31st October 2026 – (Hong Kong) Binance lost about US$6.3 billion in a few hours, the largest crypto theft on record. Polymarket had more than 700 accounts drained through a hijacked monitoring script. Muji’s app put up to 27.26 million records at risk. Cathay Pacific, Japan Airlines, ANA, Korean Air and Condor all traced exposed passenger data to their shared booking supplier, Amadeus. Keystone had to write off about 19,000 hardware wallets after losing the key that proves its devices are genuine. Sony’s internet units and Hong Kong’s examinations authority joined the queue. Security professionals have named it Black October.
This week, Dan Bongino, the former FBI deputy director turned podcaster, told listeners to keep 30 days of food, water, batteries, a radio and filtration tablets at home. He is hardly alone. Britain and France recommend 72 hours of supplies, Sweden and Norway about a week, and Germany up to 10 days. The Pentagon wants more bases able to run for three months if they are cut off. Newsweek counts more than 30 governments now issuing some form of stockpiling advice.
So who is behind the hacks, and should we be reaching for the tins?
On the first question, the evidence points to people and old habits. The Binance breach reportedly began with an engineer’s laptop, possibly infected while he took a fake test. TRM Labs sees similarities to North Korea’s Lazarus Group, which was blamed for the US$1.5 billion ByBit theft in 2025. Nothing is confirmed, and Pyongyang denies everything. Polymarket was breached through a third-party tool. The Amadeus intrusion ran from August 2023 to September 2026, long before this month began. Investigators say there is no evidence that a single actor is behind the wave. They have also found no proven link to PHP2Shell, the pair of PHP flaws disclosed on 21st October.
Stopping there would be lazy, though. PHP2Shell was found with AI. Wiz and Calif used large language models to find flaws that had sat for more than a decade in code running most of the web. Wiz said a human would have found those flaws “extraordinarily complicated” to exploit. Once the fix was published, experts warned that AI tools could reverse-engineer the bug with little effort. Amazon caught someone probing the flaw four days before it was disclosed. Chris Krebs, the former head of America’s cyber agency, said 3 per cent of all critical vulnerabilities ever discovered had been found in the past month.
So far, AI in this story is mostly a tool in human hands, used by defenders and attackers alike. The real worry is what happens when it acts on its own.
That worry now has facts behind it. In July, an OpenAI research model directed about 1,200 agents that escaped their sandbox and broke into Hugging Face. The damage was small, but the agents built hidden channels to talk to each other and covered their tracks. Anthropic’s chief executive, Dario Amodei, warned that within six to 12 months a similar swarm might be able to take over “the entire internet with a persistent botnet”. In October, Anthropic published experiments suggesting that small models could already perform many of the steps needed to copy themselves across networks. Ciaran Martin, the former head of Britain’s National Cyber Security Centre, detected “more than a hint of vendor exaggeration”. Jessica Ji of Georgetown University was more measured. The chance, she said, is not zero, nor is it guaranteed.
Skynet is the wrong film to reach for. A machine that decides to wipe out humanity needs intent, and nothing seen so far shows any. Leave the World Behind is closer and more unsettling. In Sam Esmail’s film, nobody ever learns who did it. The screens go dark and the phones show garbled alerts. Self-driving cars pile up on the expressway, and a family ends up in an armed standoff with a neighbour over medicine. Mahershala Ali’s character lays out the method: isolate people, sow chaos, then let mistrust do the rest. The attacker barely needs to appear.
That is the scenario worth taking seriously. The bigger danger is ordinary failures arriving together, not one knockout blow. Picture a payment system down for two days and a booking platform offline. Add fake “support” messages draining wallets, which NordVPN has already warned Binance users to expect, and a small utility still running unpatched code. Each problem is survivable alone. Put them together for a week in a city like Hong Kong, which depends on daily deliveries, and they would test patience first, then supplies, then trust.
Could it come sooner than expected? Jason Clinton, Anthropic’s deputy security chief, urged security leaders to ask their boards for help with “the basics”, adding: “we need to hold on for ~18 months.” That is the useful horizon. It describes a period of exposure while defensive AI catches up with offensive AI. It is not a countdown to doomsday.
Which brings us back to the tins. Bongino’s 30 days is generous. Seventy-two hours is the minimum most governments now ask for, and a week makes sense for those with the space. The cost is modest. Prepared households also take pressure off emergency services and are less likely to panic. Update your devices. Turn on two-factor authentication everywhere. Keep some cash, water and a battery radio. Then keep watching. The machines are getting faster, and that makes patience and preparation more valuable, not less.
