The Hot Drop for 11-04-2026

• Binance experienced a serious and highly sophisticated security incident on 29 October 2026.
• The affected networks included Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon.
• Early reports linked the suspected Binance hack to large transfers across Ethereum, Bitcoin, and TRON.

No background yet from current sources.

In June 2025, an engineer on Binance’s Wallet DevOps team installed a tampered version of Homebrew, a package manager used on Macs, during a supply chain attack. Binance's initial investigation suggested that a compromised laptop belonging to a DevOps engineer may have enabled unauthorized withdrawals. Binance has not publicly detailed the initial infection method, exploited vulnerability, persistence mechanism, or credentials involved. On 29 October 2026, the attacker submitted one transaction at 20:20 UTC containing 50 EIP-7702 authorizations signed by a Binance hot wallet.

Each authorization pointed the hot wallet to a sweeper contract that accepted instructions only from the operator, effectively turning the wallet into a sweeper controlled by the attacker. The attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled on Ethereum, with 50 pre-signed authorizations prepared in advance. Between 20:05 UTC and 20:09 UTC on 29 October 2026, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address. During the same timeframe, Binance hot wallets on Solana and Optimism sent around 970,500 SOL and 44.2 million OP to attacker-controlled addresses.

The affected networks included Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon.

On October 29, 2026, North Korea’s TraderTraitor group drained approximately USD 6.36 billion from Binance wallets across ten blockchains in the largest hack in history. The Federal Bureau of Investigation confirmed that North Korean hackers stole more than $6 billion in virtual assets from Binance on or about October 29, 2026. Threat actors targeted multiple software engineers at Binance with sophisticated social engineering and zero-day malware in a months-long campaign that led to this record-breaking digital heist. In June 2025, cybersecurity firm Socket reported that a Contagious Interview campaign impersonated recruiters on LinkedIn and sent developers coding assignments containing malicious npm packages.

Attackers stole about $6.34 billion in digital assets from Binance using a tampered software installer and a fake job interview. North Korean hackers used a fake job interview to trick an employee into installing malware that compromised Binance's wallet infrastructure and stole about $6.34 billion in digital assets. The attacker drained Binance 14 in a single transaction worth about $2.5B starting at 20:24 UTC on October 29, 2026. Between 20:05 UTC and 20:09 UTC on October 29, 2026, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address.

Reported outflows included approximately $1.45 billion in Bitcoin and $875 million in Ether, alongside stablecoins and other tokens. Reports suggest that around $5.7 billion may have left wallets linked to the exchange, although Binance has not confirmed the total stolen or established that every flagged transfer belongs to the attack. Binance’s public updates increased the verified frozen amount from $2.54 billion to approximately $3 billion. As of November 3, 2026, approximately $2.85 billion in stolen assets had been frozen or intercepted, while 98% of impacted token assets had been replenished as of October 31, 2026.

The FBI attributed the attack to North Korean state-sponsored hackers known as TraderTraitor, also tracked as Lazarus Group, Jade Sleet, and APT38. TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, with high confidence. Elliptic believes it is likely that North Korea-linked actors perpetrated the theft. The attackers abused Ethereum's EIP-7702 authorization mechanism, allowing them to continue stealing cryptocurrency even after the exchange suspended withdrawals.

On October 29, the hackers used the stolen credentials to deploy a malicious script and gain unauthorized access to Binance's wallet signing service. By October 20, the attackers had used the compromised engineer's computer and an internal AI tool to compromise two additional employees working on Binance's wallet infrastructure. North Korean cryptocurrency thieves tricked a Binance software engineer into downloading malware onto their work-issued computer during a fake job interview process. The attackers compromised a Binance engineer’s laptop and a privileged system to make massive withdrawals.

No indicators have been published in current sources.

Blockaid has published a live view of the incident at binance-hack-funds[.]blockaid[.]io to track stolen funds.

No mitigation or protection guidance yet from current sources.

The incident is reported by 17 distinct outlets, including bleepingcomputer.com, gbhackers.com, and securityaffairs.com. Binance's initial investigation suggested that a compromised laptop belonging to a DevOps engineer may have enabled unauthorized withdrawals, a detail reported by cybersecuritynews.com and thehackernews.com. Binance has not publicly detailed the initial infection method, exploited vulnerability, persistence mechanism, or credentials involved, according to gbhackers.com. Outlets disagree on the total amount stolen, with blockaid.io reporting a single transaction of about $2.5B while TRM and gbhackers.com report approximately USD 6.36 billion or $6.36 billion.

The amount stolen is reported as $2.5B by blockaid.io, while the FBI confirmed more than $6 billion in virtual assets were stolen. TRM reports an attacker moved approximately USD 6.36 billion, whereas reports suggest around $5.7 billion may have left wallets linked to the exchange. No timeline updates were identified.

