Entrar
The Cyber Express Weekly Roundup: FBI Blames North Korea for $6B Binance Hack, Hackers Turn Up the Heat on Europe’s Fridges and More
Visualização de leitura
Stockal Confirms Unauthorized Trades in 13 Customer Accounts
No Breach of Borderless Systems Found
Borderless stated that it has found no evidence that its platform, interface, infrastructure or internal systems were breached or compromised in the cyberattack on Stockal. It has brought in independent cybersecurity specialists to examine its systems. The company believes the account holders may have been targeted through a social engineering attack that used information exposed in another company's data breach several weeks earlier. However, it stressed that this link remains unconfirmed and under active investigation.Support for Customers Hit by the Stockal Cyberattack
Borderless called support for affected customers its immediate priority. Its teams have been in direct contact with them since shortly after the incident and are working with DriveWealth to establish the facts, review the transactions and explore "appropriate avenues for a fair resolution." The company noted that this help is offered in good faith and "does not constitute an admission of liability, wrongdoing, negligence or responsibility for the unauthorized activity." It added that it will keep supporting customers while the facts and respective responsibilities are established.New Safeguards After the Stockal Cyberattack
As a precaution, Borderless has introduced additional authentication and account-protection measures. Based on the information reviewed so far, it said the unauthorized trading identified was limited to the 13 accounts. It has found no evidence of threats to the wider Borderless platform, its other products or other customer accounts, and it continues to monitor its systems as the investigation progresses.Cooperation With Authorities
Borderless said it is cooperating with relevant authorities and regulators over the Stockal cyberattack. It also clarified that it had responded substantively to media enquiries before reports were published, sharing the information it had at the time. The company said its statement reflects its current understanding and may be updated as further facts emerge. The firm said transparency, accountability, and protecting customers' interests remain central to how it operates. It added that it built Borderless on the belief that customers deserve "a trusted, responsible & globally connected financial platform," and that it will keep communicating as verified information about the cyberattack on Stockal becomes available.
Alpine Linux SSH Flaw Lets Attackers Log In Without a Password
How the OpenSSH Server Flaw Works
An attacker who can reach the SSH port gets in with a single connection that works every time, with no retries. The attacker needs the name of an account whose password field is * (normal for key-only accounts) plus at least one other account with a $5$ or $6$ hash, then sends a password of 257 to 1,024 bytes. One user with a password exposes every account without one. When built without PAM, sshd hashes each attempt with crypt() and compares it to the stored field, borrowing another account's salt when that field is too short to hold one. musl's crypt() returns * as an error indicator for keys over 256 bytes, which exactly matches the stored field of passwordless accounts. OpenSSH 10.6p2 fixes this, and no CVE had been assigned at the time of writing.Which Alpine Linux Servers Are Affected
Alpine Linux servers are vulnerable when they run openssh-server (built without PAM) or openssh-server-pam with UsePAM no, keep the default PasswordAuthentication yes, hold at least one local $5$ or $6$ hash, and have an account with a * password field. That includes root, shipped as root:* in the base image since about Alpine 3.16. The default PermitRootLogin prohibit-password shields root unless it is set to yes, but not if another account can become root through doas. Key-only users created with adduser or usermod -p '*', directory users via musl-nscd (nslcd, winbind, sssd), and the tiny-cloud alpine user also count. Every release checked is affected: 3.21 through 3.24, edge, and the older 3.16 to 3.20. Safe setups include containers not running sshd, systems with PasswordAuthentication no or UsePAM yes, locked accounts (user:! in /etc/shadow), machines with no $-style hash, and cloud-init images, which write PasswordAuthentication no.Patching the OpenSSH Server
Running apk upgrade -U -a, followed by rc-service sshd restart, applies the fix, which ships in Alpine 3.21.10, 3.22.8, 3.23.8 and 3.24.4. Fixed builds are edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1, 3.20 9.7_p1-r6, 3.19 9.6_p1-r3, 3.18 9.3_p2-r4, 3.17 9.1_p1-r7 and 3.16 9.0_p1-r6. Although 3.21 reached end of support on 2026-11-01, patched packages go back to 3.16. For the workaround, root should first confirm key login works and keep the current session open. A drop-in file, /etc/ssh/sshd_config.d/00-no-passwords.conf (read from 3.19 onward), sets PasswordAuthentication no, while a sed command flips every such line in sshd_config, Match blocks included, and saves sshd_config.bak. Running sshd -t && rc-service sshd restart, then sshd -T | grep -i passwordauthentication, should print passwordauthentication no. Deleting the drop-in and restoring the backup undoes it.Cloud Images and Spotting Attacks on Alpine Linux Servers
Official tiny-cloud images (qcow2, VHD and AMI) from 3.18.11 through 3.24.3 ship an alpine user with a * field and passwordless doas. They are safe on first boot but become exploitable once any $6$ hash appears, such as a console password or a user-data account with hashed_passwd, giving attackers a shell as alpine and then root. Instances from earlier point releases need updating or password logins disabled. Admins should check /var/log/messages for sshd "Accepted password" lines on passwordless accounts and review doas use, new users, files, and authorized keys. If a login cannot be ruled out, the machine should be treated as compromised. Özgün Kültekin of Wakefield reported the issue. Damien Miller and Darren Tucker of the OpenSSH project delivered the fix and the 10.6p2 release; Timo Teräs helped analyze the bug, and Natanael Copa built and uploaded the updated packages.
Ransomware Just Took New York’s Queens Library Offline, and It’s Not the First
What the Queens Public Library Ransomware Attack Shut Down
In a statement on Instagram, the library described a network outage affecting every location. All branches remain open on schedule, but several services are unavailable:- The library website, queenslibrary.org
- On-site computers
- Check-out and return machines
- Free Wi-Fi access
- The QPL mobile app
- Digital services, including digital media
Image source- Instagram[/caption]
Some virtual and in-person programmes may also be affected, and the library has asked visitors to check with their local branch. Renewals are unavailable during the outage. The library reminded customers that it does not charge late fines on borrowed materials.
"Our IT department is working to resolve the issue, and we will keep you informed," the library said, adding that people can call (718) 990-0728 for help.
When The Cyber Express tried to access the library's official website, it would not load and displayed the message "This site can't be reached." The Cyber Express reached out to the library for more information but had not received a response at the time of writing.
