Daily Briefing for 10.30.26

Top stories.

1. Binance suffers the largest crypto hack on record.
2. Maximum-severity GitLab flaw is under active exploitation.
3. US sanctions Russians and North Koreans for alleged roles in fraudulent IT worker operations.

Binance suffers the largest crypto hack on record.

Cryptocurrency exchange Binance estimates that $6.3 billion was stolen in what is likely the largest crypto heist in history, WIRED reports. Hackers began siphoning cryptocurrency from Binance wallets around 4:00 PM yesterday, and completed the theft in about twenty minutes. Binance suspended all deposits and withdrawals while it investigated the hack, and the exchange says it was able to freeze about half of the funds. 

Blockchain intelligence firms TRM Labs and Chainalysis have attributed the theft to the North Korea-linked TraderTraitor operation. Tom Robinson, chief scientist and cofounder of Elliptic, told WIRED, “If North Korea is behind it, this one theft would almost double everything the regime has stolen in crypto to date.”

TRM Labs states, “Early on October 29, the operator deployed a first piece of code for the attack and tested it on two wallets. Later that day, it rehearsed the final version on a third wallet, then routed the test funds back to itself. Four hours after that rehearsal, the same code was installed on a Binance hot wallet.” The researchers say the attack “points to a compromise of Binance's hot wallet signing infrastructure.”

Binance says losses will be fully reimbursed, and the exchange has reserved more than $6.34 billion of company funds to cover the incident.

Maximum-severity GitLab flaw is under active exploitation.

The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of a maximum-severity GitLab vulnerability that was patched on October 12th, BleepingComputer reports. The vulnerability (CVE-2026-97229) can allow “an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.”

CISA has ordered Federal agencies to patch the flaw by Sunday, November 1st, and private-sector entities should follow suit.

US sanctions Russians and North Koreans for alleged roles in fraudulent IT worker operations.

The US Treasury Department’s Office of Foreign Assets Control (OFAC) has sanctioned ten individuals and one entity for their alleged roles in assisting North Korea’s IT worker fraud schemes, the Record reports. Two Russians allegedly laundered millions in cryptocurrency earned by North Korean operatives working remotely for American companies. Treasury also targeted North Korean managers overseeing IT workers in Russia, along with a company accused of using AI to help operatives land US jobs.

Treasury stated, “Today’s action builds on OFAC’s March 12, 2026 designation of a separate DPRK IT worker network and demonstrates Treasury’s sustained commitment to dismantling the networks that generate illicit revenue for the DPRK.”