FBI confirms $6.3B Binance heist; critical LXD/MicroCloud flaw; Polymarket $2.7M theft

FBI officially linked North Korea's TraderTraitor group to a $6.3 billion Binance crypto heist. Critical LXD/MicroCloud flaw allows attackers to impersonate trusted clients. Polymarket traders lost $2.7 million to hijacked script; Northflank platform breach exposed AI API keys.

The FBI officially attributed the $6.3 billion Binance cryptocurrency theft to TraderTraitor, a North Korea-aligned hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899, marking the largest cryptocurrency heist on record.

A CVSS 10.0 flaw in Canonical's LXD and MicroCloud allows remote attackers to impersonate trusted clients without their private key, requiring only network access to the HTTPS API and possession of the target's public certificate.

Polymarket traders suffered approximately $2.7 million in losses after malicious code replaced a third-party page-speed monitoring script, enabling attackers to manipulate signed-in users' positions and funds on October 29.

Cloud hosting platform Northflank disclosed a security breach resulting in unauthorized use of customers' AI API keys, forcing all users to rotate credentials.

NetamLoader malware targeted government Windows 10 systems in Asia with a sophisticated infection chain involving .NET injection techniques.

1. FBI Attributes Record $6.3 Billion Binance Heist to North Korean TraderTraitor Group

Severity: HIGH Affected: Finance

The U.S. Federal Bureau of Investigation has officially attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korea-aligned elite hacking group [1] . The group is also tracked under multiple aliases including Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899 [1] . The FBI, along with the U.S. Secret Service, confirmed this as the largest cryptocurrency heist on record ⚠ ⚠ [2] . This represents a significant escalation in nation-state targeting of cryptocurrency exchanges and validates long-standing attribution links between the group and prior high-value crypto theft campaigns. Sources: [1] The Hacker News [2] BleepingComputer

Review transaction logs for any unauthorized cryptocurrency transfers or suspicious account activity dating back to the breach window

Implement enhanced monitoring on high-value accounts and consider hardware-based key storage if not already deployed

Cross-reference with FBI/CISA threat intelligence feeds for TraderTraitor IOCs and conduct forensic review of systems for lateral movement artifacts

2. Critical LXD/MicroCloud Authentication Bypass Allows Impersonation Without Private Key

Severity: CRITICAL Affected: Technology

A CVSS 10.0 flaw in Canonical's LXD and MicroCloud container platforms allows an attacker to log in as a trusted client without holding that client's private key [1] . To exploit the vulnerability, an attacker must reach the HTTPS API over the network and possess the trusted client's public certificate [1] . Once authenticated, the attacker can act with the privileges of the impersonated client, potentially gaining full control over containerized infrastructure. Sources: [1] The Hacker News

Immediately apply security patches from Canonical for LXD and MicroCloud

Restrict network access to LXD/MicroCloud HTTPS APIs to trusted hosts only; use firewall segmentation

Audit access logs for any suspicious authentication events or certificate-based logins from unexpected sources

Rotate or revoke public certificates of trusted clients if compromise is suspected

3. Polymarket Traders Lose $2.7 Million via Hijacked DebugBear Monitoring Script

Severity: HIGH Affected: Finance

Malicious code on the website of prediction market Polymarket executed on October 29, replacing a third-party page-speed monitoring script from DebugBear with attacker-controlled code [1] . The injected script sold signed-in traders' positions and moved their funds to attackers [1] . Polymarket disclosed it is refunding approximately $2.7 million to affected users [1] . The attack exploited a supply-chain weakness in third-party script loading, allowing attackers to pivot from the monitoring provider into the platform's frontend execution context. Sources: [1] The Hacker News

Rotate all session tokens, API keys, and authentication credentials for any accounts that were active during the October 29 breach window

Implement Subresource Integrity (SRI) and Content Security Policy (CSP) headers to prevent unsigned third-party script injection

Audit all third-party script dependencies and establish code-review gates before script updates are deployed

Monitor for unauthorized transactions or position changes dating to October 29

4. Northflank Cloud Platform Breach Exposes AI API Keys to Unauthorized Use

Severity: HIGH Affected: Technology

Cloud application hosting platform Northflank disclosed a security breach that resulted in unauthorized use of customers' AI API keys [1] . The company is warning all customers to rotate all credentials and secrets stored on its platform [1] . Details on the scope of the breach and the attack vector remain limited, but the compromise of API keys presents risk for further unauthorized access to downstream AI services and customer applications. Sources: [1] BleepingComputer

URGENT: Immediately rotate all API keys, secrets, and authentication tokens stored in Northflank

Review API usage logs on all downstream AI services (OpenAI, Anthropic, etc.) for unauthorized requests or anomalous billing

Implement API rate limiting and IP-based access controls on AI service accounts

Enable audit logging and webhooks to detect unexpected API calls in real time

5. NetamLoader Malware Targets Government Windows 10 Systems in Asia

Severity: HIGH Affected: Government

Kaspersky disclosed details of NetamLoader, a malware targeting government organizations in Asia with a sophisticated infection chain [1] . The malware targets a custom Windows 10 build used exclusively by government entities in Asia and employs .NET injection techniques [1] . The attack represents a focused campaign against government infrastructure with advanced code injection capabilities. Sources: [1] The Hacker News

Cross-reference endpoint telemetry against Kaspersky's published NetamLoader indicators of compromise (IOCs)

Review .NET application loading and module execution logs for unsigned or anomalous injections

Segment government networks from public-facing systems and enforce strict application whitelisting

Deploy behavioral monitoring to detect .NET injection patterns and suspicious process creation chains

Today’s Action Checklist

☐ URGENT: Rotate all Northflank platform credentials, API keys, and secrets

☐ URGENT: Apply Canonical patches for LXD and MicroCloud; restrict network access to HTTPS APIs

☐ Audit LXD/MicroCloud access logs and certificate-based authentication events for unauthorized logins

☐ Review Binance account activity and cryptocurrency transfer logs for anomalies; enable enhanced monitoring on high-value accounts

☐ For Polymarket users: review October 29 transaction history and rotate session/API credentials

☐ Implement Subresource Integrity and CSP headers on web properties using third-party scripts

☐ Cross-reference endpoints against NetamLoader IOCs and deploy .NET injection behavioral detection