Binance $6.3 Billion Crypto Heist & Claude Code Extension SSH Backdoor - Hacker News (Oct 31, 2026)

Six point three billion dollars, gone in roughly twenty minutes. That is the scale of what investigators now say happened at Binance, and it may be one of the largest crypto thefts ever recorded. Welcome to The Automated Daily, hacker news edition. The podcast created by generative AI. I'm TrendTeller, and today is October 31st, 2026. A fitting Halloween lineup today: heists, backdoors, cloud leaks, and a few delightful hacks to lighten the mood.

Binance $6.3 Billion Crypto Heist

Let's begin with that Binance story. Crypto firms and investigators report that attackers drained about six point three billion dollars from Binance wallets spread across multiple blockchains, all in around twenty minutes. Binance quickly froze deposits and withdrawals while it traced the breach. Several tracing firms point toward North Korea's TraderTraitor group, though neither Binance nor law enforcement has confirmed that. What stands out is the preparation: test transactions and apparent rehearsals before the main event. Roughly half the funds have reportedly been frozen, but the rest sits in assets that can't simply be locked. It's a stark reminder that once money starts hopping between chains, defenders are mostly playing catch-up.

Claude Code Extension SSH Backdoor

Staying on security, but closer to every developer's laptop. Phorion reports that the official Claude Code for VS Code extension on the Cursor Marketplace was compromised and shipped with a persistent SSH backdoor. As soon as the extension loaded, it planted an attacker's key in the user's authorized SSH keys, tried to open an outbound connection to an attacker server, and set up persistence on macOS, Linux and Windows so it would survive reboots. It also sent home a beacon describing the machine and hinting at what secrets might be on it. The two affected versions have been pulled, but the lesson is uncomfortable: a trusted coding tool is about the most direct route into source code and internal credentials an attacker could ask for. If you used it, check your authorized keys.

Northflank Security Incident and Outage

Another incident is unfolding at the cloud platform Northflank. Its status page lists a partial outage linked to a security incident, after users reported unauthorized use of AI API keys they had stored on the platform. The company's guidance is blunt: assume your environment variables were decrypted and rotate every secret and credential right away. Networking, builds, services and logs are among the components marked in major outage. Northflank has turned on audit logs for all customers, including free users, and says the investigation continues.

Azure API Connections Cross-Tenant Flaws

And on the cloud provider side, a researcher has detailed five critical vulnerabilities in Azure's API Connections, the plumbing behind Logic Apps. The core problem: Azure could be tricked into using a victim's connection credentials instead of the attacker's, opening the door to another tenant's Key Vaults and SQL databases. What makes the write-up memorable is the cat-and-mouse with Microsoft. Each fix closed one route, the researcher found another, and finally a path-normalization quirk slipped right past the newest validation. It's a case study in how patching symptoms can leave a fragile design underneath.

Anti-Bot Laws Versus Web Scraping

Shifting to policy. A new article takes aim at proposed anti-bot laws, including the federal Stealth Bot Prohibition Act and a similar New York bill. The authors agree aggressive AI crawling is a real problem, but argue that forcing crawlers to identify themselves would mostly hurt the good actors: investigative journalists, the Internet Archive, accessibility auditors, public health researchers and security teams. Their point is simple: knowing who a crawler is doesn't tell you whether it's causing harm. Instead, they want rules targeting concrete damage, like excessive request volumes or fraud, plus better technical standards for machine access.

Cloudflare Turnstile Solver Without Browsers

That debate gets a practical backdrop from a new open-source Rust project called cfsolve, which solves Cloudflare Turnstile challenges without spinning up a headless browser, relying instead on impersonating specific browser profiles. Whatever your view on it, tools like this show why the bot-blocking arms race is so hard to win with technology or legislation alone.

Classic Mac OS on Nintendo Wii

Now for the fun corner. A hobbyist has gotten classic Mac OS running on Nintendo GameCube and Wii hardware, with Wii U on the wish list. Getting there meant porting OpenBIOS, rewriting assumptions baked into Apple's software, and building custom drivers for disks, graphics and controllers. After plenty of false starts, the screen went from a blinking floppy to the Happy Mac, and eventually to working desktops in Mac OS 7.6 and 9.2.2. It's a lovely reminder of how closely related those PowerPC consoles are to vintage Macs.

Nesformer Update: NES Inside Qwen

An update on a story we've followed: the Qwenputer idea has grown a sequel. A project called nesformer now compiles an entire NES CPU, its RAM and a game cartridge into the weights of a stock Qwen language model, with a small host program handling graphics and input. The headline result is that bundled test ROMs match a conventional emulator frame for frame. Odd, yes, but a genuinely striking demonstration of what can be packed into a neural network.

Florilegium Procedural LaTeX Floral Margins

Finally, something for the typography fans. Florilegium is a LuaLaTeX package that draws Delft-blue flowers in your document margins, generating every stem and petal in code when the PDF is built, no images involved. It can grow a plant to fill empty space on the last page, tuck blooms beside headings, and shift the palette from spring to autumn. Every page ends up feeling hand-illustrated.

That's all for today. If you have anything installed from a marketplace, it might be a good evening to audit it, before the trick-or-treaters arrive. Links to all stories can be found in the episode notes. I'm TrendTeller, thanks for listening to The Automated Daily, hacker news edition, and I'll see you tomorrow.

Binance $6.3 Billion Crypto Heist & Claude Code Extension SSH Backdoor - Hacker News (Oct 31, 2026)

Our Sponsors

Today's Hacker News Topics