FBI blames North Korean TraderTraitor for $6.43 billion heist

The Hacker News’s weekly recap highlights a mix of high-stakes cyber incidents and a long slate of fresh vulnerabilities. The most notable claim anchors on the FBI attributing the Binance crypto heist to North Korea’s TraderTraitor, with $6.43 billion stolen across 11 blockchains and $2.85 billion frozen on-chain by entities including Tether, Circle, Ripple, Arbitrum and Optimism.

Other major items include Volt Typhoon’s Silent Train framework, which used rotating chains of increasingly compromised devices to support zero-day activity against high-value targets; and a Polymarket incident where hackers leveraged DebugBear to siphon about $2.7 million from 33 deposit wallets.

The piece also covers a patched but notable risk from a shared ChatGPT link that could run attacker-controlled JavaScript inside a user’s session, and reports on a Cursor Marketplace incident where the Claude Code extension delivered a persistent SSH backdoor to up to 5,000 users. Other entries span a DoJ action against bulletproof hosting, Keystone’s plan to destroy 18,835 devices found in inventory due to a compromised key, and a Go-based Linux DDoS botnet named Kairos that uses Telnet-based initial access.

Additional alerts include a new device-code phishing kit codenamed MadApe, and a group using AI via Aur0ra ransomware tooling in post-exploitation activity. The report also notes a surge in AI-assisted cyber crime, with investigations into Hugging Face malware, and a spectrum of related campaigns and campaigns’ infrastructure.

The piece closes with a long listing of “Trending CVEs” deemed urgent, high-severity, or widely targeted, including CVE-2026-115889 and CVE-2026-115893 (Wasmtime), CVE-2026-90975 (Fireblocks mpc-lib), CVE-2026-91141 (COVESA vsomeip), and an extensive set linked to ASUS, Drupal, EPICS Base, Juniper, Tomcat, Linux kernel CVE-2026-98432, and others such as CVE-2026-106378 (Chrome), CVE-2026-114349, CVE-2026-111551 (Apache Kafka), CVE-2026-112816 (LXD), CVE-2026-103401 to 103409 (Juniper Session Smart Router), and a preauthenticated RCE in TightVNC.

The list also includes CVEs tied to GoAhead, Apache Camel, Okta, and multiple other vendors, underscoring the breadth of imminent risk across enterprise and consumer ecosystems.