A working examiner's read of the week's most interesting compromises. What happened, how it happened and what it means for anyone who has to reconstruct the event afterward.
Last week the evidence had a shelf life. This week the record itself became the target. Between October 22 and October 31 the largest theft in the history of cryptocurrency took about 20 minutes. Every second of it sits on a public ledger. Yet the one question that ledger cannot answer, how the attacker got the exchange to sign, lives inside Binance's own systems, starting with an engineer's laptop and a service container that nobody outside the exchange can see. A hypervisor flaw rated 2.7 out of 10 turned out to be worth a zero-day to a state espionage group, because all it did was keep certain administrator actions out of the log. And a fleet of firewalls running an old copy of PHP was rooted in a single automated batch.
The common thread is the gap between what happened and what was recorded. Some of these attacks were designed to leave no record. One left a perfect record of everything except the part that matters. Here is the week, read the way an examiner reads a disk: not as headlines but as events that leave traces. This week, also as events built not to.
Binance: $6.3 billion in about 20 minutes
The story of the week is Binance. By the numbers it is the largest crypto theft ever recorded. Starting at 20:05 UTC on October 29 an attacker moved about $6.36 billion out of Binance wallets on ten blockchains, most of it within roughly 20 minutes, according to blockchain analytics firm TRM Labs. Chainalysis puts the figure at $6.4 billion. Binance says about $6.3 billion and warns that the number may continue to increase as it traces assets. The previous record was the $1.5 billion taken from Bybit in February 2025. This is about four times that.
TRM's breakdown shows how wide the attacker reached. On Ethereum the haul was about $3.79 billion, including 200,630 ETH, 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD. A Bitcoin hot wallet sent 18,270 BTC, worth about $1.47 billion. Tron gave up 612.7 million USDT along with 46.4 million TRX. The XRP Ledger lost 233.46 million XRP. Solana, Arbitrum, Optimism, Base, Avalanche and Polygon made up the rest. Different chains, different key types and different signing schemes all paid out within about half an hour.
Binance's first explanation pointed to a single machine. Its initial investigation, the exchange said, suggests the incident may involve a compromised DevOps engineer's laptop, which appeared to let the attacker reach a service container and submit unauthorized withdrawal transactions. Binance says it has found no evidence that any wallet private key leaked. By Friday the picture had widened. Binance said further investigation had uncovered "additional points of breach." Co-CEO Richard Teng wrote that the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action
. He added that the investigation has not attributed responsibility to any individual.
TRM's on-chain reconstruction shows this was not improvised. Preparation started at least 36 hours earlier. On the morning of October 28 an operator wallet received three small withdrawals from the Tornado Cash mixer. Early on October 29 the operator deployed attack code, tested it on two wallets, rehearsed the final version on a third and routed the test funds back to itself. About four hours later the code was installed on a Binance hot wallet. Then the clock started. Five XRP Ledger wallets emptied to one address between 20:05 and 20:09 UTC, each left holding only its minimum balance. Solana and Optimism followed. At 20:20 the Bitcoin hot wallet paid out 18,270 BTC, which the attacker split into 1,000 BTC and 100 BTC pieces within the same block.
The Ethereum leg is the technically striking one. EIP-7702, introduced in Ethereum's Pectra upgrade in May 2025, lets an ordinary wallet delegate its behaviour to a smart contract through a signed authorization. At 20:20 the operator submitted one transaction carrying 50 such authorizations, all signed by Binance's Ethereum hot wallet for consecutive nonces, so that one of them would match whenever it landed. Each pointed the hot wallet at a sweeper contract only the operator controlled. Immunefi's Simone Imbrescia put that contract at about 130 lines. At about 20:23 it swept the wallet's whole balance, including 167,464 ETH and 1.615 billion USDT. Because the delegation persisted, new deposits arriving at the wallet were swept again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56. A second wave hit Avalanche and Polygon at 23:05. Elliptic reports that a second Ethereum hot wallet sent $174 million straight to the attacker, a sign that the access outlived the first burst.
