Ivanti Zero-Days, Binance's $6.3B North Korea Heist, Chainalysis Breach

CISA Orders Federal Patch for Exploited Ivanti Connect Secure Flaws

CISA added two actively exploited Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog after Ivanti updated an earlier advisory. Volexity found the flaws used alongside a third bug, CVE-2026-104935, to turn SSL VPN appliances into a foothold for lateral movement, including theft of Windows LAPS passwords and BitLocker recovery keys. Federal agencies must remediate CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026, then investigate for compromise, since Volexity reports the activity evades Ivanti's Integrity Checker Tool. (Help Net Security)

FBI Attributes $6.3 Billion Binance Crypto Theft to North Korea

The FBI confirmed North Korea was behind the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, tying the attack to the TraderTraitor group previously linked to the $1.5 billion Bybit hack. The bureau, working with the Secret Service and IRS Criminal Investigation, listed 628 addresses, including 608 Ethereum wallets, 19 Bitcoin wallets and one Solana wallet, and urged crypto providers to block transactions linked to them. Binance has replaced about 95% of the stolen assets and began phased withdrawal restoration on November 1. (Help Net Security)

Chainalysis Discloses Breach via 'Offensive Agentic Techniques'

Blockchain analytics firm Chainalysis disclosed a cybersecurity incident after external attackers used what it called "offensive agentic techniques" in October to access internal systems and tools, unrelated to the Binance hack. The company said it found no evidence that investigation content, passwords, MFA secrets or session tokens were exposed, but attackers did access some customer IDs, full names, email addresses and organization role labels. Chainalysis has since taken Reactor and Data Solutions offline as a precaution while third-party experts complete additional security assessments. (Help Net Security)

Second Wave of Refrigeration Cyberattacks Spreads Across Europe

Three weeks after refrigeration systems in French supermarkets were turned into ovens overnight, a similar attack hit chains in Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia and the Netherlands, spoiling refrigerated food again. Attackers remotely switched evaporators to defrost mode, the same mechanism used in the October French incident on Danfoss, Copeland and Dixell systems with internet-exposed management interfaces. Security researcher Kevin Beaumont said many of the affected freezers are end-of-life with no patch available. A threat intelligence firm reported authentication probing from ASNs tied to Russian bulletproof hosting in the weeks before the attack. (Help Net Security)

Trezor Warns of Seed-Stealing Implant in CryptoBilis-Sold Wallets

Trezor warned that hardware wallets sold through reseller CryptoBilis, the same reseller linked to recent Ledger wallet drains, may contain a hidden implant that steals a user's recovery phrase. A customer in Indonesia found an extra circuit board with a cellular module behind the screen of a Trezor Safe 5 bought in August and reported it to Trezor on October 28. Trezor is treating the report as credible and advising anyone who bought a device from CryptoBilis since March 2026 to move funds to a newly created wallet immediately; it dropped CryptoBilis as a reseller on October 9. (Help Net Security)