Rapid Manufacturing — a 50-year-old electronics contract manufacturer in Anaheim, California with operations in Ensenada, Mexico.
Rapid Manufacturing is not a household name. But it is a critical Tier-1 supplier to SpaceX (Falcon & Starship programs), Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace (RTX), and Millennium Space (Boeing). It builds the wire harnesses, electro-mechanical assemblies, and box builds that go inside rockets, missiles, and satellites.
The exposed material includes:
<redacted>>
ITAR-controlled engineering drawings and manufacturing processes for Falcon 9/Heavy, Starship, and Draco propulsion systems — RTD soldering acceptance criteria, visual inspection standards, cable thermocouple assemblies, and production master plans.
26 ITAR customer quoting accounts including SpaceX, Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace, and Millennium Space — the complete defense/space revenue architecture.
<redacted>
<redacted>
600–1,200 employee records spanning US (SSN, bank accounts, payroll, I-9/immigration) and Mexico (RFC, CURP, IMSS, bank accounts, nóminas) with data from 2019 through August 2026.
<redacted>
Attorney-client privileged materials — settlement agreements, severance terms, internal investigation files, and a recorded termination meeting (audio).
Group: aurora
Discovered: 2026-10-30 16:26 UTC
This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.
The Flashpoint Threat Intelligence Brief: Middle East
Flashpoint’s weekly analysis tracks shifting kinetic and cyber threat radiuses, geopolitical disruptions, and provides critical operational forecasts for the ongoing Middle East conflict.
Following Operation Epic Fury, regional kinetic operations have transitioned into direct, persistent threats against commercial shipping, energy infrastructure, and critical supply chains.
The Flashpoint Threat Intelligence Brief: Middle East cuts through headline noise to deliver tactical, ground-level intelligence for government agencies, corporate security leads, and global logistics teams—turning Flashpoint’s primary source intelligence into proactive risk mitigation.
Here are the updates from this week that your security operations team should be tracking.
Operational SITREP: Executive Summary
Between October 23 and October 29, Ansarallah (the Houthi movement) continued its campaign against Saudi aviation, military, and energy infrastructure. Houthi military spokesperson Yahya Saree claimed ballistic missile and drone strikes on King Khalid International Airport, Saudi Aramco facilities in Yanbu, crude oil pumping stations, and the Ras Tanura refinery. On October 27, the group also claimed to have struck Saudi Arabia’s Ministry of Defense headquarters in Riyadh and military transport aircraft at Abha airport along with King Khalid Air Base. Saudi authorities have not confirmed damage at several of these sites.
Saudi-led coalition forces reported intercepting missiles and drones targeting Riyadh, Khamis Mushait, the Eastern Province, and other areas, including 10 ballistic missiles directed toward southern Saudi Arabia on October 25. King Khalid International Airport resumed international flights that day, although Ansarallah warned airlines that the airport remained a military target. Coalition air strikes continued in northern Yemen, with the Sanaa-based Health Ministry reporting eight fatalities following a strike on workers’ housing in Hamdan.
Houthi ground operations also intensified around Taiz and Lahj, with reported advances along the Jabal Sabr front and an assault on Al-Maqatira Castle. On October 29, Yemeni government forces reported that Ansarallah fired two ballistic missiles at Aden International Airport, extending the threat to another major aviation facility.
The United States ordered nonessential staff and families to depart its embassy in Riyadh and consulates in Jeddah and Dhahran following statements by Islamic Revolutionary Guard Corps (IRGC) officials identifying American diplomats as legitimate targets. Similar precautionary measures were reported at US missions elsewhere in the Middle East. US officials also cited intelligence indicating potential Iranian assassination planning against American diplomatic and government personnel.
Iran continued operations against Kurdish opposition groups in Iraq, with the IRGC conducting a drone strike on a Komala facility near Erbil on October 24. Maritime incidents persisted near the Strait of Hormuz, including a UKMTO report of a vessel on fire north of Khasab, Oman on October 29. The IRGC Navy separately claimed to have electronically seized and landed a US drone west of the strait, although that claim remains unverified.
In the cyber domain, researchers from TrendAI, Citizen Lab, and Confiant identified additional surveillance activity involving Israeli advertising technology firm Discover-Tech. The company reportedly bid on advertising traffic associated with Starlink users in more than 100 countries, enabling potential identification and geolocation of individuals in conflict-affected regions. Google and Comcast subsequently removed the firm from their advertising platforms.
Kinetic & Maritime Risk
The resumption of international flights at King Khalid International Airport does not eliminate the risk of further disruption. Ansarallah has continued to designate the airport as a military target, while missile interceptions have created additional hazards for surrounding communities. In Khamis Mushait and Ahad Rafidah, falling debris injured two people and damaged residential buildings and vehicles. Similar debris was reported across parts of western Saudi Arabia, including areas around Jeddah, Taif, and Rabigh.
In Yemen, Houthi advances along the Jabal Sabr front have brought fighting closer to government-held positions overlooking Taiz, including areas near Taiz University. The expanding offensive threatens access routes around a city where the UN has warned that approximately 800,000 people urgently need humanitarian assistance. Continued operations in Lahj and attacks toward Aden add further uncertainty for transport and government facilities in southern Yemen.
