Stay Safe OnlineDaily cyber news

Today's briefing

Friday 30 October 2026

Binance suffers what looks like the biggest crypto theft on record, Cisco fixes an exploited firewall VPN zero-day, a hacked monitoring script drains Polymarket users, a DHS staff leak and a cyberattack on Belgium's tax portal, plus Linux, Telegram and Chrome extension warnings.

9 stories

Binance hit by what looks like the biggest crypto theft ever, with about $6 billion taken from a hot wallet
Image: The Hacker News
Threat

Binance hit by what looks like the biggest crypto theft ever, with about $6 billion taken from a hot wallet

The world's largest cryptocurrency exchange, Binance, said on Thursday that a security incident affected about $6.3 billion of assets, and that nearly $3 billion has already been frozen on the blockchain. Its early investigation points to a hacked laptop belonging to a DevOps engineer, which let the attacker reach a service container and push through unauthorised withdrawals from a 'hot' wallet; Binance says there is no sign its wallet private keys leaked. Stablecoin firms including Tether and Circle have frozen billions in linked funds, and blockchain analysts TRM Labs say with high confidence that North Korea's TraderTraitor hackers, also blamed for the $1.5 billion Bybit theft in 2025, are behind it. Binance says it will cover all losses from its user protection fund and its own money, and expects withdrawals to restart within 48 hours.

Why it matters: Chainalysis puts the amount stolen at roughly $5.9 billion, nearly four times the previous record. It shows how one compromised staff laptop can open the door to systems that move money. Binance customers should expect scammers to exploit the news: only trust updates from Binance's official channels, and ignore messages offering 'refunds' or asking for login details or recovery phrases.

Sources
Cisco patches a firewall VPN zero-day that attackers are using to crash devices
Image: The Hacker News
Vulnerability

Cisco patches a firewall VPN zero-day that attackers are using to crash devices

Cisco has released fixes for CVE-2026-76418, a high-severity flaw (rated 8.6) in the remote-access SSL VPN feature of its Secure Firewall ASA and Firewall Threat Defense software. An attacker who has not logged in can send a specially crafted request while connecting to the VPN and make the firewall restart, knocking it offline. Devices are only at risk when 'secondary authentication' is set up on a VPN tunnel group, including the built-in default group. Cisco says it learned of attacks using the bug this month but has not said who is behind them or how widespread they are.

Why it matters: A firewall that keeps rebooting cuts off remote workers and can leave a network less protected. Admins of Cisco ASA or FTD firewalls should install the fixed versions, or follow Cisco's temporary workaround of switching off secondary authentication or the tunnel group list where it is safe to do so.

Sources
Polymarket briefly halts trading after a hacked website-monitoring script started draining users' crypto
Image: BleepingComputer
Supply chain

Polymarket briefly halts trading after a hacked website-monitoring script started draining users' crypto

Prediction market Polymarket paused trading on Thursday after attackers compromised DebugBear, a website performance-monitoring service whose JavaScript ran on Polymarket's site, and used it to serve a crypto-stealing script. BleepingComputer's analysis found the script tried to hijack logged-in users' sessions, sell their positions and move their funds to an attacker's wallet; about $2.5 million has been traced to that wallet. Polymarket removed the script, resumed trading about an hour later and says all affected traders will be fully reimbursed. DebugBear has told customers of its real-user monitoring product to remove its code from their websites.

Why it matters: Any third-party script a website loads runs with the same power as the site's own code, so one hacked supplier can turn a trusted site against its users. Website owners using DebugBear's monitoring should remove it now, and every site should keep the list of outside scripts on sensitive pages as short as possible.

Sources
Hacker leaks details of more than 41,000 US Homeland Security staff
Image: SecurityWeek
Breach

Hacker leaks details of more than 41,000 US Homeland Security staff

A hacker calling themselves 'Department of Peace' has published more than 41,000 records about employees of the US Department of Homeland Security, mostly from Customs and Border Protection, ICE and Homeland Security Investigations, plus about 1,000 CISA staff. The data includes names, work emails and phone numbers, job titles, office locations and which internal systems each account can access. The hacker claims it came from an Okta single sign-on system used by DHS staff and contractors; Okta says it has no evidence its systems were compromised, and DHS says it is investigating a potential breach.

Why it matters: Lists of who can access which systems are a ready-made target list for phishing and further hacking. Leaks like this also put individual staff at risk of harassment. Organisations should regularly review who has access to what, and staff named in leaks should be extra wary of targeted phishing.

