Binance’s hot wallets were drained across 11 blockchains on October 29, with Elliptic estimating the theft at $6.43 billion and most funds moved within about 20 minutes. Transfers included 233.46 million XRP, large amounts of SOL and OP, and billions in assets across Ethereum and other networks. Binance estimated roughly $6.3 billion was affected, said about $3 billion had been frozen or intercepted, and pledged to cover the losses. Circle and Tether froze substantial amounts of USDC and USDT. The FBI attributed the attack to the TraderTraitor group.
Binance’s November 3 account traced the initial foothold to a fake job interview that led an engineer to install malicious code on a work computer. The attacker reportedly used an internal AI tool to expand access, stole credentials, and deployed a container from another engineer’s machine before reaching the wallet-signing service. The evidence points to abuse of Binance’s signing systems, not proof that private keys were stolen. The report does not explain how the container gained access, why the signer accepted unauthorized requests, or how valid signatures were obtained across chains. Binance’s CEO incorrectly described EIP-7702 as a multisignature protocol; the Ethereum feature enabled wallet delegation but cannot account for Bitcoin transfers. An independent security review was still pending.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Penlink’s Webloc, which uses advertising data for surveillance, has been purchased by security agencies across multiple countries. Citizen Lab warns the system enables intrusive mass surveillance, with particular risks in authoritarian states. (citizenlab.ca)
Nvidia chips reportedly reached China in large quantities after Commerce Secretary Howard Lutnick declined to enforce export controls and failed to replace them. Lutnick should resign, the author argues, over the resulting national security risks. (nytimes.com)
DOC-foundry uses AI agents to create Sigma security detection rules, then has a simulated attacker test them. A deterministic referee checks coverage before a stakeholder review chain approves the rule and records its review trail. (github.com)
The FBI warns that the FaceStealer scheme targets cryptocurrency holders and steals their funds. Treat unsolicited offers and links with caution, and verify crypto services before sharing information or sending money. (fbi.gov)
Cloudflare’s abuse-reporting page is reportedly blank, leaving visitors unable to use the form it directs them to. The page is intended for reporting abuse hosted through Cloudflare. (news.ycombinator.com)
Home Assistant stores refresh-token secrets and signing keys in plaintext, while some tokens never expire and survive password changes. Anyone who obtains the configuration directory or a backup can retain access to the home, and restoring a backup can revive old tokens. (seclists.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.