Western-linked personnel and facilities face increased exposure following Iranian threats against American diplomats. The US drawdown extends beyond Saudi Arabia, with similar precautionary measures reported at diplomatic missions in the UAE, Lebanon, Qatar, Jordan, Bahrain, and Kuwait. Iranian allegations that US aircraft are operating from Gulf states could also increase the risk of Tehran identifying host-nation military facilities as potential targets in a renewed confrontation.
At sea, the reported incidents near Khasab and Iraq’s Al-Faw port highlight risks across both the Strait of Hormuz approaches and the northern Gulf. The reporting identifies 113 maritime attacks in and around the Strait of Hormuz since February 28, underscoring the sustained exposure of commercial vessels operating through the region.
Cyber and Hybrid Risk
The latest Discover-Tech findings raise particular concerns about the information exposed through real-time advertising auctions. Researchers found that the firm could use advertising bid requests to identify and geolocate Starlink users, with activity concentrated in countries affected by conflict or political instability. This creates potential surveillance exposure for personnel relying on satellite internet services in areas where other communications infrastructure may be limited or disrupted.
The research also builds on earlier findings connecting Discover-Tech to the delivery of Candiru spyware through online advertisements. Although advertising-based tracking does not itself establish that a device was compromised, the ability to identify and locate specific users could support subsequent targeting. Google and Comcast’s removal of Discover-Tech from their advertising platforms represents a response to the reported activity.
Separately, the IRGC Navy’s claimed electronic takeover of a US drone near the Strait of Hormuz remains unverified. If substantiated, the incident would indicate an electronic warfare capability relevant to unmanned aircraft operating near Iranian-controlled waters. Iran’s announcement of arrests involving alleged US- and Israel-linked intelligence cells also reflects its continued focus on identifying suspected foreign intelligence activity, although the alleged affiliations have not been independently established.
Recommended Risk Posture and Protective Controls
Organizations with personnel, facilities, or operations exposed to the conflict should maintain heightened awareness of physical security, travel, maritime, and surveillance risks.
Cyber Defense
Limit advertising-based tracking: Organizations with personnel using Starlink or other satellite internet services in conflict zones should review network- and browser-level ad blocking, restrict advertising identifiers on managed devices, and assess exposure of location and device data through advertising systems.
Review counterintelligence exposure: Organizations with personnel or partners traveling to Iran should limit the sensitive information carried on devices, review communications practices, and reinforce check-in procedures in light of recent arrests of alleged foreign-linked cells.
Physical and Operational Defense
Strengthen protections for US-linked personnel: Organizations supporting diplomatic missions or employing current and former US government officials should review travel, residence, and event security in response to reported Iranian threats.
Reassess Saudi Arabia travel and facility plans: Confirm flight status before travel, review shelter procedures, and account for the risks associated with missile interception debris, particularly in Riyadh, Jeddah, Dhahran, and southern Saudi Arabia.
Maintain heightened maritime security: Shipping operators should monitor UKMTO advisories, review transit risks near Khasab and Al-Faw, and reinforce crew readiness for fires and other onboard emergencies.
Review exposure near Erbil: Organizations operating in Iraq’s Kurdistan region should assess proximity to Iranian Kurdish opposition facilities and update shelter and personnel-accountability procedures following repeated IRGC strikes.
Strategic Outlook: Operational Forecast
Over the next 48–72 hours, Houthi forces are likely to sustain missile and drone attacks against Saudi aviation, energy, and military infrastructure while continuing operations around Taiz, Lahj, and Aden. The resumption of international flights at King Khalid International Airport does not eliminate the threat of renewed disruption, particularly given Ansarallah’s continued designation of the airport as a target. Saudi-led coalition strikes in northern Yemen are also likely to continue.
The US diplomatic drawdown reflects heightened concern about threats to American personnel, while reported planning for additional US strikes against Iran introduces uncertainty ahead of the November 3 midterm elections. Iranian Foreign Minister Abbas Araghchi’s statements about continued diplomatic contacts suggest negotiations remain possible, although no breakthrough has been reported.
Maritime incidents near the Strait of Hormuz and northern Gulf are likely to persist, with additional uncertainty surrounding the IRGC’s claims of electronic warfare operations against US aircraft. Iranian strikes against Kurdish opposition positions near Erbil may also continue, alongside further counterintelligence arrests and public accusations of foreign involvement.
In the cyber domain, the latest Discover-Tech findings may prompt additional scrutiny of advertising-based surveillance and the exposure of satellite internet users in conflict-affected regions.
Enhance Threat Intelligence Using Flashpoint
As the conflict continues to affect military operations, commercial shipping, regional infrastructure, and digital communications, security teams need timely intelligence to assess emerging risks and protect their organizations.
Flashpoint combines primary-source monitoring, open-source intelligence, and geospatial analysis to help organizations identify developing threats, assess operational exposure, and make informed security decisions.
Request a demo to learn how Flashpoint supports physical security intelligence, threat monitoring, and operational risk assessment.
Frequently Asked Questions (FAQs)
What is the Flashpoint Physical Threat Intelligence Brief?
The Flashpoint Physical Threat Intelligence Brief: Middle East is a recurring threat intelligence update that translates raw primary-source open-source intelligence (OSINT) and geospatial data into actionable physical security analysis. It focuses on kinetic conflict developments, standoff weapon capabilities, maritime corridor security, and critical infrastructure risks across the Middle East.
