> ## Content Index
> Fetch the complete content index at: https://www.metacurity.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# How North Korean hackers pulled off the biggest crypto heist in history
- URL: https://www.metacurity.com/how-north-korean-hackers-pulled-off-the-biggest-crypto-heist-in-history/
- Published: 2026-10-30T12:55:06.000Z
- Updated: 2026-10-30T12:55:06.000Z
- Description: A suspected compromise of Binance's transaction-signing infrastructure allowed attackers to drain billions of dollars across ten blockchains in minutes, raising troubling questions about the exchange's security controls.
- Author: Cynthia B Brumfield
- Tags: News, Cybersecurity, #no-feature-image

![gold round coin on brown and black box](https://images.unsplash.com/photo-1624438253998-7bb8eca8a3f0?crop=entropy&cs=tinysrgb&fit=max&fm=jpg&ixid=M3wxMTc3M3wwfDF8c2VhcmNofDh8fEJpbmFuY2V8ZW58MHx8fHwxNzkzMzU3OTk0fDA&ixlib=rb-4.1.0&q=80&w=2000)

Photo by [Kanchanara](https://unsplash.com/@kanchanara?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit) / [Unsplash](https://unsplash.com/?utm%5Fsource=ghost&utm%5Fmedium=referral&utm%5Fcampaign=api-credit)

### Metacurity is primarily a reader-supported publication that depends on paid subscribers to keep our daily reports flowing.

If you value our unparalleled daily coverage of the most important cybersecurity developments shaping the security sector, please consider upgrading to a paid subscription today.

Your support will help us continue bringing you the news you need to defend your organizations and batten down the hatches as AI ushers in an unprecedented period of turbulence and uncertainty.

Thank you.

[Upgrade my subscription](#/portal/account/plans)

### On October 29, attackers transferred approximately $6.36 billion from wallets controlled by cryptocurrency exchange Binance across ten blockchains, including Bitcoin, Ether, stablecoins, XRP, and other cryptocurrencies, with most of the theft occurring within a 20-minute time span that followed a mere 36 hours of preparation.

TRM Labs and Chainalysis have attributed the attack to North Korea's TraderTraitor operation with high confidence. The theft dwarfs the $1.5 billion Bybit hack in February 2025, also attributed to TraderTraitor.

The most troubling aspect of the theft may be how the hackers apparently gained the authority to move the funds. Binance said a preliminary investigation points to a compromised DevOps engineer's laptop, with the attacker purportedly gaining access to a service container that enabled unauthorized withdrawals.

Binance says it has found no evidence that private wallet keys were stolen. But the attackers might not have needed those keys if they could induce the systems holding them to sign malicious transactions.

On Ethereum, attackers used EIP-7702, a feature introduced in 2025 that allows wallets to delegate execution to smart contracts. They obtained 50 pre-signed authorizations, using one to turn a Binance hot wallet into an automated mechanism for draining funds.

The attackers subsequently swept additional deposits arriving in the compromised wallet. On other blockchains, they apparently executed transactions bearing valid signatures without needing the same Ethereum mechanism.

The apparent failures point to weaknesses in the infrastructure entrusted with authorizing transactions.

Binance has estimated the total theft at $6.3 billion, including at least $5.5 billion in liquid assets. Tether announced it had frozen at least $1.567 billion in stolen USDT, while Circle froze around $800 million in stolen USDC. World Liberty Financial froze $27 million in stolen USD1, and the Arbitrum Ethereum layer-2 network froze an additional $30.5 million that had moved onto its network.

Estimates of the amount remaining under the attackers' control range from $2.4 billion to $3.3 billion, depending on the accounting and timing of the freezes.

Binance has promised to reimburse affected customers, although questions remain about its ability to cover losses of this magnitude. In any event, reimbursement doesn't resolve the underlying security questions. ([Molly White / Citation Needed](https://www.citationneeded.news/binance-theft/?ref=metacurity.com), [Daisy Wu / South China Morning Post](https://www.scmp.com/business/cryptocurrency/article/3372664/binance-pledges-cover-losses-after-us6-billion-crypto-hack?ref=metacurity.com), [Tom Westbrook / Reuters](https://www.reuters.com/legal/government/blockchain-analysis-firm-trm-says-north-korea-behind-binance-crypto-theft-2026-10-30/?ref=metacurity.com), [TRM Labs](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history?utm%5Fsource=chatgpt.com))