TRM's reading is that the attacker most likely gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains. That would fit Binance's statement that no private key leaked. An attacker does not need the key if the signer will sign. Binance has not published a root cause and says a full post-mortem will follow.
Speed mattered more than price. Stablecoins can be frozen by their issuers, so the attacker dumped them first. TRM says about 325 million USDT was sold through UniswapX and other intent-based contracts for about 122,300 ETH, at a discount of more than 10 percent to the market. Another wallet supplied 60 million USDT to the Aave lending protocol and borrowed about 19,760 wrapped ETH against it. That move deserves a second look. AMBCrypto puts the deposit and the borrow between 20:58 and 21:01 UTC. Tether's first freeze landed at 21:01. A loan turned dollars an issuer can freeze into ether that nobody can: the attacker unwrapped the borrowed WETH into native ETH, which has no issuer at all. Blacklisting the attacker's address cannot claw back USDT already sitting in Aave's pool, so the stablecoins now sit there as collateral for a loan the attacker never has to repay. Whether the loan is liquidated or the collateral stays stuck, the attacker has already walked away with ETH worth about $45 million for roughly $60 million in stablecoins: a steep price, but a price paid in money that could otherwise have been frozen outright. Elliptic said at its latest update that the loan was close to liquidation. Aave founder Stani Kulechov said there is no bad debt because the position is overcollateralized with stable collateral. Aave froze the affected markets as a precaution and reopened them on Friday, saying its smart contracts were unaffected. The issuers moved fast too. Tether froze about 1.77 billion USDT, starting with 971.1 million in the main receiving wallet at 21:01 UTC. Circle froze about 825 million USDC, including 823 million at 21:04 UTC in coordination with law enforcement. Ripple froze 40.5 million RLUSD. World Liberty Financial froze 27.8 million USD1. Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB. TRM counted about $2.7 billion frozen as of 00:30 UTC on October 30. Binance puts it at about $3 billion. What no issuer can freeze is the rest. TRM says the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion.
Attribution came from the analytics firms, not the victim. TRM attributes the theft with high confidence to TraderTraitor, the North Korean state hacking unit the FBI blamed for Bybit, citing on-chain and off-chain intelligence. Chainalysis confirmed TRM's finding with "a high degree of confidence." Elliptic also points to North Korean hackers. TRM lists the fingerprints this theft shares with Bybit and the April 2026 KelpDAO theft: small Tornado Cash withdrawals to fund an operator wallet, staging well before the theft and signatures obtained in advance then spent in one burst. Binance itself has not named an attacker.
Binance suspended deposits and withdrawals on October 29. Deposits later reopened while withdrawals stayed paused. On Friday Teng said the exchange was "very hopeful" that users would be able to withdraw before its Sunday deadline. Binance says it will cover all losses from its Secure Asset Fund for Users and company funds. Al Jazeera notes that the fund was set up in 2018 at about $1 billion, so the theft is more than six times its size. The Block reports that Binance says it has $6.34 billion ready to cover losses, including about $1.3 billion it is buying through market and OTC channels. Bitcoin fell to a six-week low of $76,368.
For an examiner the striking thing is where the evidence sits. The blockchain records every transfer to the second, publicly and permanently. It cannot record why a signing system agreed to sign. That answer lives off-chain: on the engineer's laptop, in the service container, in the signing service's own logs and in whatever access control sat between them. Containers are built to be thrown away. A restarted container takes its file system with it unless someone captured it first. The laptop is the other half. North Korean crews have a long record of reaching developers through fake job offers and poisoned code packages. Hackread notes that DPRK operators were seen in August 2026 using malicious npm packages to infect developer machines and that this attack resembles those tactics, although Binance has not said how the laptop was compromised.
