Cybersecurity
Weekly recap covered thefts, botnets and spyware
The recap assembled reports on a Binance theft attributed to TraderTraitor, covert infrastructure used by Volt Typhoon, a Polymarket suspension after a third-party compromise, and several other incidents.
- The FBI attributed more than $6 billion in virtual assets stolen from Binance to TraderTraitor, which it described as a North Korean hacking group.
- The article said $2.85 billion of the stolen assets had been frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism.
- Polymarket suspended trading after hackers compromised DebugBear and used that access to distribute crypto-draining JavaScript that affected 33 deposit wallets.
- Parameter Labs said a patched ChatGPT flaw let a shared link run attacker-controlled JavaScript inside the signed-in session of the person who opened it.
- Cursor said two versions of the Claude Code extension in its marketplace were tampered with, installed a persistent SSH backdoor, and affected up to 5,000 users.
The FBI said it had officially attributed the Binance theft to TraderTraitor. It said the stolen virtual assets totalled $6.43 billion, and that $2.85 billion had been frozen by named crypto firms.
The recap then moved to Volt Typhoon and Silent Train, a relay network built from compromised devices. It said the system had been used on selected targets and cleaned up after each operation.
Polymarket paused trading after DebugBear was compromised and used to deliver draining JavaScript. The article said 33 deposit wallets lost about $2.7 million in less than an hour.
Parameter Labs said a shared ChatGPT link could run attacker-controlled JavaScript inside the signed-in session of the opener. Cursor said two versions of its Claude Code extension were altered to install a persistent SSH backdoor, affecting up to 5,000 users.
The recap also reported a Justice Department seizure tied to Virtualine and said Wiz had tracked the Gheist campaign across more than 850 compromised GitHub accounts. It added that Keystone would destroy 18,835 devices after a website incident, and that Trezor had warned customers about a suspected implant in a Safe 5 sold by a reseller.
Named in this story
Companies
- Binance
- the exchange from which assets were stolen
- Tether
- froze some of the stolen assets on-chain
- Circle
- froze some of the stolen assets on-chain
- Ripple
- froze some of the stolen assets on-chain
- Polymarket
- suspended trading after the compromise
- DebugBear
- was compromised and used to deliver the malicious script
- Parameter Labs
- disclosed the ChatGPT flaw
- Cursor
- said its marketplace was tampered with
- Virtualine
- the hosting provider whose domain was seized
- Keystone
- said it would destroy affected inventory
- Trezor
- warned about a suspected implant
- Wiz
- said it had tracked the Gheist campaign
- GitHub
- was the platform whose accounts were targeted by the campaign
Organisations
- TraderTraitor
- the hacking group the FBI blamed
- Volt Typhoon
- used the Silent Train relay framework
Governments and agencies
- Federal Bureau of Investigation
- officially attributed the Binance theft
- U.S. Department of Justice
- announced the domain seizure
Products and systems
- Silent Train
- the relay infrastructure the group used
- ChatGPT
- was the vulnerable sharing platform
- Claude Code
- was the extension altered to install a backdoor
How the source tells it
The source mixed bulletin-style reporting with alarmed headings and embedded marketing copy, so its register was brisk, urgent and partly promotional.
- alarm loaded headlines and superlative framing around thefts and vulnerabilities
- urgency countdown-style sections and explicit instructions to prioritise urgent patches
- vendor boosterism inserted product promotion and webinar-style sales copy