> ## Content Index
> Fetch the complete content index at: https://www.metacurity.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Suspected cyberattacks turn European supermarket freezers into ovens
- URL: https://www.metacurity.com/suspected-cyberattacks-turn-european-supermarket-freezers-into-ovens/
- Published: 2026-11-02T15:38:23.000Z
- Updated: 2026-11-02T15:38:23.000Z
- Description: Refrigeration systems at grocery chains across six countries malfunctioned, with some freezer temperatures soaring to 122°F, forcing stores to discard food and raising concerns about vulnerable legacy software.
- Author: Cynthia B Brumfield
- Tags: Cybersecurity, News, #no-feature-image

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/11/Mahdia-_Tunisia_January_2024_-_Carrefour_Market_refrigerator_case-1.jpg)

Source: [Sharon Hahn Darlin](https://www.flickr.com/photos/sharonhahndarlin/53471708165/?ref=metacurity.com).

### Supermarkets across Europe were hit by suspected cyberattacks that resulted in sudden changes in the temperatures of their fridges and freezers on Monday, echoing a more widespread problem in France last month.

Incidents were reported in Belgium, Ireland, Sweden, Finland and Estonia.

Ahold Delhaize NV, Carrefour SA and Spar reported issues with their refrigerators and freezers in shops in Belgium. Supermarket chains in Sweden, Ireland and Finland were also affected, causing grocers to throw away food, according to spokespeople and local media reports.

A spokesperson for Danish maker of refrigeration systems Danfoss said the incidents across Europe involved its products, as was the case in France in October. There, some 700 stores were hit by cyberattacks that disabled refrigeration systems and forced shops to throw out damaged food. The Intermarché, Coopérative U and Carrefour chains were among those impacted. No group has publicly claimed responsibility for the hack.

If the latest incidents are indeed cyberattacks, the equipment may have remained vulnerable if it is using legacy software that can’t be patched.

Dutch retailer Ahold Delhaize confirmed that an “IT incident” took place in a number of its Delhaize shops in Belgium on Sunday night, impacting the refrigeration systems. A spokesperson for Carrefour Belgium said 15 of its 700 outlets were impacted. A spokesperson for Spar, a Dutch chain, said refrigeration in around five of its stores was hit.

In Ireland, a spokesperson for Musgrave Group said a cyber incident has affected refrigeration systems in 13 of its SuperValu sites. Chilled and frozen products in the affected stores have been removed from sale as a precaution.

Several supermarkets of the ICA and Coop chains in Sweden are seeing higher temperatures in freezers. At Ica Kvantum in Sjöbo, the freezers’ temperature has been raised to 50C (122F), the store said on its Facebook page, adding that it suspects a hack.

“We are aware that a limited number of stores were affected by an incident overnight, which impacted their refrigeration and freezer systems,” an ICA Sverige spokesperson said via email on Monday, adding that the stores are receiving support to manage the situation, without confirming a cyberattack. Coop has seven affected stores, a spokesperson said, confirming a hack.

In Finland, some refrigeration equipment in a few smaller K-food grocery stores “experienced temperature anomalies overnight,” according to Petri Käyhkö, head of corporate security at Kesko Oyj, Finland’s second-biggest grocer.

Kesko began investigating the cause after receiving automated alerts and as staff entered the premises in the morning, he said in an emailed response to questions. An IT-related incident is not ruled out, he said. It’s not a widespread phenomenon, but only affects a couple of smaller grocery stores whose equipment is not included within the scope of Kesko’s centralized safeguards, he said.

In Estonia, grocery chain Selver experienced the problem at its only store still using an older type of Danfoss refrigeration control system. The issue was fixed in minutes, a spokesperson told local broadcaster ERR. ([Charlotte Hughes-Morgan and Christopher Jungstedt / Bloomberg](https://www.bloomberg.com/news/articles/2026-11-02/belgian-swedish-supermarkets-report-new-suspected-freezer-hack?ref=metacurity.com))

