Password manager mSecure has warned customers to change their passwords, reset two-factor authentication, and potentially remove their passkeys after detecting suspicious activity, but it has not explained what happened or whether anyone's secrets were exposed. In an email sent to customers on November 3, seen by The Register, US-based developer mSeven Software said it launched an investigation after discovering something amiss with its password management application. "mSeven Software ('mSeven') recently learned of suspicious activity associated with the mSecure password management application," the company wrote. "In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist." The company has yet to answer what the suspicious activity involved, when it occurred, or whether attackers accessed customer information. Its advice to customers, however, suggests that they should take this seriously. "Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application," the email continued. "This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys." For anyone with hundreds of passwords stored in mSecure, that's potentially hours of work. And without knowing what happened, customers have no way of telling which credentials they actually need to replace. The warning has understandably gone down poorly with customers, who have taken to mSecure's support forum demanding answers. "Please provide more context to your email below advising there has been a security breach," one customer wrote. "It is not acceptable to offer the vague advice 'take steps'. Please state what remedial action is required, and what data was compromised." Others are wondering whether they're expected to spend the next several days changing every password they've ever saved. "I have over 800 passwords in mSecure, is the email saying I need to change all of them!" another customer asked. A separate user, who said they had more than 500 passwords stored in the application, questioned whether the warning applied to every two-factor authentication method and passkey associated with their accounts, or just those used to access mSecure itself. The confusion has also spilled onto Reddit, where customers have shared copies of the vague notification and questioned what might have happened. mSeven has yet to respond to The Register's questions, leaving customers to guess whether their data has actually been compromised or the company is simply being cautious. That's not exactly reassuring from a business whose entire purpose is keeping other people's secrets safe. The company's email concludes: "We regret any inconvenience that this may cause." For customers contemplating hundreds of password resets, "inconvenience" may be putting it mildly. ®

The UK's National Cyber Security Centre (NCSC) says AI-powered malware is "highly likely" to be a part of a future ransomware attack on Britain's critical national infrastructure between now and 2028. The warning accompanies its annual review and a separate assessment exploring how AI could change cyber threats over the next two years. The cyber arm of signals intelligence agency GCHQ did not provide much detail about what form this AI malware may take. However, it alluded to open source AI security tools that were initially intended to assist security researchers being repurposed for nefarious activity. Attackers are already repurposing such tools. For example, researchers are increasingly seeing widespread abuse of ARTEX, an open source, Chinese-made AI red-teaming platform, in attacks on UK registrar 123 Reg, Microsoft 365, and others since its launch in July. In its pessimistic scenario for 2028, the NCSC envisages "a significant increase in the frequency and sophistication of cyberattacks worldwide," with wider adoption of AI tools making attribution harder. China "has likely played a role" in supplying those tools in this future, "enabling them to hide their activities within the noise," the report states. It also considers a further threat: an autonomous attacker operating beyond its human operator's control. The NCSC says it "is a realistic possibility such an entity could self-replicate and conduct cyberattacks at will, with no apparent motivation or restraint." Such attacks would likely complicate geopolitical relationships, owing again to attribution difficulties, making it easier for countries that order attacks on others to deny their involvement. The UK's plans for AI defense At a time when each Patch Tuesday seems to come loaded with record numbers of bugs, the NCSC acknowledges that AI is already changing vulnerability discovery and patching. The body is also exploring how AI could help defenders keep pace. Project DROMOS began earlier this year with a four-week pilot analyzing government code repositories, before expanding into selected operational environments. The Government Cyber Coordination Centre (GC3) launched the project with the AI Security Institute and other departments. The NCSC says it uncovered hundreds of potential security issues, including critical vulnerabilities. The review also reaffirms plans for Cyber Shield, an agentic cyber defense system first teased in July. Cyber Shield is expected to be delivered in stages over the next five years. It will involve the NCSC providing defensive agents deployed by participating organizations with data that will strengthen national resilience to ongoing cyber threats. The