Skip to content

🔍 Threat Intel742

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types742Articles352Write-ups278Advisories50
Threads23Talks20Repos11Tools4Other3Papers1
🔍 Threat Intel
en.cryptonomist.charticle

Chainalysis security breach exposed customer data and raised phishing risk

Chainalysis confirmed on 30 October 2026 that an external actor accessed its systems and internal tools earlier in October, using what it called "offensive agentic techniques". Exposed data covers some customers' names, emails, job titles, user IDs and role labels. Chainalysis says it has found no access to passwords, session tokens or investigation content so far, and customers should expect targeted phishing. Affected-customer counts and the exploited vulnerabilities are not disclosed.

Chainalysisoffensive agentic techniquesphishing+1

Threat Intel· Published and added 31 Oct 2026

bleepingcomputer.comarticle

Northflank security breach leads to abuse of customers' AI API keys

Northflank, a cloud application hosting platform, disclosed a breach on 30 October 2026 after a Wiz threat alert and told customers to assume all environment variables were decrypted and to rotate secrets. Customers reported unauthorized use of AI API keys. Wiz's "Black October for AI Developer Platforms" report counts at least nine incidents, including Railway, OpenCode, Warp and Lightning AI, and describes LLMJacking, with about 2.5 million Amazon Bedrock calls costing roughly $100,000 in two cases. Northflank has not said how attackers got in.

NorthflankWizAWS Bedrock+3
LLMJackingBlack October for AI Developer PlatformsRailway+2

Threat Intel, AI Security, DevSecOps· Published and added 31 Oct 2026

theblock.coarticle

Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000

Twelve DeFi websites, including Flap, Kintsu, Pickle Finance and Origami Finance, were hijacked on 30 October 2026 and served the Step Drainer kit. All 12 domains use Name.com as registrar, and 10 were suspended. The Block traced about $138,000 stolen to three EVM wallets, excluding Solana and Aptos losses. Kintsu and Origami blame Vercel. Projects say their onchain contracts were untouched.

VercelEthereumSolana
Step DrainerName.comFlap+5

Threat Intel, Blockchain· Published and added 31 Oct 2026

decrypt.coarticle

Binance Hack: Everything You Need to Know About the Biggest Crypto Heist in History

Decrypt's explainer on the roughly $6.4 billion theft from Binance hot wallets across about 10 blockchains. Binance traced it to a compromised DevOps engineer laptop plus further breach points, and on Ethereum the attacker used 50 pre-signed EIP-7702 authorizations to turn a hot wallet into a sweeper. Chainalysis and TRM Labs attribute it to TraderTraitor; Tether and Circle froze about $2.3 billion.

EthereumBitcoinTether+3
TraderTraitorBinanceChainalysis+10

Blockchain, Threat Intel· Published and added 31 Oct 2026

theblock.coarticle

Chainalysis says hacker using ‘offensive agentic techniques’ accessed its customers’ names and emails

Chainalysis disclosed on 30 October 2026 that an attacker using "offensive agentic techniques" accessed customer names, emails, user IDs and role labels, but no investigation content, passwords or session tokens. The report also covers the Binance hack (about $6.3-6.4 billion, attributed to North Korea), where funds loop through addresses and JustLend lending on Tron is used to dodge stablecoin freezes. About $2.8 billion is frozen.

TronJustLend
ChainalysisBinanceDPRK

Threat Intel, Blockchain, AI Security· Published and added 31 Oct 2026

bleepingcomputer.comarticle

Chainalysis discloses data breach from "offensive agentic techniques"

Chainalysis disclosed a security incident in which an external actor used "offensive agentic techniques" to access internal systems and tools earlier in the month. Exposed customer data includes user IDs, names, email addresses and organizational role labels. The company reports no evidence of access to investigation content, credentials or session tokens, and has shared no details on the vulnerabilities, tools or dwell time. The article also lists other incidents from the same week.

