A theft of roughly $6.3 billion in cryptocurrency from Binance unfolded largely within 20 minutes on October 29, across wallets on at least ten blockchains, including Bitcoin, Ethereum, Tron, and Solana. Investigators say preparation began at least 36 hours earlier: the attackers tested code and transactions on several wallets, rehearsed the operation, then installed the final code on Binance hot wallets - internet-connected wallets used to process customer withdrawals. Binance halted deposits and withdrawals and says it will cover losses while working with law enforcement. Its initial suspicion of a compromised employee laptop has broadened into an investigation of several possible points of entry.
Crypto-tracing firms TRM Labs and Chainalysis see signs pointing to TraderTraitor, a sophisticated North Korean hacking group, though Binance and law enforcement have not confirmed that attribution. Analysts cite similarities to past attacks, including a suspected compromised staff device, advance rehearsals, and stolen funds mixing with money from a previous exploit linked to North Korean hackers. Companies initially froze about $3 billion; Elliptic estimates roughly $2.8 billion, mostly stablecoins, has been immobilized. Much of the remaining $3.3 billion is Bitcoin, Ether, and XRP, which cannot be frozen directly and may be intercepted only if it reaches an exchange or other service. Investigators report rapid, automated transactions and unfamiliar laundering patterns, suggesting substantial sums could remain beyond recovery.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A Linux kernel use-after-free vulnerability, CVE-2026-98432, can enable remote code execution, and Go 1.24 enables MPTCP by default on Linux, exposing listeners to the demonstrated exploit. Upgrade to a patched kernel; disabling MPTCP in Go is only a fragile mitigation. (groups.google.com)
Scribd disclosed a security incident in which an unauthorized party may have accessed users’ email addresses, partial payment card details, country, issuer, expiry date, and payment history. The company says it secured the affected system, notified authorities, and advises users to watch for phishing. (news.ycombinator.com)
Flock camera searches in Highland Heights fell 95% after a dispatcher was caught misusing the system. The sharp drop followed the discovery of the misconduct. (wkyc.com)
AT Protocol apps can store user data publicly on personal data servers, where it is easy to search and retrieve. Skyreader subscriptions exposed more than 1,300 RSS feeds, including private and paywalled feeds, while other apps also publish messages openly. (melaniekat.com)
At least nine AI developer platforms disclosed breaches in October, with attackers targeting stored credentials and environment variables that grant access to AI services. The incidents point to coordinated agent-driven attacks fueled by the resale of stolen AI access, though investigations are still ongoing. (wiz.io)
The CVE-2026-112816 page requires JavaScript to display properly. The supplied content gives no details about the vulnerability. (cve.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.