NCSC will be running the scheme alongside the Department for Digital, Culture, Media and Sport (DCMS), but acknowledged that this kind of automated defensive activity currently sits outside many organizations' risk tolerances, meaning it has a role to play in building trust in the system before adoption can go mainstream. As reported last week, the government has set aside £60 million to fund the initiative, and an additional £70 million to support a new National Exposure and Real-Time Vulnerability (NERV) Centre. The NERV Centre's job will be to identify and maintain an ongoing understanding of vulnerabilities across CNI organizations and the wider economy. Per last week's budget, £40 million will fund a National Agentic Security Unit responsible for responding to uncontrolled bots and other agentic mishaps, and £24 million was assigned to strengthen public sector defenses. An undisclosed sum will also help establish a new NCSC-managed AI Cyber Security Centre in Manchester to develop AI security expertise across government. In the meantime, NCSC CEO Dr Richard Horne is calling for organizations to "invest with urgency" in their security and resilience. "For decades, we have collectively got away with doing tech on the cheap," he said today, announcing the annual report. "We can be a nation where leaders of all organizations actively choose to invest with urgency... And where all organizations make security and resilience a fundamental requirement, not an afterthought. "The collective result would be a source of enduring national strength for us all." Horne said organizations should treat the NCSC's Cyber Essentials certification as the starting point, but scale up resilience efforts in line with organizational size, complexity, and risk. The government also announced a 75 percent discount on Cyber Essentials certification for micro, small, and medium-sized businesses applying for their first certificate. ®

Unknown criminals are exploiting a maximum-severity vulnerability in Node-RED, a flow-based programming tool that is widely used in critical infrastructure, to deploy a flow that downloads and runs a Linux bot. Node-RED is commonly used for workflow automation in industrial control systems (ICS) and operational technology (OT) environments. It’s built on top of Node.js and is used in commercial products including Siemens SIMATIC IoT2050. In August, Siemens assigned the vulnerability identifier – CVE-2026-58115 – to describe the bug and explain its perfect 10-out-of-10 CVSS rating. Affected Siemens devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that can execute system commands on the device. This means unauthenticated remote attackers can create malicious flows, which is what VulnCheck researchers began documenting last Friday. “On October 30, 2026, one of our canaries caught an attacker exploiting CVE-2026-58115,” VulnCheck researcher Patrick Garrity warned in a Monday advisory, adding that two Node-RED built-in nodes make this vulnerability “trivial to weaponize.” One is an inject node, which fires a message either on a schedule or once at startup. The second, an exec node, can run shell commands. “Wire one to the other and the flow executes a command as soon as it is deployed, with no further interaction,” Garrity said. Plus, these exploits come as criminals increasingly look to target internet-exposed OT and ICS devices, allowing their cyberattacks to impact the physical world and produce real-life harm. Case in point: the ongoing refrigeration controller hacks across Europe and the attacks on water systems across at least 12 US states over the summer. The activity observed by VulnCheck came from a single IP address, 4.201.105[.]116, which sits in Microsoft’s AS8075 network and geolocates to Brazil. “It didn't just scan us. It sent the complete exploit, flow and dropper, in a single POST /flows,” Garrity wrote. While there’s a lot that the researchers don’t yet know about the attacks - they didn’t retrieve a binary or staged scripts to analyze - the filename, bot-linux-amd64, indicates that the malware targets Linux running on AMD64 processors. It also suggests the malware operator may have other builds. “We did not fetch the binary, so we can't say what it does once running,” Garrity noted. Between October 30 and November 1, the researchers saw this IP address target the same Node-RED vulnerability 16 times, and log 125 hits against eight different CVEs across their wider canary network. Among the targets of the attack were a seven-year-old Apache Solr flaw tracked as CVE-2019-17558 – affecting Camunda, Gitea, MLflow, Traefik, and Joomla, alongside Node-RED. All this suggests “opportunistic mass scanning rather than a targeted attack,” according to the researcher. One of these hits delivered a different payload pointing to a separate server (85.215.73[.]250), which VulnCheck now tracks - but doesn’t have any telemetry other than the URL. “Because the download host is a different machine from the one that sent the exploit, the likely setup is a scan-and-infect arrangement: the hosts that find and exploit vulnerable instances pull the implant from a separate, dedicated server,” Garrity wrote. The mix of old and new bugs across unrelated products indicates “opportunistic mass scanning rather than a targeted attack,” Garrity wrote. “If you run Node-RED anywhere, including inside OT environments, check today whether it’s reachable from outside your network, apply updates where available and implement detections to reduce the risk of exploitation,” he added in a LinkedIn post. While the bug has been added to VulnCheck’s Known Exploited Vulnerabilities (KEV) catalog, it hasn’t appeared (as of press time) in the US Cybersecurity and Infrastructure Security Agency’s KEV.®