How does Flashpoint gather physical security intelligence for the Middle East?
Flashpoint Physical Security Intelligence (PSI) gathers data by combining global open-source intelligence (OSINT), geolocated social media signals, satellite imagery, and primary-source threat monitoring. The platform uses AI-driven natural language processing and geospatial mapping to track kinetic developments, weapon strike radiuses, and physical security threats in real time.
The Binance hack drained an estimated $6.3 billion from the exchange’s hot wallets across roughly 10 blockchains on the evening of October 29, 2026. The Binance hack is a hot wallet compromise in which an attacker made Binance’s own withdrawal infrastructure sign and send funds to attacker-controlled addresses, mostly within about 20 minutes.
Binance has confirmed the incident, and the evidence points to a serious, well-resourced operation: staged in advance, executed across chains at once, and built to get unauthorized transactions through the controls meant to stop them. About $3 billion has been blocked through on-chain freezes, and Binance has committed to paying for the rest.
Key Takeaways
Record loss: Binance estimates the impact of the October 29, 2026 hot wallet theft at around $6.3 billion, about four times the $1.5 billion Bybit theft and the largest crypto heist on record
Highly prepared operation: The attacker drained about 10 blockchains in roughly 20 minutes, with withdrawals pushed through Binance’s own signing path as if they were legitimate
Entry point: Binance first linked the breach to a compromised DevOps engineer’s laptop, then said its investigation uncovered additional points of breach in what it calls a complex attack
Half contained: About $3 billion is frozen on-chain, and Binance has reserved more than $6.34 billion in company funds to cover losses
Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution
Binance Hack at a Glance
Incident
Unauthorized hot wallet withdrawals at Binance
Date
October 29, 2026, starting around 20:05 UTC
Estimated Loss
Around $6.3 billion (Binance estimate); independent estimates range from $6.36 billion to $6.4 billion
Blockchains Affected
About 10, including Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon
Initial Access (Preliminary)
Compromised DevOps engineer laptop plus additional points of breach (Binance, October 30, 2026); full root cause not yet published
Private Key Exposure
No evidence found (Binance)
Frozen So Far
About $3 billion on-chain (Binance)
Loss Coverage
More than $6.34 billion in company funds reserved; about $5 billion already held in the stolen token types
Attribution
Assessed by blockchain analysts as TraderTraitor (North Korea); not confirmed by Binance or governments
Service Status
Withdrawals paused while the service is rebuilt and retested; Binance expects them back before Sunday, November 1, 2026; deposits unaffected
Binance Hack Timeline
October 30, 2026 Binance
Binance reserves $6.34 billion and targets Proof of Reserves by Monday
Binance says it has reserved more than $6.34 billion in company funds, about $5 billion of it already held in the stolen token types, and is buying the rest through market and OTC channels. Co-CEO Richard Teng says the attack was not carried out by one person, the attacker used a self-destruct mechanism to wipe tooling and traces, and a full Proof of Reserves report is planned for Monday.
October 30, 2026, 08:47 UTC Binance
Binance finds additional points of breach
Binance says its investigation has uncovered additional points of breach beyond the compromised laptop identified earlier, calling it a complex attack. The outflows stopped when withdrawals were paused, about $3 billion is frozen, and withdrawals remain on track to resume in about 45 hours. Deposits are unaffected.
October 30, 2026, 04:17 UTC Status
Withdrawals expected to resume within 48 hours
Binance co-CEO Yi He says withdrawals remain paused while the team improves controls on the withdrawal service and related addresses, and should begin resuming within 48 hours. Deposits are operating normally.
October 30, 2026, early morning UTC Attribution
Second firm links the theft to TraderTraitor and a possible Bitget connection emerges
Attribution: A second blockchain analytics firm says North Korea’s TraderTraitor likely carried out the hack and raises its loss estimate to about $6.4 billion
Bitget link: An independent investigator finds that funds from the Binance hack and the September 2026 Bitget exploit were mixed at the same address after passing through THORChain
October 30, 2026, 02:23 UTC Binance
Binance publishes its Security Incident Update
Binance’s initial investigation suggests a compromised DevOps engineer’s laptop gave the attacker access to a service container that submitted unauthorized withdrawals. Binance says it found no evidence of a wallet private key leak, estimates the impact at around $6.3 billion with about $3 billion frozen on-chain, and will cover all losses from SAFU and company funds.
October 30, 2026, 00:30 UTC Attribution
Blockchain analysts attribute the theft to TraderTraitor
Blockchain analysts attribute the theft with high confidence to North Korea’s TraderTraitor and value the stolen assets at $6.36 billion. As of 00:30 UTC, about $2.4 billion remains under attacker control, mostly more than 420,000 ETH and 18,270 BTC. Binance and government agencies have not confirmed the attribution.
October 30, 2026, 00:08 UTC Response
Arbitrum Security Council moves funds out of an attacker wallet
The council forces 8,426 ETH and 74.6 million ARB, worth about $30 million, out of the attacker’s Arbitrum wallet.
October 29, 2026, 23:05 UTC Attack
Second wave hits Avalanche and Polygon
Binance wallets on Avalanche and Polygon send out funds in a second wave, and smaller sweeps continue until about 23:56 UTC.
