hackers

According to a report by the Korean News Agency, the Financial Security Institute (FSI), a financial security agency under the Financial Services Commission of South Korea, was hacked, resulting in the leakage of hundreds of pieces of information, including about 300 personal information records of employees from financial institutions.

According to on-chain analyst Yu Jin's monitoring, the Pando Rings hacker (0x303...3d9F) washed away 3,500 ETH through Tornado 5 minutes ago, worth 7.42 million dollars.

According to on-chain analyst Yu Jin's monitoring, the UXLINK hacker (0xde8d...9524) began to liquidate their long positions on Hyperliquid using the TWAP tool, involving 30,282 ETH, 550,000 SOL, and 35.03 million XRP, with a position value of approximately 148 million dollars.It is expected to be fully executed by around 6 AM tomorrow, with an anticipated loss of 3.3 million dollars after closing the positions.

Lookonchain monitoring states that in the past 20 hours, approximately 1670 ETH from Tornado Cash was transferred to Hyperliquid and sold, with about 2959 ZEC purchased.

According to the security organization SEAL, the North Korean-linked hacker group TraderTraitor, suspected of attacking Binance, may have been lurking in its environment for about 8 weeks before the theft occurred on October 29.SEAL stated that the timeline and details described in Binance's preliminary report align with the group's pattern of using fake companies and recruitment processes to carry out attacks. The security organization believes that the attackers' period of lurking in the target environment provided an opportunity for the enterprise to discover the intrusion.

According to the Nikkei, data from Chainalysis shows that in reported cryptocurrency theft incidents in 2026, 89% involved North Korean hackers, compared to 15% in 2021.The report states that North Korean hackers are increasingly using generative AI to create fake documents and impersonate technicians. The South Korean government estimates that more than 8,000 personnel are employed by North Korean authorities for this purpose.

The Indian Computer Emergency Response Team (CERT-In) issued a security advisory stating that the hacker group "Crafty Falcon" is utilizing publicly available artificial intelligence tools to conduct high-speed automated intrusions, having breached non-bank lending institutions, fintech companies, and cryptocurrency exchanges. The agency described the related threats as "ongoing and persistently active."The advisory specifically named four intrusion tools: ARTEX, PentAGI, Cairn, and CyberStrikeAI. Cybersecurity researchers indicated that at least two of these tools are associated with China. CrowdStrike previously stated that ARTEX, developed in China, has been used to attack South Korean banks since the end of September, and a hacker group linked to China has used this tool to target over 200 organizations in at least 14 countries. CERT-In did not specify the attackers or the operational location of the group, nor did it state that the attacks were state-sponsored or led; all of the aforementioned tools are available for free.

According to BeInCrypto, MicroStrategy Chairman Michael Saylor warned at the OranjeBTC summit that the new threat to the cryptocurrency industry after the Binance hacking incident is hackers utilizing AI, rather than flaws in Bitcoin itself. He stated that advanced AI models significantly enhance the capabilities of attackers, and the real threat comes from AI hackers launching attacks on new software that has not been adequately tested and was rushed to launch.He urged exchanges, banks, and custodians to scan their systems daily with cutting-edge AI models, stating that Bitcoin itself is robust, but poorly constructed digital business software is vulnerable to hacking. Saylor also pointed out that every new feature on Ethereum, Solana, or Cardano provides new entry points for attackers.

According to Lookonchain monitoring, a wallet suspected to be related to hackers that had been inactive for over 3 years (0xd175...CEC5) spent 4.16 million DAI to purchase 1734.1 ETH and deposited it into Tornado Cash.

The French mutual credit bank Akeia was attacked by hackers, and some of the stolen funds have been intercepted. The hackers transferred money through bank accounts and exchanged it for cryptocurrency, with the involved funds possibly exceeding 100 million euros. The Paris prosecutor's office has launched an investigation.

According to monitoring by Arkham, the Mercado Bitcoin hacker is swapping PENDLE for ETH through CowSwap and 1inch. In the past hour, this address has transferred over 760,000 PENDLE, worth approximately 1.3 million USD.As of now, the CowSwap and 1inch platforms have seemingly not taken effective measures to stop the related hacking activities, raising concerns in the community about DeFi protocols being used to handle and transfer stolen funds.

According to CoinDesk, the North Korean hacker group TraderTraitor is transferring the stolen funds from the $6.3 billion Binance hack through the decentralized cross-chain protocol THORChain, exchanging Ethereum for Bitcoin, which has driven the native token RUNE of THORChain to rise nearly 10% in the past 24 hours.The attackers first dispersed the stolen SOL across multiple wallets, exchanged it for USDC, and transferred it to the Ethereum network, then purchased ETH, and subsequently exchanged it for BTC through THORChain. Previously, the attackers had transferred some funds from the Tron network to THORChain. On-chain investigator SomaXBT estimates that as of November 1, the attackers have exchanged approximately $48.3 million through the protocol, ultimately receiving about $42.7 million, with fees and slippage losses of around 12%.The U.S. FBI has attributed the October 29 attack on Binance to TraderTraitor and has called on THORChain node operators and other crypto service providers to intercept related addresses and funds. Since BTC and ETH cannot be frozen by the issuer like USDT and USDC, cross-chain exchanges have increased the difficulty of recovering the stolen funds.Binance stated on Tuesday that it has frozen approximately $2.85 billion of the stolen funds and has covered about 98% of the affected tokens with company funds. On-chain analytics firm Elliptic believes that the stolen funds are currently still being transferred between different addresses and may not have been largely cashed out yet, with the attackers possibly planning to cash out in batches through over-the-counter trading channels.

