Backdoors in official Claude Code extensions
Official Claude Code extensions were found to contain backdoors. The issue raises security concerns for users who install those extensions. (cyberplace.social)
Binance, the world’s largest cryptocurrency exchange, suffered a reported $6.36bn theft across ten blockchains on 29 October, making it the largest crypto heist on record and roughly four times the 2025 Bybit breach. Blockchain intelligence firm TRM Labs attributed the attack with high confidence to TraderTraitor, an elite North Korean hacking unit. Binance’s initial investigation suggests a compromised DevOps engineer’s laptop gave attackers access to a service container, from which they submitted unauthorized withdrawals; the company says there is no evidence that wallet private keys were exposed. Binance temporarily suspended some withdrawals, revoked affected address permissions and began working with law enforcement and blockchain partners. About $3bn of the stolen assets has been frozen, including funds blocked by stablecoin issuers, while the exchange says it will cover customers’ losses. The breach rattled markets, with major cryptocurrencies and crypto-related stocks falling.
The update also reports a cooling UK housing market. Nationwide data shows annual house-price growth slowed to 0.5% in October, from 0.8% in September, its weakest rate since January 2024; prices were unchanged month to month. Higher mortgage costs appear to be weighing on demand, with average fixed-rate mortgages nearing 6%. Nationwide’s chief economist points to an uncertain economic outlook, geopolitical tensions and energy-driven inflation concerns as factors pushing market interest rates higher and keeping mortgage pricing elevated. Weak new-buyer enquiries and declining consumer confidence suggest further near-term softness.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Official Claude Code extensions were found to contain backdoors. The issue raises security concerns for users who install those extensions. (cyberplace.social)
A compromised Claude Code extension version 2.1.313 distributed malware that collected developer device details and attempted to install a persistent SSH backdoor. Anthropic replaced the extension with version 2.1.314, but affected devices may still need remediation. (doublepulsar.com)
A compromised Claude Code extension version 2.1.313 attempted to steal device information and install a persistent SSH backdoor on developer computers. Anthropic replaced the extension, but the update does not remove backdoors from devices already infected. (doublepulsar.com)
Researchers report five full cross-tenant compromises in Azure linked to a common underlying weakness. The cases highlight risks to tenant isolation in Microsoft’s cloud platform. (binarysecurity.no)
A compromised Claude Code for VS Code extension, version 2.1.313 on the Cursor Marketplace, installed a persistent SSH backdoor and sent host information to attackers across macOS, Linux, and Windows. Cursor removed the release; organizations should check for the affected extension and investigate any installations. (phorion.io)
The provided content claims North Korea stole $6.36 billion from Binance in the largest hack in history, but includes no details to substantiate the claim. The page is dated October 29, 2026. (trmlabs.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.