❌

Visualização normal

Antes de ontemStream principal

Beyond Cold Storage: Why Hardware Wallets Need Open Source and Clear Signing

✇Hackread – Latest Cybersecurity, Tech, Crypto & Hacking News
Por:Owais Sultan
5 de Novembro de 2026, 08:37
Hardware wallets protect private keys, but clear signing, open-source firmware and on-device verification let users see malicious crypto transactions.
  • ✇Firewall Daily – The Cyber Express
  • Why Is Kim Yo-jong Suddenly Responding to a Binance Hack? Samiksha Jain
    On October 29, Binance lost control of about $6.34 billion in digital assets in a matter of hours. The attackers did not break in on that day, though. They had been working their way inside since June. The Binance hack was a slow campaign aimed at a handful of engineers, and it used a tampered download, a fake job interview and the exchange's own internal AI tool to reach the systems that sign transactions. Binance CEO Richard Teng called it "one of the most sophisticated attacks the digital
     
  • ↗️

Why Is Kim Yo-jong Suddenly Responding to a Binance Hack?

✇Firewall Daily – The Cyber Express
Por:Samiksha Jain
4 de Novembro de 2026, 02:57

Binance hack Targeted

On October 29, Binance lost control of about $6.34 billion in digital assets in a matter of hours. The attackers did not break in on that day, though. They had been working their way inside since June. The Binance hack was a slow campaign aimed at a handful of engineers, and it used a tampered download, a fake job interview and the exchange's own internal AI tool to reach the systems that sign transactions. Binance CEO Richard Teng called it "one of the most sophisticated attacks the digital asset industry has ever seen." He said the company takes full responsibility and that no user will bear the loss.

Why the Binance Hack Targeted Engineers, Not Systems

According to the post-mortem Binance released on Tuesday, the attackers went after people with access to wallet infrastructure. In June, Wallet DevOps Engineer A searched for a popular AI coding tool and downloaded a tampered Homebrew installation. Binance's security team spotted the anomaly, replaced the device and rotated his credentials. But the damage was done in another way: Engineer A's role, and his colleagues on the wallet infrastructure team, were now known to the attacker. In September, the attackers moved to social engineering. Software Engineer B, whose profile on a legitimate job-hunting platform mentioned his Binance experience, was approached by someone posing as a project director. A first-round video interview followed with a supposed HR representative, who shared personal photos and videos on social media to build trust. Binance said this was more advanced than social engineering it had seen before. Binance hack infographic In the second round, held on a popular chat app, Engineer B was told to download an "assignment" onto his work computer. It contained malicious code that ran during setup, swapped a legitimate development tool for a malicious version, and connected to an attacker-controlled server. The zero-day malware was not detected by endpoint security tools at the time. On October 20, the attackers used Engineer B's compromised computer and an internal AI tool to gain control over Engineer A and another wallet engineer, Engineer C. They then found that Engineer A had a container deployment permission token on his machine.

How the Binance Hack Unfolded on October 29

Between 17:15 and 19:56 UTC, the attacker logged onto Engineer C's computer, used Engineer A's stolen credentials, deployed a container and triggered a malicious script. That gave them unauthorized access to an internal wallet signing service, which they used to send transactions outside the normal withdrawal process. Between 20:05 and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address. Hot wallets on Solana and Optimism sent about 970,500 SOL and 44.2 million OP. Binance then received an internal alert about large transfers, and another hot wallet sent 18,270 BTC.

Why Binance Couldn't Stop It Faster

Binance suspended withdrawals, but that did not end the outflows. The attacker had used the signing service to exploit Ethereum's EIP-7702 authorization mechanism. By submitting 50 signing transactions, they gave an attacker-controlled smart contract partial execution rights over a Binance hot wallet. Those authorizations lived on-chain and worked independently of Binance's withdrawal systems. And because the wallet used Multi-Party Computation, there was no single private key that could instantly revoke them. Binance had to build a special procedure to do it. The final unauthorized transfer of 2,961.9 ETH was confirmed at 23:56 UTC. At 00:10 UTC on October 30, Binance cleared the malicious delegation.

Who Is Behind It

Over the weekend, the FBI and other U.S. agencies blamed the theft on TraderTraitor, a North Korea state-sponsored group that has spent years attacking cryptocurrency platforms. Binance said it had detected and stopped 57 suspected North Korea-linked threats in 2026 alone, many using fake job interviews and malicious developer tools. On Tuesday, Kim Yo-jong rejected the U.S. findings, calling them a "grave political provocation" in a statement carried by the Korean Central News Agency. Observers noted the statement ended by saying Pyongyang had matters to "reconsider," without directly threatening retaliation. South Korea's Unification Ministry called her personal response unprecedented. An official said it suggested the North was taking the allegations seriously and was "increasingly conscious of its international standing."

