Concentric is monitoring the risk of renewed U.S. strikes on Iran after Gulf officials said Washington told them to prepare for attacks as early as Nov. 4, raising the threat of Iranian retaliation against bases, energy sites, and shipping across the Gulf. We are also tracking a constitutional standoff in Poland, where the suspension of the Constitutional Tribunal’s president drew protesters and police to the court in Warsaw. Concentric expects larger crowds at the Independence March on Nov. 11.. Finally, we are assessing the FBI’s attribution to North Korea of a theft from cryptocurrency exchange Binance that the company estimated at $6.3 billion. The attack highlights the risk that hackers who target engineers with privileged access pose to companies well beyond the cryptocurrency sector..
Gulf Officials Say U.S. Warned of Iran Strikes After Midterms
Three senior Gulf officials told MS NOW that the United States had warned Gulf allies to prepare for a short, intense round of strikes on Iran as early as Nov. 4, the day after the U.S. midterm elections. The Wall Street Journal previously reported similar briefings. The officials said Gulf states were urging Washington to de-escalate because they feared Iranian retaliation. A White House official declined to comment on military plans. Secretary of State Marco Rubio said on Oct 31 that President Trump had not made a decision and preferred a diplomatic solution. Qatari mediators arrived in Tehran for talks Oct 30, after Vice President JD Vance sent a letter to Iran’s security chief, Mohsen Rezaei. On Oct 31, Iran’s supreme leader, Mojtaba Khamenei, ordered military commanders to meet any threat with an immediate and geographically unrestricted response, according to a statement on his official Telegram account. Iran also said that day an oil tanker had struck naval mines in a restricted area. The warning followed the U.S. drawdown of diplomatic and military staff across the region, which Concentric reported last week. Concentric assesses there is at least an even chance of renewed U.S. strikes in the week after the midterms if talks stall, and Iranian retaliation against U.S. bases, Gulf energy infrastructure, and shipping would very likely follow. We advise organizations with personnel in Gulf states to review evacuation and shelter-in-place plans before Nov. 4, keep staff away from U.S. military bases and energy facilities, and prepare for sudden airspace closures and flight cancellations. Companies moving cargo through the Strait of Hormuz should confirm war-risk insurance coverage and plan for further delays.
Poland’s Court Standoff Sparks Protests as President Alleges Forced Takeover
Police secured Poland’s Constitutional Tribunal in Warsaw on Oct 30, after the court announced that its longest-serving judge, Anna Korwin-Piotrowska, had suspended its president, Bogdan Święczkowski. Crowds of protesters, many of them supporters of the opposition Law and Justice party, or PiS, gathered to demand his reinstatement. Some cut through the court’s fence, and police detained three people after protesters threw objects at officers. President Karol Nawrocki, a PiS ally, ordered his plane back midflight to Senegal and entered the court after a physical confrontation with judges. He accused Prime Minister Donald Tusk’s government of staging a forced takeover of the court, and Tusk said the court would function in accordance with the law. The dispute began in 2015, when PiS nominees gained a majority on the court. Nawrocki vetoed Nawrocki the current government’s efforts to reform the court, and he refused to swear in five judges whom parliament elected this year, including Korwin-Piotrowska. The standoff continued ahead of Nov. 11, Poland’s Independence Day, when the annual Independence March will gather at 2 p.m. at Dmowski Roundabout in central Warsaw. Marchers will then cross the city along Aleje Jerozolimskie and the Poniatowski Bridge to the National Stadium. Concentric assesses further protests in Warsaw are very likely while the standoff continues, with the largest crowds likely on Nov. 11. Concentric cannot rule out clashes with police near government sites. We advise organizations with offices or traveling personnel in Warsaw to keep staff away from the Constitutional Tribunal and other government buildings, and to expect road closures and heavy police deployments in central Warsaw. Personnel should avoid the Independence March route on Nov. 11 and allow extra time for travel that day.
FBI Blames North Korea for Record $6.3 Billion Binance Crypto Theft
The FBI said on Oct 31 that North Korea carried out an Oct 29 attack on Binance, which the company estimates cost about $6.3 billion. Binance said its initial investigation pointed to a compromised laptop belonging to one of its engineers, but it had since found additional points of breach. Blockchain analysis firm TRM Labs called it the largest cryptocurrency theft on record, about four times the $1.5 billion that hackers stole from the Bybit exchange in February 2025. Most of the money left Binance’s wallets in about 20 minutes across ten blockchains, according to TRM. Binance, the world’s largest cryptocurrency exchange, said it had replaced 90% of the stolen funds with its own money and that a freeze now covered about $3 billion of the stolen assets. About $3 billion of the stolen assets has been frozen, according to Binance, and cryptocurrency prices fell on Oct 30. The FBI attributed the attack to TraderTraitor, a North Korean state hacking unit it also blamed for the Bybit theft, and said it expected the group to launder the funds further. The group increasingly targeted engineers through fake job interviews that used coding tests to infect their computers. In September, security firm SentinelOne found the same group’s malicious software on the laptop of an engineer at an India-based IT services company with no ties to cryptocurrency. The laptop held cloud credentials and source code access. Concentric assesses North Korean groups will likely continue targeting engineers with privileged access, including at companies outside the crypto sector. We advise organizations with engineering teams to treat staff with cloud, source code, or payment access as high-risk users, ban the use of work laptops for outside job interviews and unsolicited coding tests, and require more than one person to approve large or unusual transfers. Companies holding cryptocurrency should review which exchanges and custodians hold their funds and how quickly they can move them.