A coalition of private-sector security firms working with Japan’s National Police Agency has disrupted XCPE, a backdoor used to build a massive botnet comprising more than 1.3 million Android devices across more than 200 countries. Google, Lumen, Human Security, Plume, Synthient, and TrendAI participated in the disruption. “We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology,” the Google Threat Intelligence Group (GTIG) said in a Monday blog. Videostrong Technology is a hardware manufacturer based in Shenzhen, China. It builds Android devices, including home TV boxes and projectors. According to Google, Videostrong deliberately embedded the XCPE backdoor in device firmware and sold access to criminal affiliates, allowing them to install additional malware modules on devices shipped to unsuspecting customers. When buyers connected these devices to their home networks, the preinstalled backdoor allowed operators to create proxy networks and hide malicious traffic using the customers' internet connections without their knowledge. The firmware’s pre-installed management agent purported to be a standard remote-management client, according to TrendAI. It pulled updates from a GitHub page, and connected to a Message Queuing Telemetry Transport (MQTT) server that gave the operator full remote control of each box, allowing them to install and remove apps, change settings, and push updates to the infected devices. Between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses connected to the operation. The coalition also disrupted the command-and-control domains used to manage the affiliate modules. “Because these affiliates each have diversified distribution channels for their modules beyond XCPE, we assess that taking down their C2 domains will sever access to at least 10 million additional compromised devices,” according to GTIG. Google said it had since cut ties with Videostrong, and banned the OEM from making devices with preloaded Google apps. Videostrong did not immediately respond to The Register’s inquiries. This backdoor and botnet operation is part of the same ecosystem as BadBox 2.0, another notorious botnet that infected more than 10 million TV boxes and other devices before Human, Google, and TrendAI disrupted it in March 2025.®

If you're a customer of cloud-hosted AI workflow platform Trigger.dev, take heed, because your environment variables may have been exposed in a security incident disclosed on Sunday. Trigger offered little explanation in its Sunday security incident report, noting that its investigation had identified “exposure across a subset of organizations” and that an attacker had gained unauthorized access to environment variables belonging to those organizations. Whatever exploit was used to gain access has been blocked, the company added, and affected customers have been notified of steps they need to take to prevent further security problems. We likely don't have to tell The Reg readers how important environment variables are in SaaS and cloud services like Trigger. If compromised environment variables contain sensitive credentials, an attacker could basically end up with the keys to the kingdom, potentially gaining access to connected services and digital infrastructure. For those unfamiliar with Trigger.dev, it’s a platform for building AI agents and workflows in TypeScript, but here’s the kicker: Trigger advertises itself as a durable execution platform that handles pesky things like retries, scaling, and keeping long-running tasks going through crashes and redeployments, while providing tools to monitor what those tasks are doing. Trigger, the company’s site notes, can be used to “build durable AI agents that survive refreshes, redeploys, and crashes,” and is ideal for “long-running tasks with retries, queues, AI observability and elastic scaling.” In short, companies running their AI on Trigger probably want it to keep running, which makes stolen environment variables all the more dangerous. Elastic scaling, automated retries, and, as Trigger notes, the ability to run lots of concurrent operations without timeouts could compound the consequences of compromised API keys, depending on what those credentials allow an attacker to access. An attacker with stolen credentials could potentially interfere with a customer's connected services or workflows. Additionally, Trigger recently added webhooks to its offering, supporting services like Stripe, Supabase, and Slack, potentially expanding the range of integrations that could be affected if their credentials were exposed. This could be pretty bad for anyone affected. Trigger has some fairly high-profile customers, with companies like fashion brand Emporio Armani, Pentagon-supporting AI acquisitions platform GovSignals, SaaS calendar platform Cal.com, and others all listed on the company’s site. Trigger has not publicly identified which organizations were affected by the intrusion. We reached out to Trigger, which declined to provide any additional information on the incident. A company spokesperson instead told us to wait for a full incident report to learn more. Luckily for Trigger customers and those concerned about SaaS security now that AI is regularly coming up with new vulnerabilities in commonly used platforms, Trigger is open source and can be self-hosted, which might be a better alternative in this day and age than relying on a hosted service. ®

