💥 BREACHES & INCIDENTS
Binance breach hits $6.3B in assets; North Korea's TraderTraitor blamed for record crypto heist
Binance suffered a record-breaking security breach that impacted about $6.3 billion in assets, attributed to North Korea-linked TraderTraitor hackers.- Binance users are affected: roughly $6.3 billion in assets were impacted, with nearly $3 billion frozen on-chain so far; Chainalysis estimates about $5.912 billion stolen at time of theft.
- Attackers took over a Binance hot wallet and drained 167,464 ETH plus 63 tokens including 1.615 billion USDT in a single transaction; the attacker still controls over 420,000 ETH and 18,270 BTC worth about $2.4 billion.
- Binance's initial investigation points to a compromised DevOps engineer's laptop that gave the attacker access to a service container to submit unauthorized withdrawal transactions; no wallet private key leak was found.
- The operator submitted one transaction with 50 pre-signed authorizations for consecutive nonces of the hot wallet, then swept the entire balance 3 minutes 24 seconds later; TRM Labs attributes the attack to North Korea's TraderTraitor with high confidence, citing Tornado Cash funding and pre-staged signatures matching the Bybit and KelpDAO heists.
- Tether, Circle, Ripple, and World Liberty Financial froze about $2.67 billion in stablecoins and Arbitrum's Security Council froze about $30 million; Binance will cover losses via its SAFU fund and suspended deposits and withdrawals while it revamps the withdrawal service.
Polymarket halts trading after vendor compromise drains ~$2.7M from user wallets
A compromise of third-party monitoring vendor DebugBear let attackers drain roughly $2.7 million from Polymarket international users' wallets.- Affects users of Polymarket's international exchange (Polymarket.com); the separate U.S. platform was not compromised.
- Attackers stole funds via unauthorized withdrawals and forced position closures; analysts linked at least $2.7 million in withdrawals to 710 wallets.
- Malicious JavaScript was served through a compromised DebugBear script, reading browser storage for account details, wallet addresses, and trading API credentials.
- The script hijacked the logged-in session's trading client and signer to transfer position tokens or sell positions and move funds via Polymarket's relayer.
- Polymarket halted trading for about an hour on October 29, 2026, referred the matter to UK law enforcement, and pledged full reimbursement of affected traders.
Sources 📄 Source: cnbc.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)Cursor marketplace compromise: malicious extension drove $500k crypto heist
A malicious Solidity extension distributed via the Open VSX registry stole roughly $500,000 in cryptocurrency from a Cursor IDE developer.- Applies to Cursor IDE users who install extensions from the Open VSX third-party registry rather than official marketplaces.
- A 'Solidity Language' extension delivered malware via its bundled extension.js, resulting in about $500,000 in stolen crypto assets from one developer.
- After install, the extension executed a PowerShell script to carry out exfiltration and crypto hijacking; Kaspersky linked it to the Quasar backdoor and a crypto stealer.
- The Open VSX listing amassed over 50,000 downloads before removal on July 2; the VS Code marketplace team removed its copy seconds after publication.
- x.ai/Cursor status pages show an ongoing investigation into service degradation with VS Code extensions on Cursor Desktop.
📋 ADVISORIES
- GitLab patches CVSS 10.0 unauthenticated RCE flaw CVE-2026-110264 affecting releases back to 7.0
GitLab has patched CVE-2026-110264, a CVSS 10.0 unauthenticated remote code execution flaw in its regex compiler affecting self-managed CE/EE releases dating back to 2014.- Affects GitLab CE/EE self-managed instances: all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1
- An unauthenticated attacker can execute arbitrary code via integer overflow when GitLab compiles a specially crafted regular expression (Onigmo, Ruby's regex engine); CVSS 10.0, network-exploitable with no privileges or user interaction
- Patched October 21, 2026 in releases 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13; reported by researcher joaxcar via HackerOne
- Exploitation attempts have been observed following disclosure, including attempted exploitation of Alpine Linux's GitLab instance on October 20-21, 2026
- Distinct from CVE-2026-97229, an earlier regex-based GitLab RCE patched in October affecting 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2
📋 ADVISORIES
- 📄 Source for CISA adds actively exploited Linux kernel ESP-in-TCP flaw CVE-2026-46300 to KEV catalog — access.redhat.com