Why the Impact Reaches So Far
The scale of the system explains why an outage here matters. Queens Public Library is one of the largest library systems in the country, offering free access to more than 5 million books in 50 languages. Its reach also goes beyond its branches. It runs dozens of learning centres in public housing complexes across the borough, along with several mobile libraries. When on-site computers, free Wi-Fi and the website all go down at once, the services people come to a library for, beyond borrowing books, stop working too.Libraries Have Been Hit Before
The Queens Public Library ransomware attack follows a series of incidents at other libraries, and the pattern of disruption looks familiar. In 2024, the Seattle Public Library faced a ransomware attack that crippled its computer systems. On May 28, libraries across South Seattle were noticeably quiet, with signs telling patrons that all computer services were down. That included computer terminals, printing and in-building Wi-Fi, which many library users rely on. In December 2023, officials confirmed that a cyberattack was behind branch closures and service disruptions at the London Public Library. Three of its sixteen branches, Carpenter, Lambeth and Glanworth, were closed until January 2. The library said it experienced a systems outage early on December 13, 2023, and that cybersecurity experts were engaged immediately. It worked with a third-party security firm to repair the damage. In October 2023, the British Library faced a major outage that first looked like a technical glitch but quickly grew into a widespread disruption. It affected online systems, including the website, and onsite services such as public Wi-Fi and phone lines. Across all four cases, the same things tend to go dark: public computers, Wi-Fi and websites. Each library cyberattack shows how much everyday library services now depend on networks that can be taken down in one go.What Is Still Unknown About the Queens Public Library Ransomware Attack
Several key questions remain open. No ransomware gang has claimed responsibility, so it is not known who is behind the attack. The library has not said when services will be restored, whether any data was taken, or whether a ransom has been demanded. For now, the library's IT team is working on the issue, and updates are being shared through its social media channels.
Airline Data Breach Widens as Singapore Airlines Reports 46,000 Affected Records
What Singapore Airlines Disclosed About the Amadeus Cybersecurity Incident
SIA briefed the media on 3 November 2026. According to the airline, most of the affected records contained passengers' names, booking reference numbers, travel itineraries and booking classes. A smaller group of about 620 records carried more sensitive details. For these, email addresses, phone numbers, travel document information and KrisFlyer membership numbers may also have been viewed. The airline said no bank account or credit card data was exposed and no bookings were altered. SIA also stated that its own IT systems were not breached. It is reaching out directly to affected customers who have upcoming trips so they can change their booking reference numbers.Cathay Pacific: 53,000 Bookings Accessed Over Three Years
Cathay Pacific went public with its own statement on 30 October 2026, updated at 16:11 HKT (GMT+8) that day. The Hong Kong carrier said Amadeus first notified it on 28 October 2026 and shared further details on 29 October. According to Cathay, an unauthorized party had gained access to travel reservation data in Amadeus's systems "using login credentials assigned to its system account." Data supplied by Amadeus showed that around 53,000 Cathay Pacific bookings were affected, with the unauthorized access running from August 2023 to September 2026. In most cases, the exposed information covers booking references, passenger names, and flight details. In a smaller subset, email and phone contacts, travel document details, and frequent flyer numbers may also have been accessed. Cathay said there is no evidence that financial or payment data was touched. The airline said Amadeus has contained the incident, including through a password reset, and has added enhanced monitoring and detection on its systems. Amadeus has so far found no evidence that the data has been misused. Cathay stressed that the incident "has not impacted and is not impacting" its own systems or operations. It has informed the relevant authorities that they are still analyzing the information from Amadeus and plans to notify affected customers individually once the details are confirmed. "We apologise to our customers for the concern and inconvenience caused by this incident," the airline said.Malaysia Airlines Urges Vigilance
Malaysia Airlines issued its notice on 31 October 2026, describing Amadeus as its third-party airline reservation technology provider. The carrier said some customer information processed through Amadeus between August 2023, and September 2026 may have been affected. The airline said its own IT systems were not compromised and that there is currently no evidence that financial information was accessed. It is working with Amadeus and other relevant parties to investigate and gauge the impact. As a precaution, Malaysia Airlines asked customers to stay alert to suspicious or unsolicited messages, "particularly those requesting personal or financial information." The carrier said it would share further updates as more information emerges.Japanese and Korean Carriers Report Similar Airline Cyberattacks
Japan Airlines (JAL) reported earlier that Amadeus had informed it of unauthorized access to reservation records for both JAL and Japan Transocean Air flights. About 92,000 customers were affected, making JAL the hardest-hit carrier so far. Names, booking references, and flight information were exposed. Korean Air and Asiana Airlines also confirmed unauthorized access to data managed by Amadeus. Both said there was no evidence that their internal systems or databases had been breached.How Amadeus Explains the Breach
Amadeus has attributed the exposure to a software glitch that made certain booking-display data accessible. That explanation sits alongside Cathay Pacific's account, which describes an unauthorized party using system account login credentials. The company said its investigation is continuing and that it has found no evidence of payment or financial information was accessed. Amadeus also said there is no sign that the vulnerability was used for ransomware. It has since rolled out fixes, together with stronger monitoring and detection measures.The Full Reach of These Cyberattacks on Airlines
At least 15 international airlines are either confirmed as directly affected or are investigating possible customer data exposure from the supply-chain attack on the Spanish IT and reservations company. Because the breach hit a centralized booking display environment, it reached flag carriers as well as the regional partners that route reservations through them.Major carriers with confirmed exposure
| Airline | Reported impact |
| Japan Airlines (JAL) | About 92,000 passenger records |
| Cathay Pacific Airways | About 53,000 passenger bookings |
| Singapore Airlines (SIA) | About 46,000 booking records |
| All Nippon Airways (ANA) | Up to 37,800 customer profiles |
| Malaysia Airlines | Customer data exposed across August 2023 to September 2026 |
| Korean Air | Unauthorised access to customer reservation databases |
| Asiana Airlines | Passenger booking references exposed through system account credentials |
| Condor Airlines | Part of the German leisure carrier's international flight data accessed |
Regional and subsidiary carriers
Several smaller airlines were drawn in because they share back-end ticketing technology or corporate ties with the larger groups:| Airline | Link to the breach |
| Japan Transocean Air (JTA) | Affected through parent company Japan Airlines |
| Air Do | Affected through shared system pathways with ANA |
| StarFlyer | Affected through shared system pathways with ANA |
| Solaseed Air | Affected through shared system pathways with ANA |
| Ibex Airlines | Still determining the scope of exposure via its ANA integration |
| Oriental Air Bridge | Still determining the scope of exposure via its ANA integration |
Under investigation
Qantas Airways is formally investigating whether any Australian customer files were compromised. The airline maintains that its internal databases have not been breached.What the Amadeus Cybersecurity Incident Means for Travelers?
With the access window stretching from August 2023 to September 2026, the Amadeus cybersecurity incident spans more than three years and stands out among airline cyberattacks for how many carriers it touched through a single provider. None of the affected carriers has reported misuse of the data so far, and no airline has said payment details were taken. Even so, names, itineraries and booking references can be enough for convincing phishing attempts. That is why carriers such as Malaysia Airlines and SIA are asking passengers to watch for suspicious messages and, where advised, change their booking references. As investigations continue, more airlines may update their figures on how far these cyberattacks on airlines have reached.