ChainalysisBinanceARTEX+3

Threat Intel, AI Security· Published and added 31 Oct 2026

blog.talosintelligence.comwriteup

Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer

VOLTA (VOLTA-AUTODOXER) is a self-deleting Windows infostealer that, after theft and live session-based enrichment, POSTs an evidence bundle to OpenRouter so an LLM can rank the victim's assets by monetization value. It falls back across a Claude, Kimi and Gemini chain when a model refuses. Talos covers the builder model, the Chrome App-Bound Encryption bypass, the volta_debug.txt artifact and countermeasures such as blocking Chrome --headless.

OpenRouterClaudeGemini+3
VOLTACLOSEDQUORUMCAIRN+3

Malware & RE, Threat Intel, AI Security· Published and added 31 Oct 2026

securityweek.comarticle

Syrian Hacker Gets Prison Time in US After Over a Decade on the Run

Ahmad Umar Agha (Th3Pr0), a Syrian Electronic Army member, received a 42-month US sentence in the Eastern District of Virginia, over 12 years after he was first charged in June 2014. He compromised about 47 Western media, company, NGO and government targets, including the 2013 Associated Press Twitter takeover that caused a flash crash. Accomplice Firas Dardar remains at large.

Twitter
Syrian Electronic ArmyAhmad Umar AghaTh3Pr0+5

Threat Intel· Published and added 31 Oct 2026

wiz.iowriteup

“Black October” for AI Developer Platforms

Wiz Research links October 2026 breaches at AI developer platforms (Fireworks, OpenCode, Warp, Zeabur, Railway and others) to stolen environment-variable credentials for AI access. It details two enterprise AWS Bedrock keys abused after vendor breaches: about 800k and 1.7 million calls, over $100k in list-price usage. It profiles two LLM resale operations, "momo" and "Xingjiabi", that tested the keys.

AWS BedrockOpenCodeClaude+3
LLMjackingdistillationWiz Research+13

Threat Intel, AI Security, Cloud & Infra· Added 31 Oct 2026, published 30 Oct 2026

theblock.coarticle

Inside the largest crypto hack on record: How attackers breached Binance for $6.3 billion

The Block reports on the Binance hack of 30 October 2026, in which investigators estimate more than $6 billion was stolen from hot wallets and attribute the theft to North Korean groups. Binance says it holds about $5 billion of the affected assets and is buying $1.3 billion more to cover losses. The piece covers an EIP-7702 sweeper, laundering through Aave and DEXs, and analyst comments. The available text does not detail the intrusion path.

Aave
BinanceDPRKEIP-7702+1

Blockchain, Threat Intel· Published and added 30 Oct 2026

theblock.coarticle

President Trump says they’re looking into Binance hack as calls grow for crypto rules

The Block reports that Binance lost about $6.3 billion in a hack on 29 October 2026. Co-CEO Richard Teng said a compromised DevOps engineer's laptop gave access to a service container used to submit unauthorized withdrawals, and TRM Labs attributed the theft to North Korea's TraderTraitor. The rest covers reactions: President Trump said on 30 October he was looking into it, CFTC Chair Michael Selig and The Digital Chamber urged federal exchange rules, and senators disputed whether the Clarity Act would have allowed freezes.

BinanceTraderTraitorTRM Labs+5

Threat Intel, Blockchain· Published and added 30 Oct 2026

galaxy.comarticle

Weekly Research Brief: Binance Hacked; Hyperliquid on Wall Street; Prediction Markets’ Brazil ‘Miss’

Galaxy Research's weekly brief of 30 October 2026 opens with the Binance hack: about $6.3b drained across 10 blockchains, attributed by TRM Labs and Chainalysis to TraderTraitor (Lazarus-linked). The attacker used EIP-7702 with 50 pre-signed authorizations on Ethereum, and Binance's preliminary finding is a compromised DevOps laptop reaching a service container. Tether and Circle froze about $2.6b. The other sections cover Hyperliquid and prediction markets.

