Six billion out the door at Binance

Welcome to It's probably nothing. Four stories this time, and the first sets a record nobody wanted: Binance has confirmed roughly six point three billion US dollars in unauthorised withdrawals — the largest crypto theft on record.

Binance's own incident notice, published on the twenty-ninth of October, puts the impact at around that figure. Its initial read is that a compromised DevOps engineer's laptop gave access to a service container used to submit the withdrawals, and it reports no evidence that wallet private keys leaked. About three billion has been frozen on-chain with blockchain partners, withdrawals were suspended while deposits kept running, and Binance says the SAFU fund and company money will cover all losses. Law enforcement is engaged, and a technical post-mortem plus an updated Proof of Reserves will follow remediation. The Guardian reports experts identifying North Korea as the likely culprit — I'd hold that lightly for now, since the firmer TraderTraitor naming doing the rounds in secondary coverage hasn't been verified against TRM or Chainalysis directly. Either way, a laptop-to-container path to six billion dollars is a fairly brutal case study in workstation security.

Next, GitLab. On the twenty-ninth, CISA added an unauthenticated integer-overflow remote code execution flaw in GitLab's CI/CD regular-expression compiler to its known-exploited catalogue — a perfect ten on the severity scale. The fix actually shipped back on the twelfth of October, and GitLab.com was patched before publication, so the news isn't the bug, it's that someone's using it. The federal due date was the first of November, with forensic triage required. And yes, if you're getting déjà vu, this is a different bug from the GitLab regexp issue covered here earlier. CISA's notes warn that other products embedding the same Ruby regexp code may be affected, so this could travel beyond GitLab. GitLab has released six detections for self-managed instances, and the upgrade runs database migrations, so single-node installs will see downtime — plan for it. If your self-managed GitLab is older than the October patch releases, it's overdue, and given the triage requirement, patched boxes warrant a pass with those detections too. Exploitation is confirmed by CISA's listing, but no attack detail, actor or victims are public.

Staying with CISA, the Ivanti Connect Secure chain covered here in mid-October has grown. You'll recall the authentication bypass reaching root on a fully patched box, with the privilege-escalation link then unfixed. On the thirtieth, CISA added that escalation flaw to the known-exploited list with a second of November due date and forensic triage, alongside a newly catalogued third flaw that lets a remote authenticated attacker upload attacker-controlled files to a known location, due the thirteenth of November. CISA's entries now formally document the three flaws chaining from authentication bypass to root. One caveat: fix availability for the privilege escalation is unverified — Ivanti's advisory page failed to load.

Finally, a page-speed script that turned out to have rather more authority than any page-speed script should. On the twenty-ninth, attackers compromised DebugBear's DNS at its domain registrar and swapped the real-user-monitoring script Polymarket embedded on its pages for a wallet drainer. No passwords or seed phrases needed: the script reused logged-in sessions, trading API keys stored in the browser, and Polymarket's own transaction signer and relayer to sell or transfer positions. Roughly two point seven million US dollars left about seven hundred and thirty wallets in under an hour before Polymarket pulled the script, went cancel-only and paused the relayer. It says everyone will be made whole — three point nine million in total, including about one point two million for roughly five and a half thousand wallets caught by the pause — and has referred the matter to UK authorities. The awkward part for everyone else: a page-speed snippet effectively held signing authority over user funds. CSP didn't help because the script loaded from an approved host; Subresource Integrity would have rejected the swap. DebugBear says it found no breach of its own systems and believes one customer was targeted — that's its early assessment — and it's told RUM customers to remove the embed. If your site embeds DebugBear's script, that removal advice applies to you right now. One note: wallet counts differ between sources depending on whose figures you use, and that "no breach of our systems" line is DebugBear's own early claim.

That's the edition — record theft, exploited enterprise bugs, and a reminder to check what your third-party scripts can actually do. Until next time, it's probably nothing.

Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat.