Incidents
Thu 29 Oct
Updated Tue 3 Nov
BleepingComputer reported on 29 October 2026 (US Eastern time) that prediction market platform Polymarket temporarily suspended trading after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript. Polymarket said: "One of our third party providers was compromised, and we have referred this to relevant law enforcement," and "Anyone who has been impacted will be made whole," according to BleepingComputer. (source: BleepingComputer) BleepingComputer says Polymarket placed its exchange into cancel-only mode at 2:05 p.m. ET (2:05 am Perth time on 30 October) and that the incident was marked resolved at 3:05 p.m. ET (3:05 am Perth time on 30 October). BleepingComputer says trading resumed about an hour after the suspension and quotes Polymarket: "Trading is now fully back online. We'll make this right and are fully reimbursing all affected traders." (source: BleepingComputer) According to BleepingComputer, Hudson Rock researchers identified malicious JavaScript distributed through DebugBear's CDN that was designed to steal cryptocurrency and prediction-market holdings from Polymarket users; BleepingComputer's own analysis found it was designed to hijack authenticated Polymarket trading sessions, liquidate users' prediction-market positions and transfer assets to an attacker-controlled wallet, and that the wallet transferred approximately 28.6 million POL, valued at roughly $2.57 million, to three additional wallets. BleepingComputer said on 29 October that Polymarket had not disclosed how many users were affected, how much cryptocurrency was stolen, or how the reimbursement process would work. (source: BleepingComputer) According to BleepingComputer, DebugBear, a website performance-monitoring service, confirmed it is investigating an ongoing security incident and told customers: "We're impacted by an ongoing security incident. If you use our RUM product, please remove the embed code from your website." (source: BleepingComputer) Correction (31 Oct 2026): the card date has moved from 30 to 29 October 2026, the date BleepingComputer's report shows. (source: BleepingComputer) UPDATE (3 Nov 2026): In a postmortem on its status page dated 30 October (20:07 UTC, 4:07 am Perth time on 31 October), Polymarket said a third-party vendor whose performance-monitoring script loaded on polymarket.com was compromised and the attacker replaced the script with one built to target Polymarket users; for some people who had the site open during a small window, it used their active session to sell positions and move funds out of their wallet. Polymarket said it removed the compromised script and cleared every cache, paused trading and the relayer, reset all active login sessions, is redeploying third-party scripts with additional integrity controls and continuous monitoring, and has referred the case to law enforcement. It said it is returning $3.9M to traders in total, the $2.7M plus $1.2M to cover pause-related losses, with no claims or tickets needed, and that 95% of affected wallets had been refunded in full as of the afternoon it posted. (source: Polymarket status page) According to The Record, DebugBear said its initial findings indicate it was compromised through its domain registrar and that it had not seen any indication of a compromise of its internal systems. (source: The Record) Correction (03 Nov 2026): removed DebugBear's and Polymarket's posts on X as sources; removed details no other source gives. (source: Polymarket status page; BleepingComputer; The Record)
Polymarket status — Security incident - 3rd party vendor compromised (postmortem 30 Oct 2026, 20:07 UTC)
breaches cloud
Incidents
Thu 29 Oct
Updated Mon 2 Nov
Binance said in a post on its X account at 5:29 am Perth time (AWST) on 30 October 2026 (21:29 UTC, 29 October): "Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe." The post said its security teams are reviewing all relevant information with urgency and warned users not to trust unofficial links, messages, or requests for account information. (source: Binance on X) In a later post at 8:13 am Perth time on 30 October (00:13 UTC), Binance said: "We are working non-stop to resolve this issue. Binance will cover all losses." It said all deposits and withdrawals are temporarily suspended while its team conducts security checks, freezes funds, and works with law enforcement, and that it will share a full post-mortem once the investigation is complete. (source: Binance on X) BleepingComputer reported on 29 October 2026 (US Eastern time) that the statements followed reports of billions of dollars in cryptocurrency being transferred from multiple Binance hot wallets to a newly created Ethereum address. According to BleepingComputer, Tether CEO Paolo Ardoino said on X that Tether had frozen more than $1.567 billion in USDT and Circle CEO Jeremy Allaire said Circle had frozen more than $800 million in USDC linked to the incident. BleepingComputer notes that Arkham Intelligence's figure of about $5.78 billion is the value of assets held across the wallets it tracks, not a confirmed amount stolen from Binance, and that at the time of its report Binance had not confirmed whether the transfers were unauthorized, how the suspected breach occurred, or the total value of any stolen assets. (source: BleepingComputer) UPDATE (30 Oct 2026, Perth; Binance on X): At 8:52 am Perth time (00:52 UTC) Binance said: "The current verified total frozen amount is around $3 billion." At 10:25 am Perth time (02:25 UTC) it said: "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak." The same post says "The estimated total impact sits at around $6.3B", with about $3 billion frozen on-chain so far, and that Binance will cover all losses from the SAFU fund and the company's funds. Binance says it has revoked the affected address authorisation, engaged law enforcement and blockchain intelligence partners to trace and recover funds, and will publish a detailed technical post-mortem and an updated Proof of Reserves. In a service update at 12:36 pm Perth time (04:36 UTC), Binance said deposits "remain unaffected and continue to operate as normal" and that withdrawals remain paused while it completes "a security revamp of the withdrawal service and its related addresses", which it expects to finish within 48 hours. It said the incident "stems from multiple factors" and that its security team is tracing the full attack path through the compromised computer, which "may be the entry point of the incident". (source: Binance on X) UPDATE (30 Oct 2026, evening Perth; Binance on X): In an investigation update at 4:47 pm Perth time (08:47 UTC), Binance said: “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.” It called it “a complex attack”, said it is still gathering the facts with law enforcement, repeated that it will cover all losses from the SAFU fund and the company's funds, said it is still on track to resume withdrawals in 45 hours with deposits unaffected, that outflows ceased when it paused withdrawals, and that around $3 billion has been frozen so far. At 6:55 pm Perth time (10:55 UTC) Binance said it has begun recovering affected assets for users and has reserved over $6.34B of company funds to cover the incident, $5B of it already held in the exact token assets that were impacted, and that it is buying the remaining token assets through market and OTC channels. It said these figures do not include frozen or protected assets, and that all user funds will be verified publicly through its Proof of Reserves. (source: Binance on X) Correction (31 Oct 2026): the card date has moved from 30 to 29 October 2026, the date BleepingComputer's report shows. (source: BleepingComputer) UPDATE (31 Oct 2026; TRM Labs): Blockchain intelligence firm TRM Labs says in a blog post dated 29 October 2026 that it attributes the attack to TraderTraitor, which it calls North Korea’s elite hacking unit, based on on-chain and off-chain intelligence, and that it makes this judgment with high confidence; this is TRM’s assessment, and Binance has not named an attacker in the posts cited on this card. TRM says an attacker moved about USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC on 29 October (4:05 am Perth time, 30 October), using EIP-7702 delegation with 50 pre-signed authorisations, which in TRM’s assessment points to a compromise of Binance’s hot wallet signing infrastructure. TRM says Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion and the Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB, about USD 2.7 billion in total, and that the attacker still held more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion, as of 00:30 UTC on 30 October (8:30 am Perth). (source: TRM Labs) UPDATE (02 Nov 2026, Perth; FBI): The FBI said in a cyber alert dated 31 October 2026 that North Korea was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance on or about 29 October 2026, activity the FBI refers to as "TraderTraitor". The FBI says it, the USSS and IRS-CI have observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH), expects further laundering through DeFi and instant swap services, and urges THORNode and RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions with or derived from the addresses it lists. (source: FBI)
Binance on X — investigation update: additional points of breach uncovered; withdrawals to resume in 45 hours (30 Oct 2026, 4:47 pm AWST)
breaches
Incidents
Wed 28 Oct
Updated Sun 1 Nov