After Supermarket Freezers, Hackers Turn Up the Heat on France’s Blood Supply
How the Refrigeration Cyberattacks Reached Blood Storage
The EFS says it was not targeted directly. Like many of the affected retailers, it says the attack reached it through a third-party provider of refrigeration equipment. That detail explains why a blood service ended up on the same list as supermarkets. If attackers can get into a shared supplier's systems, any organisation using that equipment may be exposed, whatever its sector. This is the first reported case in France in the second wave of attacks on control systems, and the first reported to affect a healthcare organisation.Why the Blood Supply Survived When Food Did Not
The difference came down to how quickly someone noticed. "The EFS's monitoring and alarm systems enabled the rapid identification of these anomalies and the implementation of necessary measures to ensure that no blood samples or products were compromised," the organisation said. Depending on the situation, affected equipment was either brought under control without impacting the products, or shut down. Products in the affected cold rooms were moved to other facilities as a precaution. Compare that with the first wave in France in October. Attackers remotely defrosted fridges in hundreds of supermarkets, reportedly by triggering a forced defrost option, and pushed temperatures as high as 50 degrees Celsius. They struck while stores were closed, so the heat went unnoticed for hours. Tonnes of food perished, some equipment melted, and in some stores the heat sparked fires. Reporting on that wave found the attackers had targeted ageing, internet-connected devices still online years after their manufacturer stopped supporting them.
How Far the Refrigeration Cyberattacks Have Spread
The second wave is wider than the first. Businesses in at least 11 countries have reportedly been affected: Belgium, Estonia, Finland, France, Germany, Ireland, Luxembourg, the Netherlands, Portugal, Sweden and the United Kingdom. Earlier this week, supermarket chains in Sweden, Belgium, Luxembourg, Ireland and Estonia reported fridges and freezers set to high temperatures, with several discarding food. In Estonia, where the intrusion was caught within minutes, there was no significant damage.Who Is Behind It?
No one knows for sure, and no group or entity has claimed responsibility for the attacks. It is also unclear whether the same people are behind both waves. Rumours have spread online that two Russian hacktivists groups, Noname057(16) and Z-Pentest Alliance, posted that they had hacked Danfoss. That led to speculation that they were behind the freezer attacks. Analysts now question whether that claim means they were responsible. Russian groups have not been ruled out. However, experts say Iranian hacktivists, nation-state hackers, or even teenagers pulling pranks could also be the culprits.A French Bank Reports a Separate Attack
In the same week, Crédit Mutuel Arkéa in northwestern France said it had halted some services after a cyberattack enabled fraudulent transactions. Nothing in the bank's statements links the incident to the refrigeration attacks. However, the bank describes a similar entry point: attackers "used the platform of one of our service providers" to reach the bank directly. The bank said attackers used its own account, not customer accounts, to make transactions to other banks. That potentially let them convert the money into cryptocurrency through specialised platforms. It denied press reports that the attackers got in through its subsidiary Fortuneo, and said human error was not the cause. Asked whether 118 million euros was stolen, the bank said it could not confirm the figure and could "only validate the order of magnitude." Some funds have been frozen and recovery efforts are under way. The bank says the losses will not threaten its financial stability and that customers' assets were not affected, apart from delays to some transfers. Almost all operations have resumed. The bank has also warned customers about a likely rise in phishing attempts, urging them never to share passwords, card numbers or SMS validation codes. The refrigeration attacks and the bank attack have not been tied to the same attackers. What they share is the route in. In both cases, the organisations say they were reached through an outside provider rather than through their own systems. Neither the blood service nor the bank was the first door the attackers opened.
Two Canadians Accused of Turning US University Supercomputers Into Crypto Miners
Why the University Supercomputer Hacking Targeted Campuses
The indictment points to a clear reason for the choice of targets. Roach and Stubbings allegedly went after educational institutions in the United States that had supercomputers. The scheme relied on processing power. Once inside, the pair allegedly forced victim computers to run cryptocurrency mining software, putting the machines' computing power to work for their own financial gain. Machines built for heavy computation made the scheme more profitable. Victims included educational institutions in New York, Tennessee, North Carolina and Massachusetts. Some of the damaged computers belonged to a higher education institution in the Western District of New York, where the case is being prosecuted.How the Alleged Scheme Worked
According to the indictment, the scheme ran from June 2016 to December 2019 and followed a set pattern. The pair allegedly researched security weaknesses in victim networks before getting in. They accessed computers without authorization and deployed malware to take control. They then stole login credentials and sent the data to servers they controlled. Once inside a network, they allegedly used sophisticated techniques and tools to carry out reconnaissance and expand their access. The stolen login credentials were stored on their servers, the same servers that sent out malware and mining software to victim machines. The indictment says Roach and Stubbings damaged 10 or more protected computers within a one-year period, causing a loss of at least $5,000.How They Allegedly Stayed Hidden
The case also shows the effort the pair allegedly put into avoiding detection. They used virtual private servers in multiple countries, registered under false names. Those servers delivered malware and mining software to victim computers and held the stolen credentials. To conceal their identities further, they allegedly used a server and compromised computers belonging to one victim to gain access to another. That meant intrusions could appear to come from a victim's own systems instead of from the people behind them.Where the University Supercomputer Hacking Case Stands
Roach was extradited from Canada to the United States on October 28. He was arraigned before U.S. Magistrate Judge Mark W. Pedersen and held pending a detention hearing on November 3. Extradition proceedings for Stubbings are continuing in Canada. The investigation was carried out by the Federal Bureau of Investigation, under the direction of Special Agent-in-Charge Allen D. Davis II, and the Department of Justice's Computer Crime and Intellectual Property Section. The Justice Department's Office of International Affairs helped secure Roach's arrest and extradition. Assistant U.S. Attorney Meghan K. McGuire is prosecuting the case.What Is Still Unclear
The indictment leaves several details open. It does not say how much cryptocurrency the pair allegedly mined, how many institutions were affected in total, or which universities were targeted beyond their states. The loss figure stated in the charges, at least $5,000, is the legal threshold tied to the damage count, not a full estimate of the harm. An indictment is an accusation, not proof. Both men are presumed innocent unless and until proven guilty.