Victim organizations are losing millions of dollars in token charges as criminals hijack their corporate LLM access to steal expensive computing resources and AI services. These fraudulent charges from resource consumption can exceed $100,000 a day, according to a Monday report by Google's Mandiant incident responders, who saw cumulative charges at some organizations hit $1 million before the victim companies revoked intruders' access. "Whenever possible, threat actors want to use this technology to gain a scale advantage over defenders. They achieve that with agentic tools and by stealing tokens from unwitting third parties,” John Hultquist, chief analyst at Google Threat Intelligence Group, told The Register. “Locking down these resources will not only protect organizations from runaway costs, but also protect the broader community from a deluge of cheap, autonomous attacks.” This tactic of hijacking access to LLMs is called LLMJacking, and it’s been increasing steadily over the past two years. In one extreme case, documented in an August report from CrowdStrike, a token thief sent about 200,000 API requests in just two minutes. In one case detailed in the report, a group Google tracks as UNC6993 illicitly gained access to LLM API keys, then generated additional keys and enabled services within the victim’s cloud projects, racking up $100,000 in charges. The threat intel biz also documented a different token thief subscribing victim accounts to Pay-As-You-Go agreements to access advanced models on the victim company’s dime. The crook selected premium foundation models, launched high-volume inference streams, and used a “burn and rotate strategy” to bypass rate limits by creating and deleting short-lived service accounts while auditing the billing interface to monitor financial impact. In yet another incident, an intruder executed more than 500,000 LLM API calls in less than eight hours using stolen third-party API keys to power a token routing service called Jet Night, according to a Monday report from Google. “Given Jet Night’s per-token costs to users are so far below typical market rates GTIG believes the service relies on stolen keys to operate profitably,” the report says. “For example, Jet Night offers an unlimited token plan for approximately $60 USD per month with alleged access to frontier models, a consumer service level that would typically run between $100 and $250 per month.” Jet Night has also admitted to multiple outages on its public Telegram channel, which the Google threat hunters note is “likely due to stolen keys being revoked as victims discover their respective compromises.” Specialized LLMjacking roles As more criminals join the LLMJacking ecosystem, Google says it has documented a division of labor between the criminals that establish initial access to compromised cloud and AI services, and those that manage downstream monetization infrastructure, called “LLM Mixers.” In one case that Mandiant responded to in mid-2026, UNC6993 compromised a cloud instance through a misconfigured Service Account key and used this access to grant further access to a model API. The crooks also spun up a session hijacking page purporting to be an application portal to join a group of LLM users. “This page tricks users into navigating to the legitimate LLM service website, and pasting their raw JSON payload containing an active access token, which was then posted to the backend API to bypass password and multifactor authentication (MFA) controls,” the report says. Google predicts miscreants will “increasingly prioritize LLMJacking” compared to other types of resource theft like cryptojacking. And to prevent cloud LLM service abuse, the security firm says defenders should prioritize identity and access management plus supply chain security, and use a centralized secrets management platform to rotate keys and secrets. Also apply least-access privileges to users and service accounts, ensuring that they only have permissions necessary to complete their roles and tasks. And automate secrets scanning within codebases to identify and then remove any API keys and secrets added to source code. ®

Cyberattacks on both Russia’s and Ukraine’s emergency alert apps resulted in fake messages about missile and nuclear strikes broadcast to the public. Officials from both countries confirmed the attacks, which occurred at similar times, on Sunday evening. According to public statements and messages sent via social media, Ukraine’s alert app was hit first, with the country’s Air Force quick to dispel nuclear fears. "The Air Alert app has likely been compromised," it said via Telegram at around 2100 UTC. "There is no radiation threat! Stay calm, follow our messages on our channel!" At around 0030 UTC on Monday, Russia's Ministry of Emergency Situations confirmed the country’s app had also been abused, with fake messages sent to citizens' devices. "Attention! The Russian Ministry of Emergency Situations' mobile app has been subjected to a massive cyberattack, allowing attackers to send fake