On October 29, 2026, roughly USD 6.36 billion in cryptocurrency was transferred from Binance wallets across ten blockchains, making the incident the largest crypto theft recorded. Most of the funds moved within about 20 minutes, with additional transfers later that evening. TRM attributes the attack with high confidence to TraderTraitor, North Korea’s elite hacking unit, citing similarities to earlier North Korea-linked heists, including advance preparation, small Tornado Cash withdrawals, and signatures arranged before the theft. Binance confirmed a security incident, suspended withdrawals on several networks, and said customer funds were safe.
The Ethereum attack used 50 pre-signed EIP-7702 authorizations to give an attacker-controlled contract sweeping control of a Binance hot wallet; other compromised wallets sent ordinary signed transfers across multiple chains. Because valid transactions came from wallets using different signing systems, TRM assesses that the attacker likely accessed Binance’s hot-wallet signing infrastructure, though Binance had not disclosed a root cause. Ethereum accounted for about USD 3.79 billion of the stolen value, with major losses also involving Bitcoin, Tron, XRP, and Solana. Stablecoin issuers and Arbitrum froze approximately USD 2.7 billion, while the attacker raced those interventions by selling USDT and borrowing ETH. More than 420,000 ETH and 18,270 BTC - about USD 2.4 billion - remained beyond issuers’ freezing powers as tracking and investigation continued.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Hackers stole about $6.3 billion in cryptocurrency from Binance wallets across at least 10 blockchains, draining most of it in roughly 20 minutes. Investigators suspect North Korea’s TraderTraitor group; Binance and other firms have frozen about half the funds, while much of the rest may be unrecoverable. (wired.com)
Official Claude Code extensions were found to contain backdoors. The issue raises security concerns for users who install those extensions. (cyberplace.social)
A compromised Claude Code extension version 2.1.313 distributed malware that collected developer device details and attempted to install a persistent SSH backdoor. Anthropic replaced the extension with version 2.1.314, but affected devices may still need remediation. (doublepulsar.com)
A compromised Claude Code extension version 2.1.313 attempted to steal device information and install a persistent SSH backdoor on developer computers. Anthropic replaced the extension, but the update does not remove backdoors from devices already infected. (doublepulsar.com)
Researchers report five full cross-tenant compromises in Azure linked to a common underlying weakness. The cases highlight risks to tenant isolation in Microsoft’s cloud platform. (binarysecurity.no)
Binance suffered a $6.3 billion security breach, described as the largest cryptocurrency theft on record, and froze withdrawals. Blockchain intelligence firm TRM blamed North Korea’s TraderTraitor hacking unit; Binance said it was working with law enforcement and that customer funds were safe. (theguardian.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.