Europol Seizes 100+ Servers Running Fake Trading Platforms
The Investment Fraud Supply Chain
The target was not a single scam group. Investigators say the company supplied fake trading platforms to criminal groups, operating what they describe as a crime-as-a-service model from Cyprus and Israel. Its suspected clients ran fraudulent call centres in Albania, Kosovo and North Macedonia. Those call centre operators allegedly persuaded victims to hand over their savings. In other words, one business built the storefront, and others did the selling.How Victims Were Drawn In
The scheme promised large, quick returns from trading in cryptocurrencies, foreign currencies or stocks. It started with an advert. The investigation found that affiliate marketing was abused to attract potential victims, with deceptive ads steering people towards fraudulent investment platforms and exploiting their trust in online promotions. The personal data collected this way was then sold to the criminal groups running the call centres. Operators contacted potential victims with supposed investment opportunities and turned that first flicker of interest into repeated demands for money.Why Victims Kept Paying in This Investment Fraud
The method relied on making the scam look like it was working. Victims were first encouraged to transfer a small amount. Their online accounts then showed fictitious profits, which made the platform seem credible and the investment successful. Supposed brokers used those fake gains, along with constant psychological pressure, to push victims into sending larger and larger sums. The problem surfaced when victims tried to withdraw. Operators used delaying tactics to block payments. Eventually, contact stopped altogether, and victims were left unable to recover their money.How a Couple's Complaint Exposed the Network
The case began in 2022, when a German couple reported that they could not withdraw money they had invested through an online trading platform. A first international action day that year led to two arrests and seized evidence. With Europol-supported analysis, investigators identified seven more suspects, including suspected call centre managers. A second action day in 2025 brought further arrests and seizures of money and evidence. Analysis of that material exposed the suspected infrastructure provider and its links to call centre operators, setting up this month's operation. In total, the case took four years to reach the company allegedly behind the platforms.The Role of Europol and Eurojust
Europol's European Financial and Economic Crime Centre analysed the data, cross-checked it against Europol's databases and brought national investigators together to plan joint action. On the action day, Europol sent experts to Albania and Kosovo to support digital forensic work, and its Virtual Command Post supported the coordinated intervention. Eurojust supported the execution of European Investigation Orders, European Arrest Warrants and freezing orders. Two joint investigation teams were set up at the agency: one involving Albania, Germany and Poland, and another involving Albania and Kosovo. Judicial actions on 3 November were coordinated from Eurojust's headquarters in The Hague.
UTA Investigates Suspected Cyberattack After MachForms Service Disruption
Timeline of the UTA cyberattack
Problems first appeared on Oct. 27, when MachForms became temporarily unavailable, according to the university's cybersecurity website. Technicians from the Office of Information Technology began investigating the issue at that time. On Wednesday, the office started corrective measures aimed at restoring services as soon as possible. Since then, public information has been limited. As of Tuesday night, the cybersecurity website had not posted any updates since Thursday.What the University of Texas Is Asking Students and Employees to Do
The university's email outlined several steps for students and staff to follow while the investigation into the cyberattack on UTA continues. First, the university asked everyone to follow official guidance from the Office of Information Technology and the Information Security Office, and to pay close attention to university communications. Second, anyone who notices suspicious activity, such as unusual computer behavior, a suspicious email or anything else that raises cybersecurity concerns, should report it to the Information Security Office at opsec@uta.edu. Third, students and employees were told not to investigate the incident on their own or circulate unverified information. Questions should be directed to a department head or the Office of Information Technology, and people should rely on official updates for confirmed information. If a journalist reaches out, students and employees are asked to refer them to UTA's media relations team. Finally, the notice asked the campus community to follow any additional instructions. If action involving passwords, devices, systems, or work practices becomes necessary, students and employees will receive specific guidance through official university channels. MachForms remains affected for now. Students and employees who need access to the platform for urgent and significant operational needs can contact the Office of Information Technology service desk at uta.edu/help. The University of Texas at Arlington has not said how long the investigation will take or when full service will be restored.
Why Is Kim Yo-jong Suddenly Responding to a Binance Hack?
Why the Binance Hack Targeted Engineers, Not Systems
According to the post-mortem Binance released on Tuesday, the attackers went after people with access to wallet infrastructure. In June, Wallet DevOps Engineer A searched for a popular AI coding tool and downloaded a tampered Homebrew installation. Binance's security team spotted the anomaly, replaced the device and rotated his credentials. But the damage was done in another way: Engineer A's role, and his colleagues on the wallet infrastructure team, were now known to the attacker. In September, the attackers moved to social engineering. Software Engineer B, whose profile on a legitimate job-hunting platform mentioned his Binance experience, was approached by someone posing as a project director. A first-round video interview followed with a supposed HR representative, who shared personal photos and videos on social media to build trust. Binance said this was more advanced than social engineering it had seen before.
In the second round, held on a popular chat app, Engineer B was told to download an "assignment" onto his work computer. It contained malicious code that ran during setup, swapped a legitimate development tool for a malicious version, and connected to an attacker-controlled server. The zero-day malware was not detected by endpoint security tools at the time.
On October 20, the attackers used Engineer B's compromised computer and an internal AI tool to gain control over Engineer A and another wallet engineer, Engineer C. They then found that Engineer A had a container deployment permission token on his machine.
How the Binance Hack Unfolded on October 29
Between 17:15 and 19:56 UTC, the attacker logged onto Engineer C's computer, used Engineer A's stolen credentials, deployed a container and triggered a malicious script. That gave them unauthorized access to an internal wallet signing service, which they used to send transactions outside the normal withdrawal process. Between 20:05 and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address. Hot wallets on Solana and Optimism sent about 970,500 SOL and 44.2 million OP. Binance then received an internal alert about large transfers, and another hot wallet sent 18,270 BTC.Why Binance Couldn't Stop It Faster
Binance suspended withdrawals, but that did not end the outflows. The attacker had used the signing service to exploit Ethereum's EIP-7702 authorization mechanism. By submitting 50 signing transactions, they gave an attacker-controlled smart contract partial execution rights over a Binance hot wallet. Those authorizations lived on-chain and worked independently of Binance's withdrawal systems. And because the wallet used Multi-Party Computation, there was no single private key that could instantly revoke them. Binance had to build a special procedure to do it. The final unauthorized transfer of 2,961.9 ETH was confirmed at 23:56 UTC. At 00:10 UTC on October 30, Binance cleared the malicious delegation.Who Is Behind It
Over the weekend, the FBI and other U.S. agencies blamed the theft on TraderTraitor, a North Korea state-sponsored group that has spent years attacking cryptocurrency platforms. Binance said it had detected and stopped 57 suspected North Korea-linked threats in 2026 alone, many using fake job interviews and malicious developer tools. On Tuesday, Kim Yo-jong rejected the U.S. findings, calling them a "grave political provocation" in a statement carried by the Korean Central News Agency. Observers noted the statement ended by saying Pyongyang had matters to "reconsider," without directly threatening retaliation. South Korea's Unification Ministry called her personal response unprecedented. An official said it suggested the North was taking the allegations seriously and was "increasingly conscious of its international standing."Where Users Stand
Binance says it has set aside more than 100% of the funds needed to cover the loss. As of October 31, 98% of impacted token assets had been replenished, and Binance is buying the remaining, less liquid assets. About $2.85 billion has been frozen or intercepted with help from law enforcement, token issuers and blockchain intelligence firms. Withdrawals have broadly resumed. The exchange says it has rebuilt the affected wallet system and AI tool, replaced devices, revoked credentials tied to the affected engineers and brought in independent security firms. The investigation is ongoing.
