Billions stolen in Binance hack

0:04Billions stolen from Binance in a crypto hack. Last week's PHP 2 shell bugs are being exploited to hack Palo Alto Network's firewalls, the Brotley Bugs also get a run, Belarusian state hackers carry out a wiper attack, and a hacker leaks the data of 41 ,000 DHS employees. This is the Risky Bulletin, prepared by Katalin Kimpanu and read by me, Claire Aird. Today is the 30th of October, and this podcast episode is brought to you by Nebulok. In today's top story, hackers have stolen billions of dollars in cryptocurrency from Binance. Some of the stolen assets were frozen by Tether and Circle, but analysts are tracking the movement of massive amounts of crypto into wallets controlled by the attacker.

0:54Coindesk is reporting the attacker has amassed$5.7 billion in stolen crypto in its wallets. This is a breaking story at the time of recording and the numbers keep changing. If the reported figures are correct, this is the biggest crypto heist of all time. Binance founder and shareholder CZ says user funds are safe. In other news, threat actors have begun exploiting a vulnerability in Google's Brotley data compression protocol. CISA added the vulnerability to its Kev database on Wednesday. The vulnerability allows attackers to run malicious code on apps and servers that use the Brotley library to decompress user-supplied data.

1:37The attacks began two days after a proof-of-concept exploit was published online. Hackers are using the PHP 2 shell vulnerabilities to hack Palo Alto Network's firewalls. The attacks are targeting pan-appliances that have their management panels exposed to the internet. The company has confirmed the attacks. Belarusian state hackers have carried out a destructive data-wiping attack. The attack targeted a Ukrainian manufacturing company that plays an important role in the country's transportation sector. Security firm ESET attributed the attack to a group it tracks as Frosty Neighbour. The group is also known as Ghostwriter.

2:19ESET says Belarusian cybergroups have increasingly been helping Russia with its operations against Ukraine. The Department of Peace Hacktivist Group has leaked the personal information of more than 41 ,000 Department of Homeland Security employees. The data was stolen in August and contains information about ICE and Customs and Border Patrol employees from as far back as 2011. The hackers claim they took the data from an Okta single sign-on service database used by the DHS. Hackers have breached the US Federal Election Commission a week before the country's midterms elections. The agency shut down a system that allows campaigns to electronically file spending reports on Wednesday after detecting the intrusion.

3:06The FEC says the outage will have no impact on the voting process. A cyber attack on a New Zealand company that provides clinical trial and analytical Laboratory Services is delaying coronial investigations in the country's South Island. Zenith technology was hit by the Zawu ransomware in early September. The incident delayed lab work for New Zealand patients, but the Ministry of Justice now says some coroner's court information has also been affected. A cyber attack has brought down Belgium's tax filing portal two days before an annual filing deadline. The MyMinFin portal has been offline since the intrusion was detected on Thursday morning.

3:50The Ministry of Finance has since extended the deadline for filing tax returns until November 16. Hackers unsuccessfully tried to hack the Alpine Linux distribution's GitLab server last week. The hacker failed to convert the authentication bypass into remote code execution. Alpine Linux detected and patched the server before the attacker returned. Hackers have breached War Horse Studios, the developer behind an upcoming Lord of the Rings game. Work on the game, Kingdom Come, Deliverance 2, has been paused while the company investigates the incident. The studio says it's too early to say if anything was stolen.

4:33Japanese internet service provider GMO is offering a$1 million reward for information on the hackers who accessed its Onome desktop cloud service. The hackers targeted GMO's FX foreign trading service. GMO will accept information in three languages, Japanese, English and Chinese. The hackers demanded a$50 million ransom this week and leaked some stolen data on the dark web. A hacker compromised the update systems of online poker software makers, Drogen and intuitive tables to infect high-stakes poker players with malware. The attacker installed the Mesh Agent remote access tool and spied on opponents' screens in real time.

5:17The hack was discovered by a player after a Cored AI agent noticed Mesh Agent running in the background while tracking his game stats. Investigators believe the attacker might have cheated up to$4 million out of hacked players during online poker games. Britain's GCHQ and MI5 intelligence agencies have lost track of thousands of storage devices An investigatory powers commissioner's office investigation found the agencies misplaced thousands of USB sticks, hard drives and memory cards The IPCO says it's possible some of the devices stored sensitive information but the vast majority of the missing hardware items were strongly encrypted US, Dutch, German and UK authorities have seized the server infrastructure of bulletproof hosting provider VirtualLine.

6:10The service launched in 2022 and advertised on dark web hacking forums. Authorities say the service hosted malware, CSAM and money laundering businesses. Dutch police say the seized data includes the details on more than 3 ,000 VirtualLine customers. American authorities have dismantled a Madagascar-based cybercrime ring that ran cryptocurrency and NFT investment scams. The U.S. Secret Service says the group opened scam compounds in Madagascar in early 2025. The group previously operated out of scam compounds in Southeast Asia, but fled Cambodia following a law enforcement crackdown there. Authorities have charged six of the group's members.

6:57MongoDB's security team has found more than 26 ,000 live credentials on Giti, China's GitHub clone. The vast majority are for Chinese cloud services, but credentials for Western services are also present. MongoDB says the exposure rate on Giti is far larger than other services like Bitbucket or GitLab. A cluster of 319 malicious Chrome extensions are redirecting searches through paid affiliate schemes to generate revenue through Bing and Yahoo. The extensions have been live for more than a decade and installed by almost 13.4 million users. Most of the extensions pretend to be manual finders, PDF converters, safe search tools and AI search assistance.

7:44Chinese government-aligned groups are hacking scammers and fraudsters across the Asia-Pacific region. They've targeted hotels in Palau that are hosting scam operations and Chinese nationals running fraud schemes out of Sri Lanka. Security firm ESET believes the operations are part of China's crackdown against organized crime in the region. The Vault Typhoon, Chinese APT group, has spent the past three years hacking into centralized device management platforms, according to new research from Lumen Technologies. The group deployed at least five zero days in network and endpoint management systems, SD-WAN orchestrators and control plane infrastructure.

8:25The operation, dubbed Silent Train, has been running since 2023. Telegram has failed to patch a vulnerability that can allow one-click attacks against its users. The vulnerability is in RLotti, a library used to play sticker animations. The bug was reported to Trend Micro ZDI program, which recommended that users restrict their telegram use until a patch is available. And finally, Cisco has released security updates to patch another in the wild zero day, impacting its ASA and FTD firewalls. The zero day can be exploited via the device's SSL VPN feature. Cisco found the zero day while investigating a support case.

9:11and that is all for this podcast edition today's show was brought to you by our sponsor nebulock find them at nebulock.io thanks for your company