Crypto's biggest withdrawal.

Binance suffers a record-breaking cryptocurrency heist. Attackers exploit a critical GitLab flaw. Russian disinformation targets U.S. elections. Treasury sanctions North Korean IT worker operations. A cyberattack halts Polymarket trading. GCHQ loses track of thousands of storage devices. An abandoned Mac app leaves security risks behind. Japan Airlines reports a third-party breach. An AI-powered command-and-control framework emerges in the wild. Our guest is Josh Devon, Co-founder & CEO of Sondera, winner of the 9th annual DataTribe Challenge. We bid farewell to the captain who inspired a generation of innovators.

Today is Friday October 30th 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

Binance suffers the largest cryptocurrency hack on record. 

Cryptocurrency exchange Binance has suffered a staggering $6.3 billion theft, reportedly the largest cryptocurrency hack on record. Researchers at TRM Labs and Chainalysis attribute the October 29 attack to North Korea’s TraderTraitor operation. Attackers moved funds across ten blockchains, with most of the theft occurring in just 20 minutes. Binance says its preliminary investigation points to a compromised DevOps engineer’s laptop, which may have provided access to systems authorized to move funds. The company found no evidence that private wallet keys were stolen. Instead, attackers apparently manipulated transaction-signing infrastructure, including an Ethereum feature that allowed them to automate withdrawals. Cryptocurrency issuers and networks have frozen billions in stolen assets, but estimates suggest attackers still control between $2.4 billion and $3.3 billion. Binance has promised to reimburse affected customers, while significant questions remain about the security controls protecting its wallets.

A maximum-severity GitLab vulnerability is under active exploitation. 

Attackers are actively exploiting a maximum-severity GitLab vulnerability that could allow unauthenticated remote code execution. CISA has added the flaw, tracked as CVE-2026-97229, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to secure affected systems by Sunday. The vulnerability involves an integer overflow in GitLab’s regular expression compiler, allowing attackers to execute malicious code through specially crafted CI/CD configurations. GitLab patched the flaw earlier this month and has released additional threat detections after observing exploitation attempts. The Shadowserver Foundation reports nearly 2,800 internet-exposed GitLab Community Edition instances, though it’s unclear how many remain vulnerable. The latest discovery follows several serious GitLab security issues this year, including another recently exploited vulnerability that could expose sensitive credentials and other secrets.

A Russian disinformation group targets U.S. elections. 

Researchers say a covert Russian influence operation is targeting Democratic Senate candidate James Talarico in Texas with fabricated allegations of misconduct. Analysts at Alethea and Clemson University attribute the campaign to Storm-1516, a Russian disinformation group that spread similar false accusations during the 2024 presidential election. The latest attack involved videos that researchers at Graphika believe were AI-generated. Initially attracting little attention, the videos gained traction after several influential accounts on X amplified them. One received more than 850,000 views in its first 24 hours. U.S. intelligence assessments indicate Russia has recently intensified its election interference efforts, particularly in competitive Senate races. While much of the activity targets Democrats, intelligence officials haven’t concluded that Moscow is explicitly favoring either party.

Treasury officials sanction Russian and North Koreans over fraudulent IT worker operations. 

The U.S. Treasury Department has sanctioned Russian and North Korean nationals and companies accused of supporting Pyongyang’s fraudulent IT worker operations. Two Russians allegedly laundered millions in cryptocurrency earned by North Korean operatives working remotely for American companies. Treasury also targeted North Korean managers overseeing IT workers in Russia, along with a company accused of using artificial intelligence to help operatives secure U.S. jobs. The broader scheme involves North Koreans using stolen identities to obtain lucrative technology positions, then funneling earnings back to Pyongyang. Some workers have also stolen sensitive information and extorted employers. U.S. officials say the proceeds help fund North Korea’s weapons programs. The sanctions follow a Justice Department operation targeting laptop farms used to disguise workers’ overseas locations.

Polymarket suspends trading following a cyberattack. 

Prediction market Polymarket temporarily suspended trading Thursday after a cyberattack involving a third-party service provider disrupted its international platform. The company says trading has resumed and promises to reimburse affected users, but hasn’t disclosed the extent of the losses or identified the attacker. Blockchain security researchers traced more than $2.1 million in suspected cryptocurrency theft to a single account. Security firm Hudson Rock identified the compromised provider as website performance company DebugBear, which separately acknowledged a security incident and urged customers to remove its embedded code. Researchers discovered malicious code apparently designed to identify cryptocurrency wallets and transfer their assets to an attacker-controlled account. Polymarket removed DebugBear’s code from its website. There’s currently no evidence that other DebugBear customers were compromised.

GCHQ laments missing storage devices. 

