The Wire
The best tech and security reporting from around the web, picked through the day by our desk. Every headline links to the outlet that reported it. The one-line summaries are ours.
- Binance resumes withdrawals following $6.3 billion breachBinance has resumed withdrawals after a breach it says cost $6.3 billion, and says it has covered 95% of the stolen assets.
- Alpine Linux rebuilds GitLab after attempted RCE attackAlpine Linux rebuilt its GitLab server and reset all passwords after attackers tried to exploit a critical GitLab flaw on 20-21 October.
- Binance resumes withdrawals starting with BitcoinBinance has started resuming withdrawals in phases, beginning with Bitcoin, after a hack earlier in the week.
- Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear ScriptMalicious code injected through a third-party page-speed script drained some signed-in Polymarket traders' funds on 29 October; Polymarket says it is refunding about $2.7 million to 726 wallets.
- FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto HeistThe FBI has attributed the more than $6 billion Binance theft to TraderTraitor, a North Korea-aligned hacking group, according to the agency.
- Binance CEO says 90 percent of stolen assets have been ‘replenished’Binance says it has replaced about 90 percent of the $6.3 billion stolen in a hack and plans to cover the rest, while withdrawals remain paused.
- Northflank security breach leads to abuse of customers' AI API keysCloud hosting platform Northflank is telling customers to rotate all credentials and secrets after a breach led to unauthorised use of their AI API keys.
- New Android SMS of Death exploit can remotely crash unpatched phonesA researcher has published a proof-of-concept for a recently patched Android flaw, CVE-2026-58882, that can crash phones via a crafted text message.
- Chainalysis discloses data breach from "offensive agentic techniques"Blockchain analytics firm Chainalysis says attackers used what it calls offensive agentic techniques to reach internal tools and expose customer names, email addresses, user IDs and organisational roles.
- Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity DataChainalysis confirms an external actor accessed internal tools and non-sensitive customer data, and says investigation content, credentials and session tokens were not accessed.
- Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerCisco Talos describes VOLTA, a self-deleting infostealer that takes credentials, sessions and crypto wallets, then uses LLMs to rank victims' most valuable assets.
- Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root AccessCISA has added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalogue after attackers were seen chaining them for unauthenticated root access.
- A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private ChatsResearchers at Parameter showed a malicious ChatGPT share link could run code in a victim's session and read private chats; OpenAI fixed the flaw after a bug bounty report.
- CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)Palo Alto Networks has published a critical advisory on how the Brotli vulnerability CVE-2026-111497 affects its products.
- Applebee’s exposed customers’ personal data after leaving database password in appA security researcher found a hardcoded database password in Applebee's app that gave unrestricted access to customers' personal data, according to TechCrunch.
- China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 daysAccording to CrowdStrike, the China-backed group Vapor Panda used an agentic AI pentesting tool to compromise 140 sensitive targets in 11 days, across more than 200 targeted organisations in at least 14 countries.