information to the public," it said, also via Telegram. "Work is currently underway to patch the vulnerability and restore normal operation." The ministry issued an update around 90 minutes later, saying the app was once again functioning normally, and pointing out that an attack on the app was not the same as a compromise of the state’s national alert system. "Citizens are alerted through primary channels: regional and municipal alert systems (sirens, loudspeakers), communication networks (SMS messaging), and television and radio broadcasts. The mobile app is merely an additional, supporting information service," it stated. Ukraine's Ministry of Digital Affairs also issued a public announcement reminding citizens about how to receive emergency warnings while its “Alarm!” app was down. These include enabling iOS and Android emergency alerts, state-controlled sirens, and other official sources, such as the official social media accounts of Ukraine's government. According to the messages sent to devices after the compromise of Ukraine's alert app, the fake warnings pertained to various threats, such as street fights in Kyiv, chemical attacks, and radiation hazards. Alerts about the threat of nuclear fallout from official government warning systems would normally lead to panic, however, one of the earliest messages sent to citizens was written in Russian and referenced the "Oreshnik" missile, which was an immediate signal that the message may not be genuine. Equivalent alerts sent to Russian citizens also warned of impending nuclear strikes "at all regions of Russia," referencing "P1-Sun," the name of a Ukrainian attack drone. Oleksander Merezhko, who chairs the Ukrainian parliament's foreign affairs committee and noted the suspicious Russian-language alert, told the BBC the attack was almost certainly part of Russia's cyber war. "It's a very unpleasant fact but it is part of cyber war and people in Ukraine understand that," he said. "It is possible and we are quite prepared for such possibilities." Russia has not explicitly blamed Ukraine for the attack on its app, and official sources say the app is running as normal. Ukraine's announcement of the alert app cyberattack came almost simultaneously with the official conclusion of a six-day ceasefire in Kherson. Russia agreed to the rare temporary suspension of conflict to allow hundreds of Ukrainians to evacuate the Russian-occupied city of Olehsky. Russia did not agree to a proposed extension of the ceasefire, which officially ended at around 2100 UTC – around the same time Ukrainians began receiving fake warning messages. ®

The cyberattacks on commercial refrigerators and freezers in Europe continue, as a slew of grocery stores in Belgium, Ireland, Luxembourg, and Sweden report widespread food wastage as a result of miscreants raising the temperatures to highs of 50ºC (122°F). In Belgium, around 40 Delhaize stores were affected after the attackers reportedly switched fridges and freezers into defrost mode overnight, between Sunday and Monday, resulting in stock issues. Diego Louwers, a Proxy Delhaize store manager in Overijse, near Brussels, told RTL Info that the consequences of the cyberattacks were "catastrophic," forcing the store to throw out the entirety of its fresh and frozen products. "We can't have anything worse in our line of work," he said. "We have to throw away all of our merchandise, and it's both heartbreaking and very complicated operationally." A Delhaize spokesperson said it took steps to ensure stores remain stocked, although fresh and frozen products are "temporarily somewhat limited." "On Monday, 2 November, we identified an IT incident affecting the refrigeration systems in several dozen of our stores," they said. "We immediately took the necessary measures to keep our stores operational and ensure that our customers can continue to do their shopping as usual. "In the affected stores, the range of fresh and frozen products is temporarily somewhat limited. Our distribution centres are operating normally, and there has been no disruption to deliveries to our stores. "We are, of course, continuing to ensure that our products are stored and presented under optimal conditions, so that we can provide our customers with the quality and freshness they have come to expect from us." Around 15 Carrefour stores are also reportedly affected, as are sites operated by Intermarché, Spar, and Shop & Go stores located at Q8 service stations. Belgium’s De Laet & Van Haver chain of butcher shops reported temperature rises in its appliances too, but followed up with a statement on Monday saying there was no impact on its produce, and all stores remain open. Simultaneously, similar issues have affected Swedish grocery chain ICA, which confirmed attacks on a "small number of stores." "We can confirm that we have been informed of an incident overnight affecting a small number of ICA stores operating outside ICA’s central network," a company spokesperson said. "The incident impacted the stores’ refrigeration and freezer systems. ICA is currently supporting the affected stores in managing the situation." ICA did not respond to questions about the scale of food wastage nor when normal operations are expected to continue. One store, ICA Nära in Böda on Öland, said via social media that it is open today but has no fresh or frozen produce to sell. "Unfortunately, we are one of the stores whose