Two practical lessons follow. If you hold digital assets for clients, the machines of the engineers who can touch signing infrastructure are part of the vault. They deserve the same logging and memory capture plan as the vault itself. If you or a client lost funds in a theft, speed matters as much here as anywhere: in this case the first stablecoin freezes landed within an hour. Our cryptocurrency forensics team handles tracing, wallet analysis and exchange subpoenas. Where the root cause sits in containers or cloud workloads, our cloud forensics practice includes container forensics.
VMware ESX: a zero-day whose whole job was silence
Most vulnerabilities let an attacker do something. CVE-2026-41709 lets an attacker do something quietly. It is an insufficient logging flaw in Broadcom's VMware ESX hypervisor, rated Low at 2.7 on CVSS version 3.1. Broadcom's advisory, VMSA-2026-0006, describes it as letting an actor with administrative access perform certain operations without them being logged. Broadcom fixed it in July 2026 and credited CrowdStrike researcher Ian Barton. On October 28 CISA added it to the Known Exploited Vulnerabilities catalog, with a November 11 deadline for federal agencies.
The reason a 2.7 matters is who used it. CrowdStrike says Warp Panda, a China-nexus espionage group, exploited the flaw as a zero-day in early 2026 to significantly reduce audit trail visibility during intrusions at U.S. organizations, with the legal sector singled out. CrowdStrike calls law firms a high-value target because of their concentration of client communications and merger and acquisition materials. The Hacker News reports that Warp Panda overlaps with the group Google tracks as ARMORY CASTLE, formerly UNC5221, the actor behind the BeyondTrust intrusions in last week's roundup.
CrowdStrike's description of the playbook is consistent. Zero-days in internet-facing edge devices open the door. A pivot to VMware vCenter follows. Custom malware such as BRICKSTORM and SharpStorm provides persistence. Stolen Microsoft 365 session tokens reach mail without a password prompt. In at least one case the group registered a new MFA device on a compromised account so that access would survive a password reset.
Neither Broadcom nor CrowdStrike has said which operations escaped the log. No indicators of compromise were published. That leaves defenders with a hard question: how do you prove a negative from a log that was designed to omit things? The answer is to stop relying on any one log. An ESX host's own records are one witness. vCenter keeps its own events and tasks. Guest operating systems log their own reboots, snapshots and disk changes. Datastore files carry timestamps. Network flow records show which management sessions reached the host and when. Where those independent sources disagree with the host's audit trail, the disagreement is the finding. Fixed builds listed in reporting include ESXi80U3j-25429389 for 8.0 and ESXi-9.1.0.0-25370933 for 9.1. Check Broadcom's response matrix for your exact build. Session token theft and rogue MFA registrations are covered in our business email compromise forensics guide, which walks through the sign-in and audit records that survive.
PHP2Shell meets Fragnesia: 25 servers rooted in one batch
Last week we led with PHP2Shell, the two PHP flaws, CVE-2026-109618 and CVE-2026-109619, that give unauthenticated code execution on web servers. This week it found a partner. CISA added both PHP flaws to the exploited catalog on October 26 with an October 29 deadline. On October 28 it added CVE-2026-46300, a Linux kernel privilege escalation known as Fragnesia that was disclosed in May with public proof-of-concept code. Its deadline was October 31. Help Net Security reports CISA's warning that the PHP flaws can be chained with Fragnesia to plant PHP web shells and run commands as root.
Israeli security firm Dream described exactly that chain in the wild. According to The Hacker News, the operator used the FOFA search engine to find about 19,000 internet-facing firewalls with exposed management interfaces. A version scanner found about 5,000 that answered. Filtering by country and by one PHP build, 8.0.30, left 240 targets. An automated batch runner then fired the PHP2Shell and Fragnesia chain at each one, planted a PHP web shell, confirmed root and wrote the result to a CSV file. It rooted 24 devices in the U.S., Japan, Taiwan and South Korea. Dream says the devices run specific versions of a large vendor's firewall software but did not name the vendor.
