North Korea's $6.43B Binance Heist, SMS of Death & a Perfect-10 Bug
Sunday, November 1, 2026 · 5-minute read
The FBI, alongside the Secret Service and IRS, has officially pinned the largest crypto theft in history on TraderTraitor, a hacking group working for North Korea. The attackers stole over $6 billion from Binance and are now converting the funds into Ethereum before routing them through DeFi services to cover their tracks. Binance has begun allowing customers to withdraw funds again following the pause triggered by the attack.
↗ The Hacker NewsInvestigators probing the ShinyHunters hacking group — which breached the FBI's recruitment website and stole staff records — have found that executives at ransomware negotiation firms apparently knew about new victims before those victims did. One executive, Canadian cybersecurity professional Edward Dubrovsky, was arrested and is accused of helping ShinyHunters operate an extortion website. A Dutch hacker's Signal messages seized during his arrest were key to unraveling the case, which also includes a suspected murder-for-hire plot.
↗ Krebs on SecurityKaspersky researchers have uncovered a sophisticated attack targeting a custom version of Windows 10 used exclusively by government agencies in Asia. The malware, called NetamLoader, was hidden inside a fake Windows update package — a classic supply chain attack. The attackers haven't been identified yet, and it's not clear how much data was stolen.
↗ The Hacker NewsHackers stole roughly $2.7 million from 726 Polymarket users on October 29 by replacing a legitimate page-speed monitoring script — supplied by a company called DebugBear — with a malicious version. Anyone signed into Polymarket while the bad script was running had their crypto positions sold and funds drained automatically. The attackers hijacked DebugBear's DNS records through its domain registrar to pull off the switch. Blockchain records show $2.64 million landed in the attackers' wallet in under an hour. Polymarket says it is refunding all affected users.
A security researcher has released a working proof-of-concept exploit for a recently patched Android bug, tracked as CVE-2026-58882, that lets an attacker remotely disrupt your cellular service or crash your phone entirely — just by sending a specially crafted text message. You don't need to click anything; receiving the message on an unpatched device is enough. The flaw has been patched in recent Android updates, but phones that haven't received those updates remain vulnerable.
This is as bad as it gets — a perfect 10 out of 10 severity score. LXD and MicroCloud are tools made by Canonical (the company behind Ubuntu) that manage containers and virtual machines for businesses. The flaw let an attacker log in as a trusted user without ever having that user's private password or key — they only needed the user's public certificate, which is much easier to obtain. If the impersonated account had high-level privileges, the attacker could gain full "root" control over the entire host machine.
Status: Patch available — Canonical has released fixed versions of both LXD and MicroCloud. Update immediately if your organization runs either product.
Nicknamed "SMS of Death," this Android vulnerability lets an attacker crash your phone or cut off cellular service just by sending a specially crafted text message. No tapping, no downloading — simply receiving the message on an unpatched phone is enough to trigger it. A working proof-of-concept exploit is now publicly available, which raises the urgency significantly.
Status: Patch available in recent Android updates. Check your phone's software update settings today.
PHP — the engine behind roughly 70% of all websites including WordPress, Drupal, and Joomla — has two critical bugs that let attackers take full control of vulnerable servers. Working exploits already exist in the wild, and government websites in Europe reportedly went offline after the flaws were disclosed. Cloudflare implemented protective firewall rules early this morning. OpenAI, which helped with the research, called it "one of the most impactful security issues in recent memory."
Status: Emergency patch released by PHP. Website owners and hosting providers should update to the latest PHP version without delay.
Researchers at Anthropic — the AI safety company — developed a fully working exploit for a critical flaw in the Linux kernel affecting servers that use Multipath TCP (MPTCP). The exploit allows an unauthenticated attacker to remotely run commands as the all-powerful "root" user on a vulnerable server. Anthropic published their findings to force faster patching across the industry — a controversial but increasingly common practice. Server administrators running MPTCP listeners should apply kernel patches immediately.
Blockchain analytics firm Chainalysis disclosed that attackers broke into its internal systems using what it called "offensive agentic techniques" — a phrase that points to AI agents being used as hacking tools. The breach exposed customer names, email addresses, user IDs, and organizational roles. No financial data or investigation content was accessed. This is one of the first public cases where a major company has explicitly flagged AI-powered tooling as the method behind a breach — a sign of where attacks are heading.
Six billion dollars. That's not a rounding error — it's the largest cryptocurrency theft ever recorded, and the FBI says North Korea did it. The group behind it, TraderTraitor, doesn't work like the hackers in movies. They're patient, professional, and state-funded. And right now, they're sitting on a mountain of stolen crypto that they're slowly converting and laundering to fund the North Korean government.
TraderTraitor's playbook is well-documented at this point. They typically target employees at crypto companies with fake job offers or investment opportunities, then slip malware onto their devices. Binance has since revealed that the breach originated from a compromised laptop belonging to a DevOps employee — one person's infected machine gave attackers the foothold they needed to eventually move billions. Once inside, the group waits, watches, and moves methodically.
For everyday crypto users, the immediate risk is indirect — Binance itself absorbed the loss and has started allowing withdrawals again. But the broader picture is unsettling. North Korea has reportedly stolen billions in crypto over recent years to fund its weapons programs, effectively turning your digital wallet ecosystem into a geopolitical battleground. Every exchange, every hardware wallet, every DeFi platform is a potential target in a state-sponsored looting operation.
Watch for two things next: whether the FBI's published list of wallet addresses helps exchanges freeze any of the stolen funds before they're fully laundered, and whether the U.S. takes further legal or sanctions action against individuals or organizations helping TraderTraitor move the money. In past cases, the funds have largely disappeared into the system. This time, the speed and scale of the response may be different.