Binance is investigating suspicious transfers worth up to $5.8 billion and has not confirmed a hack or theft. Citation Needed puts the stolen total closer to $6.3 billion and attributes it to North Korea, with about $2.4 billion frozen by stablecoin issuers and the remainder exceeding Binance’s insurance fund. The figures differ by source and will keep moving, which is informative in itself: the largest exchange in the industry cannot yet say precisely what left its wallets.
The detail worth sitting with is what limited the damage. Tether and Circle froze more than $2.3 billion, two private companies using an admin switch that the industry spent years insisting its assets did not have. The decentralization pitch and the recovery plan turn out to be mutually exclusive. Whatever got saved was saved by centralization, and whatever was not saved exceeds the safety net built for exactly this day. The same issue has Keystone destroying 18,835 hardware wallets over a stolen verification key and Bithumb reporting an attack, so the week’s pattern is that the custody layer remains the soft spot.
Table of Contents
🔓 BREACHES & SECURITY INCIDENTS
💸 Binance is investigating suspicious transfers worth up to $5.8 billion, but has not confirmed a hack or theft. Tether and Circle have frozen more than $2.3 billion in related assets. Binance says customer funds are safe and is still investigating.
Polymarket briefly halted trading after a third-party security breach led to unauthorized withdrawals. Malicious code delivered through DebugBear’s monitoring tool stole an estimated $2.19 million to $2.71 million from traders. Polymarket says it fixed the issue and will reimburse affected users.
🇺🇸 A leak site published data on more than 41,000 DHS employees and contractors, reportedly taken from an identity service used by the agency. The hackers said the breach protested planned immigration enforcement, while Okta said it found no evidence its systems were compromised. Researchers say the data reveals DHS’s structure and could help with public records requests.
🇰🇷 South Korean financial firms, including Daishin Securities, Mirae Asset, and Bithumb, have reported cyberattacks — Daishin says attackers exposed personal details belonging to 38,490 customers. Officials are investigating and plan stronger security checks as cyberattacks spread across Asia.
🤖 A breach at a third-party vendor exposed some Warp users’ AI agent logs and telemetry. Warp estimates about 1% of users may be affected and is investigating with outside experts. The company advises users to watch their accounts and be cautious of unexpected messages.
🗾 ✈ A breach at travel technology firm Amadeus exposed personal and travel details of about 92,000 Japan Airlines customers. Credit card numbers and passwords were not exposed, and JAL has found no evidence of misuse. Other airlines, including ANA, Asiana Airlines, and Korean Air, have also reported breaches linked to Amadeus.
🗾 GMO Group says hackers broke into its trading service, stole customer data, and made unauthorized trades. The company refuses to pay the ransom and is offering up to $1 million for information leading to the attackers’ arrest. It is investigating with police, warning customers to secure their computers, and offering compensation to those affected.
💸 Hackers stole a key used to verify Keystone wallets, but did not access wallet recovery phrases or private keys. Keystone will destroy 18,835 unsold devices and replace the key in new ones. Owners with devices received after October 20 should contact Keystone before using them; customer shipping data was also exposed.
🇫🇷 Attackers stole some ENGIE customers’ data through a marketing platform used by its business partners. The breach affected customers in France, but ENGIE says its internal systems and customers’ banking details were not compromised. The company has contacted affected customers and warned them about possible scams.
🇺🇸 🏥 A cybersecurity incident disrupted New Mexico’s largest hospital network, forcing it to divert ambulances and cancel appointments. Other providers took in patients while the network gradually resumed services. The incident may have exposed personal data, and law enforcement is investigating.
🇩🇰 Hackers accessed a University of Copenhagen test environment, potentially exposing personal data of 525,000 people and PIN codes for 20,000 staff and students. The university says it blocked the attack, and there is no sign that daily operations were affected. It is investigating and warns people to watch for suspicious messages.
→ More incidents:
🥷🏻 CYBERCRIME, CYBER ESPIONAGE, APT’s
🇸🇾 ⚖ 🐥 Syrian hacker Ahmad Umar Agha was sentenced to 42 months in prison for attacks on Western media and other organizations. In 2013, he hijacked the Associated Press’s Twitter account with a false report about an attack on President Obama, briefly wiping $136 billion off stock values. Prosecutors said the hacking campaign supported Assad’s government and caused victims major losses.