***Related:*** [*Reuters*](https://www.reuters.com/business/polymarket-reports-major-outage-suspends-trading-actions-2026-10-29/?ref=metacurity.com)*,* [*Wired*](https://www.wired.com/story/polymarket-flagship-platform-hack-traders-lose-money/?ref=metacurity.com)*,* [*Bloomberg*](https://www.bloomberg.com/news/articles/2026-10-29/polymarket-halts-trading-after-reports-of-customers-losing-money?ref=metacurity.com)*,* [*Wall Street Journal*](https://www.wsj.com/business/polymarket-investigating-suspicious-trades-on-israel-election-44626e53?ref=metacurity.com)*,* [*Bleeping Computer*](https://www.bleepingcomputer.com/news/security/polymarket-halts-trading-after-crypto-draining-script-breach-25m-traced/?ref=metacurity.com)*,* [*NBC News*](https://www.nbcnews.com/business/consumer/polymarket-trading-halt-hack-wallets-rcna606405?ref=metacurity.com)*,* [*Financial Times*](https://www.ft.com/content/eb2917b8-05e9-4a68-951c-4921c7648419?ref=metacurity.com)*,* [*TechCrunch*](https://techcrunch.com/2026/10/29/binance-pauses-withdrawals-as-hackers-suspected-of-stealing-billions-in-crypto/?mid=1&ref=metacurity.com#cid=3780999)*,* [*The Independent*](https://www.independent.co.uk/news/ceo-los-angeles-donald-trump-b3076069.html?mid=1&ref=metacurity.com#cid=3780710)*,* [*PCMag.com*](https://www.pcmag.com/news/binance-investigates-reports-of-hack-as-billions-in-crypto-get-moved?mid=1&ref=metacurity.com#cid=3780825)*,* [*Bitcoin News*](https://news.bitcoin.com/security/binance-founder-likely-hack-billions-crypto-leaves-exchange-wallets/?mid=1&ref=metacurity.com#cid=3781227)*,* [*Bloomberg News*](https://www.google.com/url?rct=j&sa=t&url=https://www.bloomberg.com/news/articles/2026-10-29/binance-founder-says-possible-hack-of-exchange-bitcoin-falls&ct=ga&cd=CAIyGjUxMjcwYTBmN2VlN2VlYzk6Y29tOmVuOlVT&usg=AOvVaw1akMPdlUe-d6cJS4Siuz8w&mid=1&ref=metacurity.com#cid=3781385)*,* [*r/InfoSecNews*](https://www.reddit.com/r/InfoSecNews/comments/1xj0m77/binance%5Finvestigates%5F58%5Fbillion%5Fhack%5Fas%5Ftether/?mid=1&ref=metacurity.com#cid=3781306)*,* [*CryptoSlate*](https://cryptoslate.com/trumps-crypto-firm-joins-tether-circle-and-ripple-in-2-6-billion-stablecoin-freeze-as-binance-hack-outflows-near-6-billion/?mid=1&ref=metacurity.com#cid=3781308)*,* [*Startups News | Tech News*](https://techstartups.com/2026/10/29/binance-hacked-over-5-6-billion-in-crypto-reportedly-stolen-in-potentially-largest-ever-exchange-heist/?mid=1&ref=metacurity.com#cid=3780987)*,* [*Axios*](https://news.google.com/rss/articles/CBMic0FVX3lxTE83OUdSVGpVR2RxZkhXbHdVcDVzcElOMHl6dmhCN1hQWThicVA0dnpmZTQ0TF91WHU5ejQtNVQtaUFRWU1tU0wxUzZJMnlTaXBYbkpVNkdnNXQwWFM3ajJMdkNLaXFFVDhyemhrQ3RQZnY4eDA?oc=5&mid=1&ref=metacurity.com#cid=3781020)*,* [*Tech Insider*](https://tech-insider.org/crypto-decline-samsung-alphabet-earnings-fed-10-2-dissent-2026/?mid=1&ref=metacurity.com#cid=3780699)*,* [*Invezz*](https://invezz.com/news/2026/10/29/is-binance-being-hacked-billions-leave-hot-wallets-as-tether-and-circle-freeze-funds/?mid=1&ref=metacurity.com#cid=3781164)*,* [*Finbold*](https://finbold.com/binance-confirms-2-54-billion-frozen-after-suspected-record-hack/?mid=1&ref=metacurity.com#cid=3781425)*,* [*Cyber Kendra*](https://www.cyberkendra.com/2026/10/binance-hot-wallet-hack-3-billion.html?mid=1&ref=metacurity.com#cid=3781439)*,* [*BNO News*](https://bnonews.com/index.php/2026/10/binance-investigates-hack-after-billions-moved-from-crypto-wallets/?mid=1&ref=metacurity.com#cid=3781530)*,* [*The Daily Hodl*](https://dailyhodl.com/2026/10/29/5000000000-abruptly-exits-binance-wallets-as-founder-warns-exchange-may-have-been-hacked/?mid=1&ref=metacurity.com#cid=3781540)*,* [*Unchained Crypto*](https://unchainedcrypto.com/binance-says-user-funds-are-completely-safe-after-3-5-billion-drains-from-its-hot-wallets/?mid=1&ref=metacurity.com#cid=3780872)*,* [*BeInCrypto*](https://beincrypto.com/is-binance-being-hacked-customer-funds/?mid=1&ref=metacurity.com#cid=3780792)*,* [*shattered.io*](https://shattered.io/binance-2-billion-outflow-tether-circle-freeze-1-79b-customer-funds-2026/?mid=1&ref=metacurity.com#cid=3781624)*,* [*Security Affairs*](https://securityaffairs.com/202089/hacking/binance-investigates-suspicious-crypto-transfers-worth-up-to-5-8-billion.html?mid=1&ref=metacurity.com#cid=3780719)*,* [*Slashdot*](https://slashdot.org/story/26/10/29/2143222/multi-billion-binance-hack-hitting-crypto-markets?utm%5Fsource=rss1.0mainlinkanon&utm%5Fmedium=feed&mid=1#cid=3780656)*,* [*Cointelegraph.com*](https://cointelegraph.com/markets/binance-hack-rattles-crypto-markets-bnb-bitcoin-slide?utm%5Fsource=rss%5Ffeed&utm%5Fmedium=rss&utm%5Fcampaign=rss%5Fpartner%5Finbound&mid=1#cid=3781576)*,* [*Bitcoin News*](https://news.bitcoin.com/crypto-news/binance-itau-file-crypto-licenses-rivals-exit-brazil/?mid=1&ref=metacurity.com#cid=3781229)*,* [*SQ Magazine*](https://sqmagazine.co.uk/crypto-on-ramp-platforms/?mid=1&ref=metacurity.com#cid=3781021)*,* [*OmniTrace*](https://omnitraceapp.com/reports/binance-outflow-2026-10-29?ref=metacurity.com)*,* [*CNBC*](https://www.cnbc.com/2026/10/30/bitcoin-ether-price-binance-security-scare-rattles-crypto-markets.html?ref=metacurity.com)*,* [*Protos*](https://protos.com/live-binance-suspends-withdrawals-amid-massive-crypto-hack/?ref=metacurity.com)*,* [*nationthailand*](https://www.nationthailand.com/business/digital-assets/40072921?ref=metacurity.com)*,* [*Ynetnews*](https://www.ynetnews.com/business/article/bjmb5f11tme?ref=metacurity.com)*,* [*Digit*](https://www.digit.in/news/general/binance-security-breach-company-freezes-around-rs-28560-cr-in-assets-says-it-will-cover-all-losses.html?ref=metacurity.com)*,* [*Channel NewsAsia*](https://www.channelnewsasia.com/business/crypto-exchange-binance-freezes-assets-after-63-billion-security-breach-6505091?ref=metacurity.com)*,* [*Gulf News*](https://gulfnews.com/business/markets/binance-reports-63-billion-security-breach-freezes-3-billion-in-crypto-1.500729161?ref=metacurity.com)*,* [*Bitcoin Insider*](https://www.bitcoininsider.org/article/binance-reportedly-suspends-withdrawals-amid-reports-large-scale-crypto-hack?ref=metacurity.com)*,* [*CNBC*](https://www.cnbc.com/2026/10/30/billions-in-crypto-frozen-in-binance-hack-heres-what-happens-next-.html?ref=metacurity.com)*,* [*Times of India*](https://timesofindia.indiatimes.com/business/international-business/worlds-largest-crypto-exchange-binance-freezes-2-54-billion-after-suspected-hack/articleshow/135338439.cms?ref=metacurity.com)*,* [*The Indian Express*](https://indianexpress.com/article/world/cryptocurrency-exchange-binance-suspected-hack-suspends-withdrawals-10942817/?ref=metacurity.com)*,* [*RuntimeWire*](https://runtimewire.com/article/binance-says-it-will-cover-all-losses-and-suspends-withdrawa-ead227?ref=metacurity.com)*,* [*Bitcoin