Binance Links $6.3B Crypto Theft to Compromised DevOps Laptop

Cryptocurrency exchange Binance announced that it traced a record $6.3 billion security breach — in which attackers moved approximately $6.36 billion across 10 blockchains in about 20 minutes starting at 20:05 UTC on Oct. 29, 2026 — to a compromised laptop belonging to a DevOps engineer that enabled access to a service container and unauthorized withdrawal transactions (The Record, BleepingComputer, ABC7 News). Across a wave of separate security disclosures on Thursday and Friday, prediction market Polymarket temporarily halted trading after a third-party DebugBear JavaScript compromise (BleepingComputer, The Record), Pluto Security uncovered 31 malicious Hugging Face model repositories hijacking GPUs for cryptocurrency mining (BleepingComputer), Drupal warned of active exploitation of critical flaw CVE-2026-118539 in Commerce Core (BleepingComputer), and Japan Airlines (JAL) disclosed a third-party Amadeus breach affecting 92,000 passengers (BleepingComputer).

Binance Traces $6.3B Theft to DevOps Laptop as Issuers Freeze Nearly $3B

According to Binance Co-CEO Richard Teng and co-founder Yi He, the exchange suspended deposits and withdrawals for 48 hours while working with law enforcement and pledged to cover all losses through its SAFU fund and corporate reserves before publishing an updated Proof of Reserves (The Record, BleepingComputer). During initial tracking — when Arkham Intelligence monitored 55 addresses holding $5.78 billion (including $1.77 billion in USDT, $1.44 billion in Bitcoin, $876 million in Ethereum, and $823 million in USDC) after transfers of $2.53 billion across 64 tokens from "Binance 14," $174.4 million 24 seconds later, and 780 million USDC to an address holding $2.27 billion, and founder Changpeng Zhao commented on X — Tether CEO Paolo Ardoino froze more than $1.567 billion in USDT and Circle CEO Jeremy Allaire froze more than $800 million in USDC ($2.3 billion+ initially) (BleepingComputer).

In total, Tether, Circle, Ripple, and World Liberty Financial froze approximately $2.67 billion in stablecoins and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB — roughly $2.7 billion to $3 billion frozen on-chain — while the attacker sold USDT and borrowed ETH on Aave, retaining more than 420,000 ETH and 18,270 BTC worth about $2.4 billion (BleepingComputer). Blockchain intelligence firms TRM Labs and Chainalysis attributed the $6.36 billion heist — roughly 4 times the $1.5 billion ($1.4 billion) Bybit hack of February 2025 — to North Korea's TraderTraitor (Lazarus Group / APT38), noting preparations began 36 hours in advance and funds commingled with last month's $387 million Bitget theft alongside earlier attacks on KelpDAO ($300 million in April 2026), Harmony's Horizon bridge ($100 million), and Sky Mavis's Ronin Bridge ($600 million), while UN investigators estimate North Korea stole over $2 billion last year and $3 billion between 2017 and 2023, and Microsoft detailed DPRK use of the ARTEX AI penetration-testing tool (The Record).

Polymarket DebugBear Script Compromise and Hugging Face GPU Cryptomining Campaign

On Thursday afternoon, prediction market Polymarket placed its exchange into cancel-only mode at 2:05 p.m. ET, removed a compromised DebugBear Real User Monitoring (RUM) script in a build at 1:59 p.m. ET (#15337), paused trading at 2:37 p.m. ET, and resumed full operations at 3:05 p.m. ET while promising to reimburse all affected traders (BleepingComputer, The Record). Researchers at Hudson Rock and BleepingComputer found that malicious JavaScript served from cdn.debugbear.com and communicating with data.debugbear.com hijacked authenticated sessions between 1:50 p.m. and 1:56 p.m. ET, transferring approximately 28.6 million POL (worth roughly $2.57 million, with $2.19 million held at the time of inspection) to attacker wallets.

In AI supply-chain security, Pluto Security identified 31 malicious Hugging Face model repositories across 7 accounts (19 repositories in a 2nd wave that remained live 8 days after reporting) posing as small Qwen2 checkpoints and accumulating more than 32,000 total downloads (BleepingComputer). Abusing the trust_remote_code option on self-hosted Xinference and GPUStack GPU servers, the flagship fake model MENXIANGYU/qwen2-tiny climbed from 7,354 to 28,412 downloads by Oct. 28 (with a copy under htt0118 uploaded Oct. 25) while scanning clean on antivirus tools, installing a Linux cryptocurrency miner and reverse shell that mined roughly $5,000 in Pearl (PRL) — including 9 machines on a shared research GPU cluster that mined simultaneously for 6 minutes. Separately, Air Security flagged a fake GitHub repository (SolanaUpdateTools/solana-starter-kit, created November 2025 with 286 stars) that tricks AI coding agents into running a Windows PowerShell command installing NetSupport Manager RAT alongside a fake 72-hour server load error (BleepingComputer).

Drupal CVE-2026-118539, Japan Airlines Amadeus Breach, DHS Icepick Archive, and Poryadok Outage

In enterprise software and aviation, Drupal urged administrators on more than 42,000 websites using Commerce Core (versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13) to upgrade immediately to Commerce Core 3.3.13 or 8.x-2.41 and audit orders due to active in-the-wild exploitation of critical access-bypass vulnerability CVE-2026-118539, following May's CVE-2026-9082 (added to CISA's KEV catalog with a 3-day patch order, among 5 exploited Drupal flaws) and recent RCE patches CVE-2026-108097 and CVE-2026-108099 (BleepingComputer). Meanwhile, Japan Airlines (JAL) announced that Amadeus (used by over 400 airlines, 210 airport operators, 34 cruise and ferry lines, and 2 million hotels, which disclosed a booking display flaw on Oct. 1, 2026) notified the carrier on Oct. 23, 2026 of unauthorized access between Aug. 10, 2023 and Sept. 23, 2026 exposing reservation data for 90,000 customers and passport, email, phone, and frequent-flyer details for an additional 2,000 customers (92,000 total, with credit cards and passwords unaffected, while All Nippon Airways — which also suspended services on Oct. 21 — Asiana Airlines, and Korean Air confirmed Amadeus impacts) (BleepingComputer).

Separately, Department of Homeland Security contractor ZeroFox sought takedowns of the Icepick search archive containing work contact records for more than 41,000 DHS employees; Icelandic host FlokiNET refused the request on Thursday, while registrar CentralNic placed icepi.cx on serverHold before the site reappeared under a different registrar (CyberScoop). And in Russia, home goods chain Poryadok (founded in 2010 in Voronezh, operating 48 stores across 32 cities including Kursk) closed stores and suspended online services for 5 consecutive days following a Sunday cyberattack (The Record).