EthereumBitcoinUSDC+2
TraderTraitorLazarus GroupEIP-7702+7

Blockchain, Threat Intel· Added 30 Oct 2026

galaxy.comarticle

Here We Go Again: Binance Loses $6.3b in Largest Robbery in History

Galaxy Research newsletter on the roughly $6.3b drained from Binance across 10 blockchains, which TRM Labs and Chainalysis attribute to TraderTraitor. On Ethereum the attacker used EIP-7702 to turn a hot wallet into a sweeper contract backed by 50 pre-signed authorizations. Binance's preliminary finding is a compromised DevOps laptop, with no wallet key leak. Tether, Circle, Ripple and World Liberty froze about $2.7b; Galaxy also assesses Binance's ability to cover losses.

EthereumBitcoinTether+3
TraderTraitorLazarus GroupBinance+7

Blockchain, Threat Intel· Added 30 Oct 2026

status.bunny.netadvisory

Bunny CDN Security Incident

Bunny CDN status-page notice, posted 28 October 2026, about unauthorized access at an infrastructure provider that hosted one bunny.net CDN node in Armenia. Traffic was stopped within 20 minutes and the server wiped. No access to the node was found, but cached content, Pull Zone configs and TLS certificates could have been exposed, so all platform certificates were reissued. Customers with their own certificates should rotate them with new private keys.

Bunny CDNTLS
bunny.netb-cdn.netbunny.run

Threat Intel, Cloud & Infra· Added 31 Oct 2026, published 30 Oct 2026

bankless.comarticle

Binance Just Suffered the Biggest Hack in Crypto History. What Now?

Bankless report on the Binance hack of $6.3 billion, which Binance's preliminary investigation traced to a compromised DevOps engineer's laptop with access to withdrawal-authorizing systems. TRM Labs found valid EIP-7702 authorizations on Ethereum, and nine other chains were drained through normally signed transactions. TRM and Chainalysis link it to North Korea's TraderTraitor. Tether and Circle froze about $3 billion, and Binance says SAFU and corporate cash will cover the losses.

EthereumBitcoinSolana+1
BinanceTraderTraitorDPRK+9

Blockchain, Threat Intel· Published and added 30 Oct 2026

decrypt.coarticle

Secret Service, FBI Join Binance Hack Probe as Circle Freezes $823 Million

Decrypt reports that Binance is working with the FBI and U.S. Secret Service after a theft of about $6.4 billion, which TRM Labs and Chainalysis attribute to North Korea's TraderTraitor group, also linked to the February 2025 Bybit hack. Circle froze about $823 million in USDC and Tether froze USDT, though the page gives differing Tether totals. Binance first suspected a compromised DevOps engineer laptop, found more breach points, and saw no evidence of leaked wallet private keys.

USDCTether
TraderTraitorBinanceBybit+10

Blockchain, Threat Intel· Published and added 30 Oct 2026

blog.cloudflare.comwriteup

4 real? Tracking exploitation and patching of eMudhra’s weak keys

Cloudflare's follow-up on eMudhra's eight trivially recoverable intermediate CA keys (such as 4, 56 and 66), disclosed 19 October 2026. Pingora logging showed about 22,000 handshakes with the weak keys, including about 160 forged certificates made within hours of disclosure. Probes on 50 million challenge pages show many bots, old browsers and Android WebView still trust the chain.

CloudflarePingoraAndroid WebView+2
eMudhraMozillaDennis Jackson+6

Threat Intel, Blue Team & Detection· Published and added 30 Oct 2026

cisa.govadvisory

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on 30 October 2026, citing evidence of active exploitation: CVE-2026-111357 (missing authentication for a critical function) and CVE-2026-118527 (generation of predictable numbers or identifiers). The alert restates BOD 26-04, which requires federal civilian agencies to remediate KEV-listed flaws on exposed assets and check for prior compromise. It also links the KEV nomination form.