News*](https://news.bitcoin.com/security/inside-the-5-8b-binance-hack-whats-confirmed-and-what-isnt/?ref=metacurity.com)*,* [*Political.org*](https://political.org/2026/10/29/binance-freezes-3-billion-in-crypto-assets-after-suspected-hack-that-could-be-largest-in-history/?ref=metacurity.com)*,* [*Bitcoin Magazine*](https://bitcoinmagazine.com/news/bitcoin-price-slides-binance?ref=metacurity.com)*,* [*BBC*](https://www.bbc.com/news/articles/cwg7xp8kx4v5o?ref=metacurity.com)*,* [*CoinDesk*](https://www.coindesk.com/markets/2026/10/30/binance-hacker-splits-usd1-4-billion-of-bitcoin-into-19-wallets-that-no-one-can-freeze?ref=metacurity.com)*,* [*ABC*](https://www.abc.net.au/news/2026-10-30/largest-cryptocurrency-hack-billions-stolen-binance/107327732?ref=metacurity.com)*,* [*Dow Jones Newswires*](https://www.morningstar.com/news/dow-jones/2026102920750/cryptocurrencies-slide-as-news-of-major-hack-spooks-markets?ref=metacurity.com)*,* [*Hindustan Times*](https://www.hindustantimes.com/business/binance-confirms-crypto-heist-biggest-in-history-but-no-one-s-sure-what-broke-101793327637282.html?ref=metacurity.com)*,* [*The Business Times*](https://www.businesstimes.com.sg/wealth/crypto-alternative-assets/binance-halts-withdrawals-suspected-hack-spurs-crypto-sell-vows-cover-all-losses?ref=metacurity.com)*,* [*Bitcoin Insider*](https://www.bitcoininsider.org/article/254-billion-frozen-binance-after-suspected-record-breaking-hack?ref=metacurity.com)*,* [*The Independent*](https://www.the-independent.com/tech/security/bitcoin-binance-hack-price-market-cryptocurrency-b3076092.html?ref=metacurity.com)*,* [*Australian Financial Review*](https://www.afr.com/world/north-america/binance-freezes-3-5b-after-suspected-massive-hack-20261030-p61a06?ref=metacurity.com)*,* [*The Straits Times*](https://www.straitstimes.com/business/crypto-platform-binance-confirms-major-hack-more-than-us2-5-billion-frozen?ref=metacurity.com)*,* [*Cointelegraph*](https://cointelegraph.com/news/binance-hack-may-involve-private-key-misuse-not-theft-blockaid-ceo?ref=metacurity.com)*,* [*Telegraph*](https://www.telegraph.co.uk/business/2026/10/29/crypto-exchange-binance-hit-by-suspected-hack/?ref=metacurity.com)*,* [*NBC News*](https://www.nbcnews.com/business/markets/binance-hack-tether-circle-stablecoins-rcna606445?ref=metacurity.com)*,* [*Bitcoin News*](https://news.bitcoin.com/security/binance-founder-likely-hack-billions-crypto-leaves-exchange-wallets/?ref=metacurity.com)*,* [*Citation Needed*](https://www.citationneeded.news/binance-theft/?ref=metacurity.com)*,* [*TRM Insights*](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history?ref=metacurity.com)*,* [*Associated Press*](https://apnews.com/article/binance-cryptocurrency-security-hack-north-korea-550e9b876550f71f07098494fe735beb?ref=metacurity.com)*,* [*Help Net Security*](https://www.helpnetsecurity.com/2026/10/30/binance-crypto-hack/?ref=metacurity.com)*,* [*The Guardian*](https://www.theguardian.com/business/2026/oct/29/binance-crypto-exchange-hack?ref=metacurity.com)*,* [*Reuters*](https://www.calcalistech.com/ctechnews/article/7owjncwoo?ref=metacurity.com)*,* [*iTnews*](https://www.itnews.com.au/news/binance-freezes-assets-after-us63-billion-heist-630029?ref=metacurity.com)*,* [*Türkiye Today*](https://www.turkiyetoday.com/business/north-korean-hackers-linked-to-record-63b-binance-heist-trm-3231320?ref=metacurity.com)*,* [*Bloomberg*](https://www.bloomberg.com/news/articles/2026-10-30/record-binance-hack-shows-no-crypto-firm-is-too-big-to-breach?ref=metacurity.com)*,* [*Daily Mail*](https://www.dailymail.com/news/article-16251215/Worlds-biggest-crypto-heist-results-hackers-making-6-3billion-exchange-boss-says.html?ref=metacurity.com)*,* [*CoinGape*](https://coingape.com/binance-hack-update-chainalysis-trm-labs-others-blame-north-korea-for-biggest-crypto-theft/?ref=metacurity.com)*,* [*CryptoPotato*](https://cryptopotato.com/pi-networks-pi-token-defies-market-crash-triggered-by-binance-hack/?ref=metacurity.com)*,* [*SecurityWeek*](https://www.securityweek.com/6-billion-binance-hack-bears-hallmarks-of-north-koreas-tradertraitor/?ref=metacurity.com)*,* [*Insurance Journal*](https://www.insurancejournal.com/news/international/2026/10/30/890894.htm?ref=metacurity.com)*,* [*The Independent*](https://www.the-independent.com/tech/bitcoin-price-heist-north-korea-laptop-b3076144.html?ref=metacurity.com)*,* [*Bitcoin News*](https://news.bitcoin.com/security/binance-hack-north-korea-lazarus-tradertraitor/?ref=metacurity.com)*,* [*crypto.news*](https://crypto.news/binance-hack-lazarus-group-north-korea/?ref=metacurity.com)*,* [*Coinpedia Fintech News*](https://coinpedia.org/news/binance-hack-update-ripple-freezes-200-million-as-recovery-hits-3-billion-amid-north-korea-link/?ref=metacurity.com)*,* [*Cointelegraph*](https://cointelegraph.com/news/north-korea-linked-to-63b-binance-hack-by-crypto-investigators?ref=metacurity.com)*,* [*CyberInsider*](https://cyberinsider.com/binance-security-incident-6-3-billion/?ref=metacurity.com)*,* [*GB News*](https://www.gbnews.com/money/binance-north-korean-hackers-steal-billions?ref=metacurity.com)*,* [*CoinDesk*](https://www.coindesk.com/policy/2026/10/29/crypto-s-longtime-foe-north-korea-s-lazarus-group-likely-behind-binance-hack-blockchain-sleuths?ref=metacurity.com)*,* [*Disruption Banking*](https://www.disruptionbanking.com/2026/10/30/does-the-binance-hot-wallet-drain-follow-the-pattern-of-north-koreas-biggest-exchange-thefts/?ref=metacurity.com)*,* [*The Defiant*](https://thedefiant.io/news/hacks/binance-wallet-outflows-widen-to-three-accounts-in-suspected-hack?mid=1&ref=metacurity.com#cid=3780806)*,* [*The Defiant*](https://thedefiant.io/news/hacks/binance-security-incident-withdrawal-status-timeline-and-faqs?mid=1&ref=metacurity.com#cid=3780805)*,* [*The Defiant*](https://thedefiant.io/news/hacks/tether-freezes-971-million-usdt-in-wallet-linked-to-suspected-binance-drain?mid=1&ref=metacurity.com#cid=3780807)*,* [*Glitchwire*](https://glitchwire.com/news/25-billion-leaves-binance-hot-wallets-tether-and-circle-froze-what-they-could/?mid=1&ref=metacurity.com#cid=3781342)*,* [*LADBible*](https://www.ladbible.com/technology/binance-cryptocurrency-exchange-hack-six-billion-073740-20261030?ref=metacurity.com)*,* [*Ciaran Martin on LinkedIn*](https://www.linkedin.com/posts/cyberciaran%5Fone-under-appreciated-aspect-of-modern-cyber-share-7521862559218593792-hM5%5F/?utm%5Fsource=share&utm%5Fmedium=member%5Fios&rcm=ACoAAEMJZKUBY2YaDQaPvnJj5NwUhzFv97Fqn9s)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-99.png)