Sources
Cyberattack takes Belgium's online tax portal offline just before a filing deadline
Image: The Record
Outage

Cyberattack takes Belgium's online tax portal offline just before a filing deadline

Belgium's finance ministry (FPS Finance) has taken its main online tax and finance platform, MyMinfin, offline after a cyberattack, which it disclosed on Wednesday. The shutdown comes just before a 31 October deadline for some taxpayers, who will be given extra time, with a new date to be announced. The ministry says there is currently no sign that data was stolen but is still investigating, and has not said who was behind the attack or how they got in. It is not known whether it is linked to the PHP2Shell alert earlier this month, when the same ministry took websites offline as a precaution.

Why it matters: When a government portal goes down, scammers often send fake 'tax refund' or 'deadline' messages. People in Belgium should only use official government sites and should not click on links in unexpected tax emails or texts.

Sources
Spies used an old Cisco SD-WAN flaw to plant 'KeyDrift' malware that steals network encryption keys
Image: BleepingComputer
Threat

Spies used an old Cisco SD-WAN flaw to plant 'KeyDrift' malware that steals network encryption keys

Cisco Talos says a skilled hacking group it tracks as UAT-11473 has exploited CVE-2026-20127, a maximum-severity login-bypass flaw in Cisco Catalyst SD-WAN controllers that was patched in February, to install a custom malware toolkit called KeyDrift. The malware hides inside the controller's normal processes, acts as a backdoor and quietly collects the encryption keys that protect traffic between an organisation's sites, then sends them to the attackers. Targets included space and satellite firms, defence and aerospace technology companies and policy research groups. Talos says the group's infrastructure overlaps with China's Volt Typhoon 'Silent Train' network, but has not made a definite link.

Why it matters: Stolen encryption keys could let attackers read network traffic that organisations believe is private. Anyone running Cisco Catalyst SD-WAN should make sure February's fix is installed and follow Cisco's hardening guide, and check controllers for signs of tampering.

Sources
Serious Linux kernel networking flaw still has no fix for Ubuntu and Red Hat users
Image: The Hacker News
Vulnerability

Serious Linux kernel networking flaw still has no fix for Ubuntu and Red Hat users

A flaw in the Linux kernel's TCP networking code, CVE-2026-98432, is rated 9.8 out of 10 by the kernel's own CVE team, although Red Hat, SUSE, Oracle and Amazon give it lower scores. It is a timing bug that can make the kernel use memory it has already freed. Anthropic says its AI model wrote an exploit that let a remote attacker with no password run commands as root on servers with a multipath TCP listener, although in its test that took nearly an hour. Debian, Oracle Linux, SUSE and Amazon Linux have shipped fixed kernels for at least some versions, but as of Thursday Ubuntu and Red Hat Enterprise Linux had not, and no attacks have been reported.

Why it matters: Linux runs a huge share of the world's servers. Admins should install fixed kernels as soon as their distribution offers them and keep an eye on Ubuntu and Red Hat advisories. Those building their own kernels should move to the latest stable release.

Sources
Telegram for Android flaw could let a hacker take over a phone through a voice call, researchers say
Image: The Hacker News
Vulnerability

Telegram for Android flaw could let a hacker take over a phone through a voice call, researchers say

Security startup NebuSec says a bug in Telegram for Android's calling code, present in versions 8.6.2 to 12.10.3, could be combined with two other bugs to take full control of a phone once the victim answers a call from an ordinary Telegram account. Telegram fixed the underlying bug in version 12.10.4 in late September. NebuSec says it has not seen the flaw used in real attacks, and there is no evidence yet that it affects Telegram on iPhone or desktop.

Why it matters: Telegram users on Android should check that their app is on version 12.10.4 or later (the version number is at the bottom of Settings). Setting call privacy to 'Nobody', or declining calls from strangers, also blocks this attack.

Sources
319 Chrome extensions with 13.4 million installs caught quietly hijacking web searches
Image: BleepingComputer
Threat

319 Chrome extensions with 13.4 million installs caught quietly hijacking web searches

Researchers at Socket have found 319 Chrome extensions, with a combined 13.4 million reported installs, that secretly replace the browser's default search engine and route every search through the operators' own servers before sending it on to Bing or Yahoo, earning advertising referral money. They pose as PDF converters, manual finders, 'safe search' and AI search tools, are hidden from searches in the Chrome Web Store and are pushed through dodgy online adverts instead. Some need almost no code because Chrome lets extensions change the default search engine.

Why it matters: Because the searches pass through servers the operators control, they could switch to sending people to phishing pages or malware at any time without updating the extension. Check your Chrome extensions (chrome://extensions), remove anything you don't recognise or need, and make sure your default search engine is the one you chose.

Sources