Two of the rooted systems belonged to a U.S. government-affiliated organization. One crashed at 18:14 UTC on October 23 and never came back. The other was rooted at 10:09 UTC on October 24. From it the operator opened a reverse SSH tunnel into the internal network. At 11:35 UTC it compromised an internal firewall management server reachable only through that tunnel, the 25th system. Dream's artifacts show attempts to decrypt an LDAP service account password, password spraying with organization-themed passwords and attempts to create backdoor Active Directory accounts. Whether any of those succeeded is not yet established. Dream says the 22 other rooted firewalls remain parked with active web shells.
Dream also found Anthropic's Claude Code installed on the attack infrastructure, along with an AI-driven offensive platform called aiscan configured to use the DeepSeek and Kimi models. The style of the roughly 40 scripts in the toolkit suggested AI-assisted development, but Dream found no direct evidence that those tools wrote them. Its attribution is cautious: a suspected China-nexus actor, judged partly from the choice of target countries.
Two details matter to an examiner. The first is the version. PHP 8.0.30 is the end of the 8.0 line. The PHP project shipped no fixed release for that branch. Appliance vendors bundle their own copies of PHP. Those copies age at the vendor's pace rather than PHP's. A forum user quoted by Flare dismissed PHP2Shell as unexploitable in practice, because a working exploit needs memory offsets unique to each build. That objection weakens on appliances. Thousands of identical devices running one identical build share one set of offsets. The second detail is the vendor question. Help Net Security reports that Palo Alto Networks updated its PHP2Shell advisory to say active exploitation targets its internet-exposed management interface, while noting that the link to Dream's findings is unconfirmed. Researcher Kevin Beaumont separately said he knows of a ransomware group using PHP2Shell against Palo Alto firewalls for initial access.
Our guide to PHP2Shell and what to preserve before you patch covers servers. On an appliance the order matters even more. A firewall cannot be imaged like a server, so whatever the vendor's support tools can export should be exported before the upgrade reboots the box. Exposed management interfaces sit near the top of the firewall misconfigurations we find in nearly every pentest.
Ivanti closes the third link
Three weeks ago we led with an Ivanti Connect Secure chain that reached root on a fully patched appliance and erased its own traces. Last week the privilege escalation step was still unpatched. On October 29 Ivanti closed it. Its updated advisory assigns CVE-2026-111357, rated 8.8, to the privilege escalation and CVE-2026-118527, rated 4.3, to the predictable file names that made the upload step reliable. Both join CVE-2026-104935, the authentication bypass and code execution flaw fixed earlier. The fixes are in 25.1.1.3 and 22.8R2.6. Ivanti says exploitation affected a limited number of customers. CISA added both new CVEs to the exploited catalog on October 30, with a November 2 deadline for the privilege escalation.
Volexity, which tracks the actor as UTA0576, traced the first exploitation to October 3 against an appliance running 22.8R2.4, fully patched at the time. The details explain why this chain is so hard to investigate after the fact. The root step changed state in memory and then restored what it had altered, which limits what a disk-based integrity check can see. No web shell or persistent backdoor was left behind. Commands and results travelled over ordinary HTTPS requests. Evidence was selectively removed from Ivanti debug logs and Linux audit logs. Once inside the network the actor used an Active Directory service account to query Windows LAPS administrator passwords, BitLocker recovery keys and attributes that store passwords. Volexity says memory captures, disk images and exploitation core dumps were essential to reconstructing the intrusion. A clean integrity check is not a clean appliance. Anyone who ran Connect Secure through October should work out which LAPS passwords and BitLocker recovery keys that service account could read, then rotate them.
The breaches worth your attention
On October 28 the transparency group Distributed Denial of Secrets published a searchable dataset covering more than 41,000 current and former Department of Homeland Security employees and contractors. It said the data came from a hacktivist group calling itself the Department of Peace. Nextgov reports that the records include names, phone numbers, email addresses, job titles and internal group memberships across ICE, CBP, CISA and other components. Some entries describe surveillance, computer forensics and undercover work. Nextgov and CNN each confirmed portions of the data. The group claims it pulled the records from an Okta single sign-on service DHS uses. Okta's response: Okta is secure, and we have no evidence our data or systems were compromised.