### Prediction markets platform Polymarket was forced to halt trading on its international platform Thursday for nearly an hour because of what it said was a compromise of third-party software.

There were also unconfirmed reports from users on Polymarket’s Discord channel who said their wallets had been drained.

While Polymarket did not confirm that users had lost money, it said in an X post, “anyone who has been impacted will be made whole.”

“We’ll make this right and are fully reimbursing all affected traders,” the company said in a subsequent post on X.

Polymarket said the attack appeared to emanate from the United Kingdom and that it had referred the matter to British law enforcement authorities.

The hackers gained access to the funds via software from DebugBear, a web analytics and website performance tool, according to a person familiar with the details who was granted anonymity to address an evolving security situation.

DebugBear said on X that it was experiencing an “ongoing security incident” at around 2 p.m. ET Thursday.

Crypto news website The Block reported that some $2.65 million in cryptocurrencies had been siphoned from Polymarket users’ wallets, citing data from blockchain analysis group Arkham. ([Rob Wile / NBC News](https://www.nbcnews.com/business/consumer/polymarket-trading-halt-hack-wallets-rcna606405?ref=metacurity.com))

**Related:** [*The Block*](https://www.theblock.co/news/defi/2026-10-29-polymarket-exploit-2-5-million-cancel-only-mode-432158?ref=metacurity.com)*,* [*Web 3 Is Going Just Great*](https://www.web3isgoinggreat.com/single/polymarket-vendor-exploit-2?mid=1&ref=metacurity.com#cid=3781316)*,* [*Wall Street Journal*](https://www.wsj.com/business/polymarket-pauses-trading-after-some-users-report-funds-drained-b014527d?ref=metacurity.com)*,* [*Gizmodo*](https://gizmodo.com/polymarket-temporarily-froze-trading-after-hackers-reportedly-stole-millions-via-third-party-service-2000832776?ref=metacurity.com)*,* [*Reuters*](https://www.reuters.com/business/polymarket-reports-major-outage-suspends-trading-actions-2026-10-29/?ref=metacurity.com)*,* [*The Guardian*](https://www.theguardian.com/world/2026/oct/29/polymarket-temporarily-suspends-trading-security-incident?mid=1&ref=metacurity.com#cid=3780869)*,* [*The CyberSec Guru*](https://thecybersecguru.com/news/polymarket-frontend-supply-chain-attack-debugbear/?mid=1&ref=metacurity.com#cid=3781335)*,* [*Finance Magnates*](https://www.financemagnates.com/forex/polymarket-links-trading-suspension-to-third-party-security-incident/?mid=1&ref=metacurity.com#cid=3781366)*,* [*BNO News*](https://bnonews.com/index.php/2026/10/some-polymarket-users-report-losing-funds-after-security-breach/?mid=1&ref=metacurity.com#cid=3781531)*,* [*WashingtonExaminer.com*](https://www.washingtonexaminer.com/policy/technology/4785092/polymarket-uk-platform-debugbear-hacked-trading-security-incident/?mid=1&ref=metacurity.com#cid=3780891)*,* [*AndroidHeadlines.com*](https://www.androidheadlines.com/2026/10/binance-crypto-hack-withdrawal-pause.html?mid=1&ref=metacurity.com#cid=3781070)*,* [*Unchained Crypto*](https://unchainedcrypto.com/polymarket-resumes-trading-vows-to-reimburse-traders-after-third-party-provider-compromise/?mid=1&ref=metacurity.com#cid=3780876)*,* [*BeInCrypto*](https://beincrypto.com/polymarket-halts-trading-users-drained/?mid=1&ref=metacurity.com#cid=3780794)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-101.png)