Ivanti Connect SecureCISA KEVVPN
CVE-2026-111357CVE-2026-118527BOD 26-04+1

Threat Intel, GRC· Published and added 30 Oct 2026

decrypt.coarticle

Binance Sets Aside $6.34B to Cover Hack Losses, CEO Says 'Your Assets Are Safe'

Decrypt reports on the October 2026 Binance hot-wallet hack, about $6.3 billion, which Binance CEO Richard Teng says the company will cover with over $6.34 billion of its own funds. Teng says the attacker used an EIP-7702 delegation that skipped Binance's approval controls, a self-destruct mechanism to wipe tooling, and more than one breach point beyond a compromised laptop. TRM Labs and Chainalysis attribute the theft to TraderTraitor, and the attacker is still moving funds on Tron.

EthereumTronAave+1
TraderTraitorEIP-7702Binance+5

Blockchain, Threat Intel· Published and added 30 Oct 2026

microsoft.comwriteup

From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

Microsoft Threat Intelligence analysis of two human-operated intrusions that began with Teams help desk impersonation and Quick Assist sessions, then diverged at AD CS. Case 1 abused an ESC1 template for privileged certificates and DCSync, with an excluded account later used for Rclone exfiltration. Case 2 used PetitPotam and ESC8 relay to get a domain controller certificate and PKINIT. Includes investigation steps, AD CS hardening and KQL hunting queries.

Active Directory Certificate ServicesMicrosoft TeamsQuick Assist+3
ESC1ESC8PetitPotam+12

Blue Team & Detection, Threat Intel, Offensive Security· Published and added 30 Oct 2026

thedefiant.ioarticle

Binance Attacker Used EIP-7702 to Bypass Wallet Controls, Teng Says

The Defiant reports that Binance co-CEO Yi He's colleague Teng says the attacker in a breach Binance estimates at $6.3 billion used EIP-7702 to bypass wallet controls. Binance is rebuilding its withdrawal service, and attackers destroyed tools and traces during the intrusion. Only the teaser loaded, so the technical detail of the EIP-7702 abuse is not in the available text.

Ethereum
BinanceThe DefiantEIP-7702+1

Blockchain, Threat Intel· Published and added 30 Oct 2026

protos.comarticle

Trezor reveals Malaysian reseller sold wallet with spyware

Trezor says a user reported a Safe 5 wallet bought from Malaysian reseller CryptoBilis in August 2026 with a hidden board between the main board and screen, carrying a cellular module and antenna. The implant allegedly reads the screen, including the wallet backup, and sends it over a mobile network when plugged in. Trezor has not yet examined the device, has dropped CryptoBilis (9 October), and is replacing wallets bought since March 2026.

TrezorLedger
CryptoBilisDanny Sanders

Hardware & RF, Blockchain, Threat Intel· Published and added 30 Oct 2026

securityweek.comarticle

PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) has been exploited for over a week. A China-linked group chained it with the Fragnesia Linux kernel privilege escalation to root at least 25 Palo Alto Networks PAN-OS firewalls with exposed management interfaces. Defiant had seen no confirmed WordPress compromise by 28 October 2026 despite 77,000 requests, and Cato and watchTowr report few successful attackers.

PAN-OSPHPWordPress+2
CVE-2026-109618CVE-2026-109619PHP2Shell+8

Threat Intel, AppSec· Published and added 30 Oct 2026

securityweek.comarticle

In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak

SecurityWeek's weekly roundup of 30 October 2026 covers CVE-2026-97631, a 16-year-old buffer overflow in TianoCore EDK II that affects PXE network boot on most servers. It also covers a Cloudflare Workers AI cross-tenant leak caused by an SGLang bug, Anthropic's dispute with Cathedral over a bug bounty intrusion, and fake AI bots probing for secrets. Other items include AI-assisted ransomware (Gold Ogre, Aur0ra), the NIK C2 framework, and North Korean IT worker sanctions.

