WORLDTECHBinance Probes $6.3 Billion in Unauthorized Transactions Amid October Breaches
AI illustrationGBHackers reports that October brought a run of unrelated security incidents across cryptocurrency platforms, developer tooling and government systems. The reporting describes separate incidents rather than one coordinated campaign, and it stresses that confirmed compromises, vulnerable configurations and possible exposure must be kept apart.
Crypto platforms report large unauthorized transfers
Binance, a cryptocurrency exchange and finance company based in the United Arab Emirates, investigated unauthorized transactions that were reportedly worth $6.3 billion. Blockchain partners froze about $3 billion of that sum. Its incident coverage described a potentially compromised DevOps laptop and access to service containers, yet the company reported no evidence that wallet private keys had leaked.
Outside analysis tied $2.7 million in withdrawals to 710 wallets, but the platform has not confirmed that figure. Separately, Polymarket investigated malicious JavaScript aimed at browser-held trading credentials and active clients. Coinbase disclosed a vendor incident involving Amplitude that exposed customer contact information, but it did not establish compromise of Coinbase systems or customer funds.
Developer tools hit by exploits and malicious packages
PHP2Shell involved CVE-2026-109618 and CVE-2026-109619, both scored 9.2, which enable unauthenticated code execution under affected configurations. Exploitation attempts came before disclosure, though attempts should not be equated with confirmed compromises. Node.js addressed ten vulnerabilities, four of them high-severity issues involving Brotli, TLS validation and DNS handling, and operators are advised to verify deployment of releases 26.12.1, 24.22.1 and 22.23.4, particularly inside containers.
A LiteLLM supply-chain compromise pushed credential-stealing malware through version 1.107.0 wheels and affected images. Python startup hooks put environments at risk even where LiteLLM was never explicitly imported. GhostAction injected malicious GitHub Actions workflows into 790 repositories, targeting secrets and repository history, though this does not prove that GitHub's central platform was breached. Separate npm reporting described potential takeover exposure affecting more than 1,500 packages, not confirmed malware in every one. Cursor also reported malicious Claude Code extension packages in its marketplace.
Open questions
- How much of the Binance transaction total will be recovered as frozen assets rather than permanent losses?
- Will the platform confirm the $2.7 million figure and its 710 wallets?