### Mac OS security firm Phorion discovered a compromise of the official Claude Code for VS Code extension on the Cursor Marketplace, where the backdoored extension bundle contains a persistent Secure Shell (SSH) backdoor. 

Cursor has removed the associated release from its marketplace, additionally pulling NPM and VS Code versions for 2.1.313 from their relevant registries.

The Cursor Marketplace serves extensions for the Cursor editor. Because extensions run with the permissions of the IDE and the user running it, a backdoored extension gets immediate access to local files, source code, and developer tooling as soon as its module is loaded.

Notably, Phorion discovered a likely oversight in how the malware tries to turn on SSH. The setup logic assumes it can check the current Remote Login state without root privileges. When run as a standard user, `systemsetup -getremotelogin` prints an administrator-access error and exits with status `0` instead of returning `Off`. Because the script only tries to enable SSH if the output matches `Off`, it skips the enablement step entirely. 

On a Mac that doesn’t already have SSH running, that mistake breaks the inbound access path, even though the SSH keys and persistence still get dropped. While the SSH backdoor bug minimizes impact on macOS, the malware is still a significant threat that installs persistence and beacons host reconnaissance back to the operator.

Phorion says that organizations should immediately review their environments for use of Claude Code for VSCode 2.1.313 and engage incident response where use of the extension is discovered. ([Calum Hall / Phorion](https://phorion.io/blog/offical-claude-code-vsx-compromise/?ref=metacurity.com))

**Related:** [*Double Pulsar*](https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2?postPublishedType=initial&ref=metacurity.com)*,* [*Cursor*](https://cursor.com/blog/claude-code-extension-security-notice?ref=metacurity.com)*,* [*r/ClaudeCode*](https://www.reddit.com/r/ClaudeCode/comments/1xj7d4p/the%5Fofficial%5Fclaude%5Fcode%5Fvs%5Fcode%5Fextension%5Fwas/?ref=metacurity.com)*,* [*Berryville Institute of Machine Learning*](https://berryvilleiml.com/2026/10/30/anthropic-spearheads-supply-chain-attack/?ref=metacurity.com)

### After further refinement, French AI company Mistral now says its new AI model nicknamed Le Chonk is the “world’s best” open-weight model for automated coding and cybersecurity.

The advances, Mistral says, were made possible by feeding the model increasingly difficult cybersecurity and coding problems, which allowed the trillion-parameter Le Chonk to match or surpass models from leading Chinese labs like DeepSeek and Z.ai.

The finalized version of Le Chonk is now freely available for anybody to access. After a flurry of AI-related cybersecurity incidents, Mistral claims that it’s important for the West to have its own advanced open-weight models. “You have no guarantee that \[Chinese models\] won’t behave maliciously. They can be threat vectors,” Pierre Stock, VP of science at Mistral, said. ([Joel Khalili / Wired](https://www.wired.com/story/mistral-says-le-chonk-surpasses-chinese-models-cybersecurity/?utm%5Fmedium=social&utm%5Fsource=bluesky&utm%5Fcampaign=aud-dev))

**Related:** [*ZDNet*](https://www.zdnet.com/innovation/mistral-large-4-weights-release/?ref=metacurity.com)*,* [*Mistral Blog*](https://mistral.ai/news/mistral-large-4-oss/?ref=metacurity.com)*,* [*Fortune*](https://fortune.com/2026/10/29/mistral-releases-new-model-large-4-and-claims-top-open-model-for-agentic-coding-and-cyber-defense/?ref=metacurity.com)*,* [*How-To Geek*](https://www.howtogeek.com/mistral-large-4-weights-released/?ref=metacurity.com)*,* [*TechCrunch*](https://techcrunch.com/2026/10/29/mistral-releases-weights-for-its-trillion-parameter-ai-model-targeting-cybersecurity/?ref=metacurity.com)*,* [*VentureBeat*](https://venturebeat.com/technology/mistral-large-4-le-chonk-arrives-as-the-top-open-model-outside-china-with-improved-coding-performance-and-63-lower-cost-per-task?ref=metacurity.com)*,* [*SiliconANGLE*](https://siliconangle.com/2026/10/29/mistral-releases-open-weights-for-mistral-large-4-providing-sovereign-control-for-the-companys-le-chonk-ai-model/?ref=metacurity.com)*,* [*Implicator.ai*](https://www.implicator.ai/mistral-releases-weights-mistral-large-4-le-chonk-says/?ref=metacurity.com)*,* [*The New Stack*](https://thenewstack.io/mistral-chonk-coding-model/?ref=metacurity.com)*,* [*The Decoder*](https://the-decoder.com/paris-based-mistral-releases-le-chonk-a-strong-coding-model-that-still-trails-china-overall/?ref=metacurity.com)*,* [*Euronews*](https://www.euronews.com/2026/10/29/mistral-releases-latest-ai-model-for-download-giving-companies-more-control-over-their-cyb?ref=metacurity.com)*,* [*Unite.AI*](https://www.unite.ai/mistrals-1-trillion-parameter-le-chonk-checkpoint-lands-on-hugging-face/?ref=metacurity.com)*,* [*The Deep View*](https://www.thedeepview.com/articles/mistral-bets-open-weight-ai-can-win-enterprise?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-103.png)

Mistral Large 4 scores 51% on the Artificial Analysis Cyber Index, which measures a model’s ability to discover vulnerabilities in a codebase, reproduce and validate them, and patch them without breaking existing functionality. Source: Mistral.