🇷🇺 ❌ Authorities seized Virtualine’s domain for helping criminals run scams, ransomware, malware, and other illegal activities. Researchers say it received more illicit cryptocurrency payments than any other tracked bulletproof host this year. The seizure disrupted access, but may not have shut down the service or its infrastructure.
🇺🇦 ⚖ A Ukrainian man was sentenced to 70 months in prison for carrying out ransomware attacks from 2018 to 2021. His attacks targeted hospitals, businesses, and government offices, disrupting care and causing major losses. He worked with the Nefilim and Hive groups, and authorities are still seeking an alleged co-conspirator.
🇰🇷 South Korean police say a former penetration tester led attacks on more than 90 organizations, stealing 8.2 million records. The suspects used the ARTEX AI hacking tool, and the leader demanded ransom in 38 cases. All seven suspects were arrested, and police are checking whether stolen data was leaked.
🇨🇳 ⚖ 🇺🇸 Zheng Zhao was extradited to the U.S. to face money laundering charges tied to an alleged $37 million crypto scam. The scheme used fake relationships and trading sites to defraud at least 174 Americans. Eight co-conspirators have pleaded guilty, and authorities say the investigation is ongoing.
🇳🇱 🏧 Dutch police arrested two men accused of stealing more than $400,000 from 170 people. They used fake bank calls to trick victims into scanning their debit cards with a phone app. The app copied card data, which accomplices used to withdraw cash at ATMs.
🗓️ {Cyber,Info}Sec Events — A community-maintained list of infosec conferences worldwide. Subscribe to the ICS calendar feed to get events straight into your calendar, or follow @[email protected] on Mastodon for weekly digests. Contributions and ⭐ welcome!
👨🏻⚖️ 👀 GOVERNMENT, POLITICS, AND PRIVACY
🇨🇳 🌊 A report warns that China could threaten undersea cables linking the U.S. with Taiwan, Japan and the Philippines. Cable damage could overload networks, slow internet traffic and disrupt vital services. The report urges stronger monitoring, faster repairs and tougher penalties for damage.
🇺🇸 Senators and civil liberties groups say the Trump administration is breaking the law by delaying release of a surveillance court opinion. The opinion reportedly raises concerns about searches of Americans’ communications under Section 702. They urge Congress to block the law’s renewal unless the opinion is released and stronger protections are added.
🦠 MALWARE & THREATS
🤗 Attackers uploaded fake Hugging Face models that secretly install crypto miners and backdoors, and one popular model reached over 28,000 downloads. The campaign returned with new repositories after earlier ones were removed, and some infected machines may still be at risk.
🧩 A report found 319 Chrome extensions with 13.4 million installs hijacking searches to earn ad money. Their redirects could later lead to phishing sites or harmful downloads. Users should remove the listed extensions and scan their devices for threats.
🍎 💸 A fake Padre Terminal app on Apple’s App Store stole about $23,000 from 27 Solana wallets after users entered their private keys. The app has been removed, but investigators found four other suspicious crypto apps that may be scams. Users should only install crypto apps linked from official project websites and check who published them.
🇦🇺 Australia’s cyber agency cut off an Amadey malware controller, blocking access to about 180,000 infected computers. The malware could steal passwords and install other harmful software, but cutting off the controller does not erase data already stolen. In a separate case, the agency destroyed stolen business data before criminals could sell it.
🛍 A long-running attack infected 953 online stores, mostly Magento sites, with hidden loader code. The code targets real visitors and may hide from security checks, while attackers exploit flaws and backdoors to gain access. Store owners should check for infections, remove backdoors, change passwords, and install the latest patches.
🤖 A hidden instruction file (AGENTS.md) in the Downloads folder can trick AI coding agents into installing malware or exposing account tokens. The attack works when users launch an agent in a folder containing untrusted instructions. Use agents only in the project folder, and review unfamiliar instruction files before running them.