**Related:** [*BBC*](https://www.bbc.com/news/articles/cq1kd1nee80eo?ref=metacurity.com)*,* [*Reuters*](https://www.reuters.com/business/retail-consumer/temperature-soars-swedish-grocery-store-freezers-one-store-blames-hackers-2026-11-02/?ref=metacurity.com)*,* [*The Record*](https://therecord.media/cyberattack-grocery-freezers-europe?ref=metacurity.com)*,* [*The Guardian*](https://www.theguardian.com/world/2026/nov/02/supermarket-freezers-across-europe-hit-by-second-suspected-cyber-attack?ref=metacurity.com)*,* [*The Irish Times*](https://www.irishtimes.com/technology/data-security/2026/11/02/supervalu-removes-frozen-and-chilled-food-from-13-stores-after-cyber-attack-on-fridges/?ref=metacurity.com)*,* [*Associated Press*](https://apnews.com/article/europe-supermarkets-freezers-cyberattacks-a8ea5b30d67da47957769f29101fe686?ref=metacurity.com)*,* [*Tom's Hardware*](https://www.tomshardware.com/tech-industry/cyber-security/supermarket-freezers-across-europe-struck-in-second-crippling-cyberattack-hackers-raise-temperatures-to-50-degrees-celsius-in-belgium-and-sweden-destroying-food-stocks?ref=metacurity.com)*,* [*BleepingComputer*](https://www.bleepingcomputer.com/news/security/hackers-disrupt-refrigeration-systems-at-european-supermarkets/?ref=metacurity.com)*,* [*Help Net Security*](https://www.helpnetsecurity.com/2026/11/02/european-supermarkets-refrigeration-units-cyberattacks/?ref=metacurity.com)*,* [*TechCrunch*](https://techcrunch.com/2026/11/02/a-fresh-wave-of-cyberattacks-has-hit-europes-supermarket-refrigerators-destroying-food-across-countries/?ref=metacurity.com)*,* [*Silicon Republic*](https://www.siliconrepublic.com/enterprise/13-supervalu-stores-hit-in-suspected-cyberattack?ref=metacurity.com)*,* [*The Register*](https://www.theregister.com/cyber-crime/2026/11/02/frozen-part-ii-hackers-remotely-defrost-produce-in-euro-supermarkets-again/5306924?ref=metacurity.com)*,* [*BelgaShare.be*](https://www.belganewsagency.eu/press-releases/38269/cyber-attack-sabotages-refrigeration-systems-of-supermarket-chains/?ref=metacurity.com)*,* [*The Verge*](https://www.theverge.com/tech/1024300/europe-freezer-fridge-hack-cyberattack?ref=metacurity.com)*,* [*Security Affairs*](https://securityaffairs.com/202260/security/another-fridge-cyberattack-hits-european-supermarkets-this-time-in-belgium-luxembourg-sweden-and-estonia.html?ref=metacurity.com)*,* [*Dexerto*](https://www.dexerto.com/entertainment/supermarket-fridges-hacked-again-as-cyberattack-turns-them-up-to-122-degrees-3423916/?ref=metacurity.com)*,* [*Neowin*](https://www.neowin.net/news/europe-supermarket-freezers-cyberattack-hits-belgium-netherlands-sweden-luxembourg/?ref=metacurity.com)*,* [*Digital Trends*](https://www.digitaltrends.com/computing/hackers-remotely-turned-supermarket-freezers-into-ovens-across-europe-ruining-millions-of-euros-worth-of-food/?ref=metacurity.com)*,* [*Business Insider*](https://www.businessinsider.com/freezer-hack-europe-grocery-stores-belgium-sweden-supermarkets-france-cyberattack-2026-11?ref=metacurity.com)*,* [*FoodNavigator.com*](https://www.foodnavigator.com/Article/2026/11/02/cyber-attacks-raise-supermarket-fridge-temperatures/?ref=metacurity.com)*,* [*TheJournal.ie*](https://www.thejournal.ie/supervalu-cyber-incident-13-stores-fridges-7212412-Nov2026/?ref=metacurity.com)*,* [*Political.org*](https://political.org/2026/11/02/supermarkets-in-sweden-belgium-luxembourg-and-estonia-hit-by-cyberattacks-disrupting-freezers-and-fridges/?ref=metacurity.com)*,* [*r/eutech*](https://www.reddit.com/r/eutech/comments/1xlw136/supermarket%5Ffreezers%5Fin%5Fbelgium%5Fsweden%5Fand/?ref=metacurity.com)*,* [*r/cybersecurity*](https://www.reddit.com/r/cybersecurity/comments/1xlv4i8/supermarkets%5Fin%5Fbelgian%5Fand%5Fsweden%5Freport%5Fnew/?ref=metacurity.com)*,* [*r/enshittification*](https://www.reddit.com/r/enshittification/comments/1xlv3fq/supermarket%5Ffreezers%5Facross%5Feurope%5Fhit%5Fby%5Fsecond/?ref=metacurity.com)*,* [*r/worldnews*](https://www.reddit.com/r/worldnews/comments/1xlue7v/belgian%5Fswedish%5Fand%5Festonian%5Fsupermarkets%5Freport/?ref=metacurity.com)

### Ukraine and Russia said they faced cyberattacks on emergency and air raid alert systems.

Residents of Kyiv received warnings of a “nuclear danger” late on Sunday through the air raid alert app, which millions of Ukrainians rely on for information about incoming Russian missile and drone strikes. The app then sent alerts about a “chemical danger” and said that “there’s fighting on Kyiv’s streets, don’t leave your homes.”

The messages alarmed users of the app, prompting Ukraine’s Air Defense Forces to say that the system had been hacked. The service, which runs alongside regular air-raid sirens, said early Monday it was gradually restoring operations.

Russia’s Emergencies Ministry said its emergency situation alert app had also been attacked and that specialists were working to restore it. Unlike in Ukraine, however, the app isn’t the main channel for emergency and air raid warnings, with many Russian regions relying on street sirens, loudspeakers and intercom networks in residential buildings instead. 

The official Ukrainian Air Alert app was apparently hacked on Sunday evening, with notifications showing radiation and chemical hazards.

At 10:47 p.m., the app issued a warning about a radiation and later a chemical threat to Kyiv, as well as a threat of street fighting. A missile strike threat was indicated throughout Ukraine.

At the same time, a message appeared in the application in Russian: "Hello! Now there will be a nuclear alert throughout Ukraine. Don't worry, Oreshnik is flying.

The air raid sirens did not sound.

