💸 $6.3B Crypto Heist + a Backdoored AI Coding Tool 💻

This week's two biggest stories share a lesson: attackers go where the trust is. One went after the world's largest crypto exchange, the other after a developer tool that thousands of people install without thinking twice.

North Korea Pulls Off a Record $6.3 Billion Crypto Robbery

Binance, the world's biggest crypto exchange, lost $6.3 billion in what is now the largest crypto theft on record. The FBI says the attack came from TraderTraitor, part of North Korea's Lazarus Group. It started with a single compromised laptop and malware that wiped its own tracks. Binance has replaced 90% of the stolen funds, promised to cover the rest, and is reopening withdrawals in phases. The takeaway for everyone else: one infected device can lead to a nine- or ten-figure loss. Protecting employee laptops isn't just an IT chore. It protects the whole business.

Read more

A Trusted AI Coding Extension Shipped With a Backdoor

For nearly 12 hours, a malicious version (2.1.313) of the Claude extension for the Cursor code editor was available through Anthropic's official publisher account. Up to 5,000 developers could have received it. It collected information about their machines and tried to plant a hidden way back in, through an SSH key and a reverse tunnel. Cursor has removed it, blocked the attacker's server, rotated keys and audited its marketplace. This is a supply-chain attack: the bad code came from a source people had every reason to trust. If you or your developers installed or updated this extension last Thursday, check the published indicators of compromise now.

Read more

Stay ahead of threats with GOCO Security at gocosecurity.com.