Hackers Exploit WordPress Flaw Within 48 Hours of Security Patch
What WordPress 7.1.4 Fixes Beyond the WordPress Vulnerability
Version 7.1.4, released on October 28, is mainly a security release. Alongside the critical code execution fix, it patches several stored cross-site scripting (XSS) flaws, a denial-of-service issue, and two separate information leaks. The update also refreshes WordPress's bundled root certificates after eMudhra revoked its certificates. Of everything in the release, the code execution bug is the one attackers zeroed in on. Aaron Jorbin, who wrote the release announcement, told users to “update your sites without delay.” A GitHub security advisory published the next day described the issue as a timing weakness in the update system. If an unauthorized user moves quickly enough while an upgrade is running, they may be able to execute their own code on the server. No CVE number has been assigned to it so far.How the Vulnerability in WordPress Works
When WordPress performs a full-package core update, it first extracts the new files into a dedicated directory inside the upgrade folder. According to the advisory, that directory had a predictable name and was reachable from the public web. That combination is the problem. An attacker who requests the right file at the right moment, before WordPress finishes cleaning up, could trick the server into running arbitrary PHP code. Pulling this off is not trivial. The attacker needs four conditions to line up: a full-package update in progress, web access to the temporary folder, a path they can guess, and a short window before the files are deleted. Under controlled conditions, that window may last only a few seconds.Which Sites the WordPress Vulnerability Affects
The advisory lists every WordPress release from 4.7 through 7.1.3 as vulnerable. It also names the fixed version for each branch, including 7.0.8, 6.9.11, 6.8.12 and 5.9.20. The WordPress project said it backported the patch to all branches still receiving security maintenance, reaching as far back as 4.7. It also stressed that only the newest version is actively supported. Not every site can be taken over through this bug. The risk rises sharply, however, if an attacker hits a site while it is running a full-package update. Smaller websites face extra exposure. Many sit on shared servers with default settings, which makes them attractive targets for cybercriminals.How Attackers Are Targeting the Vulnerability in WordPress
Wordfence traced the root cause to full-package upgrades repeatedly using web-accessible paths that are easy to guess. Alex Thomas, a threat analyst at Wordfence, said attackers quickly understood the race condition and turned their attention to it. Two of the biggest attack sources reportedly kept polling small groups of websites for roughly 14.5 hours. Other sources tried out different folder names and version names. The pattern looks like large-scale automated guessing rather than attacks on chosen victims. So far, no confirmed reports have put a number on how many sites have actually been compromised.How Serious Is This WordPress Vulnerability?
Sources disagree on how severe the flaw is. The Hacker News gave it a CVSS score of 8.1, which falls in the high range. The GitHub advisory, by contrast, rates it as low severity. That gap most likely comes down to how hard the bug is to exploit successfully. Even so, the sheer volume of attack attempts and the simplicity of the fix make it sensible to treat this as a serious threat.What Comes Next for This Vulnerability in WordPress
The probing is unlikely to stop soon. Once a vulnerability is patched, the fix itself becomes a detailed roadmap for anyone hunting sites that have not been updated. The WordPress project says backports to older branches are still in progress. The next major release, WordPress 7.2, is scheduled for December 8. The advisory credits researcher Umut Bayram with discovering the flaw and reporting it responsibly. There is currently no alternative workaround, so applying the patch is the only fix available.
Polymarket Users Lost Money Without Clicking Anything. Here’s How
Polymarket users who had the site open during a short window on October 29 watched their positions get sold and their funds leave their wallets without doing anything themselves. The Polymarket hack did not start inside Polymarket.
It came through a small piece of code from an outside company that loaded on every visit to polymarket.com. The cryptocurrency-based prediction market now says it is returning $3.9 million to affected traders.
How the Polymarket Hack Worked
In a post-mortem published on October 31, Polymarket said a third-party vendor whose performance-monitoring script ran on polymarket.com had been compromised. The attacker swapped the vendor’s legitimate code for a compromised script built specifically to target Polymarket users.
The attacker did not need anyone’s password. For users who had the site open at the time, the malicious script used their active session to sell positions and move funds out of their wallets. Anyone logged in and browsing during that window was exposed. The vendor has publicly confirmed the compromise.
Polymarket’s status page first reported “unauthorized activity affecting user wallets” on October 29 and marked the incident as resolved later that day.
Who Was the Vendor Behind the Polymarket Hack?
Performance-monitoring company DebugBear released its own update on the incident. It said its initial findings point to its domain registrar as the point of entry.
“Our DNS records were compromised through our domain registrar,” the company said on X. “We are currently unable to receive emails sent to our domain. Based on our initial investigation this attack targeted the website of a specific customer.”
[caption id="attachment_115172" align="aligncenter" width="538"]
Source- Twitter[/caption]
DebugBear added that it has “not seen any indication of a compromise of our internal systems,” though it is continuing to investigate.
This is the part of the story that should worry other website operators. According to the statements from both companies, the attacker appears to have gone after a vendor’s domain setup rather than Polymarket’s own systems, and used that position to put malicious code in front of Polymarket’s users. DebugBear’s own internal systems, by its account, show no sign of being breached.
How Polymarket Responded
Polymarket listed the steps it took once the attack was identified:
- Removed the vendor’s compromised script and cleared every cache.
- Paused trading and its relayer to stop further drains, then reopened once the site was clean.
- Reset all active login sessions.
- Began redeploying third-party scripts with added integrity controls and continuous monitoring, including a stronger content security policy, explicit version pinning and sandboxing.
- Referred the case to law enforcement while running its own investigation into the threat actor.
The trading pause stopped the bleeding, but it created a second set of losses for traders who were not directly hit by the script.
Where the Polymarket Hack Refunds Stand
Polymarket is returning $3.9 million in total. Of that, $2.7 million covers the initial losses from the attack, and $1.2 million covers losses tied to the hours-long shutdown.
As of its post-mortem, the company said 95% of affected wallets had been refunded in full, through a mix of reimbursements for drained wallets and goodwill payments.
The refunds cover more than drained wallets. Polymarket said it also made goodwill payments in two cases:
- Positions taken during the attack. If the script moved or force-sold a user’s positions, Polymarket will pay what they were worth when they were taken, including any slippage from the sale.
- Losses during the trading pause. If a user held a position when trading paused and it lost value because the market ended during the pause, or the user sold right after trading reopened, Polymarket covered the difference from its value at the pause.
Users do not need to file claims or tickets. Polymarket said it identified eligible wallets using on-chain and trading data. Anyone who thinks their amount is wrong, or believes they should have received a payment, can submit a form for the company to recheck.
What Remains Unanswered
Some questions are still open. Neither company has named the threat actor. DebugBear has said the attack targeted a single customer, but its investigation is ongoing, and it still cannot receive email sent to its domain. Polymarket has also not said exactly how many wallets were affected, only that 95% have been made whole.
The incident shows how much trust a website places in every outside script it loads. Polymarket’s own systems were not the entry point, yet its users still lost money, and it took a trading halt, a session reset and a removal of the vendor’s code to stop it.
