Cybersecurity & Infrastructure

Chainalysis reported a cybersecurity incident in which sensitive customer data, including hashed passwords, was stolen. The company is restoring services in phases and instructs all users to reset passwords and rotate API keys before reusing restored tools. Customers should follow the published guidance, monitor for suspicious activity, and treat credentials as potentially compromised.

On 2026-11-06 CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities Catalog. KEV trackers report severity 7.5 and a federal remediation due date of 2026-11-20. Affected organisations should prioritise inventory, patching, or mitigations in line with the KEV listing and federal timetable.

On Nov 7, 2026 Chainalysis posted an update saying Reactor, KYT (UI and API) and Address Screening are back online. The provided official excerpt does not include details about customer instructions, credential resets, API key rotation, or IP allowlisting. Customers should monitor Chainalysis communications for further operational guidance.

Chainalysis disclosed that names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor, according to a company update quoted by reporting. The public excerpts do not specify remediation steps or whether investigative datasets were accessed. Customers should assume exposed credentials and tokens may be abused and increase monitoring and mitigation.

On November 4, Chainalysis said names, usernames, password hashes and live authentication tokens for all Chainalysis users were exposed to a malicious actor. The disclosure was reported independently by The Record and Security.io, and customers should immediately rotate credentials, revoke sessions, and coordinate with Chainalysis for confirmation of invalidation.

A November 5 report quotes Chainalysis saying certain customer information including names, usernames, password hashes and live tokens for all users were exposed to a malicious actor. The retrieved report does not provide corroborating technical details, nor does it describe product outages or a restoration timeline.

South Korea's military reported that North Korea launched multiple missiles toward the sea after Pyongyang publicly protested U.S. accusations that North Korean hackers were behind a recent Binance cryptocurrency heist. The reporting shows a close timing between the protest and the launches, but does not provide evidence that the launches were ordered specifically as retaliation or that they have affected international investigative efforts.

On November 3, 2026 TRM Labs reported that about USD 6.4 billion left Binance wallets on October 29 and that proceeds not frozen are moving through laundering routes involving self‑minted tokens and chained cross‑chain bridges, with active movement on TRON and Solana. Binance’s November 3 update states approximately US$2.85 billion of the impacted assets have been frozen or intercepted to date.

Binance reported a Thursday evening attack that it says resulted in about $6.3 billion stolen. The company told press that attackers began with a supply chain action that lured an engineer into downloading a tampered development tool. These details, as reported, highlight supply chain risks to developer workflows and custody operations. The cited press excerpt does not include independent forensic findings or technical indicators.

On Nov 3, 2026 Binance published initial findings saying a months-long intrusion campaign began with fake recruitment interviews and used malicious software, compromised internal AI tooling and endpoint compromise, enabling an advanced transaction-authorization method that permitted roughly $6.3 billion in unauthorized transfers. Investigations and forensic tracing are ongoing and key technical and attribution details remain under investigation.

On Nov 1–2 onchain analysis showed about $242 million of funds stolen from Binance moved through the Tron blockchain over two days, and Elliptic reports most laundering has run through Tron where funds were split across about 7,700 addresses and bridged to Ethereum. This activity indicates active cross-chain laundering that complicates recovery and enforcement.

On Oct 31, 2026 Binance reported that 90% of the assets taken in the recent security incident had been covered. On Nov 1, 2026 the company published a recovery update scheduling Phase 1 withdrawals from 14:00 to 17:00 (UTC+8). These are company disclosures; independent confirmation of remaining coverage levels and any resulting net outflows is not available in the cited Binance posts.

The FBI issued a public advisory attributing the theft of more than $6 billion in virtual assets from Binance that occurred on or about October 29, 2026. Associated Press reporting ties the operation to an actor called TraderTraitor. The public excerpts do not provide details on operational instructions to private-sector crypto infrastructure or on-chain conversion specifics.

Chainalysis published a security-incident notice and independent reporting states the company said some customer information was accessed, including names and email addresses. Chainalysis says its investigation to date has found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens.

On Nov 1, 2026 Binance resumed phase-one withdrawals after its estimated $6.3 billion hack and reported operational updates. CoinDesk and exchange data show Binance increased replenishment of affected token balances to about 95%, up from 90%. Reuters and exchange-tracking data show customers withdrew heavily after the reopening, producing roughly $3.64 billion in net outflows in the initial hours. These developments materially change the liquidity and trust posture around the incident and could affect recovery dynamics and regulator actions.

Binance says its initial investigation may involve a compromised DevOps engineer's laptop that enabled an attacker to access a service container and submit unauthorized withdrawal transactions. This is material because it points to a possible endpoint or DevOps compromise rather than solely a leaked private key, increasing urgency for exchanges and custodians to review DevOps and endpoint controls.

