Must Know
AI & Agents · Theregister Security
What happened
Binance halted trading, deposits, and withdrawals after reporting a security incident involving unauthorized withdrawal transactions and froze $2.5 billion in assets, later raising its estimate of funds at risk to $6.3 billion. [1]
Binance’s initial investigation suggests that a compromised DevOps engineer’s laptop enabled an attacker to access a service container and submit unauthorized withdrawal transactions. [1]
Why it matters
Binance said it found no evidence that wallet private keys were leaked and stated that user funds were safe; it also promised to cover customer losses. [1]
The incident makes operational access paths, not only custody keys, a salient review boundary for exchange security. [1]
AI & Agents · Securityaffairs
What happened
A hacker leaked personal and work-contact data for more than 40,000 DHS employees, including names, job titles, email addresses, phone numbers and office locations; affected personnel include CBP, ICE, CISA and senior DHS officials. [2]
The data reportedly includes records from about one-fifth of DHS’s 220,000 employees, with approximately 21,000 CBP records, 10,000 ICE and Homeland Security Investigations records, and just under 1,000 CISA records. [2]
Why it matters
The records reportedly identify access to tools including Microsoft 365, ChatGPT, Penlink surveillance software and Mobile Fortify, and include personnel associated with undercover operations, investigations and deportation programs. [2]
AI & Agents · Helpnetsecurity
What happened
Phorion researchers found that a tampered Anthropic Claude Code extension build for VS Code-compatible editors planted an SSH backdoor on developers’ machines. [3]
The malicious package was version 2.1.313 and was found on Open VSX, an open-source VS Code extension marketplace operated by the Eclipse Foundation. [3]
Why it matters
The reported compromise involved a persistent SSH backdoor, indicating that affected developer machines could retain unauthorized access through SSH. [3]
This places marketplace provenance and post-install persistence as distinct review concerns for developer environments. [3]
Incident · Malwarebytes Labs
What happened
Socket researchers found three malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget wallets; the extensions stole recovery phrases and private keys that could give attackers full wallet control. [4]
The extensions searched for 12-, 15-, 18-, and 24-word recovery phrases and Ethereum or Solana private keys, including by reading input fields, detecting pasted text, and scanning displayed screens. [4]
Why it matters
The Phantom variant logged captured secrets, sent them to a Telegram bot, and automatically moved funds to hardcoded payout addresses across multiple blockchain networks. [4]
The trust boundary is at secret entry and extension provenance, rather than the wallet brand an extension claims to represent. [4]