BlockThreat - Week 44, 2026

Folks, we have a problem. For years, a rogue nation state has been hitting our industry with brutal hacks. Operating beyond the reach of any court and acting with total impunity, North Korea shows up every few months and takes hundreds of millions, as if we we are its personal bank. The withdrawals keep getting bigger. Last year it set a record with the $1.5 billion Bybit hack. This year, $1B+ stolen already wasn’t enough. On October 29, the regime took $6.36B from Binance making it the biggest computer theft in history, in crypto or anywhere else. North Korea has now stolen more in 2026 than in every previous year combined.

No government is going to fight this war for us. Law enforcement can name the culprits, but it can’t arrest a nuclear-armed pariah state that is already under every sanction imaginable. Our only real defense is to become the hardest and most expensive industry on earth to target. Traditional finance faced this same moment in 2016, when DPRK almost stole $1B from Bangladesh Bank. The industry answered with mandatory security baselines, 24/7 hotlines, threat intelligence, practiced incident response and more across the whole SWIFT network. In just 4 years time North Korea went looking for easier targets - us. I covered the Crypto’s SWIFT Moment in my DSS talk, which will be online soon. In this edition, I’ll focus instead on the lessons from the Binance hack, so we may all come out of it stronger.

Three Laptops and a Key

TraderTraitor, Contagious Interview, and the other groups under the DPRK umbrella don’t need new tactics when the old ones keep working. According to Binance’s report, the largest theft in crypto history began with three engineers’ machines, compromised months apart. In June, a hot wallet DevOps engineer installed a malicious Homebrew package while setting up an AI coding tool. Binance caught it, replaced the device and rotated credentials. It was a textbook response to a well known tactic.

In September, a second engineer ran a fake job interview’s take home assignment on a work machine. On October 20, the attacker used an internal AI tool on that machine to move regain access to the same wallet DevOps engineer’s machine and a third engineer’s. On the DevOps engineer’s machine they found a token that could deploy key signing containers. On October 29, between 1:15 and 3:56 AM Binance local time, DPRK leverage access to deploy a container into the wallet environment and started the script that drained the hot wallets.

Several controls failed before a single asset moved:

• Corporate laptops were used for personal work
• An internal AI tool enabled lateral movement
• Container deployment token on a developer's machine
• A critical key signing container was deployed without raising an alarm, additional reviews using a single engineer's authorization.

There are many more lessons, of course, from signing infrastructure and other preventive controls to detection and incident response, but in the interest of time and space I want to focus on lateral movement and single points of failure. When I run threat modeling exercises with my clients, we always start from one assumption that at any given moment, two or more of your engineers are compromised. So the challenge is to make lateral movement from a compromised host extremely hard using strict access policies, entitlements, and human and automated reviews, etc. Treat internal tools that can reach many engineers’ machines, AI tools included, as privileged infrastructure.

The Industry Showed Up

On the more positive side, the best part of the incident was outside of Binance. From Spreek's initial notice of a likely hack to Tether, Arbitrum, and even Circle freezing billions of stolen assets to the whole community jumping in to track stolen funds in real time:

Set up
2026-10-29 15:59 - Sweeper contract deployed
2026-10-29 17:15 - 19:56 - Malicious container deployed

Draining
2026-10-29 20:05 - Draining begins on XRP
2026-10-29 20:10 - Solana drained
2026-10-29 20:18 - Optimism drained
2026-10-29 20:20 - BTC drained
2026-10-29 20:20 - Binance: Internal large transfer alert
2026-10-29 20:20 - EIP-7702 on Ethereum
2026-10-29 20:20 - Tron drained
2026-10-29 20:24 - Ethereum drained
2026-10-29 20:30 - Arbitrum drained
2026-10-29 20:30 - Avalanche drained

