Daily digest,
Major Binance Hack Results in $6.3 Billion Theft, Recovery Efforts… (+7 more)
Vulnerabilities
Critical CVSS 10.0 GitLab Flaw Exploited on Alpine Linux
A critical vulnerability in GitLab, rated CVSS 10.0, has been against Alpine Linux's GitLab server on October 20 and 21, 2026. The flaw, tracked as CVE-2026-97229, resides in the Onigmo regular expression engine within Ruby, allowing unauthenticated users to execute arbitrary code. The attack involved a newly registered account sending crafted pipeline settings that disrupted GitLab worker processes. Although the attacker attempted to exploit the flaw multiple times, Alpine Linux reported no evidence of successful code execution. CISA added the vulnerability to its KEV list on October 29, 2026, highlighting its status. Organizations running their own GitLab servers are advised to ensure Ruby is patched, as simply updating GitLab is insufficient. The vulnerability was disclosed on October 13, 2026, with a proof-of-concept available the same day.
Ransomware · 2 sources · score 73 · CVE-2026-97229, Akira, XMRig
Critical Linux Kernel Flaw Discovered by AI Poses Major Security Risk
An AI model has identified a critical vulnerability in the Linux operating system, rated 9.8 out of 10 by Linux's security team. This flaw allows attackers to gain full system access via a TCP connection without requiring user action. It affects millions of devices, particularly servers that accept incoming connections. The vulnerability has existed since 2016 but was only recently uncovered. AI tools, such as Anthropic's Claude, demonstrated the ability to exploit this flaw in under an hour. A fix is reportedly available, and users are urged to update immediately. The discovery comes amid a backdrop of previous security incidents involving critical flaws in widely used software. The rapid pace of AI in identifying vulnerabilities raises concerns about the time window for exploitation.
Vulnerability · 2 sources · score 72
Breaches
Major Binance Hack Results in $6.3 Billion Theft, Recovery Efforts Underway
On October 31, 2026, Binance reported a significant security breach resulting in the theft of $6.3 billion in cryptocurrencies, marking it as the largest hack in crypto history. The attack is believed to have been facilitated by a compromised engineer's laptop, allowing hackers to access the platform's systems. Bitcoin's price fell to around $76,700, reflecting a broader market downturn, with Bitcoin trading approximately 4% lower than before the attack. Binance has managed to recover 90% of the stolen assets, utilizing its Secure Asset Fund for Users (SAFU) to cover losses. The exchange plans to resume withdrawal services on November 1, 2026, and has set aside $6.34 billion in company funds to assist in recovery. Law enforcement agencies, including the FBI and Secret Service, are involved in the investigation, with indications pointing to North Korean hackers as the perpetrators. The incident has led to increased scrutiny of exchange security practices and a significant drop in investor sentiment.
Breach · 4 sources · score 77
Binance Suffers $6.3 Billion Theft Amid Security Concerns
On October 29, 2026, Binance confirmed a breach resulting in the theft of approximately $6.3 billion from its hot wallets, affecting Bitcoin, Ethereum, and various tokens. The incident is believed to have involved unauthorized access to the systems of a developer or operations staff member, allowing attackers to initiate withdrawal requests. Binance has frozen about $3 billion of assets and stated that no wallet private keys were leaked. The market reacted sharply, with Bitcoin dropping to around $76,400 and forced liquidations in futures markets totaling $1.5 billion. Charles Hoskinson, founder of Cardano, warned of dangerous code related to the exploit, particularly concerning Ethereum's EIP-7702 delegation feature. The investigation into the breach is ongoing, with a focus on Binance's internal approval systems and potential exploitation of account permissions. The incident has raised significant concerns about custody practices and reserve transparency in the cryptocurrency market.