South Korea President Eyes Cybersecurity Task Force After North Korea-Linked Crypto Heist
Cybersecurity Task Force and North Korea's Binance Heist
The directive follows a string of attacks on domestic financial companies that exposed customer data. The most recent targets were Mirae Asset Global Investments, cryptocurrency exchange Bithumb, and Daishin Securities. It also comes after the hacking of Binance, the world's largest crypto exchange, in which more than US$6 billion in cryptocurrency was stolen. The U.S. Federal Bureau of Investigation (FBI) has since attributed the theft to North Korea, which gives the incident a national security dimension beyond financial crime. Lee said cyber threats have grown severe enough to endanger the national economy, national security and the daily lives of ordinary citizens. He called for "a comprehensive prevention system" to address them. According to the president, hacking methods are becoming more sophisticated and widespread, driven partly by advances in artificial intelligence (AI). He said this trend is exposing clear limits in the systems currently used to maintain security.A Possible "Czar Agency" Amid North Korea Threats
Lee's plans go further than a single task force. He stressed the need for talks on setting up a pan-government agency responsible for cybersecurity across both the public and private sectors. He specifically told officials to "proactively consider the formation of a cybersecurity czar agency" that could act as a strong and effective control tower for security management. The president also ordered officials to thoroughly fix security weaknesses at major state institutions and key national infrastructure, naming information communications, energy, and finance. Because hackers tied to North Korea have repeatedly targeted financial assets, the finance sector is a particularly pressing concern.Social Media Limits for Teens Also on the Agenda
Cybersecurity was not the only digital issue raised at the meeting. Lee also called for quick discussions on the government's plan to restrict adolescents' use of social media. "The harmful effects (of social media on teenagers) appear to be greater than what we think," Lee said. The government is pursuing measures to limit social media sign-ups by young teens and to restrict their use of certain services, including algorithm-based ones. The goal is to shield adolescents from the harms of social media. Lee told Kim Jong-cheol, chairman of the Korea Media and Communications Commission, to "conduct relevant discussions thoroughly and promptly." He pointed to similar efforts already under way in Europe, Australia and Canada. Kim replied that the plan should be pursued on the basis of social consensus. He said the commission intends to gather public input and finalize the measures in the first half of next year. Officials will now weigh whether to form a cybersecurity task force and a broader czar agency. Their decisions will shape how South Korea responds to escalating digital threats, including attacks attributed to North Korea.
Why Would Anyone Hack a Supermarket Freezer? Europe Is Finding Out
How the Supermarket Cyberattack Unfolded Across Europe
Sweden saw some of the clearest signs of tampering. ICA Group spokesperson Gustaf Nilsson told the TT news agency that "a limited number" of stores were affected overnight by an incident involving refrigeration systems. One ICA Kvantum store in Sjöbo, in southern Sweden, was more direct. In a Facebook post, it said its fridges and freezers had been hacked and set to 50 degrees Celsius, and that staff were discarding affected products. The Coop chain also reported problems with fridges and freezers at six stores in central Sweden, according to TT, though it did not immediately share details. In Belgium, Delhaize said an "IT incident" had affected refrigeration in several dozen stores, mostly in Belgium and a few in neighbouring Luxembourg. "In the affected stores, the range of fresh and frozen products is temporarily somewhat limited. Our distribution centers are operating normally, and there has been no disruption to deliveries to our stores," spokesperson Sarah De Meester said. Carrefour said a cyberattack targeting refrigeration had affected 15 of its more than 700 Belgian stores, and described the impact as "extremely limited.
In Ireland, Musgrave Group said refrigeration systems in 13 SuperValu stores were affected by the "cyber incident." Chilled and frozen products were removed from sale as a precaution. By Monday afternoon, the company said the incident had been "fully resolved" and that restocking of chilled and frozen ranges was "well under way."
In Estonia, refrigeration technology company Kitman Coldtech said attackers had accessed a computer controlling a client's refrigeration system and raised the temperature to 50 degrees Celsius, public broadcaster ERR reported. Chief executive Jann Mutso declined to name the store but said the attack was addressed within minutes and caused no significant damage. The Selver supermarket chain confirmed that one of its outlets was affected.
Is This Supermarket Cyberattack Linked to France?
None of the companies has publicly linked Monday's incidents to France, but the pattern is hard to miss. Last month, attackers remotely took control of refrigeration systems in hundreds of supermarkets and independent stores across France. They pushed fridge and freezer temperatures as high as 50 degrees Celsius. French TV channel BFM reported that the attackers appeared to trigger a forced defrost option, which kept units heating instead of cooling. By morning, tonnes of food had perished. Some equipment had melted, and in some stores the heat had sparked fires. Five of France's major retail groups were hit: E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U. At least 300 Intermarché and Netto stores were affected. Coopérative U reported more than 100 stores, Carrefour said 80, and Monoprix said about 5% of its roughly 490 stores were targeted. Bruce Hallas, CEO at Re-thinking the Human Factor, who lives in France, noted on LinkedIn that current estimates sit around 400 stores. He added that some individual branches reported losses of about €250,000. Retailers say millions of euros' worth of food was spoiled, which makes food losses the most visible cost of the attack.Why the Supermarket Cyberattack Targeted Fridges
The French case offers the strongest clue. The attack did not rely on a new exploit. It targeted ageing systems: internet-connected devices that were still online years after their manufacturer stopped supporting them. Experts say this weakness is common across retail and industry. The cyberattacks in France appeared to target old systems in particular. Timing made the damage worse. In France, the attackers struck while shops were closed, so temperatures kept rising for hours with no one in the store to notice. Monday's incidents in Sweden also happened overnight. Estonia shows the other side of the picture. There, the intrusion was caught within minutes and caused no significant damage. The difference between tonnes of ruined stock and almost no loss came down to how quickly someone noticed.What We Still Don't Know
Key questions remain open. The reports do not say who is behind the attacks or what they want. The full scale is also unclear. Estimates for France range from around 400 to more than 500 stores, and ICA has not said how many of its Swedish stores were hit. The chains affected on Monday have not confirmed whether their equipment shares the ageing, unsupported setup seen in France. What is clear is that the same tactic has now reached at least five European countries, with fridge temperatures set to 50 degrees Celsius each time.