Detection and Freezing
2026-10-29 20:32 - Spreek alerts about the hack
2026-10-29 20:41 - Ethereum delegates drained
2026-10-29 20:57 - World Liberty Reserve freezes (first)
2026-10-29 20:58 - Laundering on AAVE
2026-10-29 21:01 - Tether freezes 971.1M USDT
2026-10-29 21:02 - More Tether freezes (130M)
2026-10-29 21:04 - Circle freezes 823M USDC
2026-10-29 21:07 - More Tether freezes (8.41M)
2026-10-29 21:09 - More Tether freezes (378.7M)
2026-10-29 21:14 - More Tether freezes (175M)
2026-10-29 21:18 - More Tether freezes (30M)
2026-10-29 21:29 - Binance: Public announcement
2026-10-29 21:42 - AAVE guardians start freezing reserves
2026-10-29 21:44 - Binance 14 USDT top up drained
2026-10-29 22:01 - Ripple freezes 40.5M RLUSD
2026-10-29 22:06 - Tether blacklists Binance 14
2026-10-29 22:30 - Paxos freezes
2026-10-29 22:33 - Binance: Withdrawals paused
2026-10-29 22:39 - Binance 14 drained again
2026-10-29 22:48 - Binance: freezes wBETH
2026-10-29 22:55 - Binance: Moving funds to cold storage

Second Wave
2026-10-29 23:05 - Polygon drained
2026-10-29 23:53 - Circle blacklists Binance 14
2026-10-29 23:56 - Last drain on Ethereum
2026-10-30 00:10 - Binance: EIP-7702 delegate removed
2026-10-30 00:18 - Arbitrum Security Council freeze

What I see in this timeline is a race, and for once the defenders didn’t run it alone. WLFI, Tether, Circle, Aave, Arbitrum and others ran what looked like a coordinated war room. They even helped Binance by blacklisting its hot wallets to stop further top ups from getting sweeped. So far that effort has frozen $2.85B that can go back to Binance instead of to Pyongyang and that’s a major win in my book.

Could Binance have caught the XRP and Solana drains and halted signing before Bitcoin and Ethereum were hit? Possibly. Largest drains started at 20:20 UTC on BTC about 15 minutes after XPR wallet was drained. Could Binance have moved hot wallet funds to cold storage sooner? Not unless it was an automated or practiced response, because anyone who has been in a war room knows these calls are brutal to make mid-incident, with adrenaline pumping and the root cause unknown. That is exactly why the decision to pause has to be made in advance, practiced constantly, and preferably automated, so a circuit breaker trips in seconds instead of minutes. Those minutes can be the difference between a recoverable incident and a company ending hack.

In Other News

Chainalysis suffered a major breach that exposed names, usernames, password hashes and live session tokens for all of its users. If you’ve ever used a blockchain analytics platform, you know just how sensitive the data behind those logins is including internal address labels, ongoing investigations, compliance cases, etc. Chainalysis says it has no evidence that investigation data was accessed, meaning they don't know yet.

Meanwhile, two more leaks came through the side door. A breach at the analytics vendor Amplitude exposed contact details for some Coinbase customers. At Bithumb, an attacker got into the staff messaging app DaouOffice and copied files that included national ID numbers, bank accounts and ID scans for 844 customers. Leaked contact and identity data is how targeted phishing and wrench attacks find their victims. Be careful out there!

Celebrating Security Researchers

In what I hope is becoming a tradition, I want to celebrate the latest tools and research from our community: the beta of Phishing Dojo by matta (The Red Guild), Dickson’s Web3 Audit Corpus, Elad Ernst’s (Blockaid) work on Sei key extraction, an interesting Chainflip vulnerability from playboi.eth, and Louis Marquenet’s (Opsek) defender notes on YubiKeys, among many others. Thank you for sharing your work!

Next time, I want to feature yours. Yes, you, the reader. Get out there and learn, build and explore the wild frontier we all live on.

And now let’s dive into the news!