bunny.net said on its status page on 28 October 2026 (7:40 pm AWST) that last week one of its infrastructure providers reported unauthorised access involving third-party server management software, and that one of its CDN nodes, located in Armenia, was hosted on a server supplied by that provider. Bunny says that after the provider's alert it stopped routing traffic through the server within 20 minutes, reviewed and preserved the relevant security logs, securely wiped the server, revoked its access to Bunny's other systems and permanently removed it from its infrastructure. Bunny says its investigation found no evidence of unauthorised access to the CDN node or any of its data, and that the provider has also found no evidence that Bunny's server was accessed but continues to investigate; Bunny says it cannot completely rule out the possibility. If the node was accessed, Bunny says the potentially exposed information would have been temporarily cached CDN content, Pull Zone configurations and TLS certificates stored on that server; no other customer data, including bunny.net account data, was stored on the server, and no internal systems were affected. As a precaution Bunny revoked and reissued all TLS certificates for its platform domains (b-cdn.net and bunny.run) and began reissuing managed TLS certificates for custom domains. In an update on 30 October 2026 (2:40 am AWST), Bunny said reissuance of managed certificates for custom domains was ongoing in controlled batches, each with a new private key, and was taking longer than first estimated, with completion now expected by the end of 31 October; existing certificates continue to be served until replaced, and neither Bunny's investigation nor the provider's has found any new evidence of unauthorised access to its server. Bunny does not name the provider. (source: bunny.net status page) UPDATE (1 Nov 2026): In an update on 31 October 2026 (8:50 pm AWST), Bunny said it has completed the reissuance of managed TLS certificates for custom domains: all managed certificates have been reissued with new private keys and the previous certificates revoked, and no action is required from customers using managed certificates. Bunny still recommends that customers who manage their own TLS certificates revoke and reissue them with new private keys as a precaution. Bunny said it has stopped using the affected provider while that investigation continues and is changing how configurations are distributed so that each PoP only receives the configuration and TLS certificates for the sites it is actively serving, and that neither its investigation nor the provider's has found any evidence of unauthorised access to its server. (source: bunny.net status page)
bunny.net Status — Security update regarding one of our infrastructure providers (posted 28 Oct 2026, 7:40 pm AWST; update 30 Oct 2026, 2:40 am AWST)
breaches cloud
The Independent reported on 28 October 2026 that US-based AI startup Cathedral, which The Independent says was founded this year by former staff of the US Department of Government Efficiency, claimed it breached Anthropic's internal network in less than 12 hours as part of a bug bounty program that encourages outsiders to look for security flaws. (source: The Independent) According to The Independent, Anthropic confirmed that Cathedral had reached a "limited set" of sales, HR and IT systems but did not access users' conversations with Claude, and the model's source code was not compromised. Anthropic said in a statement quoted by The Independent: "Our monitoring flagged some of Cathedral's activity before they reported it to us," and "We shut off their access the same day." (source: The Independent) An Anthropic spokesperson told The Independent that the activity "involved attempts over several days", pushing back on the 12-hour claim, and that Cathedral's actions went "substantially beyond" the company's bug bounty program by targeting third-party applications. (source: The Independent)
The Independent — Anthropic hacked by AI startup in less than 12 hours, report claims (28 Oct 2026)
ai identity
Belgium's Federal Public Service Finance (FOD Financiën / SPF Finances) says its digital services were hit by a cyberattack on Wednesday 28 October 2026 and that the attack was successfully stopped (FPS Finance notice in Dutch, dated 28 October and last updated 29 October; Cyberstack translation). As a precaution, MyMinfin and some other services were temporarily taken offline; FPS Finance says it is working on a restart, but that this takes time in order to rule out new risks. Because this affects tax deadlines in the near future, FPS Finance says the deadline for filing returns with specific income is postponed to 16 November 2026. FPS Finance says data protection is its priority and that it now knows no data has been leaked, and that a large part of its other applications remains available with full or partial functionality. The Register reports the deadline that moved was 31 October, for filings covering specific types of income such as sole traders and earnings from foreign companies, and The Record reports that Belgian authorities have not identified who was behind the attack or disclosed how the hackers may have gained access. (source: FPS Finance; The Register; The Record)
FOD Financiën — Cyberincident bij de FOD Financiën (28 Oct 2026; updated 29 Oct 2026; in Dutch)
breaches
