Back Rodtrent.Substack

Security Check-in Quick Hits: North Korea's Record $6B+ Binance Heist, Supply

Rodtrent.Substack • November 1, 2026

North Korean TraderTraitor Behind Record $6 Billion+ Binance Cryptocurrency Heist

On or October 29, 2026, attackers drained more than $6 billion (estimates range from roughly $6.3–$6.43 billion) in virtual assets from Binance hot wallets across multiple blockchains in a matter of minutes. The FBI formally attributed the theft on October 31 to North Korea’s TraderTraitor campaign (also tracked as Jade Sleet, UNC4899, Slow Pisces, and related Lazarus-linked activity), the same cluster previously tied to the roughly $1.5 billion Bybit theft.

The bureau, working with the U.S. Secret Service and IRS-CI, observed the actors converting stolen funds primarily into Ethereum and expected further laundering through DeFi protocols and instant-swap services. It published wallet addresses and urged virtual-asset service providers, node operators, and analytics firms to block related transactions.

Binance has stated it is covering the losses from its own reserves (reports of 90–95% replenished), has begun phased resumption of withdrawals, and continues investigating entry points that include a compromised DevOps engineer’s laptop. The incident is the largest publicly known crypto theft on record and underscores North Korea’s continued reliance on state- cyber theft to generate hard currency.

Key takeaway: Hot-wallet key hygiene, multi-party controls, and rapid freezing coordination remain essential; attribution and laundering tracking are already under way.

Polymarket Users Lose ~$2.7 Million via Hijacked DebugBear Monitoring Script

On October 29, a compromised real-user monitoring (RUM) script served from DebugBear’s CDN was loaded on Polymarket’s international site. The malicious JavaScript (replacing a legitimate page-speed script) ran in the context of logged-in sessions, read local storage for authentication parameters and trading API keys, located the in-page trading client, sold or transferred positions, and moved proceeds to an attacker-controlled wallet.

The script was active for roughly 50–60 minutes. Independent analyses put the haul at approximately $2.6–$2.7 million (around 28.6 million POL plus positions) from roughly 700–737 wallets. Polymarket confirmed a third-party provider compromise, removed the script, paused trading briefly, and has been refunding affected users (reports of ~95% of the directly impacted wallets repaid, plus additional compensation related to the pause).

DebugBear’s domain/DNS appears to have been the vector; the payload was tailored specifically to Polymarket and did not appear to target other customers. No smart-contract or core server compromise was required—the attack abused the trust placed in a third-party script running with the same origin authority as the application.

Key takeaway: Strict Content Security Policy, subresource integrity, and minimizing third-party script privileges in authenticated financial apps would have limited the blast radius.

Malicious Claude Code Extension on Cursor Marketplace Plants SSH Backdoor

For approximately 11 hours on October 29 (roughly 2:27 a.m. to 1:35 p.m. PT), Cursor’s VS Code extension marketplace served trojanized versions of the Anthropic Claude Code extension (versions 2.1.312 and 2.1.313). These were not published by Anthropic and were not present on the official Microsoft or Open VSX marketplaces.

The injected loader collected host and user details, appended an attacker-controlled SSH public key (commented as “svc-telemetry”) to ~/.ssh/authorized_keys, attempted to enable the local SSH service, established a reverse SSH tunnel, and installed platform-specific persistence (LaunchAgent on macOS, scheduled task on Windows, cron on Linux). Cursor estimated at most 5,000 users were potentially affected and advised that simply uninstalling the extension may leave the backdoor artifacts in place.

Microsoft Threat Intelligence and others have published detailed analyses. Successful remote access often required elevated privileges that most installations lacked, but the key and persistence mechanisms could still be written.

Key takeaway: Marketplace integrity, extension signing/verification, and post-install behavioral monitoring remain weak points in the developer-tool supply chain.

Critical CVSS 10.0 Vulnerabilities Under Active Exploitation (GitLab, PHP2Shell/Palo Alto, LXD)

A cluster of maximum-severity flaws is seeing real-world activity, with CISA KEV deadlines falling on or around November 1.

GitLab CVE-2026-97229 (CVSS 10.0): Unauthenticated remote code execution via a crafted regular expression in CI/CD configuration (rooted in the Ruby/Onigmo engine). Alpine Linux disclosed an attempted exploitation against its own instance on October 20–21; it found no confirmed success but rebuilt the server from scratch. CISA added the flaw to the KEV catalog on October 29 with a federal remediation deadline of November 1. Self-hosted instances running their own Ruby (rather than GitLab’s bundled runtime) remain exposed even after a GitLab upgrade until the underlying Ruby is also patched.

PHP2Shell (CVE-2026-109618 / CVE-2026-109619) chained with Fragnesia (CVE-2026-46300): Attackers (reportedly China-nexus) used a custom exploit against internet-exposed Palo Alto Networks PAN-OS management interfaces, chaining the PHP memory-corruption bugs with a Linux kernel privilege-escalation flaw to obtain root on roughly two dozen firewalls (some tied to U.S. government-affiliated organizations) and then pivot further. Palo Alto has confirmed active exploitation of exposed management interfaces and released hotfixes across affected branches. Management interfaces should never be internet-facing.

LXD / MicroCloud CVE-2026-112816 (CVSS 10.0): Improper certificate validation in the HTTPS listener allows an unauthenticated attacker who possesses a trusted client’s public certificate to impersonate that client and gain full cluster and VM access (potentially host root if the impersonated identity is privileged). Fixed versions have been released; exposure of the API is the primary risk factor.

Additional active issues include chained Ivanti Connect Secure flaws and a Cisco ASA/FTD SSL VPN denial-of-service vulnerability also recently added to the KEV catalog.

Key takeaway: Prioritize internet-exposed management interfaces and self-hosted DevOps platforms; verify both application and underlying runtime patches, then hunt for webshells and persistence.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Hackers Steal $6.3 Billion from Binance in Record Cyber Heist On October 29, 2026, Binance, the world's largest cryptocurrency exchange, suffered a massive cyberattack attributed to North Korean hackers known as TraderTraitor, resulting in the theft of approximately $6.3 billion in digital assets. The attackers exploited vulnerabilities in Binance's hot wallet system, allowing unauthorized withdrawals across multiple blockchains. The FBI confirmed the involvement of TraderTraitor, a group linked to previous high-profile hacks, including the $1.5 billion Bybit theft. Binance reported that it has replenished 95% of the stolen assets using its own funds, including its Secure Asset Fund for Users (SAFU). As of November 1, 2026, Binance began restoring withdrawals in phases, with a significant spike in customer withdrawals observed. Approximately $3 billion of the stolen assets have been frozen through cooperation with law enforcement and industry partners. The incident has raised concerns about the security of centralized exchanges and the ongoing threat of state-sponsored cybercrime. 222 sources 78

Extracted Entities

Security Check-in Quick Hits: North Korea's Record $6B+ Binance Heist, Supply

The full story

Extracted Entities

APT Groups (3)

Campaigns (1)

Companies (4)

Countries (2)

CVEs (5)

Malware (1)

MITRE ATT&CK (3)

Platforms (8)