News

• Binance hackers used fake job interview in $6.3 billion attack. More details, analysis, PoCs, onchain tracking, and more in the Hacks section below.
• Chainalysis says hackers stole credentials and tokens for all of its customers.
• Launch of our Threat Simulation Learning Platform: Phishing Dojo v3 (beta) by matta (The Red Guild).
• 75 crypto projects shut down in 2026 by CoinStats.

News - Web2

• Anthropic VS code extension on Cursor backdoored for nearly 12 hours. According to the security notice by Cursor, the malicious extension the backdoor attempted to set up a reverse SSH tunnel to attacker's C2 infra.
• India's RBI tightens cyber checks on lenders after spate of hacks. A wave of hacks hit State Bank of India, Central Bank of India, Bharat Electronics and hundreds of NBFCs.

Crime - Enforcement

• Israel extradites Israeli-Russian citizen to US over alleged USD 2.8 million crypto theft. Reminder of the Nomad Bridge Incident.
• Canadian 'tremendously sorry' after spending stolen crypto on Lamborghini, BMWs, jewelry. Trenton Johnston sentenced to time served after pleading guilty to U.S. money laundering conspiracy.
• 'Crypto King' Aiden Pleterski found guilty of fraud at his jury trial in Toronto. Is Canada the home of crypto scammers?
• FBI Seizes Virtualine Domain After Provider Led Bulletproof Hosting Sector in Illicit Inflows by TRM Labs.
• Crypto Continues to Flow Through Sihanoukville Casinos Despite Cambodia's Crackdown by TRM Labs.

Crime - DPRK

• The Developer by Encrypted Films. An upcoming documentary about North Korean IT workers and more.
• Defense contractor employee pleads guilty to aiding North Korean remote IT scheme by USAO.
• North Korea Responsible for $6 Billion+ Binance Attack by FBI Cyber Branch. More importantly FBI is asking certain blockchain operators including THORChain to stop the free movement of stolen funds. It's a polite ask for now.
• Tracking AI adoption in North Korean threat actor tradecraft by Microsoft Threat Intelligence.
• The word "Lazarus" doesn't mean anything anymore, it's just a collective name used to describe various North Korean cyber operations. The (relevant) clusters are as follows by tanuki42.

Crime - Wrench

• 27-Year-Old Missouri Man Admits Role in Failed Bitcoin Kidnapping Plot.

Policy

• Binance Hack Shows Why Offshore Exchanges Need US Oversight, CFTC Chair Says.

Scams

• $LAUNCH Token Collapse: Anti-Pump.fun Rival Rugs to $100K.

Malware

• Udesk Loads Malicious JS to Steal Data and Alter Transfer Addresses by SlowMist.

Media

• SEC-T 0x12 - Yippee-Ki-Yay, Blockchain: Exploiting Decentralized Systems One Die Hard at a Time by Sofia Bobadilla.
• yAudit Block 8: Thinking like an attacker with Dravee.
• Bitcoin Security Expert Jameson Lopp: Cyberattacks on “Exponential” Path

Vulnerabilities

• Please Try Again: Stealing Keys from MPC Wallets via Selective Abort Attacks by Chainsecurity. Report of a critical flaw in Vultisig wallet.
• Remote Private Key Extraction from Sei Validators via Exposed Go pprof by Elad Ernst (Blockaid).
• Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it by Electrum.
• Three new Bitcoin Core vulnerabilities discovered including a bug allowing attackers to remotely brick nodes.
• I was able to save a protocol $9.8m at risk by playboi.eth. Chainflip F1 - BTC change-UTXO poison.

Research - AI

• Web3 Audit Corpus by Dickson. A linked audit corpus with a metadata knowledge graph. Every released finding occurrence has a plain-text Markdown file, including metadata-only records. Report-level finding extracts are also retained. AI-assisted extraction and annotation may contain errors.
• Concerning behavior from a popular open-weight AI model by Cohere. Qwen3.8 Flash Next attempted to send machine diagnostics to the cloud without permission.
• LLM Exploit Generation Guide 2.0. Compares human-guided and autonomous AI approaches against live cybersecurity targets.
• Hacking Back AI Pentesting Agents by Plaintext Cybersecurity.