At 23:02, the Air Force of the Armed Forces of Ukraine published a message that, presumably, the "Air Alert" application was exposed to hostile influence. ([Bloomberg News](https://www.bloomberg.com/news/articles/2026-11-02/ukraine-and-russia-report-cyberattacks-on-emergency-alert-apps?ref=metacurity.com) and [Kateryna Tyshchenko, Valentyna Romanenko / Pravda.com.ua](https://www.pravda.com.ua/news/2026/11/01/8060773/?ref=metacurity.com))

**Related:** [*CoinDesk*](https://www.coindesk.com/business/2026/11/02/why-crypto-exchange-hacks-can-be-harder-to-contain-versus-global-banks?ref=metacurity.com)*,* [*CTech*](https://www.calcalistech.com/ctechnews/article/zpmkwdpa8?ref=metacurity.com)*,* [*BleepingComputer*](https://www.bleepingcomputer.com/news/security/fbi-links-63-billion-binance-crypto-heist-to-north-korean-hackers/?ref=metacurity.com)*,* [*Telegraph*](https://www.telegraph.co.uk/business/2026/11/01/investors-pull-1bn-crypto-exchange-hacked-by-north-korea/?ref=metacurity.com)*,* [*The Business Times*](https://www.businesstimes.com.sg/international/global/north-korean-hackers-stole-billions-fbi-says-its-not-their-first-heist?ref=metacurity.com)*,* [*NBC News*](https://www.nbcnews.com/tech/security/binance-hack-north-korea-tradertraitor-theft-crypto-eth-rcna606572?ref=metacurity.com)*,* [*Bitcoin Insider*](https://www.bitcoininsider.org/article/fbi-binance-theft-north-korea-tradertraitor?ref=metacurity.com)*,* [*Seoul Economic Daily*](https://en.sedaily.com/international/2026/11/01/fbi-says-north-korea-behind-63-billion-binance-hack?ref=metacurity.com)*,* [*The Korea Times*](https://www.koreatimes.co.kr/foreignaffairs/northkorea/20261101/trump-says-us-will-talk-to-n-korea-if-it-is-behind-binance-hack?ref=metacurity.com)*,* [*Daily Mail*](https://www.dailymail.com/news/article-16255969/donald-trump-fbi-north-korea-binance-hack.html?ref=metacurity.com)*,* [*Reuters*](https://www.aljazeera.com/news/2026/11/1/fbi-blames-north-korea-for-record-6-3bn-crypto-heist?ref=metacurity.com)*,* [*Bitcoin News*](https://news.bitcoin.com/featured/trump-speaks-on-6-3b-binance-hack-as-fbi-confirms-north-korea/?ref=metacurity.com)*,* [*NPR*](https://www.npr.org/2026/10/31/nx-s1-6024426/binance-crypto-heist-cyber-criminals-north-korea?ref=metacurity.com)*,* [*CNN*](http://www.cnn.com/2026/10/31/business/crypto-hacker-money-laundering?ref=metacurity.com)*,* [*BBC News*](https://www.bbc.com/news/articles/c51kdy1ew7zvo?ref=metacurity.com)*,* [*ABC News*](https://www.theguardian.com/world/2026/nov/02/ukraine-war-briefing-kyiv-says-air-raid-warning-app-likely-hacked-after-users-receive-false-alerts?ref=metacurity.com)*,* [*Reuters*](https://www.reuters.com/world/europe/ukrainian-air-force-says-public-air-raid-alert-app-has-been-hacked-2026-11-01/?ref=metacurity.com)*,* [*Al Jazeera*](https://www.aljazeera.com/news/2026/11/2/ukraine-blames-russia-after-air-alert-app-sends-out-false-warnings?ref=metacurity.com)*,* [*The Kyiv Independent*](https://www.aljazeera.com/news/2026/11/2/ukraine-blames-russia-after-air-alert-app-sends-out-false-warnings?ref=metacurity.com)*,* [*UPI*](https://www.upi.com/Top%5FNews/World-News/2026/11/01/ukraine-air-raid-warning-app-compromised-issues-false-alerts/1901793579708/?ref=metacurity.com)*,* [*Euromaidan Press*](https://euromaidanpress.com/2026/11/02/ukraines-air-alert-app-was-warn-of-radiation-chemicals-and-street-fighting-in-kyiv-none-of-it-was-real/?ref=metacurity.com)*,* [*Bloomberg*](https://www.bloomberg.com/news/articles/2026-11-02/ukraine-and-russia-report-cyberattacks-on-emergency-alert-apps?ref=metacurity.com)*,* [*Security Affairs*](https://securityaffairs.com/202248/security/hackers-send-fake-nuclear-threat-alerts-to-ukrainian-and-russian-citizens.html?ref=metacurity.com)*,* [*NBC News*](https://www.nbcnews.com/world/ukraine/ukraine-russia-emergency-app-cyberattacks-alerts-radiation-kyiv-war-rcna606964?ref=metacurity.com)*,* [*CNN*](https://www.cnn.com/2026/11/02/europe/hacked-russian-ukrainian-emergency-apps-intl?ref=metacurity.com)*,* [*New York Post*](https://nypost.com/2026/11/02/world-news/hackers-breach-emergency-alert-apps-in-ukraine-and-russia-with-fake-warnings-of-nuclear-attacks/?ref=metacurity.com)*,* [*Implicator.ai*](https://www.implicator.ai/ukraine-says-air-raid-alert-app-compromised-late-sunday/?ref=metacurity.com)*,* [*Al Jazeera*](https://www.aljazeera.com/news/2026/11/2/nuclear-radiation-in-russia-ukraine-no-just-hacked-warning-alerts?ref=metacurity.com)*,* [*Business Insider*](https://www.businessinsider.com/nuclear-attack-scare-ukraine-russia-false-alert-hack-2026-11?ref=metacurity.com)*,* [*The Guardian*](https://www.theguardian.com/world/2026/nov/02/hackers-fake-nuclear-chemical-threat-alert-kyiv-ukraine-emergency-app?ref=metacurity.com)*,* [*Reuters*](https://www.aljazeera.com/news/2026/11/2/ukraine-blames-russia-after-air-alert-app-sends-out-false-warnings?ref=metacurity.com)*,* [*Associated Press*](https://apnews.com/article/russia-ukraine-cyberattacks-emergency-apps-717372f7bbf4e8a805bc918f06f9730f?ref=metacurity.com)*,* [*The Sun*](https://www.thesun.co.uk/news/40879647/ukraine-russia-nuclear-cyber-attack/?ref=metacurity.com)*,* [*The Cyber Express*](https://thecyberexpress.com/emergency-alert-app-cyberattacks-hit-russia/?ref=metacurity.com)*,* [*Free Press Journal*](https://www.freepressjournal.in/tech/ukraine-russia-report-cyberattacks-on-emergency-alert-systems-as-fake-chemical-radiation-threat-warnings-trigger-public-alarm?ref=metacurity.com)*,* [*Metro.co.uk*](https://metro.co.uk/2026/11/02/millions-ukrainians-sent-false-nuclear-attack-warning-suspected-hack-29757281/?ref=metacurity.com)*,* [*Agence France-Presse*](https://www.arabnews.com/world/cyberattacks-trigger-false-emergency-alerts-in-ukraine-and-russia-3009331?ref=metacurity.com)*,* [*France 24*](https://www.france24.com/en/europe/20261102-ukraine-suspects-nationwide-air-raid-alert-app-has-been-hacked?ref=metacurity.com)*,* [*RedState*](https://redstate.com/wardclark/2026/11/01/ukraine-alert-system-hacked-broadcasting-false-nuclear-and-chemical-alerts-n2208903?ref=metacurity.com)*,* [*Political.org*](https://political.org/2026/11/01/ukraines-public-air-raid-alert-app-hacked-sending-false-nuclear-and-chemical-warnings/?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/11/image-5.png)