Russia and Ukraine Emergency Apps Hacked With Fake Threat Alerts
Emergency Alert App Cyberattacks Trigger False Warnings
Ukraine was the first to report problems with its emergency alert application, which is supported by the country's Ministry of Digital Transformation and provides notifications about the beginning and end of air defence alerts. Following the incident, the Ukrainian Air Force said the application had probably experienced hostile interference. It specifically denied that Kyiv faced the radiation threat indicated by the false alerts and asked residents to remain calm and follow official updates. Ukraine's Centre for Strategic Communications also urged users to disregard strange messages appearing in the application. The centre blamed Russia for the incident in a post on X and highlighted an alert containing a message in Russian about the Oreshnik missile system. The supplied reporting does not establish how the attackers gained access to the application or how the false messages were inserted into the alert system.Russia's Emergency App Issues False Nuclear Warning
Several hours after Ukraine reported the incident, Russian authorities said their emergency alert application had suffered what they described as a massive cyberattack. One false message reportedly warned Russian residents that nuclear warheads mounted on P1-Suns, identified in the message as a Ukrainian attack drone, had been launched towards all regions of Russia. The alert also instructed people to stock up on food for three weeks and hide. A Ukrainian espionage group claimed that fake nuclear strike warnings had been sent to users in Russia. However, the available reporting did not independently establish who was responsible for the Russian application incident. Russia's emergencies ministry said the mobile application was an additional information service and that the wider public warning system continued to operate normally. The ministry said emergency information was also distributed through sirens, loudspeakers, text messages, television and radio broadcasts. It added that specialists were working to restore the application and described the situation as under control.Cybersecurity Expert Warns of Further Attacks
Herbert Lin, a senior research scholar specialising in cyber policy and security at Stanford University, described the reported compromise of Ukraine's air raid warning application as concerning. Speaking to the BBC's Newsday programme, Lin said he believed it was the first time an official Ukrainian information application had experienced such an incident. He warned that similar attacks could occur again but stressed that the method used to compromise the application was not yet known. The incident highlights the potential consequences of interference with emergency alert systems, which are designed to deliver time-sensitive information to people facing security threats. False warnings can create uncertainty about whether a reported threat is genuine, particularly when residents rely on mobile applications for immediate updates during military attacks. However, the supplied reporting does not establish the wider impact of the incidents on public behaviour or emergency response operations.False Alerts Coincide With End of Kherson Ceasefire
The false warnings in Ukraine appeared just minutes before the scheduled end of a localised ceasefire in the frontline Kherson region, according to BBC reporting. The six-day ceasefire involving the area around Oleshky, which has been under Russian occupation since 2022, had enabled hundreds of people to evacuate. The arrangement was brokered with assistance from US First Lady Melania Trump and Pope Leo XIV. Both sides had accused each other of using the ceasefire period to strengthen their frontline positions. Ukrainian officials said the humanitarian operation could provide a basis for further solutions, although the Kremlin viewed such operations as separate from the wider peace process. The timing of the false alerts was reported, but the available information does not establish that the cyber incidents were connected to the ceasefire or its conclusion.Russia and Ukraine Continue Exchanging Energy Strikes
The reported cyberattacks on Russia and Ukraine occurred amid continued strikes against energy infrastructure on both sides. Russian authorities reported drone strikes against an industrial enterprise east of Moscow, identified by Ukrainian media as the Kstovo oil refinery. Nizhny Novgorod regional governor Gleb Nikitin reported significant damage, possible power outages and reduced hot water supplies. One woman was reportedly injured by falling drone debris. Ukrainian President Volodymyr Zelensky also said Russian strikes had hit energy infrastructure in four Ukrainian regions, leaving hundreds of thousands of homes without power. The emergency application incidents add another layer of concern to the conflict, where digital information services are used to communicate immediate threats to civilians. Investigations into the reported attacks, including who was responsible and how the applications were compromised, remain unresolved in the supplied reporting.
FBI Blames North Korea for $6B Binance Hack as Recovery Hits 95%
Binance Hack: FBI Attributes $6 Billion Theft to North Korea
According to the FBI, North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or around October 29, 2026. The agency is working with the US Secret Service (USSS) and the Internal Revenue Service Criminal Investigation division (IRS-CI) to address the activity. The agencies have observed stolen crypto assets being converted primarily into Ethereum. The FBI expects the operators to use DeFi platforms and instant swap services to move the funds through additional laundering stages. The FBI, USSS, and IRS-CI have urged cryptocurrency industry participants to block transactions involving addresses used by the TraderTraitor actors, including transactions derived from those addresses. The request covers THORNode operators, remote procedure call (RPC) node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers. The FBI has also asked anyone with relevant information to contact a local FBI field office or submit information through the Internet Crime Complaint Center.Binance Withdrawals to Resume in Phases
In its November 1 recovery update, Binance said it was preparing to restore withdrawals progressively after temporarily suspending the service as a precautionary measure. The exchange said the suspension allowed its teams to contain the impact of the incident, assess affected services, review withdrawal infrastructure, and monitor for residual risks. The company also said it was working with law enforcement and industry partners to trace and recover stolen funds. The first phase prioritizes assets and networks based on user demand over the preceding week. Binance said additional networks and assets would be added as they become ready, rather than reopening every withdrawal service simultaneously. Users may encounter temporary delays or longer processing times during the initial rollout because of traffic volumes. Binance advised users to check the withdrawal page for their selected asset and network, or consult its network status page, to confirm availability. The exchange said deposit services remained open and were not affected by the incident. It also stated that it would absorb the financial impact of the stolen funds rather than pass the losses on to users.Binance Reports 95% Recovery of Affected Assets
Binance's recovery updates show a steady increase in the amount of affected assets it says has been covered. In its October 31 update, the company reported that coverage had reached approximately 90%, up from around 80% in the previous update. By November 1, Binance said it had covered approximately 95% of the impacted amount. The remaining 5% consists of tokens outside the ten assets it identified as fully backed, which include BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC. According to Binance, these remaining tokens have lower market liquidity and take longer to acquire at the required scale. The company said it was continuing to purchase the outstanding assets through market transactions and over-the-counter (OTC) channels. The exchange also said its replenishment efforts involved its corporate treasury, a partial deployment of the Secure Asset Fund for Users (SAFU), and a portion of its Futures insurance fund. Binance committed to replenishing SAFU to bring the fund back to approximately $1 billion.