Research - Bug Hunting

• I got curious about Immunefi's submission fees so I checked their public fee collector by Martin Marchev
• When Staking Rewards Spend User Principal by Bloqarl (Zealynx).
• Report It Anyway by Dickson.

Research - EVM

• Under The Hood - decode Morpho oracles and liquidation risk by tim.

Research - Defense

• The New Security Agenda by a16z. What CISOs told us about AI, budgets, and the priorities shaping 2027.
• Why a YubiKey is not enough: Session theft, EDR and MDM by Louis Marquenet (Opsek).
• $50M+ Lost in RWA Perps With Zero Contract Bugs by QuillAudits.
• Most of the cybersecurity world is focused on the risks and vulnerabilities that lead to initial access, but defenders get *way* more leverage from making lateral movement impossible. You want to get to where the most an attacker can do is screen-scrape the victim's workstation by Dino A. Dai Zovi.

Whitepapers

• Tracing Money Laundering Across DeFi, Bridges, and Mixers on Ethereum by Huan Xing, Gaohe Jin, Bang Fu, Yue Li, Baoning Niu, Xing Fan
• Beyond Copying: Lifelong Smart Contract Security Task Construction via Protocol Mutation by Zifan Peng, Peng Huang, Jingyi Zheng, Yingjie Xue, Xuechao Wang, Xinlei He, Xia Hu, Dongrui Liu
• Deanonymizing Monero Transactions in Tor Network by Ruisheng Shi, Shihan Zhang, Yulian Ge, Lina Lan, Qingfeng Zhang, Qin Wang

Tools

• New Wallet Testing Tool by Coinspect Security. Check out the new Wallet Security Ranking (WSR) testing tool.
• Web3 Audit Database: search and download 180,907 audit findings by Dickson.

Tools - AI

• Introducing the "Grim Prompter" one of the largest collection of open source threat modeling prompts on the planet by Jim Manico (Manicode Security).

Hacks

Detailed indicators of compromise including exploit transactions, attacker addresses, additional write ups, exploit PoCs are available upon request.

Socios Compromise

Date: October 26, 2026
Attack Vector: Hot Wallet Compromise
Impact: $4,800
Chain: Ethereum

https://x.com/m13_digital/status/2115896321358156161

Bloom Compromise 2

Date: October 26, 2026
Attack Vector: 3rd Party Compromise
Impact: $946,000
Chain: Solana

https://x.com/BloomTrading/status/2114646392010359238

Liquidity Reserve Compromise

Date: October 26, 2026
Attack Vector: Price Oracle Manipulation
Impact: $821,920
Chain: BSC

https://x.com/SlowMist_Team/status/2113206749524316486?a=O9EE1YgvoZ7yHD-Nono&s=20

Myriad Markets Compromise

Date: October 26, 2026
Attack Vector: Stolen Private Keys
Chain: BSC

https://x.com/MyriadMarkets/status/2115117700779253890

Safe Wallet 3725bd Hijacking

Date: October 26, 2026
Attack Vector: Uninitialized Address
Impact: $7,500,000
Chain: Avalanche

https://x.com/DefimonAlerts/status/2115005055619260758

Polkadot Asset Hub Compromise

Date: October 26, 2026
Attack Vector: Incorrect Price Oracle
Impact: $1,380,000
Chain: Polkadot

https://forum.polkadot.network/t/xcm-issue-affecting-asset-hub/19126

Chiliz Compromise

Date: October 26, 2026
Attack Vector: 3rd Party Compromise
Impact: $2,000
Chain: Unknown

https://x.com/alex_dreyfus/status/2115786604354613751

Foundation Compromise

Date: October 26, 2026
Attack Vector: API Key Theft
Impact: $400,000
Chain: Unknown