October 29, 2026, about 22:30 UTC Binance
Binance confirms a security incident and pauses withdrawals
Binance suspends withdrawals on multiple networks as a precaution, says user funds are safe, and warns users not to trust unofficial links or messages about the incident.
October 29, 2026, 22:01 to 22:26 UTC Response
Ripple and World Liberty Financial freeze stablecoins
Ripple freezes the RLUSD the attacker had not yet sold, and World Liberty Financial freezes 27.8 million USD1 in the attacker’s main receiving wallet.
October 29, 2026, 21:01 to 21:04 UTC Response
Tether and Circle freeze about $1.8 billion
Within about 40 minutes of the main Ethereum sweep, Tether freezes 971.1 million USDT in the attacker’s main receiving wallet and Circle freezes 823 million USDC, in coordination with law enforcement.
October 29, 2026, 20:20 to 20:24 UTC Attack
Ethereum hot wallet emptied in under four minutes
EIP-7702 sweep: One transaction carries 50 authorizations signed by a Binance Ethereum hot wallet, each pointing to an attacker-controlled sweeper contract
Main drain: About three and a half minutes later, 167,464 ETH and 1.615 billion USDT leave the wallet
Other chains: 18,270 BTC and 612.7 million USDT on Tron leave Binance in the same window
October 29, 2026, 20:05 UTC Attack
Multi-chain drain begins
Five Binance wallets send 233.46 million XRP to a single attacker address. Within roughly 20 minutes, Binance wallets on about 10 blockchains have sent funds out.
October 28, 2026 Staging
Attacker prepares an operator wallet
A fresh operator wallet starts receiving small Tornado Cash withdrawals on the morning of October 28, and the attack code is deployed and tested early on October 29.
What Happened in the Binance Hack?
Attackers pushed unauthorized withdrawal transactions through Binance’s hot wallet infrastructure on October 29, 2026, moving an estimated $6.3 billion in crypto to attacker-controlled wallets. The outflows hit about 10 blockchains at once. Binance confirmed a security incident, suspended withdrawals, and revoked authorization for the affected address.
What Did Binance Say in Its Official Statement?
Binance published a Security Incident Update on October 30, 2026, laying out its preliminary findings and response. The key points:
Initial finding: The initial investigation suggests the incident may involve a compromised DevOps engineer’s laptop, which let the attacker reach a service container and submit unauthorized withdrawal transactions
Keys: Binance has found no evidence of any wallet private key leak
Impact: The estimated total impact is around $6.3 billion, with about $3 billion frozen on-chain through blockchain partners
Coverage: Binance will cover all losses from the SAFU fund and company funds, and says user funds are safe
Containment: Binance suspended deposits and withdrawals during security checks and revoked the affected address authorization
Next steps: Law enforcement and blockchain intelligence partners are engaged, and Binance will publish a technical post-mortem and an updated Proof of Reserves
In an October 30 update at 08:47 UTC, Binance said its investigation had identified additional points of breach beyond the laptop, indicating a more complex attack. The exchange confirmed that outflows stopped after withdrawals were suspended, approximately $3 billion remains frozen, and asset recovery for affected users is underway. Binance is also cooperating with law enforcement. In a video statement, co-CEO Richard Teng said the attack “was not carried out by one person.”
How Did Attackers Get Into Binance’s Systems?
Binance first traced the breach to a compromised DevOps engineer’s laptop, which gave the attacker access to a service container that could submit withdrawal transactions. The company adds that the compromised computer was only the first stage, and that its investigation has not assigned responsibility to any individual employee. Its latest update goes further: the investigation has uncovered additional points of breach, which Binance describes as part of a complex attack.
As of October 30, 2026, Binance has not said what the additional points of breach are or published a full root cause.
How Sophisticated Was the Binance Attack?
The on-chain evidence points to a carefully engineered operation. Blockchain tracing shows the attacker funded an operator wallet on October 28, then deployed and tested code early on October 29. When the theft began, Binance wallets on about 10 chains sent funds out within roughly 20 minutes.
The withdrawals carried valid signatures from Binance’s own hot wallet infrastructure, so the approval path that should have blocked them signed them instead. Analysts assess that the attacker gained the ability to make Binance’s signing system approve transactions of its choosing across chains. Binance itself now describes the incident as a complex attack involving more than one point of breach. Co-CEO Richard Teng added that the attacker used a self-destruct mechanism that destroyed tooling and traces along the way, making the investigation harder.
How Much Crypto Was Stolen From Binance?
Binance puts the total impact at around $6.3 billion. Independent tracing values the stolen assets at $6.36 billion at the moment they were taken, and another analytics firm raised its estimate to about $6.4 billion on October 30. The gap reflects different pricing snapshots and timing.
Estimated value of assets taken from Binance by blockchain at the time of theft, with Binance’s impact and freeze estimates.
When Did the Binance Hack Happen?
The first unauthorized transfers began around 20:05 UTC on October 29, 2026, when five Binance wallets sent XRP to a single attacker address. Bitcoin, Tron, Solana and Ethereum outflows followed within roughly 20 minutes. A second wave hit Avalanche and Polygon around 23:05 UTC, and smaller sweeps continued until about 23:56 UTC.
Short timeline of Binance’s hack, from attacker staging on October 28 to Binance’s service update on October 30, 2026.
What Role Did EIP-7702 Play in the Ethereum Drain?
