Help Net Security reports that the FBI said in an October 31 alert that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance, linked it to TraderTraitor, and urged providers to block 628 listed addresses; Binance began restoring withdrawals on November 1 and says it has replaced about 95% of the stolen assets with its own funds.
Help Net Security reports that Binance said the incident "may involve a compromised DevOps engineer's laptop," which let an attacker reach a service container, that it found no evidence of a private-key leak and will cover all losses. TRM Labs counts about $6.36 billion leaving Binance wallets across ten blockchains and attributes the attack with high confidence to North Korea's TraderTraitor; Binance says close to $3 billion has been frozen, and TRM puts freezes at about $2.7 billion.
Reps. Pat Harrigan and George Whitesides introduced the AI Cyber Defense Act on October 22. It directs the National Institute of Standards and Technology to work with private-sector AI developers on voluntary standards for detecting and preventing AI distillation attacks, which it says "can allow outside actors to extract valuable capabilities from advanced AI models"; creates an AI Cybersecurity Roundtable of technology companies and critical-infrastructure operators to develop best practices for using AI to strengthen cyber defences; excludes entities tied to China, Russia, Iran, North Korea and Cuba from the eligible private-sector stakeholders; gives NIST 180 days after enactment to begin engaging industry and to stand up the roundtable; and requires the resulting standards and best practices to be made publicly available. Harrigan said "Our adversaries are already looking for ways to exploit these systems" and that "as AI becomes more powerful, the risks to our critical infrastructure will only grow"; Whitesides said "AI makes cyberattacks faster, cheaper, and harder to stop". The release names no bill number, and the draft attached to it is named "NIST_Defensive_AI_Standards_Act_Final_10.06.2026.pdf", which differs from the name used in the text.
Wiz reports malicious versions of arrayref@0.3.10, internment@0.8.7 and append-only-vec@0.1.9 on crates.io pulling a typosquatted proc-macro1 dependency whose build script downloads and executes a remote binary, so “building an affected project was sufficient to execute the payload.” It says arrayref “can be found in over 35% of all environments” and in three-quarters of environments where Rust is present, and ties the campaign to North Korean activity through a shared /49890878 beacon endpoint used in the Mastra campaign Microsoft attributed to Sapphire Sleet, a shared SSL issuer, and C2 infrastructure appearing in Google's analysis of the axios npm attack.