https://ourcryptotalk.com/news/foundation-phishing-email-passport-wallet

Solflare Compromise

Date: October 26, 2026
Attack Vector: Stolen Private Keys
Impact: $135,000
Chain: Solana

https://x.com/solflare/status/2115223521395896530

PredictFun Compromise

Date: October 27, 2026
Attack Vector: 3rd Party Compromise
Impact: $400,000
Chain: BSC

https://x.com/predictdotfun/status/2115089547528950108

Diamante Compromise

Date: October 27, 2026
Attack Vector: Stolen Private Keys
Impact: $700,000
Chain: BSC

https://x.com/diamante_io/status/2115183662954356858

Fence Finance TranchePool Compromise

Date: October 27, 2026
Attack Vector: Reward Manipulation
Impact: $1,010,000
Chain: Avalanche

https://x.com/blockaid_/status/2115249066787340562

Wagyu Compromise

Date: October 27, 2026
Attack Vector: Server Compromise
Chain: Ethereum

https://x.com/CryptoChrisG/status/2115200864772293013

Harvest Moon Compromise

Date: October 27, 2026
Attack Vector: Unknown
Impact: $40,000
Chain: NEAR

https://x.com/neartinkerunion/status/2115328018147340697

zkLink Nova Arbitrator Compromise

Date: October 28, 2026
Attack Vector: Signature Verification
Impact: $781,121
Chain: ethereum, mantle, optimism, blast, base

https://x.com/m13_digital/status/2115828225851187333

Hifi Finance Compromise

Date: October 28, 2026
Attack Vector: Governance
Impact: $1,000,000
Chain: Ethereum

https://x.com/spreekaway/status/2115570707463868782

Coinbase Compromise 2

Date: October 28, 2026
Attack Vector: 3rd Party Compromise
Chain: Unknown

https://x.com/CoinbaseSupport/status/2115274731310002356

Binance Compromise 2026

Date: October 29, 2026
Attack Vector: Hot Wallet Compromise
Impact: $6,340,000,000
Recovered: $2,850,000,000
Chain: Ethereum, Bitcoin, Tron, Solana, Arbitrum, Optimism, Base, Avalanche, Polygon, Ripple

References:

• https://x.com/binance/status/2115993361517891592
• https://x.com/binance/status/2116089661408108712
• https://protos.com/live-binance-suspends-withdrawals-amid-massive-crypto-hack/

Analysis:

• https://x.com/binance/status/2117626126214504729
• https://rekt.news/binance-rekt
• https://blockaid.io/blog/binance-55b-hack-using-advanced-ai-models-blockaid-detects-the-biggest-theft-in-crypto-history
• https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
• https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/
• https://nexusmutual.io/blog/binance-incident-report

Tracking:

• https://x.com/dicksonwuml/status/2115960482825658847
• https://x.com/XBToshi/status/2116369756433653825
• https://x.com/blockaid_/status/2115914335512150480
• https://x.com/somaxbt/status/2116106296747540635
• https://x.com/somaxbt/status/2116448331505553589
• https://twitter.com/NPC_68/status/2115913109936160975
• https://arkm.com/explorer/entity/21a94755-f604-45e5-9501-6542e23005e8
• https://binance-hack-funds.blockaid.io/
• https://etherscan.io/flow?s=72c5540c9d1195f1c6cfc6fcb618460d3b1bb467
• https://go.octav.fi/binance-drain-dash
• https://binance.lamps.works/
• https://bitquery.io/investigations/binance-hack-who-profited
• https://x.com/td_0101/status/2115908756097663419
• https://x.com/newtonfndn/status/2116152759494062282
• https://x.com/somaxbt/status/2116884703655723207
• https://x.com/officer_secret/status/2116187104631775369
• https://x.com/xbtoshi/status/2116065766823100926
• https://fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack

Sweeper:

• https://x.com/concorde81/status/2116151867189154109
• https://x.com/blockaid_/status/2115917919603306651
• https://x.com/blockaid_/status/2115924317888495661
• https://x.com/andrewmohawk/status/2116333247919706588
• https://gist.wavey.info/Ta3FgAxastgj42BEy4V64SYR

Attribution:

• https://x.com/evilcos/status/2116022700485554587

Incident Response:

• https://x.com/arbitrum/status/2115961730920841644
• https://x.com/binance/status/2115943482204574108
• https://x.com/jerallaire/status/2115916207463481846
• https://x.com/paoloardoino/status/2115918000373346709
• https://x.com/ZachWitkoff/status/2115930660166860922
• https://x.com/heyibinance/status/2115928691045982577
• https://x.com/aave/status/2115937863162339637
• https://x.com/aave/status/2116167597901107629
• https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954
• https://x.com/spreekaway/status/2115913988072411495
• https://x.com/zerolore/status/2115950609258217730
• https://x.com/cz_binance/status/2115915423174853077
• https://x.com/zachxbt/status/2115960582230913357
• https://x.com/heyibinance/status/2115932201288397140
• https://x.com/USDT0_to/status/2115918569762652298
• https://x.com/rapidresponse47/status/2116685362672103503

Lessons:

• https://x.com/mattiascaricato/status/2116197818897404323

After the hack:

• https://www.theblock.co/news/business/2026-11-01-binance-sees-3-64-billion-in-net-outflows-after-reopening-withdrawals-following-record-hack-432259

Polymarket Compromise 5

Date: October 29, 2026
Attack Vector: Supply Chain
Impact: $2,700,000
Chain: Polygon

https://x.com/PolymarketTrade/status/2115874609014726842

Zero-Quorum Compromise

Date: October 29, 2026
Attack Vector: Governance
Impact: $24,800
Chain: Ethereum

WAX Bridge Compromise

Date: October 29, 2026
Attack Vector: Function Parameter Validation
Impact: $90,500
Chain: Solana, WAX

https://x.com/WAX_io/status/2113390476225397077?s=20

AlpsCon AI Trade Hub Compromise

Date: October 29, 2026
Attack Vector: Insufficient Function Access Control
Impact: $152,000
Chain: BSC

https://x.com/exvulsec/status/2112118384464892127

Chainalysis Compromise

Date: October 31, 2026
Attack Vector: Server Compromise
Chain: Tron

https://www.chainalysis.com/blog/security-incident-october-30/

Mass Name dot com Compromise

Date: October 31, 2026
Attack Vector: DNS Hijacking
Impact: $202,000
Chain: Unknown

https://x.com/flapdotsh/status/2116400269445509360

Talis Protocol Compromise

Date: October 31, 2026
Attack Vector: Insufficient Function Access Control
Impact: $3,100
Chain: Injective

https://x.com/ProtocolTalis/status/2116664033457680705

Troves Compromise

Date: October 31, 2026
Attack Vector: Insufficient Function Access Control
Impact: $667,000
Chain: Starknet

https://x.com/trovesfi/status/2116541963755475375

VergeX Compromise

Date: October 31, 2026
Attack Vector: 3rd Party Compromise
Impact: $3,689
Chain: Unknown

https://x.com/vergex_ai/status/2116549211110129781

b14g Core DAO Compromise

Date: October 31, 2026
Attack Vector: Function Parameter Validation
Impact: $1,470,000
Chain: Core

https://x.com/b14g_network/status/2116570456245596580

BTCPay Compromise 2

Date: November 1, 2026
Attack Vector: Server Compromise
Impact: $1,630,000
Chain: Bitcoin, Litecoin

https://x.com/btcpayserver/status/2117020340815819262

Premia Compromise

Date: November 1, 2026
Attack Vector: Reward Manipulation
Impact: $437,000
Chain: Arbitrum

https://x.com/blockaid_/status/2116745378674463229