EIP-7702, an Ethereum feature that lets a regular account delegate its behavior to smart contract code, was used to empty one of Binance’s Ethereum hot wallets. The attacker submitted a single transaction carrying 50 authorizations signed by that wallet, each pointing to an attacker-controlled sweeper contract.
The 50 authorizations covered consecutive nonces, guaranteeing one would be valid at execution time. About three and a half minutes later, the wallet’s full balance, including 167,464 ETH and 1.615 billion USDT, moved to the attacker. EIP-7702 only provided the sweep mechanism; the authorizations still carried the hot wallet’s signature. Binance says the delegation did not pass through its normal approval controls.
Were Binance Private Keys Leaked?
Binance says it has found no evidence of any wallet private key leak. The on-chain pattern is consistent with that: apart from the EIP-7702 sweep, funds on Ethereum and the other chains left through ordinary signed transfers. That pattern fits an attacker who controlled what the signing system approved, rather than one holding stolen keys.
Who Is Behind the Binance Hack?
Blockchain analysts attribute the theft with high confidence to TraderTraitor, a North Korean state-backed cluster often grouped under the Lazarus umbrella. Their assessment cites on-chain and off-chain intelligence and overlaps with earlier thefts, including small Tornado Cash withdrawals for staging and signatures obtained in advance. A second analytics firm says TraderTraitor likely carried it out.
Other investigators are more cautious. One person familiar with crypto investigations told reporters the theft is not yet definitively attributed. As of October 30, 2026, neither Binance nor any government agency has publicly named the attackers.
Is the Binance Hack Linked to the Bitget Hack?
Possibly. An independent on-chain investigator found that funds from the Binance hack and from the September 2026 Bitget exploit were commingled at the same address after passing through THORChain, and said the same actor is likely behind both. Bitget had already said it suspected North Korean attackers in its roughly $387 million loss. Neither exchange has confirmed a shared attacker.
How Much of the Stolen Crypto Has Been Frozen?
Binance reports about $3 billion frozen on-chain as of October 30, 2026, close to half of the estimated loss. Stablecoin issuers did most of the work because they can blacklist addresses holding their tokens, and the first large freezes landed within about 40 minutes of the main Ethereum sweep.
Tether: Froze more than $1.567 billion in USDT tied to the theft
Circle: Froze more than $800 million in USDC, in coordination with law enforcement
Other issuers and protocols: Ripple froze RLUSD, World Liberty Financial froze USD1, First Digital froze FDUSD, and Aave froze affected lending markets
Arbitrum Security Council: Forced about $30 million in ETH and ARB out of an attacker wallet
Where Is the Rest of the Stolen Money Going?
Roughly $2.4 billion remained under attacker control as of 00:30 UTC on October 30, 2026, mostly more than 420,000 ETH and 18,270 BTC. The bitcoin is moving through a peel chain that splits it into 1,000 BTC and 100 BTC pieces.
The cash-out moved fast, and the attacker accepted heavy losses to stay ahead of the freezes:
Discounted swaps: About 325 million USDT went to market makers through UniswapX and other intent-based contracts for roughly 122,300 ETH, an implied price near $2,650 per ETH while ether traded around $2,300 to $2,350, a discount of more than 10%
DeFi borrowing: A second wallet supplied 60 million USDT to Aave and borrowed about 19,760 ETH before Aave froze the affected markets
Tron routing: 300 million USDT moved to a wallet supplying JustLend, while another 200 million USDT passed through hop wallets to Uniswap, where 30 million was frozen
Stablecoin dumping: About 48 million RLUSD was sold on decentralized exchanges between 21:42 and 22:01 UTC, until Ripple froze the remaining 40.5 million
Later reporting shows some funds moving through THORChain, a cross-chain swap protocol, an early sign of the cross-chain laundering stage seen after earlier North Korea-linked thefts.
Are Binance User Funds Safe?
Binance says user funds are safe and that it will cover all losses from its Secure Asset Fund for Users (SAFU) and company funds. With about $3 billion frozen, that commitment means Binance absorbs the unfrozen remainder itself. The stolen assets came from Binance’s hot wallets, and an updated Proof of Reserves will follow remediation.
More than $6.34 billion in company funds were reserved to cover the losses. About $5 billion of that is already held in the same token types that were stolen, such as USDT, USDC, BTC, ETH and BNB, and Binance is buying the rest through market and OTC channels, which may take longer for low-liquidity tokens. The reserve excludes the roughly $3 billion in frozen assets, which remain subject to recovery. Teng said Binance never uses customer funds, and that most user assets sit in cold wallets and move to a hot wallet only when a user withdraws. A full Proof of Reserves report is targeted for Monday, November 2, 2026.
The SAFU fund was created in 2018 to protect users in extreme cases and reportedly holds about $1 billion in bitcoin, so it cannot absorb a loss of this size alone; Binance says company funds will cover the rest. SAFU last covered a major theft in May 2019, when attackers stole 7,000 BTC from Binance.
Can I Withdraw From Binance Right Now?
Not yet. As of October 30, 2026, Binance withdrawals remain paused while the team rebuilds and retests the withdrawal service, and Binance says it will not switch it back on until it passes rigorous testing. Co-CEO Yi He first said withdrawals should resume within 48 hours, and in a later video statement, co-CEO Richard Teng said users should be able to withdraw before Binance’s Sunday, November 1 deadline, which he put at within 40 hours. Deposits are unaffected.