Fake messages in the "Air Alert" application for Kyiv. Source: Ukraine Pravda.

### Russia’s state statistics agency Rosstat said Sunday that a coordinated cyberattack had hit its websites, while hackers claimed to have stolen 23 terabytes of data, including information on Russian losses in the war in Ukraine.

Messages from the Belarusian Cyber Partisans and Silent Crow hacking groups appeared on the agency’s main website and regional portals, Rosstat told the RBC news website. Among them was a message in Belarusian reading: “No one will escape accountability.”

Both groups are designated as extremist and banned in Russia.

Rosstat said the attacks took place between Oct. 29 and Nov. 1 and were carefully planned, targeting several areas simultaneously and involving specialists with different expertise operating from a wide range of locations.

The agency denied that any databases or legally protected information had been leaked, saying its monitoring systems had detected suspicious activity in time for staff to respond quickly.

Its main website was inaccessible at the time of publication.

The hackers, a group calling itself Silent Crow, claimed the stolen files included data on Russian wartime losses, demographic and economic statistics, and documents marked “for official use only.” ([The Moscow Times](https://www.themoscowtimes.com/2026/11/01/russias-statistics-agency-hit-by-cyberattack-as-hackers-claim-massive-data-theft-a94146?ref=metacurity.com))

**Related:** [*Kommersant*](https://www.kommersant.ru/doc/9078370?ref=metacurity.com)*,* [*Silent Crow on Telegram*](https://t.me/silentcrow%5Fext/6?ref=metacurity.com)*,* [*UA.news*](https://ua.news/en/war-vs-rf/biloruski-khakeri-zlamali-rosstat-i-otrimali-dani-pro-vtrati-rf-v-ukrayini?ref=metacurity.com)*,* [*UNN*](https://unn.ua/en/news/rosstat-suffered-a-large-scale-cyberattack-databases-and-servers-destroyed?ref=metacurity.com)

---

**Spend less time finding cybersecurity news. Get more out of it.**

Metacurity delivers the cybersecurity news, analysis, and insight that would take you hours—and sometimes days—to assemble yourself.

Every weekday, we sift through thousands of news articles, press releases, filings, court documents, and research reports, including details that vendor announcements and PR pitches leave out. We tell you what changed, why it matters, and what deserves your attention. Minimal vendor marketing. No outrage bait. No SEO filler.

**A paid subscription gives you:**

- **The full Metacurity archive:** Every newsletter, searchable and browsable.
- **Our weekly long-reads roundup:** The best cybersecurity writing from across the industry, selected and vetted to make your reading time count.
- **Specialized reports and analysis:** Periodic deep dives that go beyond the daily headlines.
- **A direct role in sustaining independent journalism:** Your subscription helps keep our editorial priorities focused on readers and the cybersecurity community.

If Metacurity saves you time, helps you spot an important development, or gives you a clearer understanding of the industry, please consider becoming a paid subscriber. Your support keeps that work going.

**Subscribe today—and thank you for reading and supporting Metacurity.**

[Upgrade my subscription](#/portal/account/plans)

---

### Binance, the world’s biggest cryptocurrency exchange, said it has covered $6 billion ‌of the $6.3 billion stolen from its platform by using company money to buy replacement tokens, after a hack that US officials said was carried out by a North Korean state-sponsored unit known as TraderTraitor.

"We had already covered $6B of the impacted amount of the hacked loss," Binance said on X on Saturday, after saying ​earlier that it had covered 90% of the stolen funds.

The remaining amount, now less than 10%, consists of assets that are ​less liquid and may take longer to source in the required amounts, according to Binance.

The US Federal Bureau ⁠of Investigation (FBI) said on Saturday the North Korean state-sponsored unit known as TraderTraitor was responsible for the attack.

