Backdoors in official Claude Code extensions
Official Claude Code extensions were found to contain backdoors. The issue raises security concerns for users who install those extensions. (cyberplace.social)
The record concerns a suspected theft from a Binance hot wallet, with the heading identifying a new recipient account and alleging that it had been funded through Tornado Cash. Its central detail is a successful Ethereum transaction on October 29, 2026, involving 167,464.247856558836135296 ETH, valued at about $378.32 million at the time. The decoded transfer labels Binance 14 as sending the funds to an account named “Suspect Binance Hot Wallet Exploiter 2,” linking the transaction to a suspected large-scale wallet drain.
The transaction fields show a more complicated call path: the top-level sender is the suspect-labeled address, while Binance 14 is listed as the address it interacted with; the decoded action describes the ETH moving from Binance 14 to the suspect. The transaction has 64 logs and is marked successful. These details establish the scale, destination label, and recorded movement of funds, but the displayed transaction does not itself show how the suspect account was funded or document its connection to Tornado Cash. That link is asserted in the heading rather than demonstrated in the transaction details provided.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Official Claude Code extensions were found to contain backdoors. The issue raises security concerns for users who install those extensions. (cyberplace.social)
A compromised Claude Code extension version 2.1.313 distributed malware that collected developer device details and attempted to install a persistent SSH backdoor. Anthropic replaced the extension with version 2.1.314, but affected devices may still need remediation. (doublepulsar.com)
A compromised Claude Code extension version 2.1.313 attempted to steal device information and install a persistent SSH backdoor on developer computers. Anthropic replaced the extension, but the update does not remove backdoors from devices already infected. (doublepulsar.com)
Researchers report five full cross-tenant compromises in Azure linked to a common underlying weakness. The cases highlight risks to tenant isolation in Microsoft’s cloud platform. (binarysecurity.no)
Binance suffered a $6.3 billion security breach, described as the largest cryptocurrency theft on record, and froze withdrawals. Blockchain intelligence firm TRM blamed North Korea’s TraderTraitor hacking unit; Binance said it was working with law enforcement and that customer funds were safe. (theguardian.com)
A compromised Claude Code for VS Code extension, version 2.1.313 on the Cursor Marketplace, installed a persistent SSH backdoor and sent host information to attackers across macOS, Linux, and Windows. Cursor removed the release; organizations should check for the affected extension and investigate any installations. (phorion.io)
Today's best Hacker News stories, summarized and screenshotted, one email a day.