Rebuilding withdrawals: The withdrawal service is being rebuilt and will stay off until it passes rigorous testing
Company-wide security review: Endpoints, cloud, key management and signing are all under review
Covering the shortfall: Binance is completing its token purchases and will verify holdings through Proof of Reserves
Tracing funds: Binance is working with law enforcement, blockchain intelligence firms, token issuers and other exchanges to trace and recover stolen assets
Was Binance.US Affected?
Binance.US was not affected, as live incident coverage of the exchange’s statements noted. Binance.US runs as a separate platform, and the unauthorized withdrawals came from Binance’s global hot wallets. Customers of either platform should treat unsolicited messages that reference the hack with suspicion, since attackers often use major incidents as phishing bait.
How Did the Crypto Market React to the Binance Hack?
Prices fell as news of the theft spread. Bitcoin slid below $77,000, BNB dropped about 7% and ether lost about 5% over 24 hours. Leveraged traders took the brunt, with about $1.55 billion in liquidations over the same period, $1.34 billion of them long positions.
The estimated loss equals roughly 4% of the about $144 billion in assets Binance held before the hack. Market makers Wintermute and GSR disclosed exposure to Binance of less than 20% and less than 5% of net equity, respectively, while Coinbase said it is blocking transfers to compromised wallets.
How Does the Binance Hack Compare to the Bybit Hack?
The Binance hack is about four times the size of the $1.5 billion Bybit theft in February 2025, which the FBI attributed to TraderTraitor. Both began with a compromised developer machine: in Bybit’s case, one belonging to its wallet provider Safe{Wallet}. In both, legitimate signing systems ended up approving the attacker’s transactions.
What Indicators Should Defenders and Exchanges Track?
Binance has not published indicators of compromise, so the indicators below come from public on-chain analysis and explorer labels. Exchanges, bridges and DeFi protocols can screen deposits against these addresses, and wallet operators can watch for the transaction pattern behind the Ethereum drain.
Type
Indicator
Context
Ethereum address (attacker)
0x8532FA14ACAf483729C449b8458aedDb900543D4
Received about 195,460 ETH from the main receiving wallet at 20:38 UTC on October 29, 2026; labeled Binance Hot Wallet Exploiter 8 on Etherscan
Ethereum address (attacker, frozen)
0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c
Main receiving wallet funded by the Binance 14 hot wallet; holds 971.1M USDT and 823M USDC frozen by Tether and Circle
Transaction pattern
EIP-7702 (type-4) transaction carrying 50 authorizations across consecutive nonces
Delegated a Binance Ethereum hot wallet to an attacker-controlled sweeper contract at 20:20 UTC
Funding pattern
Small Tornado Cash withdrawals into a fresh operator wallet
Staging that began on the morning of October 28, 2026
Recommendations for Exchanges, Custodians and Crypto Users
Engineer and DevOps endpoints are now a direct path to hot wallet funds. TraderTraitor has a long record of targeting crypto staff, including DevOps personnel, with social engineering such as fake job offers carrying trojanized applications. The priorities below aim to make sure a single compromised laptop can never reach a service that submits withdrawals.
Isolate signing paths: Separate hot wallet signing infrastructure by chain and wallet tier so one foothold cannot drain every network
Harden privileged endpoints: Treat DevOps and engineering laptops as tier-zero assets with strict device posture checks, phishing-resistant MFA and short-lived credentials for production access
Restrict EIP-7702 use: Configure signers to reject unexpected EIP-7702 authorizations, and alert on batches of authorizations spanning a range of nonces
Add withdrawal circuit breakers: Enforce velocity limits and anomaly-based holds on hot wallet outflows, especially simultaneous drains across chains
Screen counterparties: Exchanges, market makers and DeFi protocols should screen deposits and fills against addresses labeled as linked to the Binance theft
Train for recruiter lures: Brief staff on fake job offers, coding tests and trojanized tools, which North Korean operators favor for initial access
Watch for scams: Users should rely only on official Binance channels and ignore messages offering refunds, “recovery” services or account verification links
How SOCRadar Supports Crypto Platform Defense
Thefts like this one typically begin before any funds move, with targeted lures, stolen sessions and reconnaissance on staff. SOCRadar helps crypto platforms catch those early signals:
Cyber Threat Intelligence: Tracks North Korea-linked activity such as TraderTraitor’s tooling and lure themes, so teams can tune detections early
Dark Web Monitoring: Alerts when employee credentials or session data from infostealer logs surface in underground markets, a common precursor to privileged access
Brand Protection: Spots fake recovery sites and impersonation domains that appear after high-profile incidents and target worried users
Combined with internal telemetry and strict signing controls, these signals give exchanges and custodians more time to act before an attacker reaches the systems that can move funds.
La Caisse Nationale d’Assurance Sociale (CNAS) a signalé des perturbations temporaires de ses services électroniques suite à une cyberattaque sur ses systèmes d’information. L’institution conseille aux utilisateurs de faire preuve de vigilance, de ne pas fournir de données personnelles par téléphone ou message, et de n’utiliser que le site web officiel (www.cnas.gov.md).