Britain’s intelligence agency GCHQ cannot account for thousands of storage devices potentially containing sensitive information. The Investigatory Powers Commissioner says USB drives, hard disks, and memory cards remain unaccounted for years after the problem was first identified. Some devices may contain intercepted communications and other highly sensitive intelligence data. The watchdog expressed frustration over GCHQ’s slow investigation. The agency acknowledged shortcomings in its tracking system but says it has implemented corrective measures. Officials are still determining how many devices are actually lost.

An abandoned Mac app causes security headaches. 

An abandoned version of the once-popular Popcorn Time streaming app left hundreds of thousands of Macs potentially vulnerable to attack. Researchers at Eye Research discovered that Time4Popcorn installed a persistent update checker that could download and execute code with elevated privileges, even years after users stopped opening the app. With the developers long gone, attackers could potentially hijack expired update domains to distribute malware. Researchers found no evidence of exploitation, but estimate 250,000 to 350,000 Macs were affected. They took control of an abandoned domain and used the update mechanism itself to disable the vulnerable checker on more than a million Macs and Windows PCs. Other vulnerabilities remain, however, and some update domains are still uncontrolled. Researchers recommend uninstalling Time4Popcorn entirely.

Japan Airlines suffers a third-party data breach. 

Japan Airlines says a breach at its technology provider, Amadeus IT Group, exposed personal information belonging to 92,000 customers. Compromised data includes names, reservation codes, and flight details. For approximately 2,000 passengers, attackers also obtained passport numbers, contact information, and frequent flyer numbers. The airline says payment card information and flight operations were unaffected.

The disclosure comes amid a wave of cyber incidents in Japan, including breaches affecting millions of customers at a Sony-owned internet provider, Burger King Japan, and gaming company Capcom. Prime Minister Sanae Takaichi has called for emergency cybersecurity measures, warning of growing risks from stolen personal information. Japanese and American defense officials have also discussed strengthening cooperation against cyber threats as the country grapples with the recent attacks.

An AI-integrated command-and-control framework is found operating in the wild. 

Cisco Talos researchers have discovered an AI-integrated command-and-control framework called NIK C2 operating in the wild. The Windows-based malware combines credential theft, keylogging, surveillance, and remote access with direct access to OpenAI’s API. Attackers can use AI to analyze stolen information during an active intrusion, potentially accelerating their operations. The malware can even use a victim’s own OpenAI API key, potentially charging them for the attacker’s AI requests. NIK C2 also includes screen-locking ransomware that demands cryptocurrency payments without encrypting files. Its capabilities extend to lateral movement, security evasion, and persistent access. Talos observed active infrastructure and multiple versions of the malware, suggesting ongoing development. Researchers warn that integrating AI directly into malware could significantly reduce defenders’ opportunities to detect and interrupt attacks.

 

We bid farewell to the captain who inspired a generation of innovators. 

We say goodbye today to Sir Patrick Stewart, who has died at the age of 86.

His was a remarkable life. From a difficult childhood in a working-class Yorkshire home, he found his way to the Royal Shakespeare Company, where he spent decades mastering his craft. And then, approaching 50, he took a chance on a science fiction television series that he wasn’t entirely convinced would succeed.

And in doing so, he became Captain Jean-Luc Picard.

For those of us who grew up with Star Trek, it’s difficult to overstate what Patrick Stewart brought to that role. Picard was thoughtful, principled, intellectually curious, and deeply committed to the idea that humanity could become something better. He valued diplomacy over violence, reason over impulse, and the dignity of every individual. He was a leader who listened, who questioned his own assumptions, and who understood that having the authority to give an order didn’t necessarily mean it was the right order to give.

And there’s something else worth remembering. Star Trek inspired generations of scientists, engineers, programmers, and technology professionals. People who watched those shows as kids and went on to build the technologies that shape our world today. The communicators, the tablets, the voice-controlled computers, the extraordinary networks connecting people across unimaginable distances. For countless young viewers, Star Trek wasn’t just entertainment. It was an invitation to imagine what technology might make possible, and then go out and make some of it real.

Patrick Stewart helped make that future feel worth pursuing.

He also reminded us that intelligence and kindness weren’t mutually exclusive, that leadership could be compassionate, and that even in a universe filled with extraordinary technology, the most important questions were still fundamentally human ones.

Now, you might reasonably ask, “What does this have to do with cyber security?”

Well, as it happens, Captain Picard was something of an early adopter of multifactor authentication. Whenever the Enterprise’s auto-destruct sequence needed to be activated or canceled, the ship required authorization codes and confirmation from multiple senior officers.

Even in the 24th century, apparently, you couldn’t just blow up the Enterprise with a single password.

Sir Patrick Stewart gave us many wonderful performances over a long and extraordinary career. But for generations of us who looked to the stars and imagined a better future, he’ll always be our captain.

Thank you, Sir Patrick.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

We’re proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world’s preeminent intelligence and law enforcement agencies.

N2K helps cybersecurity professionals and organizations grow, learn, and stay ahead. We’re the nexus for discovering the people, tech, and ideas shaping the industry.  Learn how at n2k.com.

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.