TianoCore EDK IISGLangCloudflare Workers+3
CVE-2026-97631CathedralCequence+9

Threat Intel, AI Security, Hardware & RF· Published and added 30 Oct 2026

21shares.comarticle

Binance hack: the largest robbery in financial history

Binance hack analysis from 21shares on the 29 October 2026 theft of about $6.3 billion from Binance. Binance's initial finding points to a compromised DevOps engineer's laptop with no sign of a leaked wallet key. Chainalysis attributes it to North Korea with high confidence, and about $3 billion was frozen by Tether, Circle and the Arbitrum Security Council. The attacker also borrowed about $44.6 million of WETH on Aave. Binance says SAFU and company funds will cover all losses.

AaveTetherUSDC+2
BinanceLazarus GroupDPRK+7

Threat Intel, Blockchain· Published and added 30 Oct 2026

bleepingcomputer.comarticle

Malicious Claude Code extension on Cursor planted SSH backdoors

A malicious version 2.1.313 of Anthropic's Claude Code extension was served from Cursor's marketplace for about 11 hours on 29 October 2026, reaching up to 5,000 developers. A JavaScript loader prepended to extension.js added an attacker SSH key, a reverse tunnel and macOS/Windows persistence, and reported to 134.209.82[.]225. Coding errors likely blocked SSH access on many hosts. Cursor removed it and rotated keys; victims should look for an 'svc-telemetry' SSH key.

Claude CodeCursorVS Code+3
PhorionOpenSourceMalwareLaunchAgent persistence+1

Supply Chain, AI Security, Threat Intel· Published and added 30 Oct 2026

decrypt.coarticle

What is EIP-7702? The Ethereum Upgrade Behind the $6.4B Binance Hack

EIP-7702 ("Set Code for EOAs") is the Ethereum change, live since the Pectra upgrade on 7 May 2025, that lets ordinary wallets delegate to smart contract code. The guide covers set-code transactions, delegation indicators, batching, sponsorship and sweeper-contract scams. It then describes the 29 October 2026 Binance theft of about $6.4B, which TRM Labs and Chainalysis attributed to TraderTraitor, where 50 pre-signed authorizations turned a hot wallet into a sweeper.

EthereumTornado Cash
EIP-7702EIP-8141TraderTraitor+10

Blockchain, Threat Intel· Published and added 30 Oct 2026

securityweek.comarticle

Bulletproof Host Virtualine Loses Its Domain to FBI Seizure

Virtualine is a Russian-speaking bulletproof hosting provider whose domain virtualine.net the FBI seized. Court documents say it hosted phishing, spam, carding and illicit content, and ignored abuse reports. TRM Labs says it received more illicit-attributed cryptocurrency than any other labeled bulletproof host, mostly from a Russian drug marketplace (44%) and a sextortion scheme (17%), and later from StealC operators in 2026.

Bitcoin
VirtualineStealCFBI+3

Threat Intel· Published and added 30 Oct 2026

theblock.coarticle

Binance says it has $6.34 billion ready to cover hack losses

The Block reports that Binance says it has set aside $6.34 billion of its own funds to cover a hack it puts at about $6.3 billion. Co-CEO Richard Teng says the entry point was a compromised DevOps laptop and no private key leak was found. About $3 billion was frozen by Tether, Circle, Ripple and others, withdrawals are suspended, and TRM Labs sees parallels with North Korean attacks. Technical detail is thin.

BinanceTRM LabsTether+4

Blockchain, Threat Intel· Published and added 30 Oct 2026

aikido.devarticle

Binance hack: how a compromised developer laptop can lead to a $6.3 billion breach

Aikido Security's analysis of the roughly $6.3 billion Binance incident, which Binance says may have started with a compromised DevOps engineer's laptop. It sets out what is known (no private key leak, TraderTraitor attribution by TRM Labs and Chainalysis, additional breach points) and a plausible chain from laptop credentials to a withdrawal service. It compares the 2025 Bybit theft and lists mitigations.

npmVS CodeAWS+1
BinanceTraderTraitorLazarus Group+9

Blockchain, Threat Intel, Supply Chain· Published and added 30 Oct 2026

Showing 30 of 742

Show more