Breach · 2 sources · score 69
Binance Suffers $6.3 Billion Hack, 90% of Losses Covered
On November 1, 2026, Binance announced it has replenished 90% of the $6.3 billion stolen in a hack attributed to North Korean hackers. The remaining 10% consists of less liquid tokens, which may take longer to source. The company used its own funds, including its Secure Asset Fund for Users (SAFU), to buy back tokens. Following the breach, Binance suspended user withdrawals but plans to resume them on November 2. The attack was described as a 'complex' incident involving a compromised laptop and malware that deleted evidence. Cryptocurrency prices fell in response to the news, raising concerns about the stability of the market. Binance has set aside over $6.34 billion to cover the losses and has taken a new snapshot of assets for proof-of-reserves.
Breach · 3 sources · score 61
Binance Hack Estimated at $6.3 Billion; 90% of Losses Covered
Binance reported a significant security incident with an estimated impact of $6.3 billion, attributed to unauthorized withdrawal transactions facilitated by a compromised employee laptop. The exchange has successfully covered 90% of the losses using corporate funds and its Secure Asset Fund for Users (SAFU). Approximately $3 billion of affected assets have been frozen on-chain, and Binance is collaborating with law enforcement to trace and recover the stolen funds. The remaining 10% of losses are in less liquid tokens, which may take longer to source. Withdrawals were temporarily paused but are expected to resume on November 1, 2026. Binance has confirmed that no wallet private keys were leaked during the incident. The breach has drawn attention to operational security risks within cryptocurrency platforms.
Breach · 3 sources · score 55
BCD Travel Data Breach Exposes 700,000 Records Amid Investigation
BCD Travel Services B.V. reported a data breach stemming from a third-party vulnerability affecting personal information of travelers. The breach, linked to the hacking group ShinyHunters, has led to claims of over 700,000 records being compromised, though BCD has not confirmed this number. The company activated its cybersecurity incident response team and took the affected application offline, while also notifying law enforcement. So far, BCD has not found evidence of misuse of the exposed data. The compromised data may include names, contact details, and travel-related information, raising concerns about identity theft and fraud. Edelson Lechtzin LLP is investigating potential class action claims on behalf of affected individuals. BCD is offering one year of complimentary credit monitoring to those impacted. The breach occurred between May 22 and May 26, 2026.
APT · 2 sources · score 52 · ShinyHunters
Threat actors and malware
StepDrainer Malware Targets 12 Crypto Websites in Coordinated Attack
On October 31, 2026, a coordinated wave of frontend attacks impacted at least 12 cryptocurrency websites, including StonkFun and Pickle Finance. Attackers used StepDrainer malware to redirect users to wallet-draining pages after compromising domain infrastructure. Blockchain security firm Blockaid linked the incidents to StepDrainer, a malware toolkit that facilitates fraudulent wallet connections and transaction approvals. Affected platforms included Flap, Kintsu, and others, with StonkFun confirming its website was compromised but stating that on-chain operations remained unaffected. Users were advised to avoid connecting wallets or signing transactions during the incident. The attack's scope continues to be investigated, with security firms working to gather more data and restore affected services.
Malware · 3 sources · score 63 · Step Drainer, Halloween Campaign, StepDrainer
New on leak sites
84 victims listed on ransomware leak sites by 15 groups in the 24 hours before this issue. The most active:
Also moving
- Ransomware groups: Akira, BianLian, BlackCat, Cl0p, Kraken
- Malware: Andromeda, XMRig, Amadey, Blockaid, Closedquorum
- Campaigns: ConnectWise Supply Chain Compromise, FIMI Campaign, Halloween Campaign, Hong Kong Cybersecurity Attack And Defence Drill 2026, Locked Shields
- CVEs: CVE-2025-31324, CVE-2026-102764, CVE-2026-104935, CVE-2026-109618, CVE-2026-109619
- APT groups: GRU, ShinyHunters
- Vulnerabilities: Heap Buffer Overflow Via Point Cache, Heap Overflow, Out Of Bounds Memory Access Via Svm Import Plugin Vulnerability, Path Traversal, Path Traversal Vulnerability
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.