### According to sources, a contractor from Accenture caused a security incident at the Department of Defense by connecting a secure centralized system used by multiple intelligence agencies to their personal account for Claude Code, Anthropic’s AI coding agent. 

It appears that the agent used by the contractor then sent information about the DOD system, including login credentials, to a high-risk, third-party website.

The centralized system contains controlled unclassified information (CUI), which is considered sensitive and not to be released to the public without review. CUI can include information about critical infrastructure, nuclear submarine propulsion, and vulnerabilities to chemical and biological terrorism. Additionally, security experts say, access to the system could allow for the exploitation of even more sensitive ones.

“It puts all the data that’s in there at risk,” says a source aware of the incident, who requested anonymity as they were not authorized to speak to the press. If the third-party software was compromised, “there could be somebody out there with the ability to log into a secure environment without anyone knowing. It’s 100 percent a national security threat and could cause irreparable harm.”

A DOD spokesperson said that “the Department does not comment on the status of its networks or systems.”

The Accenture employee is alleged to have connected a secure production environment to their personal Claude account so as to allow an AI agent to write and deploy code. Claude is currently barred from being used by DOD staff. (Anthropic directed WIRED to the company’s usage policy, which instructs users not to use its products to “interfere with the operation of military bases and related infrastructure” or to “bypass security controls such as authentication systems, end point protection, or monitoring tools without authorization.”)

The Accenture employee’s AI agent ran on the DOD network for two months before it was identified and the vulnerability could be patched. Sources indicate that despite the security risks posed by the AI coding agent, Accenture employees did not treat the incident as severe or urgent. DOD employees and federal contractors are required to report any cybersecurity incident within 72 hours of its discovery, but sources indicate Accenture did not initially report the breach to the government at all. ([Vittoria Elliott / Wired](https://www.wired.com/story/a-defense-contractor-gave-their-personal-ai-agent-access-to-a-secure-pentagon-system/?ref=metacurity.com))

**Related:** [*CDO Magazine*](https://www.cdomagazine.tech/us-federal-news-bureau/defense-contractor-gave-personal-ai-agent-access-to-pentagon-system?ref=metacurity.com)*,* [*Tech Times*](https://www.techtimes.co.uk/accenture-claude-code-pentagon-network-access-1809566?ref=metacurity.com)*,* [*Cyber Kendra*](https://www.cyberkendra.com/2026/10/accenture-claude-agent-dod-network-credentials.html?ref=metacurity.com)

### According to an audit by the agency’s Office of Inspector General, the General Services Administration did not effectively protect physical security, personally identifiable data, and general proprietary business information stored within its Google Drive.

In a limited search of GSA’s Google Drive, the OIG found 116 files containing controlled unclassified information, or CUI, that were improperly shared with employees and contractors who did not have a legitimate business reason to know those details. The exposed data included Social Security numbers, phone numbers, proprietary research, vendor proposals, and site plans for a Washington, D.C. building.

GSA IT’s review determined that the identified documents were “not exposed externally” and found “no indication of malicious intent,” according to a response letter from David Shive, GSA’s chief information officer.

The watchdog attributed the improper exposure of sensitive information to “deficiencies” in GSA’s oversight.

The OIG said the agency did not effectively manage a third-party data loss prevention tool, used to prevent and detect CUI exposures.

That tool searches documents shared in GSA’s Google Drive for CUI-related keywords or phrases. If the tool detects CUI, it performs a “pre-designed response,” which could include restricting access to the document, flagging the document to GSA’s Security Operations and Engineering Division, and sending an automated email to the document owner, according to the OIG audit.

But GSA did not fully complete annual reviews of the tool’s search terms to ensure it detected CUI and did not incorporate “many relevant terms” from agency guidance into tool searches, the watchdog concluded. Tool searches also failed to detect documents that included search terms.

GSA also did not implement a tool feature known as optical character recognition that could have prevented CUI exposures, did not document program decisions affecting CUI protection in the Google Drive, and was not aware of the tool’s file size limit of 15 megabytes, OIG wrote.

In addition to mismanagement of the tool, OIG found GSA lacked an approval process for properly sharing sensitive information and a standard naming convention that could help prevent CUI exposures in its Google Drive.

The office gave GSA seven recommendations to prevent future CUI exposures. ([Christian Robles / NextGov/FCW](https://www.nextgov.com/cybersecurity/2026/10/gsa-left-sensitive-information-its-google-drive-exposed-watchdog-finds/416886/?ref=metacurity.com))

**Related:** [*GSA OIG*](https://www.gsaig.gov/content/controlled-unclassified-information-gsas-google-drive-was-improperly-exposed?ref=metacurity.com)*,* [*The Register*](https://www.theregister.com/public-sector/2026/10/29/gsa-left-sensitive-google-drive-files-open-to-staff-contractors/5306430?ref=metacurity.com)*,* [*FEDWeek*](https://www.fedweek.com/federal-managers-daily-report/gsa-still-leaving-employees-personal-information-other-sensitive-data-exposed-says-ig/?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-107.png)

Source: GSA OIG.

###   
Cybersecurity Researcher Jeremiah Fowler discovered a publicly exposed database belonging to a US company called CitySourced that was neither password-protected nor encrypted, containing approximately 42 million documents and 450,000 JSON files containing plaintext PII. 

The exposed records consisted primarily of images of complaints or code violation reports. In a limited sample, Fowler observed names, physical addresses, email addresses, phone numbers, and thousands of internal records dating from 2016 to 2026.

The exposed repository contained numerous top-level application directories, including names such as Api, Content, Customers, Data, Developers, FileStorage, json, Product, Public, Support, Widget, temp, Logs\*\*, and several other operational folders. There were also a number of .sdk and .exe files.