• The attacker uploaded fake cPGuard updates, versions 5.88.12 through 5.88.19, to OPSShield's update storage on November 2, 2026.
• The attack began on November 2 at 02:06 UTC and affected cPGuard versions 5.88.12 through 5.88.19.

No background yet from current sources.

The attack began on November 2, 2026, at 02:06 UTC, according to OpsShield. The attacker uploaded fake cPGuard updates, versions 5.88.12 through 5.88.19, to OPSShield's update storage on November 2, 2026, between 02:04 and 02:09 UTC. cPGuard agents installed the fake update on about 2,950 customer servers and ran it as root for over 70 minutes. The stolen data was uploaded to OpsShield’s licensing server through a compromised account, which the attackers then used to retrieve it.

Users updating cPGuard during the compromise window received a script that targeted sensitive data on their machines, including Linux password hashes, root database (MariaDB/MySQL) configuration, root shell history, and root SSH authorization and known-hosts files. According to OPSShield, the attacker stole customer contact information and hashed passwords from the firm's billing and licensing server.

According to BleepingComputer, attackers compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script. According to Help Net Security, an attacker compromised the update infrastructure of cPGuard and pushed a malicious update to nearly 3,000 customer servers.

No indicators have been published in current sources.

No detection or hunting guidance has been published in current sources.

OPSShield released a clean update, version 5.88.26, which removes the hidden root shell planted by the malicious update. The vendor detected the compromise and stopped the malicious distribution within 12 hours after the attacker pushed the compromised cPGuard versions.

Two distinct outlets, Help Net Security and BleepingComputer, reported on the incident. Help Net Security reported that the attacker uploaded fake cPGuard updates, versions 5.88.12 through 5.88.19, to OPSShield's update storage on November 2, 2026, between 02:04 and 02:09 UTC, and that cPGuard agents installed the fake update on about 2,950 customer servers and ran it as root for over 70 minutes. According to OPSShield, as reported by Help Net Security, the attacker stole customer contact information and hashed passwords from the firm's billing and licensing server. BleepingComputer reported that users updating cPGuard during the compromise window received a script that targeted sensitive data on their machines, including Linux password hashes, root database (MariaDB/MySQL) configuration, root shell history, and root SSH authorization and known-hosts files, and that the stolen data was uploaded to OpsShield’s licensing server through a compromised account, which the attackers then used to retrieve it.

According to OpsShield, as reported by BleepingComputer, the attack began on November 2 at 02:06 UTC and affected cPGuard versions 5.88.12 through 5.88.19, and the vendor detected the compromise and stopped the malicious distribution within 12 hours after the attacker pushed the compromised cPGuard versions. Help Net Security reported that OPSShield released a clean update, version 5.88.26, which removes the hidden root shell planted by the malicious update. No confirmed disagreements between outlets were identified. No timeline updates were identified.

No details yet about the affected products from current sources.

No background yet from current sources.

Cold storage rooms in France's National Blood Service (EFS) were turned to a boiling temperature of 110°C (230°F) in a cyber-attack.

The cyber-attack targeted temperature-controlled storage and refrigeration equipment provider Coolworld. Three blood banks have detected and reversed a potentially destructive temperature spike in their cold rooms. The French Blood Establishment (EFS) is the only civilian blood collection and transfusion organization in France.

No details yet about the attackers from current sources.

No ATT&CK techniques were identified in current sources.

No indicators have been published in current sources.

No detection or hunting guidance has been published in current sources.

No mitigation or protection guidance yet from current sources.

Two distinct outlets reported on the cyberattack affecting the French Blood Establishment (EFS). Infosecurity Magazine reported on 2026-11-04 that cold storage rooms in France's National Blood Service were turned to a boiling temperature of 110°C (230°F). Help Net Security reported on 2026-11-04 that three blood banks detected and reversed a potentially destructive temperature spike in their cold rooms following a cyberattack targeting a refrigeration equipment provider of the EFS. The specific detail that three blood banks detected and reversed the temperature spike is reported only by Help Net Security.

Both outlets state the facts with certainty, and no confirmed disagreements or timeline updates are present in the source data. No confirmed disagreements between outlets were identified. No timeline updates were identified.

No details yet about the affected products from current sources.

No background yet from current sources.

No technical details yet about how the attack or flaw works from current sources.

No details yet about who was affected or the impact from current sources.

SkyW4lker is an active phishing kit that abuses legitimate Microsoft device-code authentication to gain unauthorized access to corporate accounts without stealing passwords or bypassing MFA.

No detection or hunting guidance has been published in current sources.

An IPv4 address 198[.]23[.]223[.]185 was identified as an indicator with an unknown role.

No mitigation or protection guidance yet from current sources.

The claim that SkyW4lker abuses legitimate Microsoft device-code authentication to gain unauthorized access to corporate accounts without stealing passwords or bypassing MFA is reported by a single outlet, medium.com. No confirmed disagreements between outlets were identified. No timeline updates were identified.