The transparency nonprofit Distributed Denial of Secrets (DDoSecrets) on Wednesday 28 October 2026 published an archive of US Department of Homeland Security records that, according to WIRED, exposes details of more than 41,000 employees or contractors of DHS and seven of its component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection. WIRED reports that the records include email addresses, phone numbers and office addresses as well as references to internal systems and to undercover and surveillance programs, and were last updated on 19 August 2026; according to a WIRED analysis of the data, CBP staff account for more than half of the records and ICE for about 10,000. A Homeland Security spokesperson told WIRED: "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively." DDoSecrets says in a press release that the data is from DHS's Okta login system, according to WIRED; an Okta spokesperson told WIRED: "Okta is secure, and we have no evidence our data or systems were compromised." DDoSecrets told WIRED it obtained the data from a group calling itself the Department of Peace. (source: WIRED)
WIRED — Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents (28 Oct 2026; includes DHS and Okta statements)
breaches identity
Incidents
Wed 28 Oct
Updated Sun 1 Nov
Japan Airlines (JAL) said one of its IT providers suffered a data breach that leaked the personal records of more than 90,000 customers, according to The Record (28 Oct 2026). The Record reports that JAL published a notice on Wednesday (28 October) saying Amadeus IT Group, the company that runs its flight reservation, ticketing and check-in systems, informed it last week that hackers accessed a 'portion of customer reservation data' for Japan Airlines and Japan Transocean Air flights; in total 92,000 customers were affected, with names, reservation codes and flight information accessed, and for about 2,000 customers passport numbers, frequent flyer numbers, email addresses and phone numbers were also taken. According to The Record, JAL said the breach never affected flight operations and credit card numbers were not compromised, and that it will contact affected customers individually, including reminders to watch for phishing emails, fraudulent phone calls and websites impersonating the JAL Group. ITmedia NEWS (28 Oct) reports that JAL and Japan Transocean Air (JTA) said Amadeus reported the unauthorised access to them on 23 October; that the traces of outside access cover part of the reservation records for JAL and JTA flights from 10 August 2023 to 23 September 2026; that for the about 2,000 customers the items accessed also include nationality, ticket number and seat number; that no leak of credit card numbers or passwords has been confirmed; that Amadeus has already completed the necessary security measures and, as of 28 October, no misuse of the information had been confirmed; and that a dedicated inquiry line opens on 29 October (our translation from Japanese). Correction (31 Oct 2026): removed the Cathay Pacific notice (Personal data security incident involving a third-party service provider) as a source, with the update and the title, product and advice wording that came only from it, because this desk could not read that page in full; every fact on this card now comes from The Record and ITmedia NEWS. (source: The Record) Updated (01 Nov 2026): Star Flyer, which uses the Amadeus passenger service system through All Nippon Airways (ANA), said on 30 October (first posted 29 October) that it received an updated report from ANA that an unauthorised third party accessed reservation information for Star Flyer-operated flights within the system, and that there are indications certain personal information of its customers may have been accessed. Star Flyer lists the information that shows signs of access as customer name, booking reference number, travel date, flight routing, cabin class, email address, phone number, frequent flyer number, airline, flight number, e-ticket number and seat number, among other related details, for certain customers who made reservations with Star Flyer from 28 July 2025 to 23 September 2026. Star Flyer said the incident did not involve credit card numbers or account passwords, that it has been informed the compromised authentication credentials have been revoked and monitoring substantially enhanced, and that it is still verifying the number of people affected and will contact customers directly once their details are verified. (source: Star Flyer)
The Record — Japan Airlines warns of data breach as country grapples with multiple cyber incidents (28 Oct 2026)
breaches
Incidents
Wed 28 Oct
Updated Thu 29 Oct
Coinbase said in a post on its Coinbase Support account on X at 10:49 am Perth time (AWST) on 28 October 2026 (02:49 UTC): 'Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.' In the same post Coinbase said it had found no evidence of unauthorized access to Coinbase systems, that customer funds were not impacted, and that it is notifying impacted customers and regulatory agencies in accordance with its legal obligations. (source: Coinbase Support on X) Decrypt (28 Oct) reports that Coinbase did not say how many customers were affected, what kinds of contact data were exposed or when the incident took place, and did not name the other Amplitude customers affected. (source: Decrypt) Correction (29 Oct 2026): the post's time is now given in Perth time from the post's own timestamp, each statement is credited to the post or to Decrypt, and wording not in either source was removed. (source: Coinbase Support on X)
