Reversal X Mods (бесплатные премиум-приложения для Android)
Відкрити в Telegram
Anything worth while. Share and support us @reversemoda
Показати більшеКраїна не вказанаТехнології та додатки28 370
2 495
Підписники
+624 години
+87 днів
+930 днів
Архів дописів
+1
❗️Northflank, one of the AI developer platforms in Wiz's "Black October" report, is now telling all customers to assume every environment variable was decrypted. Users say their stolen AI keys are already being abused, and Northflank says that abuse comes from the same IP addresses Wiz flagged. It has no root cause yet.
+1
‼️ BREAKING: Nvidia's Brev AI platform has been breached.
Nvidia is telling users that unauthorised activity hit Brev from October 4 to 20 and that the SSH keys it set up for their VMs may have been exposed.
Wiz counts at least nine other AI developer platforms hit this month.
+1
‼️ The Syrian hacker who hijacked AP's Twitter account to post that Obama was injured in White House explosions was sentenced to 42 months in a US prison.
The 2013 fake tweet briefly wiped $136B off Dow stocks, the DOJ says.
Ahmad Umar Agha later called that crash "our goal".
+1
❗️ A fake Solana starter kit on GitHub ranked first when AI coding agents searched for one, AIR Research Lab says.
In AIR's demo, Claude Code picks it as the top result and runs its only install step, a one-line PowerShell command.
That command plants 13 genuine, signed NetSupport Manager files and one config file written by the attacker.
The config hides the chat and disconnect options and lets any operator take control of the Windows PC from any IP address.
The repo was on GitHub since November 2025 and collected 286 stars.
AIR says the same operator earlier lured crypto traders with fake TradingView "AI signal" videos.
The repo and its account are now gone from GitHub.
binance lost billions in one night
first, what got hacked?
binance keeps crypto in big online wallets that send out money when users withdraw. one of the biggest is called "binance 14". it held billions
step 1: the hacker got ready (oct 28-29)
- he took money from tornado cash (a mixer that hides where money came from), so no one can see who he is
- he used it to pay fees for his transactions
- he practiced the attack on 3 of his own wallets first, to make sure it worked
- at 15:59 he deployed his "sweeper", a small program built to empty wallets
step 2: the attack (oct 29)
20:18 > the first theft wasn't even on ethereum. a binance wallet on op chain sent him 44.23M $OP (~$4.5M)
20:20 > the big one. he took control of binance 14 using a new ethereum feature called 7702. it lets a wallet run outside code. he made binance's wallet run his sweeper
how? he sent 50 approvals signed with binance 14's own key. only 1 worked, and 1 was enough
step 3: he emptied it
20:24 > 167,464 eth + 1.615B usdt
20:41 > 780M usdc
20:59 > 43M usdc
21:04 > 1,699.9 eth
21:44 > 369.8 eth + 200.4M usdt
22:39 > 128.5 eth
everything went to his main wallet
step 4: more binance wallets paid him
this is the scary part. 3 other binance wallets also sent him money with normal transactions, no trick needed:
- 20:24 > binance 16 sent 28,005.6 eth
- 20:18 > binance wallet on op sent 44.23M $OP
- 23:05 > binance wallet on polygon sent 6.19M usdt0 + 46
a normal transaction needs binance's own approval. so the hacker likely had access to binance's signing system, not just one wallet
step 5: binance kept feeding the hacked wallet
binance didn't notice for hours. money kept landing in binance 14 and he took it right away:
- 21:42 > binance 124 sent 200M usdt into it. he took it 72 seconds later
- 23:55 > a 2,961.99 eth deposit landed. he took it 60 seconds later
step 6: binance fights back
- 21:01 > tether froze the hacker's main wallet
- 22:06 > tether also froze binance 14
- 23:07 > binance started moving tokens out to safety (45 transfers)
- 00:10 (oct 30) > binance finally cut his access, 3h49m after the hack started
- circle also froze the usdc in his wallet
step 7: where the money is now
- ~$2B stuck in his main wallet, frozen (1.175B usdt + 823M usdc). he can't move it
- 197,460 eth sitting in one wallet, untouched
- 40,601 eth in another. he sold stolen tokens like aave, wld, rsr and morpho for eth and collected it here
- 17,260 eth in a third wallet
in total he still holds 255,000+ eth, which can't be frozen
check it yourself
hacker :
0x7C8601d4645b93cea45F71e118A729332e6B5CA0
fee wallet (tornado funded) :
0xe4F9070e1316de2988fc6f869feaD8fb99cC74cd
sweeper program :
0x63e842B054Bd624a465454D533C33F573e9c6fAe
hacker main wallet (frozen ~$2B) :
0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c
hacker eth wallets :
0x8532FA14ACAf483729C449b8458aedDb900543D4 (197,460 eth)
0x54401f80Da97893a15D43566184635B6674BC942 (40,601 eth)
0x03b0eE5d82990cFF1bDa48651AC3e436d1a020ea (17,260 eth)
binance wallets that lost funds :
binance 14 : 0x28C6c06298d514Db089934071355E5743bf21d60
binance 16 : 0xDFd5293D8e347dFe59E90eFd55b2956a1343963d
binance (op) : 0xacD03D601e5bB1B275Bb94076fF46ED9D753435A
binance (polygon) : 0xe7804c37c13166fF0b37F5aE0BB07A3aEbb6e245
all tracked by zarvium
+1
‼️ Picking up a Telegram voice call was enough to let an attacker run code on an Android phone, NebuSec says.
It says its GPT-5.4 tool found the flaw, which hit every Android version from March 2022 until 12.10.4 in late September.
Telegram's iOS app got the same fix in May.
+1
‼️ A 1992 safety system called LZB failed on Spain's Madrid-Seville high-speed line, setting off a chain of events that killed 69.
After which the control centre then cleared a train despite a red signal.
+1
‼️ WARNING: Updating the poisoned Claude Code extension won't remove its backdoor, Kevin Beaumont says.
Cursor, which served the bad build to up to 5,000 users, warns that even uninstalling it may not be enough.
The backdoor never lived only in the extension. On loading, it planted the attacker's SSH key and its own startup scripts, which keep trying to open a tunnel to the attacker every 60 seconds or so.
An update swaps the extension's files but leaves the key and the scripts in place.
+1
‼️ BREAKING: Cursor's extension marketplace served a backdoored Claude Code extension to up to 5,000 users.
For about 11 hours, version 2.1.313 planted an attacker's SSH key and persistence. Cursor says Anthropic did not build it.
Cursor has not said how the rogue build got in.