DHS said it is aware of a potential breach. CNN reports that officials worry about follow-on phishing and doxxing. That is the right worry. A directory of who works where, under whom and in what role is the raw material for targeted phishing.
On October 26 the University of New Mexico Health Sciences Center diverted ambulance traffic to other hospitals, cancelled appointments and outpatient surgeries at its clinics and sent nonessential staff home. UNM later said the event affected some end-user devices but did not penetrate core systems or servers. Critical systems were back the next day. Clinical operations were fully functional by October 28. The incident is under criminal investigation. UNM told the public not to engage with anyone claiming responsibility and said it "did not make concessions with any group behind the threat." A group has claimed it stole patient data. UNM has not confirmed that. The pattern is familiar: a hospital can restore service in two days, while the question of what data left the building takes far longer to answer. Our healthcare cybersecurity guide covers the HIPAA requirements behind that question.
Quest Diagnostics disclosed in an SEC filing, reported on October 23, that it had found unauthorized access to Quanum, the platform doctors' offices and hospitals use to order lab tests and handle billing. Quest learned of the access on October 21, notified law enforcement and paused the system. It says "certain patient records" were accessed, including protected health information, but it has not said how many patients are affected or when the access began. Quest says it has remediated the incident and restored the system. It is the company's second major breach in a decade, after 11.9 million patient records were exposed through a billing vendor in 2019.
On the watchlist
A few more items for the patch-now list.
GitLab's CVE-2026-97229, an integer overflow in the way regular expressions inside CI/CD configurations are handled, joined CISA's exploited catalog on October 29 with a November 1 deadline. GitLab rates it 10.0. Reporting describes it as reachable without authentication. Fixed releases for the 19.2, 19.3 and 19.4 branches shipped on October 12. A GitLab server holds source code, CI secrets and deployment keys, so a compromise reaches well past the server itself. Do not confuse it with CVE-2026-110264, a separate GitLab regular expression flaw disclosed later in October that the CVE-2026-97229 fix does not cover.
Cisco disclosed CVE-2026-76418, an actively exploited flaw that lets an unauthenticated attacker force ASA and FTD firewalls to reload when SSL VPN is enabled and secondary authentication is configured on a tunnel group. Cisco says its PSIRT became aware of exploitation in October. CISA listed it on October 29 with a November 1 deadline. Shadowserver tracks more than 51,000 exposed ASA SSL VPN devices. A crash is not only an outage. A forced reload clears the device's memory, which is where evidence of anything else an attacker did on it would live.
Arista confirmed on October 22 that CVE-2026-114625, a SQL injection in on-premises VeloCloud Orchestrator, is being exploited. Any logged-in user, even one with the lowest read-only role, can use it to gain operator privileges. CISA added it on October 23. It is the third exploited orchestrator flaw Arista has reported since late July. Fixed releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12. Orchestrators patched for the July and September flaws are still exposed to this one.
Sansec reports that a Magento loader campaign hidden in stores' CMS blocks has reached 953 stores since July 2025. In March the same operator injected its loader into 471 stores in one hour after uploading web shells through PolyShell, CVE-2026-48356. CISA added PolyShell to the exploited catalog on October 27. The loader lives in the database rather than in files, so a file integrity scan will not find it. For a wider review of a store, see our e-commerce security audits.
CISA also added CVE-2026-110447, an OS command injection in Collabora Online's built-in CODE server, on October 23. On October 27 it added CVE-2026-111497, an unchecked return value flaw in Google's Brotli compression library.
The forensic read
Pull back from the individual stories and the week makes one argument. A log is a witness. Witnesses can be silenced, selective or never called at all.