According to monitoring by Lookonchain, the Mercado Bitcoin hacker has sold various altcoins including PEPE, AAVE, UNI, ONDO, and ENA, and has converted all the obtained assets into ETH. Currently, the hacker holds 7,988 ETH, worth approximately 18.19 million USD.

The founder of the cryptocurrency exchange BitMart, Sheldon Xia, announced the closure and is advancing the restructuring and liquidation process. He confirmed that BitMart also suffered a hacker attack yesterday, with a relatively small amount involved. The team has quickly launched an investigation and strengthened security defenses.Preliminary investigations indicate that yesterday's hacker attack may have been carried out by the same organization that attacked the Brazilian Bitcoin market Mercado Bitcoin yesterday.

According to PeckShieldAlert, the address marked as the BlueMove hacker has once again cross-chained 193,000 USDC from Ethereum to Hyperliquid and purchased 306.59 XMR at a price of $630.The address also cross-chained 200,000 USDC from Ethereum to Solana via Wormhole, and then transferred back to Ethereum through deBridge, depositing it into Railgun.

According to monitoring by Lookonchain, the Binance hacker is continuously exchanging SOL for BTC. They first distribute SOL to multiple wallets and sell it for USDC; then, they transfer USDC to the Ethereum network via a cross-chain bridge and buy ETH, and finally, they exchange ETH for BTC through THORChain.

According to The Block citing the Korean Central News Agency, Kim Yo-jong, the Minister of the Workers' Party of Korea, issued a second statement regarding the Binance hacking incident, stating that North Korea is willing to engage in dialogue, but this may not necessarily align with national interests.Kim Yo-jong is the sister of North Korean leader Kim Jong-un. She previously criticized the United States for blaming North Korea for the $6.3 billion Binance vulnerability incident.

On-chain analyst @FabianoSolana posted that suspected North Korean hackers transferred approximately $1.46 million through the Jupiter Lend and Circle cross-chain bridge. According to his analysis, the funds were initially transferred from a Solana wallet address marked by the FBI (starting with AffzFD), then dispersed to about 35 temporary addresses via intermediary wallets before being re-aggregated and deposited into Jupiter Lend. A few minutes later, a similar amount was withdrawn by another new wallet.Subsequently, the funds were exchanged for USDC and transferred out of Solana through the Circle cross-chain bridge, returning to a new address on the Solana network via Noble and dYdX. The related funds were transferred out in approximately 16 transactions totaling about $1.4634 million, and then returned in 19 transactions, with a difference of about $10 between the amounts transferred out and returned. According to the analyst, the related funds have not been frozen.In response, Jupiter's Chief Operating Officer Kash Dhanda stated that based on the current investigation results, the attackers only performed deposit and withdrawal operations through Jupiter Lend, which is different from the previous Aave incident where stolen stablecoins were borrowed and could not freeze the assets. The flow of related funds can still be fully tracked through LP tokens, and the relationship of the funds has not been severed, so it cannot be concluded that the attackers used Jupiter Lend to launder the source of the funds. The Jupiter security team has been monitoring the flow of related funds in real-time. As of the time of publication, Circle has not publicly responded to the reasons for the aforementioned fund transfer and why they have not been frozen.

The cryptocurrency exchange platform Binance released a preliminary investigation report on a security incident, disclosing the attack process in which approximately $6.3 billion in assets were stolen. The report states that an engineer, referred to as Little A, from the wallet operations team, searched for and installed an AI programming tool in June 2026, downloading a tampered Homebrew installation package from the search results. After the security team discovered the anomaly, they replaced the relevant equipment, but Little A still exposed the wallet infrastructure permissions.The report indicates that the attacker continued to lurk thereafter. In September, the attacker contacted a software engineer, referred to as Little B, through a recruitment platform, posing as a project director, and conducted video interviews and social media interviews, sending a code repository as an assignment. Little B downloaded the repository to their work computer and set it up according to the instructions. One file of 3,414 bytes bypassed terminal security protections and used internal AI tools to find traces related to Little A.The report states that on October 30, the attacker logged into another employee, referred to as Little C's, computer and transferred $6.3 billion. Binance stated that approximately $6.34 billion in assets were affected, with about $2.85 billion frozen or intercepted, and the losses covered by the SAFU fund and company funds. As of October 31, 98% of the affected tokens have been replenished.

According to a report by Reuters, Binance stated that hackers used fake job interview attacks to compromise employee devices and steal cryptocurrency.