On October 29, 2026, TRM Labs reported an on-chain reconstruction estimating about $6.36 billion was moved from Binance-linked wallets, and TRM attributed the transfers to TraderTraitor, which it described as North Korea's elite hacking unit, with high confidence. Stablecoin issuers Tether and Circle have frozen more than $2.3 billion in assets tied to the incident.

U.S. blockchain intelligence firm TRM publicly attributed a recent theft from Binance to TraderTraitor, which it described as North Korea's elite hacking unit, and said it made the judgment with "high confidence." The attribution is reported by AP quoting TRM's post. Independent confirmation from governments, law enforcement, or Binance is not included in the cited excerpt.

Binance said it is investigating a potential security incident and reported a current verified total of $2.54 billion in frozen assets. A live Euronext feed reported that stablecoin issuers Circle and Tether froze related assets. Independent on-chain analysis produced higher outflow estimates, with one report citing up to $5.8 billion.

An independent security report quotes the threat actor saying it "had compromised 36,000 systems across UNM's main campus and hospital environments." Separately, UNM HSC said it did not pay a ransom to the hackers. The scope of any confirmed compromise or data exfiltration remains unverified in the public reporting cited.

A post on a criminal data‑leak site claims the threat actor "compromised 36,000 systems" across UNM’s main campus and hospital environments. UNM’s official update states that "Critical electronic systems ... are back online following Monday’s cybersecurity event." The claim remains unverified and raises the potential for data exposure and further operational impact while response and investigations continue.

U.S. Impact: Current Low · Potential Elevated

CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog (Tenable: "Update October 26: CISA added CVE-2026-109618 and CVE-2026-109619 to its KEV catalog.") and reporting states CISA confirms the PHP2Shell flaws are being exploited in attacks (BleepingComputer: "CISA confirms PHP2Shell vulnerabilities now exploited in attacks."). CISA is urging organizations to immediately patch affected PHP installations (GovDelivery: "CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619.").

On Oct 26, 2026 Tenable reported that ELLIO sensors recorded an exploitation attempt against CVE-2026-111497. Quoted vendor/ecosystem comments state the issue "can crash the process, expose memory, and enable remote code execution (RCE)." Organisations using Brotli-consuming software should apply vendor updates and monitor for further exploitation reports.

CVE-2026-111497 is a critical out-of-bounds write in Google’s Brotli C decoder documented in an upstream GitHub advisory and aggregated by OpenCVE; the advisory states the bug affects Brotli versions 1.0.3–1.2.0 and can corrupt memory, disclose sensitive contents, cause denial-of-service, or potentially allow code execution when processing crafted Brotli-compressed streams. BleepingComputer reports the issue and notes Brotli is built into Node.js, so administrators should monitor vendor guidance and apply upstream or downstream fixes as directed.

ConnectWise brought its Cloud Backup service back online after a cyberattack forced the provider to shut the service down. The company completed a staged restoration that prioritized reconnecting partners to their backup data, according to CRN reporting.

ConnectWise posted a Trust Center update at 00:45 UTC on October 22, 2026 saying phased restoration of Cloud Backup is underway and will take several days; it warns partners that individual Microsoft 365 tenants still require review for unauthorized changes or persistent access. The advisory is an active remediation notice but does not, in the retrieved content, attribute the incident or confirm tenant data access.

ConnectWise says service availability for Cloud Backup and related services will "return in stages" and take "several days," per company status updates. CRN quoted ConnectWise CTO David Raissipour saying regranting partner access "takes about 5 to 10 minutes per tenant." ConnectWise's status page indicates teams are "actively working to restore service." This matters because restoration is being performed tenant‑by‑tenant and will proceed in phases.

ConnectWise published a Trust Center update (Update: Monday, October 20, 2026 at 12:45 UTC) saying remediation, account resets, credential replacement and environment validation are underway. CRN quoted the ConnectWise CTO saying the company has made "significant progress" toward restoring Cloud Backup Microsoft 365 access to "more than several thousand MSPs." The advisories confirm ongoing remediation but do not specify how many MSPs have already had access fully restored or the timetable for completion.

Huntress reported on 17 Oct 2026 that almost 1,000 Microsoft Entra tenants had sign‑in activity from IP 144.172.64[.]128, with 'more than 300' successful sign‑ins. ConnectWise states it disabled seven ConnectWise application identities at 07:00 UTC on October 17, 2026; security.io reports that affected certificates were revoked. These items indicate large‑scale sign‑in activity and vendor containment actions now posted publicly.

ConnectWise's Trust Center page was last updated on October 20 at 00:45 UTC. Earlier Trust Center updates (Oct 18) published three IP addresses observed in downstream monitoring: 144.172.64[.]128, 144.172.64[.]99 and 144.172.64[.]60. An Oct 19 update says 'Containment remains in place, with no successful threat activity observed in the environments we monitor since mitigations initiated October 17, 05:00 UTC.'

U.S. Impact: Current Low · Potential Elevated