks the terms. It also creates a concrete question for procurement: what data does the tool collect, who can use it, and can the district make the vendor delete it?
This is not a federal law, and the protection doesn’t automatically appear in every school’s Microsoft contract. Districts have to request it. Parents and educators can reasonably ask whether their district has done so and which products the terms cover. Small businesses buying AI services can borrow the same logic. Vendor assurances are nicer when they’re written into the deal with ownership, deletion, human review and consequences spelled out.
The rules around technology matter too
Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.
Applebee’s put a database credential where anyone could extract it
Applebee’s left a database password inside its Android app, according to reporting by TechCrunch, which says it independently decompiled the app and verified the researcher’s finding. The exposed database included customer names, email addresses, phone numbers, dates of birth, ZIP codes, veteran status, account dates and last-login IP addresses. Dine Brands says the issue has been fixed and that its investigation found no current evidence of unauthorized access. The company has not said how many people were exposed or whether its logs are complete enough to rule access out.
A mobile app runs on the customer’s device, which means curious people and attackers can inspect it. Shipping a working database credential inside the app is therefore less like hiding a key and more like handing out copies with the download. The app should call a server-side service that performs narrowly defined actions; the database credential stays on the server, receives only the permissions it needs, and can be rotated without waiting for users to update an app.
Customers don’t need to panic over information the report doesn’t say was exposed, such as payment-card numbers. They should be alert for messages that use real account details to make a fake Applebee’s offer or “verification” request look convincing. For businesses, the checklist is more direct: scan builds for secrets, restrict database accounts, keep useful access logs, and publish a security-reporting address. More broadly, our guide to preparing for an attack you don’t know about yet explains why limiting access and testing recovery matter even before the exact failure is known.
Technical discovery & auditing
The public page doesn’t tell you much about the machinery behind it. Raymond Tec audits inherited and long-running projects to uncover the plugins, integrations, data, dependencies, and old decisions that determine what the next change will really involve.
Google Sheets gives each AI-filled cell its own sources
Google is rolling out cell-level web citations for Fill with Gemini in Google Sheets. When the AI function uses the web to generate a cell’s value, the source appears with that cell instead of leaving users to guess where a large batch came from. The rollout began October 20 for eligible Business, Enterprise, consumer and education plans with Gemini in Sheets enabled.
This is a useful improvement for catalog cleanup, research tables and other repetitive work. It is not a truth button. A source can be outdated, weak, or correctly quoted and still used to support the wrong conclusion. The practical workflow is to inspect the linked source, spot-check a sample across the sheet, and review every cell that can change a price, customer decision or published claim. Citations make that audit possible. They don’t perform it for you.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
- Binance: Withdrawal services resume in phases (November 1, 2026)
- Binance: Security incident update (October 30, 2026)
- Reuters: Binance says exit rush is slowing (November 2, 2026)
- Microsoft, AFT and UFT: National AI Safety and Privacy Standard (September 9, 2026)
- Microsoft: Districts can request the standard beginning November 1 (October 22, 2026)
- TechCrunch: Applebee’s exposed customer data through an app credential (October 30, 2026)
- Google Workspace Updates: Cell-level citations in Sheets (October 28, 2026)
Photo by Alesia Kozik on Pexels.
