Defendor — DeFi Security

🕵️ North Korean Hackers Move $38M Through Relay in 7 Hours Specter reports the transfers were still ongoing, and Relay's Know Your Transaction monitoring failed to block them. Specter says the hackers would have struggled to move that much through THORChain in the same time, raising questions about Relay's risk controls. 🔗 Details

🚨 Premia Exploited for ~$400.5K on Arbitrum The attacker created empty option pools, flash-loaned funds, and bought options so the vaults' collateral locked into those pools, then withdrew it as liquidity. 🔗 Details

⏸️ THORChain Pause Delays Laundering of Binance Stolen Funds An Ethereum reorg this morning caused THORChain to wrongly issue a double refund to someone who deposited 10 ETH, triggering an emergency pause. Until it returns, neither the DPRK launderers nor anyone else can swap through most of its bridges. 🔗 Details

📝 Binance Update #3: 90% of Stolen Assets Replenished Binance says BTC, ETH, USDT, BNB, SOL, USDC, XRP, and several other major tokens are now fully backed, using SAFU, part of its Futures insurance fund, and company treasury. A new Proof of Reserves snapshot is live, and withdrawals are on track to reopen on Sunday. 🔗 Details

🚨 Flap and Kintsu Websites Hit by DNS Hijacking GoPlus says an attacker likely compromised a domain registrar and redirected more than 10 domains to clone sites that drain wallets. Both sites are back online, and users who signed suspicious transactions should move assets and revoke approvals. 🔗 Details

📝 Binance Recovery Update: $5B Set Aside, ~$3B Frozen Binance has set aside $6.34B and covered about 80% of the $6.3B loss, and says it found additional breach points beyond the compromised laptop. Withdrawals should resume in phases within about 34 hours. 🔗 Details

🔓 Chainalysis Confirms Breach by Attacker Using Agentic Techniques An attacker using "offensive agentic techniques" accessed customers' names, emails, and role labels, according to an email the firm sent to users. Chainalysis says the incident has nothing to do with the $6.3B Binance heist. 🔗 Details

🕵️ ZachXBT Links $6.3B Binance Exploit to Bitget Hack Stolen funds from both incidents arrived via THORChain and were commingled at the same address, suggesting the same actor is behind them. The Bitget exploit was previously attributed to North Korea-linked TraderTraitor, and MistTrack says the address was also used by the Phemex hacker. 🔗 Details

🚨 Cursor Marketplace Hit by Malicious Claude Code Extension A modified Claude Code VS Code extension, not developed by Anthropic, was served through Cursor's marketplace and affected at most 5,000 users. Cursor took the marketplace down, neutralized the malware, and reinstated it, and asks affected users to update to version 2.1.314. 🔗 Details

🚨 Binance Confirms Security Incident, ~$6.3B Impact Initial findings point to a compromised DevOps engineer's laptop that gave the attacker access to a service container to submit unauthorized withdrawals, with no evidence of a wallet private key leak. About $3B has been frozen, Binance will cover all losses from SAFU and company funds, and deposits and withdrawals are suspended. 🔗 Details

🚨 Binance Hot Wallet Drained of ~$201.2M in Follow-Up Sweep The attacker's operator called a drainer through an EIP-7702 delegation on the wallet, moving 200.40M USDT, 369.8 ETH, and dozens of other tokens to a new address. Setting the delegation requires the account's own signature, pointing to a private key compromise, and the sweeps total about $2.5B. 🔗 Details

⚠️ Possible Massive Binance Hack Under Way, ~$2.7B Reportedly Moved A Binance wallet appears to have been drained into a new address. The contract call that did it was funded by Tornado Cash. 🔗 Details

🚨 Polymarket Loses ~$2.65M After Third-Party Provider Compromise Arkham data shows a suspected attacker wallet holding about $2.65M in POL, after losses within minutes forced Polymarket into cancel-only mode. Polymarket says it found and fixed the cause, a compromised third-party provider, and has referred the matter to law enforcement. 🔗 Details

🛑 zkLink Suspends Nova Block Production After Exploit The team emergency-patched the affected contracts and disabled withdrawals to cut off further attacks. Nova services will only return once all risks are confirmed eliminated. 🔗 Details

🚨 zkLink Confirms Ongoing Exploit and Offers 20% Bounty The team identified an exploit targeting zkLink Nova's Arbitrator contract on Ethereum and Optimism and is working to contain it. They offered the attacker a 20% white hat bounty and no further action if the funds are returned. 🔗 Details

🧊 Tether Blacklists 33 TRON Addresses Holding ~$27M in USDT TrustSniffer reports the addresses were flagged on October 28, with the largest holding about $7.8M. Tether has not publicly disclosed the reasons for the coordinated blacklisting. 🔗 Details

🚨 zkLink Bridge Exploited for ~$786K on Ethereum Blockaid detected an attacker using a public relayer to inject a forged batch root, then finalizing withdrawals from the L1 escrow to attacker-chosen receivers. The exploit is still ongoing. 🔗 Details

🔬 Rekt: Initia's VM Kept Trusting an Approval After the Code Changed A published replay shows the VM verified a script once, then reused that approval after the module underneath was swapped, letting an attacker-made object pass as a real token. About $2.73M reached Ethereum through LayerZero and Noble before the halt, and the Initia Foundation has committed to restoring backing when the chain resumes. 🔗 Details

🔬 How Payy's ZK Bridge Lost $1.92M to a Forged Proof A verifier bug let the attacker forge withdrawals backed by empty notes, and every layer above trusted the proof. The fix had been out for 73 days, but Payy was still running an older build. 🔗 Details

🚨 Bithumb Confirms Security Breach An unauthorized party accessed Bithumb's internal mobile groupware system and leaked personal data, and the exchange is investigating whether customer information was compromised. Mirae Asset Global Investments and Daishin Securities were also breached, with 38,490 Daishin customers' data leaked. 🔗 Details