The Cyber Express Weekly Roundup: Binance Hit by $6.3 Billion Security Incident, South Korea Busts AI-Powered Hacking Ring and More
The Cyber Express Weekly Roundup
Binance Hit by $6.3 Billion Security Incident, Nearly $3 Billion Frozen
Binance says a security incident affected about $6.3 billion in crypto assets, making it one of the largest in the industry’s history. Close to $3 billion has already been frozen on-chain, including 1.567 billion USDT frozen by Tether and 800 million USDC frozen by Circle. Read more...South Korean Police Bust AI-Powered Hacking Ring That Targeted 90 Companies
Seoul police have arrested seven people accused of using generative AI to hack about 90 companies and steal 8.2 million personal records, then demanding payment to keep the data private. The group’s 32-year-old ringleader, who taught himself to hack, used AI tools in roughly 60 of the attacks. Read more...Columbia University Settles $16.1 Million Lawsuit Over 2025 Data Breach
Columbia University will pay $16.1 million to settle a class action over its June 2025 cyberattack. The breach exposed Social Security numbers, health information and financial aid data belonging to about 870,000 applicants and affiliates. An internal investigation concluded the attack was politically motivated, with the hacker looking for evidence of affirmative action in admissions, and found no sign that the data was sold. Read more...Ukrainian Ransomware Affiliate Sentenced to 70 Months for Attacks on Hospitals and Businesses
Artem Stryzhak, 36, has been sentenced in the U.S. to 70 months in prison for his part in the Nefilim and Hive ransomware operations, which caused more than $100 million in losses. Working as an affiliate, he attacked companies, law firms and healthcare providers, including during the COVID-19 pandemic. Stryzhak was arrested in Spain in 2024, extradited in 2025, and pleaded guilty to two conspiracy counts. Read more...Discord to Let Google Index Public Server Messages, Raising Privacy Concerns
Discord will allow search engines to index content from its Discoverable Servers, the more than 63,000 public communities with at least 1,000 members. Server web pages and discussion summaries go live on November 16, and individual messages follow from mid-December. Usernames and avatars will be hidden, and older messages are excluded. Read more...Weekly Cybersecurity Takeaway
Several incidents this week show how far a single foothold can reach. At Binance, one engineer’s compromised laptop was enough to push through unauthorized withdrawals worth billions. In South Korea, generative AI helped a self-taught attacker run dozens of intrusions that would once have needed a larger, more skilled team. The other common thread is that the consequences of a breach outlast the breach. Columbia is paying $16.1 million more than a year after its attack, Stryzhak was sentenced years after the Nefilim and Hive campaigns, and the U.S. is still chasing his alleged partner with an $11 million bounty. Discord’s change is a reminder that exposure doesn’t always come from attackers: a default-on setting can make years of casual conversation searchable going forward. Organizations should treat the devices of privileged staff as high-value targets and require multi-party approval for sensitive actions such as large withdrawals. They should assume AI is lowering the cost of attacks and keep basic defenses tight, minimize how much sensitive data they keep and for how long, and review default privacy settings on the platforms their teams and communities use.
Binance Security Incident Affects $6.3 Billion in Crypto Assets, $3 Billion Frozen
How the Binance Data Breach Happened
According to the exchange, early findings point to a compromised employee device. Initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," Binance said in an update. The statement, titled "Security Incident Update," was published on October 30, 2026, at 07:53. It said the company had found no evidence that any wallet private key was leaked. Binance added that it would release a detailed technical post-mortem once the investigation is complete and the facts are fully verified.Who Will Cover the Losses
Binance said it will cover all losses from the cyberattack on Binance using its Secure Asset Fund for Users (SAFU) and the company's own funds. "User funds are safe," the exchange stated. It also said it had worked with blockchain partners to freeze the affected assets. Once remediation is complete, it plans to publish an updated Proof of Reserves.Immediate Steps Following the Binance Data Breach
As an immediate precaution, the exchange said it has:- Temporarily suspended deposits and withdrawals while security checks are completed;
- Revoked the affected address authorization;
- Engaged law enforcement and blockchain intelligence partners to trace and recover the funds.
Withdrawals Expected to Resume Within 48 Hours
In a later update, Binance said it expects withdrawals to resume in 48 hours, after its team "completes a security revamp of the withdrawal service and its related addresses." Until then, users cannot move funds on or off the platform. Binance has not yet said how the attacker gained access to the engineer's laptop. The company has said those technical details will be in its upcoming post-mortem on the Binance data breach.
Three Cyberattack Campaigns Target Japan, Exposing AI’s Growing Role
Case A: Automated Cyberattacks on Japan
In a short burst in October 2026, Case A abused CyberStrikeAI, an open-source agent-based penetration-testing tool with a Simplified Chinese console. Entries like "credential-search agent 8/44" show 44 agents dividing up reconnaissance, exploitation, command and control, persistence, exfiltration, and reporting. The platform produced Japanese forms and fake login pages. It also throttled traffic to each target to avoid detection. At least 19 organizations received identical reports, including at least 16 in Japan and others in Taiwan and Hong Kong. Most were smaller businesses and local public bodies. Yet many entries read "no session, no web shell, no exfiltration." The deepest intrusion began at an unauthenticated administration interface on a legacy system.Case B: Human-Led, AI-Assisted
Over about 24 days in August and September, a human operator used an LLM for planning and tooling. The operator scanned at least 6,000 Japanese IP addresses and also probed AI assets in South Korea. One LLM-written plan targeted AI and GPU services. To get it, the operator framed the request as an authorized assessment to bypass the model's guardrails. Other tools sought to hijack and pool access to other people's AI services, likely to get cheap inference capacity. One company suffered full control through FTP, a database, administrator rights, a web shell, and SSH, and the attacker repeatedly restored backdoors after cleanup. At another, a GIS server left on default credentials exposed several hundred thousand cadastral and commercial records, Windows credentials, and email. Several hundred attempts on one cluster failed.Case C: Limited AI Role
From January to October, a seasoned operator ran at least six campaigns, several in parallel from September onward. They targeted at least 1,300 WebLogic candidates and 35 VPN entry points, mainly in Japan and South Korea. The target lists also included the UK, France, Italy, Qatar, and Colombia. Devices included Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, and Yamaha RTX1210. On the RTX1210, leftover credentials in configuration files opened direct access to corporate networks. Section headings such as echo '=== ... ===' in the command history and emoji status markers in scripts point, with high confidence, to AI-written tools. A skilled human mimicking that style cannot be excluded.Lessons Beyond ARTEX
All three operations worked in Simplified Chinese and sorted results under names like jp_success, jp_attack, and jp_cve_attack. Each picked targets opportunistically, and most of their activity came before the ARTEX reports. Whether they share an operator is unconfirmed, and their language is only a weak clue to origin. AI increased scale, speed, localization, and reporting. It did not change the types of vulnerabilities exploited, the entry points, or how many targets were deeply compromised. The AI also logged planned steps as finished and overstated success. LLMs can also invent vulnerability IDs. These flaws can help with detection and honeypots. Defenders found the PHP2Shell flaws, disclosed in October 2026, through an AI-assisted audit, but no AI-found zero-day was exploited in these cases.Defending Against Cyberattacks on Japan
Recommended steps:- Inventory public-facing systems and update or isolate legacy ones.
- Remove exposed default credentials and admin interfaces.
- Secure VPN and edge-device configurations against credential reuse.
- Check internal AI and GPU services for exposure.
- Monitor for low-frequency, distributed attempts.
- Prepare for LLM misuse through requests built on false premises.
Ransomware Attacks on Hospitals and Businesses Lead to 70-Month Sentence
A Ukrainian ransomware affiliate has been sentenced to 70 months in prison for participating in cyberattacks against hospitals, businesses, law firms and government entities across multiple countries. Artem Stryzhak, 36, was sentenced in the United States for his role in ransomware conspiracies linked to more than $100 million in losses, according to the U.S. Department of Justice (DOJ).
Stryzhak worked with the Nefilim ransomware and Hive ransomware groups, targeting computer networks and disrupting operations across different sectors. The attacks included incidents affecting healthcare providers during the COVID-19 pandemic, when hospitals faced disruptions to their ability to access digital systems and treat patients.
