North Korea Just Stole $6.43 Billion From Binance

The FBI, U.S. Secret Service, and IRS Criminal Investigation have jointly attributed the largest cryptocurrency theft in history to TraderTraitor, a North Korean state-sponsored hacking group, according to The Hacker News.

The group drained more than $6.43 billion from Binance — the world's largest crypto exchange — across 11 blockchains, with 82% of the stolen funds moving through Ethereum and Bitcoin. That figure nearly doubles every dollar North Korean-linked hackers have ever stolen in crypto combined.

The FBI says the stolen assets are being converted into Ethereum and then funnelled through DeFi (decentralised finance — peer-to-peer financial platforms that operate without a central bank or broker) and instant-swap services to obscure the trail. Blockchain firms Tether, Circle, Ripple, and others have managed to freeze $2.85 billion of the stolen funds on-chain so far. Binance has resumed limited withdrawals after a temporary pause.

TraderTraitor has been active since at least 2020 and is responsible for prior heists targeting Bybit ($1.46 billion, February 2025), DMM Bitcoin, and others. The group's method is specific: they pose as job recruiters, use AI to build convincing fake personas, and trick targets — often software engineers and security professionals — into downloading malware-laced applications.

If you applied for any job in blockchain, crypto, AI, or cybersecurity and downloaded something from a "recruiter" in recent months, run a full malware scan immediately. Do not open any files sent by unfamiliar contacts through LinkedIn, Telegram, or email. Verify recruiter identities through company websites before engaging.

Chinese hackers have crossed a notable line, according to Bleeping Computer: running coordinated, AI-directed attacks against more than 200 organisations across 14 countries at the same time.

The group, tracked by CrowdStrike as Vapor Panda, used ARTEX — an open-source AI penetration-testing framework (a toolkit that automates the process of probing networks for weaknesses) — to perform reconnaissance, exploit vulnerabilities, steal credentials, and pivot through networks without waiting for a human to issue each command. Confirmed victims include telecom providers in the U.S. and Belgium, government bodies in Greece and the Middle East, and pharmaceutical firms.

In one intrusion, the AI agents consumed over 1.4 billion processing tokens — roughly the equivalent of reading a small library — working through the network autonomously. A separate attack on a cybersecurity research group went from initial access to full administrative control in 12 minutes.

If your organisation runs unmanaged or unmonitored servers, this campaign is a direct argument for getting endpoint protection in place now.

What LXD and MicroCloud are: LXD is Canonical's system for running and managing Linux virtual machines and containers — think of it as a tool for spinning up isolated computing environments on a server. MicroCloud ties multiple LXD machines together into a single cluster.

What it is: An authentication flaw that lets an attacker log in as a trusted client without ever holding that client's private key. It carries a perfect CVSS (Common Vulnerability Scoring System — a standardised 0–10 scale measuring severity) score of 10.0.

Who's at risk: Administrators running LXD with the network API enabled, or anyone using MicroCloud. Standalone LXD installations are not exposed by default, but MicroCloud clusters are inherently networked.

CVSS: 10.0 (Critical — patch today.)

Root cause: LXD uses mutual TLS (Transport Layer Security — a protocol that verifies identity by requiring both sides to present certificates) to authenticate remote clients. The server checked every certificate a client presented against its list of trusted identities, but a TLS connection only proves ownership of the first — the "leaf" — certificate in the chain. The attacker could attach a trusted client's public certificate, which is not a secret, further back in the chain. The server saw the trusted cert and waved them through. It is like a bouncer checking the back of your ID queue rather than the person holding it.

Attack vector: An attacker needs two things: network access to the HTTPS API, and the public certificate of any client the server already trusts. In a MicroCloud cluster, that certificate is briefly visible as members join. With both in hand, the attacker builds a TLS chain with the trusted cert at the back, connects to the API, and is accepted as that trusted client — with full access to the cluster, its virtual machines, and, if the impersonated account is privileged, root access to the physical host.

Detection strategies:

1. Check API access logs for connections from unexpected IP addresses presenting certificates belonging to known cluster members.
2. Look for administrative API calls — such as VM creation, deletion, or configuration changes — that do not correspond to scheduled operations.
3. Monitor for new container or VM instances you did not create.

Recommended actions:

1. Run sudo snap refresh lxd and sudo snap refresh microcloud immediately. Verify the installed version after refresh.
2. Until patched, restrict network access to the LXD HTTPS API using firewall rules — only allow known, trusted IP addresses.
3. Incus users (the community fork of LXD) should upgrade to version 7.6.0.

Microsoft's October Windows 11 update quietly broke Smart App Control for some users, according to Bleeping Computer. The feature — which blocks potentially harmful apps and unknown binaries from running — appeared greyed out and couldn't be switched on, leaving some machines less protected than their owners realised.

Microsoft has fixed the issue in the KB5127936 update, released October 28, 2026. Here's what to do right now:

1. Open Windows Security → App & browser control → Smart App Control settings
2. Check it shows as On — not greyed out, not "Evaluation"
3. If it's greyed out, go to Settings → Windows Update and install any available updates

Smart App Control works alongside Microsoft Defender to stop unrecognised software before it runs. If it was silently disabled on your machine, you've been without that layer of protection for weeks.

The Florida Department of Education says hackers breached its student financial aid website in October, potentially exposing names, Social Security numbers, dates of birth, addresses, and contact details for up to 4.9 million people, according to Security Week. Anyone who has ever applied for Florida state financial aid may be affected.

The department has not confirmed how the attackers got in. If you have applied for Florida student aid at any point, monitor your credit and consider placing a fraud alert with the major credit bureaus — it's free and takes minutes.