TECHBOARD #5: Binance loses $6.3 billion as attackers slip a backdoor into Claude Code

Real-world hacks

Global cryptocurrency exchange Binance lost approximately $6.3 billion in a cyberattack. The attack on 29 October enabled unauthorized withdrawals from corporate wallets, with most of the assets disappearing in about 20 minutes. One of the possible entry points was a DevOps engineer’s laptop. The initial investigation suggested that attackers used it to access a service container, although Binance later identified additional points of compromise. The FBI attributed the attack to the North Korean TraderTraitor group.

The exchange stated that by 2 November, it had replaced approximately 95% of the stolen assets using its own funds. This does not mean that the assets were recovered from the attackers. The incident demonstrates how a compromise of development infrastructure can escalate into a breach of critical financial processes. Red teaming is designed to test precisely these attack paths and an organization’s ability to detect them.

Attackers inserted an SSH backdoor into the Claude Code extension for Visual Studio Code. Compromised versions 2.1.312 and 2.1.313 were distributed through the Cursor Marketplace. According to an analysis by Phorion, the malicious code added the attacker’s public SSH key to the authorized_keys file after the extension was loaded and attempted to establish a reverse SSH tunnel. This could have given the attackers persistent access to the developer’s workstation. Although implementation errors prevented the attack from completing in some configurations, uninstalling the extension may not remove a backdoor that has already been created.

Vulnerability landscape

Microsoft Authenticator for Android could hand authentication tokens to a malicious application without requiring special permissions. Researchers at Enclave demonstrated the AuthMask attack, in which an application impersonated Microsoft Teams. Authenticator failed to verify the true identity of the calling application adequately and returned tokens that could provide access to the user’s emails, files, and calendar. Microsoft patched CVE-2026-80097 in September, while the technical analysis was published on 23 October. The case is a reminder that multifactor authentication alone cannot prevent the misuse of tokens that have already been issued.

Citadelo’s Josef Korbel is credited with discovering two more WebKit vulnerabilities. In its October security update, Apple confirmed CVE-2026-112695, which may cause a process to crash, and CVE-2026-112626, which could allow malicious code to execute under certain conditions. Both vulnerabilities were discovered in collaboration with other security researchers.

AI/LLM news

Claude can build functional exploit chains. Anthropic demonstrated this capability using an internal research model that identified vulnerabilities in Chrome, Safari, Android, Windows, and Linux. One particularly notable finding is CVE-2026-98432 in the Linux kernel, where a race condition causes a use-after-free vulnerability in the networking subsystem.

Claude was able to develop an exploit that enabled unauthenticated remote command execution with root privileges. Under test conditions, it needed approximately 48 minutes to bypass KASLR and another five minutes to execute a command. However, the attack requires a specific Multipath TCP configuration and remains difficult to carry out in a real environment. Anthropic’s research shows that AI can significantly accelerate the work of security researchers, but the same capabilities also pose a risk when misused by attackers.

Tool tips

CVEngine combines external attack surface mapping, technology identification, and vulnerability validation. The open-source tool automates the discovery of accessible systems, CVE mapping, and the verification of potential weaknesses. It supports integration with AI agents through MCP and uses existing tools such as Nuclei and Nmap. For penetration testers, it can simplify reconnaissance and vulnerability prioritization.

CITADELO news

Red teaming tests whether an organization can stop a real attacker. In our new article comparing penetration testing and red teaming, we describe a real-world scenario in which our ethical hackers cloned an employee’s access card and entered the company’s premises without triggering a security alert.

An AI agent can misuse its privileges to perform actions that an attacker could not access directly. In our article on AI and LLM application security, we explain the confused deputy problem and why organizations need to test agent permissions, external integrations, and autonomous decision-making.

How far could an attacker get after compromising a single device or account?

Red teaming tests realistic attack paths across technology, people, and processes, revealing whether your organization can detect and stop them in time.