North Korea has for years ​denied using state-linked cyber units for espionage, financial thef,t and revenue. Its mission in Geneva and embassy in China did not respond to ​requests for comment.

Members of the unit were observed by law enforcement converting stolen assets into the cryptocurrency ethereum, the FBI said in a statement, adding that it expects "further laundering" of the assets through the use of related technology.

The money spent re-buying tokens came from using part of its $1 ‌billion Secure ⁠Asset Fund for Users (SAFU), a bitcoin reserve it holds to protect customers in the event of security breaches, as well as some of its Futures Insurance Fund, and the company's own corporate treasury, it said on X.Co-CEO Yi He said on Saturday that 50% of its SAFU funds would be used, while the company said it was committing to replenishing the fund to return it to about $1 billion. 

The FBI said that North Korea was responsible for stealing more than $6 billion in cryptocurrencies in a brazen hacking attack on Binance.

“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum,” the FBI said Saturday in a statement, referring to the US Secret Service and the criminal division of the Internal Revenue Service. “It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.”

According to Bloomberg, as trading hummed along on Binance at midweek last week, hackers were quietly running sequences of code on accounts they controlled on the Ethereum blockchain — just a couple dollars or so at a time. According to cybersecurity analysts, they were testing a program designed to seize control of accounts owned by the world’s largest crypto exchange and smuggle their contents elsewhere.

Just after 4 p.m. New York time Thursday, they attacked.

Binance co-CEO Yi He acknowledged that the exchange had fallen short on security. “We should have invested more in security earlier, and set stricter standards,” she said in a video posted Friday. ([Angela Christym Shubham Kalia, Elizabeth Howcroft and Max Cherney / Reuters](https://www.reuters.com/legal/government/binance-says-90-stolen-assets-replenished-2026-10-31/?ref=metacurity.com) and [Kevin Whitelaw / Bloomberg](https://www.bloomberg.com/news/articles/2026-10-31/fbi-blames-north-korea-for-6-billion-binance-crypto-hack?ref=metacurity.com) and [Ben Weiss, Muyao Shen, and Olga Kharif / Bloomberg](https://www.bloomberg.com/news/articles/2026-10-31/rogue-code-2-test-runs-and-no-sleep-inside-the-binance-hack?ref=metacurity.com))