Victim: Caisse Nationale d’Assurance Sociale (CNAS)
The abuse of legitimate, vulnerable drivers remains a persistent method of evading endpoint security controls. As EDR killer techniques become publicly available, researchers and threat actors alike are examining how weaknesses in driver access controls can be exploited to terminate protected security processes.
An older Microsoft Defender driver, dating back to 2011, can still be loaded on the latest version of Windows 11 and abused to terminate security software. The technique, publicly demonstrated through an open-source proof of concept (POC) called DefenderKiller, exploits weaknesses in how the driver restricts access to its process termination functionality.
Flashpoint analysts have identified 13 publicly available samples incorporating the DefenderKiller technique, including obfuscated variants that indicate modifications to the original POC.
DefenderKiller Exploits a Legacy Microsoft Driver
On June 29, 2026, security researcher Jehad Abudagga, also known as redteamfortress, published research demonstrating how an older Microsoft driver could be abused to terminate security software. The researcher subsequently released the DefenderKiller POC on GitHub. The technique targets KSLDriver.sys, version 1.1.0013.0, a driver associated with Microsoft’s malware protection infrastructure. Although its digital signature dates to 2011, the driver remains accepted by Windows’ driver verification mechanisms and can load into the kernel on the latest version of Windows 11.
KSLDriver includes access controls intended to restrict which processes can communicate with it. When loaded, the driver retrieves an AllowedProcessName value from its service registry configuration and applies restrictions limiting access to SYSTEM and administrator accounts. When a user-mode process attempts to communicate with the driver, its process image path is compared against the configured registry value. If the values match, the driver accepts input/output control (IOCTL) requests.
DefenderKiller exploits this mechanism by configuring the driver’s service and authorized process path before starting the driver. Once authorized, the requesting process can invoke functionality that accepts a target process identifier (PID), obtains the corresponding kernel process object, and terminates the process using ZwTerminateProcess(). This allows a sufficiently privileged attacker to leverage the legitimate driver to terminate security processes.
Source code of the user-mode application performing the registry bypass before starting the driver. (Source: Flashpoint)
Following publication of the original POC, Flashpoint analysts identified 13 publicly available samples incorporating the DefenderKiller technique, including obfuscated versions. These findings indicate that the original code has been modified, although the available evidence does not establish whether the samples have been deployed in confirmed intrusions.
Implications for Endpoint Security
The findings illustrate how Bring Your Own Vulnerable Driver (BYOVD) techniques can exploit legitimate, digitally signed drivers to interfere with endpoint security. KSLDriver relies on process authorization checks that can be bypassed through manipulation of registry-controlled information, while remaining loadable on the latest version of Windows 11.
Flashpoint analysts assess that advances in large language models may be contributing to growing interest in BYOVD research and EDR killer development by making user-mode and kernel-mode code development more accessible. Exploitation generally requires administrative privileges to create the services necessary to load these drivers, although attackers may obtain these privileges through local privilege escalation.
Security teams should consider monitoring for unexpected kernel driver installations, changes to driver service configurations, and termination of security processes following driver loading. In particular, modifications to registry values such as AllowedProcessName and ImagePath may provide useful investigative context when correlated with suspicious service creation or driver activity.
Indicators of Compromise and Technical Artifacts
The following artifacts were identified during Flashpoint’s analysis and may support threat hunting and further investigation.
The presence of these artifacts should be evaluated in context, as legitimate software may use some of these components.
Stay Ahead of EDR Evasion Techniques With Flashpoint
The discovery of vulnerable drivers beyond those targeted by publicly available EDR killers highlights the need for continued research into the techniques used to disable endpoint defenses. The public release of DefenderKiller, along with the emergence of modified variants, highlights the need for continued visibility into defense evasion techniques and the vulnerable drivers that enable them.
Flashpoint continuously monitors emerging threats and adversary techniques, combining primary source intelligence with technical research to help organizations understand how threats are evolving. Request a demo to learn how Flashpoint can help your team identify emerging threats and strengthen its defenses.
Data Exposure Report Argentina Government Student & Education Data Leak Claim Unverified
Buenos Aires Student Database Leak Claim Lists 1.7 Million Enrollment Records
Claimed records1.7M
Academic year2025
RegionBuenos Aires
Data typeStudent enrollment
Severity HIGH
Overview
An actor using the handle “dmitryy” claims to have released a database called ALUMNOS GBA, described as a structured dataset containing student enrollment information from the Province of Buenos Aires, Argentina, for the 2025 academic year.
The post advertises approximately 1.7 million records and says the dataset centralizes enrollment and school records from multiple educational institutions. The visible columns include DNI, CUIT, sex, first name, last name, date of birth, academic year, education level, school name, institution type, address and CUE. The dataset, its source, the claimed volume and current availability have not been independently verified.
Post details
OrganizationGovernment of the Province of Buenos Aires
CountryArgentina
SectorGovernment / education
Actor“dmitryy”
Dataset nameALUMNOS GBA
Claimed volumeApproximately 1.7 million records
Academic year2025
Post date shown
What the post claims
Approximately 1.7 million student records
2025 academic-year data
DNI field included
CUIT field included
Sex field included
First-name and last-name fields included
Date-of-birth field included
Academic-year field included
Education-level field included
School-name field included
Institution-type field included
School-address field included
CUE institution code included
Sample rows displayed
The visible sample contains student identity information and school-enrollment details. Individual student names, DNI/CUIT values, dates of birth, school names and addresses shown in the screenshot are not transcribed in this report.