Look at the week through that lens. Binance's blockchain is the most complete record any theft has ever had. Every transfer, every freeze and every swap is public to the second. It still cannot say how the signer was persuaded to sign. That answer sits inside Binance's own systems, starting with a laptop and a container. The VMware flaw was a vulnerability whose entire value was keeping the hypervisor's own log quiet. Ivanti's chain restored what it changed and pruned its debug and audit logs, so the appliance's own account of the day is incomplete by design. The PHP2Shell operator rooted firewalls, devices most organizations cannot image at all. A forced reload of a Cisco firewall wipes the memory that would show what else happened on it.
The answer is corroboration. No single source should be the only witness to anything important. Forward logs off appliances and hypervisors as they are written. Keep vCenter, guest and network records alongside host logs so one can check the other. Give the laptops of engineers who touch money, keys or production the same logging and capture plan as the systems they manage. Capture memory before the reboot, the patch or the reload. None of this is expensive. All of it has to be planned before the incident, which is what our Digital Evidence Readiness Self-Audit is built to check.
That is the through-line Sherlock Forensics cares about. An intrusion is not finished when the attacker leaves. It is finished when someone can reconstruct what happened in a form that holds up to scrutiny. This week that depended on finding the witnesses the attacker did not silence. If a wallet, hypervisor, VPN or firewall of yours is in scope for any of these stories, our incident response team can preserve the evidence and build the timeline. An incident response retainer means the first hour is already planned the next time. See you next week.
Sources
- North Korea steals USD 6.36 billion from Binance in the largest hack in history, TRM Labs: www.trmlabs.com
- Statement on the Binance security incident, Binance CEO Richard Teng on X: x.com
- Binance links $6.3 billion crypto theft to compromised DevOps laptop, BleepingComputer: www.bleepingcomputer.com
- Binance hack: the largest crypto hack, North Korea, The Block: www.theblock.co
- How the Binance hacker used Aave against the Tether and Circle freezes, AMBCrypto: ambcrypto.com
- Binance probes DevOps engineer's hacked laptop after $6.3B theft, Hackread: hackread.com
- Billions in crypto frozen in Binance hack: what happens next, CNBC: www.cnbc.com
- Binance hack: investigators in a cat and mouse game to recover $6.3 billion, CNBC: www.cnbc.com
- Binance says $6.3bn stolen in biggest crypto heist in history: what we know, Al Jazeera: www.aljazeera.com
- China-linked hackers exploited VMware ESX zero-day to reduce audit trail visibility, The Hacker News: thehackernews.com
- Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls, Help Net Security: www.helpnetsecurity.com
- PHP2Shell attack roots 25 servers, breaches U.S. government-affiliated network, The Hacker News: thehackernews.com
- CISA adds two Known Exploited Vulnerabilities to catalog, October 30, CISA: www.cisa.gov
- Hackers exploit Ivanti Connect Secure zero-day vulnerabilities to gain root access and steal credentials, GBHackers: gbhackers.com
- DHS personnel leak exposes contact details and sensitive job information, Nextgov/FCW: www.nextgov.com
- Hackers claim leak of sensitive details on thousands of DHS workers, CNN: www.cnn.com
- Ambulance traffic diverted, clinical appointments and classes cancelled due to cybersecurity issue at UNM HSC, UNM Health Sciences: hscnews.unm.edu
- Lab testing giant Quest Diagnostics confirms patients' personal and health data was compromised during breach, TechCrunch: techcrunch.com
- CISA warns of GitLab integer overflow vulnerability exploited in attacks, Cyber Security News: cybersecuritynews.com
- New Cisco firewall zero-day exploited to crash SSL VPN devices, BleepingComputer: www.bleepingcomputer.com
- Arista warns of critical VeloCloud SQL injection zero-day exploited in attacks, The Hacker News: thehackernews.com
- deepveindrilling.com: Magento CMS block loader hits 953 stores, Sansec: sansec.io
- Known Exploited Vulnerabilities catalog, CISA: www.cisa.gov
Previous in this series: Weekly Security Roundup: October 15 to 21, 2026.