Blockchain intelligence firms TRM and Chainalysis attribute a theft affecting about $6.3 billion in Binance assets to TraderTraitor, a North Korean hacking group. TRM says roughly $6.36 billion was moved from Binance wallets across ten blockchains, mostly within 20 minutes, making it potentially the largest cryptocurrency theft on record. The firms cite similarities to earlier North Korea-linked attacks, including the 2025 Bybit hack. Binance says it has worked with partners to freeze about $3 billion in affected assets and is starting to recover assets for users. Deposits remain available, withdrawals are temporarily suspended, and the exchange says it will cover all losses.
Binance’s initial investigation pointed to a compromised laptop, but it later identified additional possible breach points. The company says it has found no evidence that wallet private keys were leaked and is working with law enforcement to identify those responsible. A cybersecurity executive questioned whether approval controls were adequate, suggesting that one authorization may have given an attacker lasting, unrestricted access to a hot wallet. The breach comes amid a broader pattern of North Korean cyber theft: experts say illicit digital-asset operations help the country obtain foreign currency despite sanctions and support its nuclear program. Binance founder Changpeng Zhao, who no longer runs the company, said user funds were safe and expected them to be fully covered.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A Linux kernel use-after-free vulnerability, CVE-2026-98432, can enable remote code execution, and Go 1.24 enables MPTCP by default on Linux, exposing listeners to the demonstrated exploit. Upgrade to a patched kernel; disabling MPTCP in Go is only a fragile mitigation. (groups.google.com)
Scribd disclosed a security incident in which an unauthorized party may have accessed users’ email addresses, partial payment card details, country, issuer, expiry date, and payment history. The company says it secured the affected system, notified authorities, and advises users to watch for phishing. (news.ycombinator.com)
Flock camera searches in Highland Heights fell 95% after a dispatcher was caught misusing the system. The sharp drop followed the discovery of the misconduct. (wkyc.com)
AT Protocol apps can store user data publicly on personal data servers, where it is easy to search and retrieve. Skyreader subscriptions exposed more than 1,300 RSS feeds, including private and paywalled feeds, while other apps also publish messages openly. (melaniekat.com)
At least nine AI developer platforms disclosed breaches in October, with attackers targeting stored credentials and environment variables that grant access to AI services. The incidents point to coordinated agent-driven attacks fueled by the resale of stolen AI access, though investigations are still ongoing. (wiz.io)
The CVE-2026-112816 page requires JavaScript to display properly. The supplied content gives no details about the vulnerability. (cve.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.