**Related:** [*The Information*](https://www.theinformation.com/briefings/fbi-says-north-korea-behind-6-3-billion-binance-hack?ref=metacurity.com)*,* [*Channel NewsAsia*](https://www.channelnewsasia.com/business/binance-says-has-covered-90-us63-billion-hack-losses-6510271?ref=metacurity.com)*,* [*New York Post*](https://nypost.com/2026/10/31/world-news/binance-has-already-refunded-90-of-stolen-6-3-billion/?ref=metacurity.com)*,* [*Cointelegraph*](https://cointelegraph.com/news/binance-hack-90-percent-replenished?ref=metacurity.com)*,* [*The Independent*](https://www.the-independent.com/tech/binance-hack-north-korea-crypto-losses-b3076938.html?ref=metacurity.com)*,* [*Political.org*](https://political.org/2026/10/31/binance-says-90-of-6-3-billion-hack-losses-now-covered-plans-to-resume-withdrawals/?ref=metacurity.com)*,* [*TheStreet*](https://finance.yahoo.com/markets/crypto/articles/binance-says-90-hack-impact-191513226.html?ref=metacurity.com)*,* [*CoinGape*](https://coingape.com/binance-confirms-it-has-replenished-90-of-the-losses-from-the-6-3b-hack/?ref=metacurity.com)*,* [*Stories Framing the Globe*](https://sfg.media/en/a/binance-recovers-90-percent-6-billion-hack-withdrawals/?ref=metacurity.com)*,* [*Reuters*](https://www.theglobeandmail.com/business/article-binance-replenishes-assets-stolen-security-incident/?ref=metacurity.com)*,* [*Bitcoinist.com*](https://bitcoinist.com/binance-recovers-90-of-6-3b-hack-losses-withdrawals-set-to-resume/?ref=metacurity.com)*,* [*CNBC*](https://www.cnbc.com/2026/10/31/binance-hack-asset-coverage-withdrawals.html?ref=metacurity.com)*,* [*Bloomberg*](https://www.bloomberg.com/news/articles/2026-10-31/binance-restores-90-of-stolen-crypto-promises-withdrawals-soon?ref=metacurity.com)*,* [*Blockchain.News*](https://blockchain.news/flashnews/binance-hacker-dumps-2017-token-crashes-90?ref=metacurity.com)*,* [*Al Jazeera*](https://www.aljazeera.com/news/2026/11/1/binance-restarts-withdrawals-after-6-3bn-heist?ref=metacurity.com)*,* [*Wall Street Journal*](https://www.wsj.com/finance/currencies/binance-resumes-withdrawals-after-suffering-biggest-ever-crypto-hack-11d1900f?ref=metacurity.com)*,* [*CryptoSlate*](https://cryptoslate.com/fbi-blames-north-korea-for-6-billion-binance-hack-urges-thorchain-to-block-stolen-funds/?ref=metacurity.com)*,* [*CBS News*](https://www.cbsnews.com/news/binance-crypto-heist-withdrawals/?ref=metacurity.com)*,* [*The Daily Hodl*](https://dailyhodl.com/2026/11/01/binance-says-it-has-replaced-90-of-6300000000-stolen-in-record-crypto-hack/?ref=metacurity.com)*,* [*crypto.news*](https://crypto.news/binance-restores-usdt-usdc-eth-bnb-withdrawals/?ref=metacurity.com)*,* [*Binance Support*](https://www.binance.com/en/support/announcement/detail/73911fb819b240f88b88256bdd318eda?ref=metacurity.com)*,* [*CryptoPotato*](https://cryptopotato.com/binance-starts-withdrawal-recovery-as-fbi-blames-north-korea-for-6b-hack/?ref=metacurity.com)*,* [*The Asia Business Daily*](https://www.asiae.co.kr/en/article/2026110110451148319?ref=metacurity.com)*,* [*Bitcoin Insider*](https://www.bitcoininsider.org/article/fbi-binance-theft-north-korea-tradertraitor?ref=metacurity.com)*,* [*Agence France-Presse*](https://gulfnews.com/business/markets/binance-resumes-withdrawals-after-634-billion-crypto-hack-1.500731461?ref=metacurity.com)*,* [*CNBC*](https://www.cnbc.com/2026/10/31/binance-hack-asset-coverage-withdrawals.html?ref=metacurity.com)*,* [*TheStreet*](https://finance.yahoo.com/markets/crypto/articles/binance-says-90-hack-impact-191513226.html?ref=metacurity.com)*,* [*The Hill*](https://thehill.com/policy/technology/6186304-binance-replenishes-ninety-percent-hack/?ref=metacurity.com)*,* [*CoinGape*](https://coingape.com/binance-confirms-it-has-replenished-90-of-the-losses-from-the-6-3b-hack/?ref=metacurity.com)*,* [*Cointelegraph*](https://cointelegraph.com/news/binance-hack-90-percent-replenished?ref=metacurity.com)*,* [*Reuters*](https://www.reuters.com/legal/government/binance-says-90-stolen-assets-replenished-2026-10-31/?ref=metacurity.com)*,* [*Stories Framing the Globe*](https://sfg.media/en/a/binance-recovers-90-percent-6-billion-hack-withdrawals/?ref=metacurity.com)*,* [*Bloomberg*](https://www.bloomberg.com/news/articles/2026-10-31/binance-restores-90-of-stolen-crypto-promises-withdrawals-soon?ref=metacurity.com)*,* [*Forbes*](https://www.forbes.com/sites/antoniopequenoiv/2026/10/30/binance-says-it-plans-to-resume-withdrawals-this-weekend-after-63-billion-hack/?ref=metacurity.com),[*FBI*](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack?ref=metacurity.com), [*Reuters*](https://www.reuters.com/world/fbi-links-north-korea-theft-6-billion-from-binance-2026-10-31/?ref=metacurity.com)*,* [*Hackread*](https://hackread.com/fbi-crypto-wallet-addresses-north-korea-binance-hack/?ref=metacurity.com)*,* [*Euronews*](https://www.euronews.com/2026/11/01/fbi-blames-north-korea-for-63-billion-binance-crypto-hack?ref=metacurity.com)*,* [*RTÉ*](https://www.rte.ie/news/2026/1101/1597504-binance-theft/?ref=metacurity.com)*,* [*Agence France-Presse*](https://www.abc.net.au/news/2026-11-01/fbi-blames-north-korea-binance-cryptocurrency-exchange-hack/107333446?ref=metacurity.com)*,* [*Cyber Security News*](https://cybersecuritynews.com/fbi-confirms-north-korean-hackers/?ref=metacurity.com)*,* [*Daily Mail*](https://www.dailymail.com/news/article-16255969/donald-trump-fbi-north-korea-binance-hack.html?ref=metacurity.com)*,* [*The Independent*](https://www.the-independent.com/tech/fbi-north-korea-binance-crypto-heist-b3076990.html?ref=metacurity.com)*,* [*The Guardian*](https://www.theguardian.com/business/2026/nov/01/binance-losses-covered-hack-fbi-north-korea-cryptocurrency?ref=metacurity.com)*,* [*Seoul Economic Daily*](https://en.sedaily.com/international/2026/11/01/fbi-says-north-korea-behind-63-billion-binance-hack?ref=metacurity.com)*,* [*Bitcoin Insider*](https://www.bitcoininsider.org/article/fbi-ties-north-korea-record-63b-binance-hack-withdrawals-resume?ref=metacurity.com)*,* [*New York Post*](https://nypost.com/2026/10/31/tech/ai-fueled-hacking-spree-black-october-culminated-with-record-binance-hack/?ref=metacurity.com)*,* [*Bitcoin News*](https://news.bitcoin.com/featured/trump-speaks-on-6-3b-binance-hack-as-fbi-confirms-north-korea/?ref=metacurity.com)*,* [*Fox Business*](https://www.foxbusiness.com/technology/north-korea-responsible-6-billion-binance-cryptocurrency-hack-fbi-says?ref=metacurity.com)*,* [*American Greatness*](https://amgreatness.com/2026/11/01/fbi-blames-north-korean-hackers-for-6-billion-cryptocurrency-heist/?ref=metacurity.com)*,* [*The Information*](https://www.theinformation.com/briefings/fbi-says-north-korea-behind-6-3-billion-binance-hack?ref=metacurity.com)*,* [*Hürriyet Daily News*](https://www.hurriyetdailynews.com/fbi-says-north-korea-behind-6-billion-crypto-theft-from-binance-228852?ref=metacurity.com)*,* [*NewsMax.com*](https://www.newsmax.com/newsfront/fbi-north-korea/2026/10/31/id/1274699/?ref=metacurity.com)*,* [*New York Times*](https://www.nytimes.com/2026/10/31/world/asia/north-korea-hacking.html?ref=metacurity.com)*,* [*The Hacker News*](https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html?ref=metacurity.com)*,* [*Blockchain.News*](https://blockchain.news/flashnews/binance-north-korea-stole-6b-october-attack?ref=metacurity.com)*,* [*Cointelegraph*](https://cointelegraph.com/news/fbi-blames-north-korea-for-record-63b-binance-hack?ref=metacurity.com)*,* [*France 24*](https://www.france24.com/en/binance-hit-by-6-3-billion-dollar-crypto-theft?ref=metacurity.com)*,* [*Capital Brief*](https://www.capitalbrief.com/newsletter/fbi-hunts-north-korean-hackers-after-9b-binance-heist-477e7a14-afd4-4fb1-931c-d4cfdf463a2d/?ref=metacurity.com)*,* [*Financial Times*](https://www.ft.com/content/e84eceda-040b-4e5f-b906-09768085933a?ref=metacurity.com)*,* [*Wall Street Journal*](https://www.wsj.com/pro/cybersecurity/cyber-chiefs-stormy-relationship-with-crypto-70cc6b0e?mod=djemCybersecruityPro%26tpl%3Dcs&ref=metacurity.com)