It is not known whether the database was owned and managed directly by the company or by a third-party contractor. According to online sources, CitySourced provides services to local government agencies in approximately 184 unique geographic locations. These include 38 US states and Puerto Rico; Alberta, British Columbia, Newfoundland and Labrador, Ontario, and Saskatchewan in Canada; and the Bahamas and Bermuda in the Caribbean.

Fowler sent a responsible disclosure notice to CitySourced, alerting them to the exposure of millions of records that were accessible to anyone with an internet connection, with no specialized tools needed to view them in a browser. The database was quickly restricted from public access and is no longer accessible at the time of publication. ([Jeremiah Fowler / ExpressVPN](https://www.expressvpn.com/research/citysourced-data-exposed?ref=metacurity.com))

**Related:** [*StateScoop*](https://statescoop.com/report-over-42-million-records-exposed-by-local-government-technology-platform-for-civic-engagement/?ref=metacurity.com)*,* [*Cyber Kendra*](https://www.cyberkendra.com/2026/10/citysourced-data-exposure-leaks-42m-civic-records.html?mid=1&ref=metacurity.com)

### Britain's intelligence agency GCHQ cannot account for the whereabouts of thousands of storage devices which could contain sensitive material, according to an official watchdog.

A report by the Investigatory Powers Commissioner (IPCO) — which polices how Britain’s intelligence agencies use their spying powers — found that a significant number of devices, including USB sticks, hard drives and memory cards, are unaccounted for.

Brian Leveson, the Investigatory Powers Commissioner, said that GCHQ “still cannot tell me what has happened to removable media that may hold sensitive data, years after I first raised it with them.”

He noted that the devices “may contain IPA-related data” — which has a high level of sensitivity.

IPA-related data refers to information collected or held under the Investigatory Powers Act 2016\. That could include intercepted communications such as emails, texts and telephone calls, as well as information extracted from people’s computers or phones.

The report added that GCHQ currently estimates the number of devices “to be in the thousands” and is currently undergoing work so it can report how many of the devices have been confirmed as lost.

“We remain very concerned about this issue and are disappointed with the time it has taken GCHQ to investigate,” the report notes. ([Mason Boycott-Owen / Politico](https://www.politico.eu/article/britains-spy-agency-gchq-doesnt-know-where-thousands-of-its-memory-sticks-are/?ref=metacurity.com))

**Related:** [*IPCO Annual Report*](https://ipco-wpmedia-prod-s3.s3.eu-west-2.amazonaws.com/IPCO%5FANNUAL%5FREPORT%5F2025.pdf?ref=metacurity.com)*,* [*UA.news*](https://ua.news/en/world/gchq-ne-mozhe-znaiti-tisiachi-nosiyiv-danikh-politico-europe?ref=metacurity.com)

### Frontline Education, a leading provider of cloud-based school administration and management software designed for K-12 school districts, teachers, substitutes, and administrative staff, announced that it had begun sending notification letters to people affected by an August 2026 cybersecurity incident.

The exposed data varied by person, but it included Social Security numbers, dates of birth, driver's license numbers, passport numbers, other government IDs, Medicaid IDs, and Student IDs.

Frontline is offering adults in the US two years of credit monitoring and minors' cyber monitoring at no cost through TransUnion. ([Kalleigh Lane / All About Cookies](https://allaboutcookies.org/frontline-education-data-breach?ref=metacurity.com))

***Related:*** [*Frontline Education*](https://www.frontlineeducation.com/news/frontline-education-notice-of-data-breach/?ref=metacurity.com)*,* [*Aviatrix*](https://aviatrix.ai/threat-research-center/australia-amadey-malware-backend-180000-infected-computers/?ref=metacurity.com)*,* [*Databreaches.net*](https://databreaches.net/2026/10/29/student-ssns-and-medicaid-ids-exposed-in-frontline-school-software-breach/?ref=metacurity.com)

### A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets.

Blockchain investigator Iris confirmed that one victim was compromised through the malicious App Store app, but has not determined how the other affected wallets were compromised.

The researcher says the app drains wallets after unsuspecting users import their private keys into it.

Padre was a cryptocurrency trading platform, mainly used to buy and sell meme coins on Solana. It was later renamed Terminal by pump.fun, a platform focused on creating, buying, and selling cryptocurrency “meme coins” on the Solana blockchain.

Iris says the legitimate Padre trading service, now Terminal by pump.fun, is web-only, so any mobile apps impersonating it, including the one previously available on the App Store, are malicious. ([Bill Toulas / Bleeping Computer](https://www.bleepingcomputer.com/news/security/fake-crypto-app-on-apple-app-store-linked-to-23k-wallet-theft/?ref=metacurity.com))

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-102.png)

The malicious crypto drainer app on the App Store. Source: BleepingComputer

### According to researchers at CrowdStrike, Chinese state-linked hackers used artificial intelligence, including the popular DeepSeek model, to launch cyberattacks against more than 200 organizations around the world in just 11 days.

The hackers targeted government agencies, telecommunications providers, and companies in pharmaceuticals, defense, and other industries, compromising at least nine organizations, CrowdStrike said. 

The campaign relied heavily on ARTEX, an AI-powered cybersecurity testing tool, and the Chinese AI model DeepSeek to automate hacking tasks that would otherwise require extensive human involvement. Another unnamed subscription-based AI model was used in addition to DeepSeek, according to CrowdStrike.

ARTEX is an open-source AI tool released in July for cybersecurity testing that manages various AI products. It is used for penetration testing, a crucial cybersecurity practice in which researchers try to hack a website to identify and fix its vulnerabilities. The Chinese hacker group, which CrowdStrike calls VAPOR PANDA and has tracked since 2021, has relentlessly used the tool in the past two weeks against its targets, the report said.