refrigerators and freezers have been hacked," it said. "We are open as usual, but unfortunately we have no refrigerators and freezers to sell. "We have no status on when the refrigerators and freezers are expected to be up and running again." The store manager, Mats Olsson, told SVT that he arrived to work on Monday morning and was greeted by a puddle of water and freezers set to 55 degrees C – a tale echoed by other managers across the country. Coop stores are affected by similar attacks too, with six locations in central Sweden experiencing fridge-freezer issues, according to a company spokesperson. Likewise, at least 13 SuperValue stores in Ireland are also affected, with fresh and frozen food being thrown out, according to parent company Musgrave speaking to RTE. The news comes less than a month after various grocery chains in France resorted to discarding bucketfuls of produce after their appliances were remotely defrosted by cybercrooks. Carrefour, Coopérative U, Intermarché, Monoprix, and others were hit with cyberattacks in mid-October, and hundreds of stores across the chains were reportedly impacted. At least some of the affected stores were running outdated firmware on their Danfoss refrigeration controllers, and shortly after the attacks were confirmed, CERT-FR published an alert pertaining to numerous Danfoss AK-SM and AK-SC controller compromises. Other retailers, such as Coopérative U, confirmed they were not Danfoss customers. It remains unclear if the latest attacks across Europe used the same methods as those used for the disruption in France last month. None of the companies that spoke to The Register on Monday responded to questions about who was behind the intrusions. ®

The FBI has blamed North Korean hackers for the record-breaking $6.3 billion theft from cryptocurrency exchange Binance, pointing the finger at the notorious Lazarus Group as the exchange scrambles to replace stolen funds and reassure customers. In an alert published Saturday, the agency attributed the October 29 attack to TraderTraitor, a North Korean hacking operation linked to Lazarus, which has made a lucrative career out of relieving crypto exchanges of their digital assets. Pyongyang was already in the frame before the FBI weighed in. Blockchain intelligence firms TRM Labs and Elliptic had linked the theft to North Korea, with TRM reporting that most of the $6.36 billion haul disappeared in about 20 minutes. Elliptic, which puts the total closer to $6.43 billion, says it has verified that $2.85 billion of the stolen assets have been frozen or seized. According to the FBI, the hackers have started swapping their loot for Ethereum, with investigators expecting them to move the funds through decentralized finance (DeFi) platforms and instant swap services to make the money harder to trace. The agency has published a list of cryptocurrency wallet addresses linked to the theft and is urging exchanges, blockchain analytics firms, and other virtual asset providers to block transactions involving the stolen funds. The FBI's attribution comes days after Binance admitted that hackers had made off with roughly $6.3 billion in cryptocurrency. According to the exchange, the trouble started with a compromised DevOps engineer's laptop, which gave the intruders access to a service container and allowed them to authorize withdrawals they had no business making. Binance has since resumed customer withdrawals, which it suspended after the attack, and says it has now replenished about 95 percent of the stolen assets. The remaining tokens are proving harder to replace because of their limited liquidity. The exchange has committed billions of dollars from its own reserves and emergency funds to cover the losses, with co-CEO Richard Teng promising that customers won't be left footing the bill. That hasn't stopped users from heading for the exits. Binance recorded approximately $3.64 billion in net outflows after withdrawals resumed, although the company said this represented only around 2.1 percent of its reported assets. Replacing the stolen cryptocurrency is one thing. Getting it back from North Korea is another, and investigators face the considerable task of tracking billions of dollars as the hackers attempt to move it beyond their reach. TraderTraitor has form when it comes to raiding crypto exchanges. The North Korean crew has previously been linked to a string of cryptocurrency thefts, including the $308 million attack on Japan's DMM Bitcoin exchange in 2024. The group has previously used fake job offers and recruitment exercises to trick employees into handing over access to their employers' systems. As we reported here on Friday, crypto exchange Bitget has now confirmed that the cyberattack where hackers drained $387.5 million worth of digital assets from the exchange’s wallets also has all the hallmarks of a North Korean operation. Its CEO did not go into too much detail, but did say that “IP behavioral patterns and on-chain signatures” suggest it was Kim’s cronies at work. This isn’t Binance's first expensive encounter with hackers, either. Back in 2022, attackers exploited its BNB blockchain bridge and made off with roughly $566 million in tokens. Four years later, the sums have grown considerably. Binance may have the reserves to make its customers whole, but the attackers responsible for the latest raid still have billions of dollars to launder. ®