Coinbase Support on X — statement on Amplitude security incident (28 Oct 2026)
breaches
Incidents
Wed 28 Oct
Updated Thu 29 Oct
Lumen's Black Lotus Labs has published research, reported by BleepingComputer on 28 October 2026, on what it calls Silent Train, a covert framework it attributes to the China state-sponsored group Volt Typhoon. Black Lotus Labs says it has tracked Silent Train for three years, first observing consistent activity in November 2023, shortly before the initial takedown of the KV-botnet, and that the work led to hundreds of victim notifications. It describes Silent Train as rapidly rotating chains of compromised SOHO, IoT and enterprise devices that are exploited on demand, used against selected targets, cleaned up after each operation and continuously refreshed: sessions began from virtual private servers outside the US and were daisy-chained through compromised non-US devices before pivoting within the US to reach targets. It observed more than 27 device classes used, from TP-Link routers and Netgear Orbi devices to Fortinet appliances and CyberPanel servers, with device types reserved for fixed roles (Intelbras modems only as overseas relays, Netgear Orbi devices as US-based hops that interacted with victims). By early 2025, compromised enterprise platforms were kept in the chains for one to three months, making Silent Train a hybrid framework. Black Lotus Labs says its monitoring helped uncover at least four confirmed and one likely zero-day campaigns against network and endpoint management systems, SD-WAN orchestrators and other control-plane infrastructure: Versa Director (which it documented in mid-2024), N-able N-central (a chain of then-undisclosed flaws assigned CVE-2025-8875 and CVE-2025-8876), Cisco Catalyst SD-WAN (CVE-2026-20127, exploited from late 2025 and continuing well after Cisco's February 2026 disclosure), VeloCloud Orchestrator (a zero-day later designated CVE-2026-16812) and, assessed with moderate confidence, Quest KACE (more than 30 victims; activity declined after Quest's October 2025 security updates). Post-incident analysis found in-memory webshells, credential harvesting, abuse of native platform features and, in several cases, erased or altered logs. Victims included telecommunications providers, government, defense contractors, satellite and mission-critical communications services, universities, MSPs, IT firms and critical infrastructure; Hawaii, California and Texas were the most targeted regions. Activity was concentrated on weekdays between 09:00 and 22:00 China Standard Time. BleepingComputer (28 Oct) also reported the research. Correction (29 Oct 2026): the 28 October date is now credited to BleepingComputer's report. (source: BleepingComputer)
Lumen Black Lotus Labs — Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access
breaches network
Incidents
Wed 28 Oct
Updated Mon 2 Nov
The FBI seized the domain of Virtualine, a 'bulletproof' hosting provider accused of facilitating a range of cybercrimes including money laundering and the distribution of child sexual abuse material, The Record reported on 28 October 2026. According to The Record, the Justice Department said on Tuesday that a court authorised the seizure of virtualine.net, a service operating under names including Secury, Massgod, Spamhouse, Lanedo and Omegatech, and the site has been replaced by a seizure notice. Citing court records, The Record says Virtualine advertised on cybercrime forums, offering hosting for 'all illegal/black hat activities' including phishing, carding and spam. The Record reports that in January, about a month after Virtualine allegedly provided an IP address to a forum used to sell sexually explicit images of minors, the company received complaints from authorities in Germany, Canada and Australia, as well as the National Center for Missing and Exploited Children and a victim's attorney, and that instead of ending service it helped the forum's operators build another site, according to the Justice Department. The Record says the FBI's Washington Field Office led the investigation with help from authorities in Germany, the Netherlands and Britain and private-sector partners OverRIPE and Lumen, and that the Justice Department did not identify Virtualine's operators or announce criminal charges at the time of the seizure. Correction (02 Nov 2026): removed The Hacker News as a source. (source: The Record)
The Record — FBI seizes ‘bulletproof’ hosting site accused of facilitating child abuse, money laundering (28 Oct 2026)
breaches
