Daily Cyber Threat Brief — October 30, 2026: Binance links record $6.3B crypto theft to a compromised DevOps laptop

Per TRM Labs, the attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC on October 29. Stablecoin issuers Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB — roughly $2.7 billion frozen in total. The attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave, and now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion in assets beyond any issuer's reach. Binance has revoked authorizations for the affected address and says it will publish an updated Proof of Reserves once remediation is complete. Binance itself has not attributed the attack; the TraderTraitor attribution comes from TRM Labs, confirmed by Chainalysis "with a high degree of confidence." TraderTraitor was previously linked to the $1.5 billion Bybit hack of February 2025.

Dream Security's Monday report describes a complete attack operation pairing a custom weaponization of the PHP2Shell chain with the Fragnesia privilege escalation, including target lists, exploitation logs and approximately 40 custom post-exploitation scripts — a campaign that rooted 25 servers across the United States, Japan, Taiwan and South Korea, then zeroed in on three servers in a US government-affiliated environment. CISA added the PHP2Shell flaws to KEV on Monday with a Thursday deadline for federal civilian agencies. Separately, a Perplexity security engineer confirmed in-the-wild exploitation over the weekend after honeypots recorded remote code execution against an Apache mod_php installation running PHP 8.4.26. CISA has not shared further details on ongoing Fragnesia attacks. Patching priority: PHP hosts running kernels predating May 13, 2026 should be patched first, since the chain turns a web flaw into root.

KeyDrift has two components. PolyFlame is a memory-resident module delivered through modified runit service paths and injected into legitimate vdaemon processes, acting as a backdoor and command-and-control relay. LittleFilch hooks SSL_read inside vdaemon, inspects decrypted control-plane messages, extracts OMP-distributed AES-256 IPsec data-plane keying material for predefined edge nodes, and stages the records RSA-encrypted at /var/tmp/vdaemon.bin. Talos assesses with high confidence that the framework is designed for long-term access and automated exfiltration, and notes the infrastructure overlaps considerably with Volt Typhoon's "Silent Train" covert access network — but makes no definitive link between UAT-11473 and Volt Typhoon. The same flaw was exploited as a zero-day since at least 2023 by UAT-8616. Cisco states there is no workaround; administrators should run fixed releases, consult the Catalyst SD-WAN hardening guide, hunt for rogue peers, and rotate keying material — a patched controller is not proof of a clean one. Talos lists Snort SIDs 65938 and 65958 for exploitation attempts.

Polymarket has not publicly named the third-party provider. Some coverage points to DebugBear based on unnamed sources and security analysis; that identification is unconfirmed, and the scale of the incident beyond the reported ~$2.65 million remains as reported rather than independently verified. On-chain tracing reported by BleepingComputer shows drained funds swapped into roughly $2.57–2.65 million of POL through Relay and moved into three additional wallets. No core contract breach and no sign of systemic spillover have been reported.

Frontline has not published a nationwide total, so every figure so far comes from a district or a state filing: Killeen Independent School District in Texas reports information tied to about 45,000 current and former employees and others potentially exposed; Austin Independent School District appears on a Texas attorney general posting with 44,652 affected employees; Greenwood School District 50 in South Carolina puts roughly 16,678 students in scope. Exposed data varies by district and individual but includes Social Security numbers, email addresses and physical addresses in district notices reviewed by BleepingComputer. Frontline has not named the third-party application involved. District disclosures relay that Frontline has no indication the information was misused. Affected adults are being offered two years of TransUnion credit monitoring; minors are offered cyber monitoring.