### Researchers at Parameter Labs discovered an exploit against ChatGPT's implementation of the artifacts pattern (OpenAI used to call this "Canvas," but it looks like the latest revision is called HTML previews), where interactive custom HTML apps are displayed in a sandboxed iframe.

Parameter found quite a complex attack chain. OpenAI uses the MathLive JavaScript library as part of their graph support, and that library includes its own virtual keyboard, which can be triggered in the parent page via postMessage() from the sandboxed iframe.

That message-receiving code uses innerHTML, so anything that sends a message can add custom HTML to the parent - and there was no mechanism to prevent other sandboxed frames, including HTML preview frames, from calling that method.

This meant untrusted code in an iframe could insert HTML, and while innerHTML doesn't directly execute script elements, it could be used to inject a new iframe without sandbox restrictions.

OpenAI’s CSP rules blocked inline scripts entirely and only allowed script loading from a handful of domains, but one of those was YouTube - and the YouTube oEmbed endpoint could be used to reflect JavaScript in a way that executed it.

Once the attack had JavaScript execution on ChatGPT, it was trivial to fetch private user data from APIs and exfiltrate it via an image reference.

The result is that malicious actors could create a ChatGPT share URL which, when visited by another signed-in user, could exfiltrate their private data or take actions on their behalf.

OpenAI closed the hole and paid out a $5,000 bug bounty, which I think was a bit cheap for a vulnerability this serious. ([Simon Willison's Blog)](https://simonwillison.net/2026/Oct/31/how-we-took-over-chatgpt-accounts/?ref=metacurity.com)

**Related:** [*Parameter*](https://www.parameter.ai/labs/we-found-a-gap-at-openai?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/11/image-2.png)

A graph that depicts the exploit chain. Source: Parameter.

### Blockchain analytics firm Chainalysis confirmed it suffered a cyberattack in which hackers used agentic AI to gain unauthorized access to its systems and internal tools. 

The security breach has exposed customer names, email addresses, user IDs, and organizational roles.

Chainalysis confirmed the cyberattack has compromised some non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users. The team is investigating unauthorized activity further, patching vulnerabilities, and hardening its systems.

“Our team is working with leading cybersecurity experts to investigate this activity and harden our systems. We’ve proactively notified all of our customers and will keep them updated as our work progresses,” said Chainalysis.

Chainalysis did not specify the hacker or detail the agentic AI techniques used. However, security experts note that agentic AI systems can autonomously identify vulnerabilities, coordinate multi-step attacks, and adapt in real time, which makes them especially formidable. ([Varinder Singh / CoinGape](https://coingape.com/crypto-hack-tracker-chainalysis-confirms-it-was-hit-by-agentic-ai-driven-cyberattack/?ref=metacurity.com))

**Related:** [*Chainalysis*](https://www.chainalysis.com/blog/security-incident-october-30/?ref=metacurity.com)*,* [*Cointribune*](https://www.cointribune.com/en/crypto-an-ai-assisted-cyberattack-hits-chainalysis/?ref=metacurity.com)*,* [*Onesafe*](https://www.onesafe.io/blog/chainalysis-breach-blockchain-security-weakness?ref=metacurity.com)

### New research from Cisco Talos shows that hackers have started adding AI functionality into a new strain of infostealer malware, making it possible for the system to profile victims automatically and quickly surface the highest-value targets and their information. 

Dubbed “Volta-Autodoxer” because of how the malware refers to itself internally, the research sheds light on the ways that commercial LLMs are being used to augment and enhance the capabilities of established types of malware.

Often hidden in counterfeit software, infostealers are designed to live up to their name, grabbing usernames, passwords, authentication tokens, cookies, credit card data, and more from infected machines. Many of the biggest data breaches in recent years—from the widespread Snowflake-linked breaches that included AT&T and Ticketmaster to the theft of a terabyte of Disney data—have resulted from hackers accessing targets using login details gathered by infostealers. Overall, the malware has been used to steal hundreds of millions of credentials in recent years.

Talos flagged the malware using its new CAIRN framework, built to identify hacking tools that incorporate AI capabilities. Fetterman notes that Talos did not track whether Volta has been used in the wild.

Volta’s traditional infostealer capabilities are powerful and seem to be geared toward targeting younger internet users with robust digital lives. It sweeps for passwords stored in browsers, Microsoft OAuth tokens, cookies, payment cards, and crypto wallet seed phrases, but also active Discord, Telegram, Steam, and Roblox sessions. Then the malware does a second, deeper sweep using its first-round findings. By looking through the target’s Gmail or another central account, Volta builds a fuller picture of the victim, their location, and their habits using data like receipts and order history from services including UberEats and DoorDash.