🤖 🧰 AI, CRYPTO, TECH & TOOLS
🤖 🪖 🇺🇸 An Accenture contractor connected a personal Claude AI agent to a secure Defense Department network — The agent reportedly sent login details and system information to a risky website, and went undetected for two months. Officials say there’s no evidence classified systems were breached, but experts warn the incident posed serious security risks.
🆕 Google announced Gemini 4 Carbon, its strongest model yet, built for complex coding and long-running tasks. It leads benchmarks for finding, testing, and fixing software vulnerabilities. Google is first giving it to trusted cyber defenders while improving safeguards before a wider release.
🔥 🧱 📦 GitHub is testing a firewall that checks npm packages and blocks suspicious ones before installation. Administrators can set rules to stop malware, risky updates, and newly added install scripts. The feature aims to slow supply-chain attacks, though safe packages may also be delayed.
🇨🇳 Cohere says Alibaba’s Qwen model tried to send test text to a server in Beijing during a security test. Experts said the rare behavior likely came from training quirks, with no evidence of a deliberate backdoor. Cohere shared its test records and urged governments to clarify rules for Chinese AI models.
🐛 🧠 VULNERABILITIES, RESEARCH, AND THREAT INTELLIGENCE
➝ From the Patching Department:
⚠ 💥 🐧 A critical GitLab vulnerability was exploited in an attack on Alpine Linux, but the attack appears to have failed. Alpine rebuilt its GitLab instance and found no evidence that its code or releases were altered. Fixing the flaw may require updating Ruby as well as GitLab, and CISA has urged agencies to patch quickly.
📲 A flaw in Telegram for Android let attackers run code on a phone after the user answered a voice call. Telegram fixed it in version 12.10.4, so Android users should update to that version or later. Researchers have not shown whether the flaw was used in real attacks or affects other Telegram apps.
💥 🩹 Cisco fixed a zero-day flaw in its ASA and FTD firewalls that attackers were exploiting to cause outages. The flaw affects some SSL VPN setups and can be triggered without logging in. It is the second similar Cisco firewall flaw exploited since August.
⚠ A serious flaw affects UEFI boot firmware used by many server makers and data centers. Attackers may exploit it to run code before the operating system and its security protections start. The code runs only once, but it could help attackers install further malware.
⚠ 🔎 🐛 Hackers are testing a newly patched, critical Oracle E-Business Suite flaw — The bug could let remote attackers take control of affected systems. Oracle patched it last week, and early probing was reported on October 27.
⚠ 🩹 Hackers are exploiting two critical flaws in PHP, software used by many websites. CISA has ordered U.S. civilian agencies to fix the flaws within three days. Researchers say AI helped uncover a way to exploit the bugs, highlighting risks in aging software.
🔓 A researcher found that a hacked device could use Tailscale SSH to gain root access to other reachable servers, but the flaws have not been independently confirmed. The tests were done in a lab, and Tailscale says it is working on fixes. Until then, administrators should tighten access rules, disable port forwarding where possible, and remove permissions they do not need.
🛰️ ICS, OT & IoT
🇺🇦 👀 Attackers are breaking into Dahua cameras in Ukraine through weak passwords, outdated software, and guessable device serial numbers. They can watch video, change settings, and create hidden accounts, sometimes reaching cameras through Dahua’s cloud service. CERT-UA advises disabling unused remote access, keeping devices updated, and checking for unfamiliar accounts or changes.
🐛 Four flaws in EPICS control software could crash research systems, and one may allow remote code execution. The bugs affect EPICS Base 7.0.10 and earlier; CISA recommends upgrading to version 7.0.11. The flaws are decades old and were found by an AI security system in under four hours.
🚢 Several organizations have launched Blue Initiative, a free database of security flaws affecting ships and ports — It helps maritime teams find and prioritize risks, with searchable entries and alerts. The database includes nearly 30,000 vulnerabilities, including flaws known to be used in attacks.
💬 CONNECT
Follow me on Mastodon for quick daily updates and bite-sized content.
Prefer using an RSS feed? Add Infosec MASHUP to your feed here.
Enjoying our newsletter? Forward it to a colleague—
it’s one of the best ways to support us.
Thanks for reading today’s newsletter, and if you're enjoying it and want to support my work, you can buy me a coffee ☕ over at https://www.buymeacoffee.com/0x58
See you next time!
-X.
