# Today's Top Stories

The FBI, alongside the U.S. Secret Service and IRS-CI, officially attributed the record-breaking $6.43 billion theft from Binance to North Korea's TraderTraitor group, also tracked as Jade Sleet, Pressure Chollima, and UNC4899. This is the largest cryptocurrency heist on record, and the multi-agency attribution signals coordinated U.S. law enforcement focus on DPRK crypto-theft operations that fund the regime's weapons programs. Security teams at crypto exchanges and financial institutions should review threat intelligence on TraderTraitor TTPs as the group remains active.

The FBI confirmed North Korean state-sponsored hackers known as TraderTraitor executed the $6.3 billion Binance crypto theft, marking the largest cryptocurrency heist on record. The attribution reinforces the ongoing threat posed by DPRK-linked actors targeting cryptocurrency infrastructure globally. This story is complementary to the THN report (id 11084) and offers BleepingComputer's editorial angle on the same FBI disclosure.

A CVSS 10.0 vulnerability in Canonical's LXD and MicroCloud allows an attacker to impersonate a trusted client without possessing the client's private key — requiring only network access to the HTTPS API and the target's public certificate. Successful exploitation grants full cluster access, including control over virtual machines, making this critical for any organization running LXD or MicroCloud in multi-tenant or cloud environments. Canonical patches should be applied immediately given the maximum severity rating and low attack complexity.

A proof-of-concept exploit for CVE-2026-58882, dubbed 'SMS of Death,' has been published, enabling remote attackers to crash or disrupt cellular service on unpatched Android devices by sending a specially crafted SMS. The vulnerability affects Android phones that have not yet received the relevant security patch, and the public PoC significantly lowers the bar for exploitation. Android device administrators should prioritize deploying available patches and assess exposure across their mobile device fleets.

On October 20-21, attackers attempted to exploit a critical GitLab remote code execution vulnerability against Alpine Linux's self-hosted GitLab infrastructure, prompting a full server rebuild and organization-wide password reset. The incident illustrates the real-world risk of unpatched GitLab instances in open-source CI/CD pipelines, where a successful compromise could inject malicious code into widely distributed packages. Organizations running self-managed GitLab should audit their patch levels and review recent pipeline activity for signs of tampering.

On October 29, attackers injected malicious code into Polymarket's website by replacing a legitimate DebugBear page-speed script with a weaponized version, resulting in theft of approximately $2.64–$2.7 million from 726 trader wallets. The attack automatically sold victims' open positions and transferred funds, representing a classic supply-chain/third-party script compromise against a high-value DeFi platform. This case underscores the risk of loading third-party JavaScript from external domains in financial applications and the need for subresource integrity controls.

Kaspersky researchers detailed a sophisticated infection chain targeting government organizations in Asia using a previously undocumented .NET assembly-loading framework called NetamLoader, deployed against a custom Windows 10 build used exclusively by those government entities. The attack chain is described as 'highly sophisticated,' suggesting a well-resourced threat actor with specific knowledge of the target environment. Security teams supporting government networks in Asia should review Kaspersky's IOCs and assess exposure to .NET-based loader malware.

Cloud hosting platform Northflank suffered a security breach in which an external actor gained unauthorized access to customer secrets stored on the platform, leading to abuse of customers' AI API keys. Northflank is urging all customers to immediately rotate credentials and secrets, indicating the breach scope may extend beyond AI keys to other stored secrets. The incident highlights the systemic risk of storing sensitive API credentials in third-party cloud platforms and the value of secrets rotation policies.

Blockchain analytics firm Chainalysis disclosed that an external actor accessed non-sensitive customer identity data using 'offensive agentic AI' techniques against internal tooling, though investigation content, authentication credentials, and session tokens were not exposed. The use of AI-assisted attack tools against a company specializing in crypto investigation is notable given Chainalysis's role supporting law enforcement and financial intelligence operations. Customers should monitor for any follow-on phishing or social engineering attempts leveraging the exposed identity data.

A U.S. federal court sentenced Syrian hacker Ahmad Umar Agha to 42 months in prison for conducting pro-Assad cyberattacks against media organizations, businesses, and government entities over a span of more than a decade while evading capture. The case demonstrates sustained U.S. prosecution efforts against nation-state-aligned hacktivists and serves as a deterrence signal to state-sponsored actors. Security teams should note the long operational timelines involved, as threat actors of this profile may maintain persistent access for years before detection.