CrowdStrike declined to name the affected organizations, but its report on the campaign said at least nine have been significantly compromised: two UD pharmaceutical companies, a Middle Eastern interior ministry, two Latin American foreign ministries, a Greek government entity and telecommunication companies in the US, Belgium and the Philippines. ([Kevin Collier / NBC News](https://www.nbcnews.com/tech/security/china-linked-hackers-used-ai-target-200-organizations-crowdstrike-says-rcna606343?ref=metacurity.com))

**Related:** [*CrowdStrike*](https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/?ref=metacurity.com)*,* [*Unite.AI*](https://www.unite.ai/china-nexus-vapor-panda-breached-nine-of-200-plus-targets-with-ai-agents/?ref=metacurity.com)

### Andy Yen, the CEO of Proton, had a message for an employee in the company’s security Slack channel who urged the company to at least take a few days to pentest newly written code before pushing it live.

"That’s bullshit and loser thinking. Of course it’s possible to be fast and secure,” Yen wrote in the channel at the end of August. “Stop thinking always of how to be slower, and focus more on how to be faster.”

In a follow-up message, Yen reiterated his point: “only losers think like that.” His ultimate message for the team was to “stop lovingly handcrafting all our code and use AI more.”

That exchange was just one of many that showed how Yen and other company executives are aggressively pushing Proton towards AI. Proton is a Swiss company that famously makes the encrypted email service Proton Mail and a suite of privacy and security-focused products, including an encrypted drive service, an authenticator app, a password manager, and more.

In the last few months, Yen set up an email address for employees to contact if they come across anything blocking adoption of AI at Proton, so leadership can “ruthlessly smash everything that stands in the way of AI velocity.” Proton installed software on workers’ computers that tracks how much AI code the company is generating. Yen said this is the last year that Proton will hire engineers at all, and instead only hire people to build things with AI.

That AI push came to a head this week when 404 Media reported Proton said it would re-interview staff about their use of AI, with the clear implication that those interviews, and employees’ willingness to embrace AI, could decide whether a worker is fired or not. ([Joseph Cox / 404 Media](https://www.404media.co/manifestos-fear-and-loser-thinking-inside-protons-ai-reckoning/?ref=metacurity.com))

**Related:** [*India Today*](https://www.indiatoday.in/amp/jobs/story/proton-says-it-will-stop-hiring-engineers-ai-will-be-used-for-work-tchc-3028349-2026-10-30?ref=metacurity.com)*,* [*r/ProtonMail*](https://www.reddit.com/r/ProtonMail/comments/1xilgwk/manifestos%5Ffear%5Fand%5Floser%5Fthinking%5Finside%5Fprotons/?ref=metacurity.com)

### Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.

Tracked as CVE-2026-118539, this flaw stems from a missing authorization weakness that can be abused by unauthenticated attackers and affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13.

The Drupal security team asked admins on the 3.x branch to upgrade immediately to Commerce Core 3.3.13 (or Commerce Core 8.x-2.41 for earlier versions) and audit orders for inconsistencies, since threat actors are exploiting this vulnerability in attacks.

"This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs," Drupal said in a Wednesday advisory tagged as highly critical.

"The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. This vulnerability is being actively exploited in the wild." ([Sergiu Gatlan / Bleeping Computer](https://www.bleepingcomputer.com/news/security/drupal-warns-of-critical-commerce-core-flaw-exploited-in-attacks/?ref=metacurity.com))

**Related:** [*Drupal*](https://www.drupal.org/sa-contrib-2026-254?ref=metacurity.com)

### A data breach has impacted the Florida Student Financial Aid website, according to the state Department of Education, with the breach involving “unauthorized criminal access” to information on around 4.9 million people, the Florida Department of Education (FLDOE) said.

Personal identifying information, including Social Security numbers, was compromised as a result of the breach.

FLDOE said current financial aid is not at risk and the breach will not impact eligibility for scholarships, grants, or student loans.

The Department said it “immediately activated its cybersecurity response protocols” and worked to contain the incident and secure systems.

At this time, the breach is believed to be limited to the Florida Student Financial Aid website.

Certain websites and online services may experience disruptions as part of the ongoing cybersecurity response, and the Department is working to restore full functionality. ([WCTV](https://www.wcjb.com/2026/10/29/around-49-million-people-possibly-impacted-by-florida-student-financial-aid-data-breach-fldoe-says/?ref=metacurity.com))

**Related:** [*WTSP*](https://www.wtsp.com/article/news/regional/florida/florida-education-department-data-breach-student-financial-aid-49-million-people/67-84b0a500-040d-4c29-bbce-03d50680012c?ref=metacurity.com)*,* [*WFLA*](https://www.wfla.com/news/florida/4-9m-people-affected-by-florida-department-of-education-data-breach-that-includes-social-security-numbers/?ref=metacurity.com)*,* [*WPBF*](https://www.wpbf.com/article/florida-department-of-education-data-breach-affecting-49-million-people-financial-aid/74287584?ref=metacurity.com)

### Best Thing of the Day: Icepick is Back, Baby

The website for the Icepick tool that allowed visitors to search details of more than 41,000 DHS contractors and employees, including workers for the universally-despised Immigration and Customs Enforcement group, which appeared to be suspended yesterday at the registry level, [is totally back online](https://icepicx.is/?ref=metacurity.com) under a new domain.

### Worst Thing of the Day: Tale as Old as Time

Surveillance of an attractive executive at Singapore-based data center company Megaspeed, Alice Huang or Huang Le, a Chinese citizen, [revealed](https://www.nytimes.com/2026/10/29/us/politics/nvidia-china-jensen-huang-trump.html?unlocked%5Farticle%5Fcode=1.MVE.7xnb.7zggwb6DaNFj&smid=nytcore-ios-share&ref=metacurity.com) that she had developed a close relationship with Jensen Huang, Nvidia’s chief executive, and may have been funneling Nvidia trade secrets to Beijing as an espionage asset.

### Bonus Worst Thing of the Day: The Cyber Defenders Are on the Verge of PTSD

Cybersecurity incident responders [are showing signs](https://www.axios.com/2026/10/30/cybersecurity-ai-burnout-human-workers?ref=metacurity.com) of burnout as they battle a barrage of AI-enabled attacks and wade through threat data.

### Closing Thought

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/10/image-98.png)