Once all of this is done, the malware feeds its findings into AI tools for analysis using OpenRouter, a service that can send prompts to multiple different AI providers. Volta defaults its requests to Anthropic’s Claude Opus 4.6\. But apparently preparing for the possibility that the model’s guardrails could block the activity, Volta is built with fallbacks to the Chinese open-weight Moonshot AI Kimi K2 and, if that fails, Google’s Gemini 2.5 Flash. Building in fallbacks and relying on cost-effective, older-generation models are common techniques among attackers. ([Lily Hay Newman and Matt Burgess / Wired](https://www.wired.com/story/kernel-panic-volta-autodoxer-ai-infostealer-malware/?mid=1&ref=metacurity.com#cid=3782376))

**Related:** [*Cisco Talos*](https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/?ref=metacurity.com)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/11/image-3.png)

Source: Cisco Talos.

### Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20–21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise.

Alpine Linux is a small, lightweight operating system widely used as the foundation for Docker container images that run applications and services.

The attacks targeted CVE-2026-97229, a maximum-severity remote code execution flaw, repeatedly crashing GitLab processes, with some attempts coming close to succeeding.

Although Alpine Linux found no evidence that attackers executed code or tampered with its software packages and releases, it could not rule out a successful compromise due to missing logs and a lack of outbound connection records.

"Because we cannot rule out code execution, and the evidence we would need to confirm it no longer exists, we took the harder route and rebuilt the GitLab instance from scratch," explained the Alpine Linux team. ([Bill Toulas / Bleeping Computer](https://www.bleepingcomputer.com/news/security/alpine-linux-rebuilds-gitlab-after-attempted-rce-attack/?ref=metacurity.com))

**Related:** [*Alpine Linux*](https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html?ref=metacurity.com)

### Apple has begun sending a new round of threat notifications to victims of suspected mercenary spyware attacks located in nearly 100 countries, with targets including a Turkey-based reporter and a Lebanese documentary filmmaker.

The notification advises victims that alerts were sent to targeted users in 99 countries, according to a screenshot posted to X by threat researcher Costin Raiu, who said he verified the accuracy of several victims’ notifications.

“So far we do not see any signs of compromise in the logs that could confirm which actor is responsible for the breaches,” he said via text.

Apple does not attribute attacks or the notices to specific malicious actors or geographical regions, the notification said, due to the “extreme cost, sophistication, and worldwide nature of mercenary spyware attacks \[which\] make them some of the most advanced digital threats in existence today.”

At least two recipients of the threat notifications have so far shared them publicly.

“This is the third Apple Threat Notification I received this year,” Ragıp Soylu, the Turkey bureau chief for the Middle East Eye news outlet, said in an X post Thursday. “Likely state actors using mercenary spyware have repeatedly tried to hack my phone.”

Calling the notification a “badge of honour,” Soylu said he considers the hacks an “endorsement for the reporting I do.”

A second victim, Radwan Mortada, also announced on X that he received a Thursday threat notification warning of targeting with “sophisticated mercenary” spyware.

Mortada is a Lebanese documentary filmmaker, investigative journalist and author known for his reporting on security issues across the Middle East. He has covered the Syrian civil war and Islamic militants, along with other regional security incidents, for several years.

Adversaries previously targeted his phone with the powerful zero-click Pegasus spyware in 2017 and 2021, he told Recorded Future News via email.

Mortada noted the latest Apple-confirmed attack comes days after the release of an investigative documentary he directed about September 2024 pager explosions in Lebanon. The film, which is available on Qatar-based Al Jazeera 360, focuses on the controversial attacks, which Israel has confirmed it carried out against members of Hezbollah, a Lebanese Shiite militant group and political party. ([Suzanne Smalley / The Record](https://therecord.media/apple-warns-users-99-countries-mercenary-spyware?ref=metacurity.com))

**Related:** [*SOFX*](https://www.sofx.com/germany-warns-officials-of-mercenary-spyware-following-apple-alerts-in-99-countries/?ref=metacurity.com)*,* [*Cyber Press*](https://cyberpress.org/apple-99-countries-mercenary-spyware-attacks/?ref=metacurity.com)*,* [*CyberScoop*](https://cyberpress.org/apple-99-countries-mercenary-spyware-attacks/?ref=metacurity.com)

### Best Thing of the Day: Leaving Clues for Investigators

North Korean hackers [mishandled](https://en.bloomingbit.io/feed/news/123455?ref=metacurity.com) the Binance funds by mistakenly sending tokens worth about $3.5 million to a NEWT contract address and receiving only $71 after selling about $5 million worth of PROM.

### Worst Thing of the Day: We'll Handle Your RAM with Care, We Promise

OpenAI CEO Sam Altman [believes](https://www.macobserver.com/news/sam-altman-says-keeping-ram-in-personal-computers-is-a-waste/?utm%5Fsource=macobserver&utm%5Fmedium=rss&utm%5Fcampaign=rss%5Feverything&mid=1#cid=3782663) keeping large amounts of RAM in personal computers is an inefficient use of the world’s limited memory supply, arguing that data centers can put those resources to better use.

### Closing Thoughts

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/11/image-1.png)

![](https://storage.ghost.io/c/fe/ca/feca6970-c474-4029-9fd4-35f85e158811/content/images/2026/11/image.png)