Backdoors in official Claude Code extensions
Official Claude Code extensions were found to contain backdoors. The issue raises security concerns for users who install those extensions. (cyberplace.social)
The Ethereum address is labeled “Binance Hot Wallet Exploiter 2” and is presented in connection with a reported $2.5 billion drain from a Binance hot wallet. Its displayed Ethereum token holdings total about $2.274 billion across 63 assets, with another roughly $3.88 million in ETH. The largest holdings are stablecoins: about $975 million in USDT and $823 million in USDC. Other substantial positions include roughly $76 million in wrapped Binance ETH, $50 million in Tether Gold, $47 million in Uniswap, $41 million in Ethena, and $38 million in Pepe.
The address page shows 22 transactions, with activity beginning about an hour before the displayed snapshot and several transfers in the minutes immediately before it. It also identifies Binance as the address’s funder. The wallet’s holdings extend beyond Ethereum: a multichain estimate puts its portfolio near $2.34 billion, including balances on Arbitrum, Avalanche, Optimism, and Base. The available transaction list does not explain how the assets were taken or establish the full sequence of events; it offers a snapshot of the address’s balances, labels, funding information, and recent on-chain activity.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Official Claude Code extensions were found to contain backdoors. The issue raises security concerns for users who install those extensions. (cyberplace.social)
A compromised Claude Code extension version 2.1.313 distributed malware that collected developer device details and attempted to install a persistent SSH backdoor. Anthropic replaced the extension with version 2.1.314, but affected devices may still need remediation. (doublepulsar.com)
A compromised Claude Code extension version 2.1.313 attempted to steal device information and install a persistent SSH backdoor on developer computers. Anthropic replaced the extension, but the update does not remove backdoors from devices already infected. (doublepulsar.com)
Researchers report five full cross-tenant compromises in Azure linked to a common underlying weakness. The cases highlight risks to tenant isolation in Microsoft’s cloud platform. (binarysecurity.no)
Binance suffered a $6.3 billion security breach, described as the largest cryptocurrency theft on record, and froze withdrawals. Blockchain intelligence firm TRM blamed North Korea’s TraderTraitor hacking unit; Binance said it was working with law enforcement and that customer funds were safe. (theguardian.com)
A compromised Claude Code for VS Code extension, version 2.1.313 on the Cursor Marketplace, installed a persistent SSH backdoor and sent host information to attackers across macOS, Linux, and Windows. Cursor removed the release; organizations should check for the affected extension and investigate any installations. (phorion.io)
Today's best Hacker News stories, summarized and screenshotted, one email a day.