The supplied capture shows the ALUMNOS GBA claim, the Province of Buenos Aires branding, the advertised student-enrollment columns and sample rows containing identity and school information. Personal student data from the sample is not repeated here.
IOCs & identifiers
Identifiers directly visible in the supplied material. These support correlation and do not independently verify the dataset claim.
Type
Identifier
Source
Actor handle
dmitryy
Screenshot 1
Group
PampaLeaks
Screenshot 1
Named organization
Gobierno de la Provincia de Buenos Aires
Screenshot 1
The screenshot references PampaLeaks as a Telegram group and lists several member handles. Those names are not expanded here because they are not necessary to describe the exposed student dataset. No malware hash, Tox ID, Session ID, attacker-controlled domain or attacker-controlled IP address is visible in the supplied material.
Mapped techniques
Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.
Collection T1213.006 Data from Information Repositories: Databases Inferred The listing presents a structured student-enrollment database containing identity and school information. The supplied material does not disclose how the data was obtained or independently establish unauthorized access to Buenos Aires government systems.
Potential impact
If authentic, the claimed dataset could expose student names, national identifiers, dates of birth, sex, education level, school names and school addresses at very large scale. Because the sample visibly includes school-age students, the exposure could create heightened risks of identity fraud, targeted phishing, impersonation, harassment or other privacy-related abuse.
Status Unverified
Dark Web Informer has not independently verified the dataset’s authenticity, source, completeness, approximate 1.7 million-record count, sample contents or current availability. The supplied screenshot documents the listing and visible sample rows, not independent confirmation of the underlying database.
Want everything on this threat? Paid subscribers get the full unredacted claim details and more. After subscribing, check out the threat feed and search there for this alert.
Data Exposure Report Egypt B2B Commerce User & Phone Data Free Leak Unverified
Capiter Data Leak Claim Exposes 208,206 User Accounts and Phone Numbers
Claimed accounts208,206
Phone numbers208K+
Uncompressed size150 MB
Compressed size34 MB
Severity HIGH
Overview
An actor using the handle “GoreTerminal” claims to have leaked a Capiter dataset containing approximately 208,206 user accounts. The post describes Capiter as an Egyptian B2B startup founded in Cairo that permanently shut down in 2023.
The actor states the breach occurred on October 28, 2026 at 10:11 AM EDT and characterizes the release as a leak rather than a ransom event. The archive is described as JSON Lines, with an uncompressed file named CAPITER_UNIQUE.JSONL at 150 MB and a compressed archive at 34 MB. The visible schema includes phone numbers, international phone numbers, customer IDs, country, carrier, city, district, area, order and product metadata, payment type, inventory data and profile timestamps. The dataset, its source, the stated counts and current availability have not been independently verified.
Post details
OrganizationCapiter
CountryEgypt
SectorB2B commerce / distribution technology
Actor“GoreTerminal”
Claimed accountsApproximately 208,206
FormatJSON Lines
Archive sizes150 MB raw / 34 MB compressed
Claimed breach timeOct 28, 2026 at 10:11 AM EDT
What the post claims
Approximately 208,206 user accounts
208K+ phone numbers
JSON Lines format
150 MB uncompressed file
34 MB compressed archive
Phone and international-phone fields included
Customer IDs included
Country and carrier fields included
City, district and area fields included
Order IDs and order-position fields included
Order-status fields included
Product IDs, ranks and categories included
Inventory-related fields included
Payment-type fields included
Offer and retry-count fields included
Profile-created timestamps included
Sample records displayed
Free download advertised
The sample shown in the source material contains structured customer and transaction-related records. Individual phone numbers, customer identifiers and other personal values visible in the sample are not transcribed in this report.
The supplied captures show the Capiter leak claim, the stated breach time, user-account and phone-number scope, JSONL archive sizes, schema fields, sample records and a free-download section. Direct download access is not reproduced here.
IOCs & identifiers
Identifiers directly visible or supported by the supplied material. These support correlation and do not independently verify the breach claim.
Type
Identifier
Source
Actor handle
GoreTerminal
Screenshots 1–2
Named organization
Capiter
Screenshots 1–2
No organization domain, malware hash, Tox ID, Session ID, Telegram handle or attacker-controlled IP address is visible in the supplied screenshots. Personal identifiers shown in the sample are not included in this table.
Mapped techniques
Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.
Collection T1213.006 Data from Information Repositories: Databases Inferred The listing presents a structured JSONL dataset containing customer, phone, order and product-related fields. The supplied material does not disclose how the data was obtained or independently establish unauthorized access to Capiter systems.
Potential impact
If authentic, the claimed dataset could expose mobile phone numbers, customer identifiers, location information and transaction-related metadata for more than 200,000 accounts. The combination could support targeted phishing, SMS abuse, impersonation, profiling or other customer-focused social engineering.
Status Unverified
Dark Web Informer has not independently verified the dataset’s authenticity, source, completeness, 208,206-account count, archive sizes, sample contents or the actor’s claimed October 28 breach time. The supplied screenshots document the listing and visible sample records, not independent confirmation of the underlying data.
Want everything on this threat? Paid subscribers get the full unredacted claim details and more. After subscribing, check out the threat feed and search there for this alert.
Table Of Contents
Argentina
Egypt
