Binance halted trading, deposits, and withdrawals after reporting a security incident involving unauthorized withdrawal transactions and froze $2.5 billion in assets, later raising its estimate of funds at risk to $6.3 billion. Binance’s initial investigation suggests that a compromised DevOps engineer’s laptop enabled an attacker to access a service container and submit unauthorized withdrawal transactions.
Why it matters
Binance said it found no evidence that wallet private keys were leaked and stated that user funds were safe; it also promised to cover customer losses. The incident makes operational access paths, not only custody keys, a salient review boundary for exchange security.
Known limitation: This item is supported by one source record and has not been independently corroborated here.
Security Daily
AI & Agents · Securityaffairs
What happened
A hacker leaked personal and work-contact data for more than 40,000 DHS employees, including names, job titles, email addresses, phone numbers and office locations; affected personnel include CBP, ICE, CISA and senior DHS officials. The data reportedly includes records from about one-fifth of DHS’s 220,000 employees, with approximately 21,000 CBP records, 10,000 ICE and Homeland Security Investigations records, and just under 1,000 CISA records.
Why it matters
The records reportedly identify access to tools including Microsoft 365, ChatGPT, Penlink surveillance software and Mobile Fortify, and include personnel associated with undercover operations, investigations and deportation programs.
Known limitation: This item is supported by one source record and has not been independently corroborated here.
Security Daily
AI & Agents · Helpnetsecurity
What happened
Phorion researchers found that a tampered Anthropic Claude Code extension build for VS Code-compatible editors planted an SSH backdoor on developers’ machines. The malicious package was version 2.1.313 and was found on Open VSX, an open-source VS Code extension marketplace operated by the Eclipse Foundation.
Why it matters
The reported compromise involved a persistent SSH backdoor, indicating that affected developer machines could retain unauthorized access through SSH. This places marketplace provenance and post-install persistence as distinct review concerns for developer environments.
Known limitation: This item is supported by one source record and has not been independently corroborated here.
Evidence is visible. Uncertainty stays visible too.
Baitaphish separates source records from interpretations, labels AI-assisted enrichment, and avoids turning ingestion volume into unsupported claims about threats, prevalence, or risk.