Where Users Stand

Binance says it has set aside more than 100% of the funds needed to cover the loss. As of October 31, 98% of impacted token assets had been replenished, and Binance is buying the remaining, less liquid assets. About $2.85 billion has been frozen or intercepted with help from law enforcement, token issuers and blockchain intelligence firms. Withdrawals have broadly resumed. The exchange says it has rebuilt the affected wallet system and AI tool, replaced devices, revoked credentials tied to the affected engineers and brought in independent security firms. The investigation is ongoing.
  • ✇@BushidoToken Threat Intel
  • UK Cybercrime Journal: Police Cryptocurrency Crime Operations in 2026 BushidoToken
    What HappenedFour key UK enforcement actions have showcased the diversifying spectrum of cryptocurrency crime in the UK in 2026. This ranges from violent home invasions to sophisticated police impersonation and seed phrase social engineering. UK law enforcement also cracked down on P2P exchanges to help prevent cryptocurrency laundering and cashing out.Cryptocurrency Theft via Physical Violence (February 2026)Three individuals from Sheffield executed a targeted home invasion in London. Posing as
     
  • ↗️

UK Cybercrime Journal: Police Cryptocurrency Crime Operations in 2026

✇@BushidoToken Threat Intel
Por:BushidoToken
7 de Outubro de 2026, 06:00

What Happened

Four key UK enforcement actions have showcased the diversifying spectrum of cryptocurrency crime in the UK in 2026. This ranges from violent home invasions to sophisticated police impersonation and seed phrase social engineering. UK law enforcement also cracked down on P2P exchanges to help prevent cryptocurrency laundering and cashing out.

Cryptocurrency Theft via Physical Violence (February 2026)

  • Three individuals from Sheffield executed a targeted home invasion in London. Posing as Amazon delivery drivers, the teenagers ambushed the victim with physical violence, forced him to transfer $4.5 million (£3.1 million) in cryptocurrency to their accounts, and stole his vehicle.
  • The offenders recorded their escape and boasted about the crime on Snapchat. The Metropolitan Police tracked the vehicle down and detained all three suspects within hours of the crime taking place.
  • The trio was sentenced at Sheffield Crown Court to a combined total of 16 years in youth detention, with the victim's assets recovered within 72 hours.

OCG Arrested for Seed Phrase Vishing (May 2026)

  • Ten suspects were arrested and charged following a coordinated multi-force operation led by the Eastern Region Special Operations Unit (ERSOU) alongside the Met, City of London Police, Kent Police, and YHROCU.
  • The organised crime group (OCG) targeted victims via fraudulent phone calls, posing as police officers or cryptocurrency platform representatives. Victims were tricked into disclosing critical wallet credentials, including private wallet seed phrases, allowing the attackers to drain the contents of their wallets.
  • One victim alone lost over £300,000. Simultaneous search warrants across Kent, Essex, London, and Yorkshire resulted in ten individuals being charged with conspiracy to defraud.

Impersonation Gang Jailed Over £4 Million Police Impersonation Fraud (July 2026) 

  • At Southwark Crown Court, three men in their twenties, were jailed for up to six years for defrauding eight victims out of over £4 million in cryptocurrency.
  • The gang impersonated police officers over the phone, informing victims their assets were compromised and convincing them to move funds to "secure police accounts" or share account access. To reinforce the ruse, the group also constructed fake police websites.
  • The Met Police Cryptocurrency Team dismantled the OCG, seizing 40 mobile devices, luxury vehicles, and recovering £1 million in direct victim funds.

FCA and Partners Crackdown on Illegal P2P Crypto Trading (September 2026):

  • In a joint operation, the UK Financial Conduct Authority (FCA), HM Revenue & Customs (HMRC), and the Metropolitan Police targeted three London premises operating as unregistered peer-to-peer (P2P) cryptocurrency exchanges, serving cease-and-desist letters to halt their unauthorised commercial activities under the Money Laundering Regulations 2017.
  • Because carrying out P2P crypto trading "by way of business" legally requires FCA authorisation, and zero P2P crypto businesses are currently registered in the UK, these firms operated outside mandatory Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) frameworks, establishing a critical, unregulated liquidity channel for criminals to move and launder illicit funds.

Analyst Comment

The operational shift in UK-based cryptocurrency targeting indicates a dangerous blend of high-tech social engineering and low-tech physical coercion.

The first case involving the home invasion highlights to risks of showing off rich lifestyles on social media. Unfortunately, we live in an age whereby criminals can research their targets and gather the information necessary to attack their homes. High net-work individuals are prime targets and can be relatively trivial to locate due to posting their lives on social media.

Both the cryptocurrency vishing cases highlight the effectiveness of police impersonation. Threat actors exploit the high trust and compliance associated with law enforcement branding to bypass technical two-factor authentication (2FA) mechanisms, inducing panic in victims to voluntarily surrender seed phrases or authorise wallet transfers.

In the UK, unlawful gains are rapidly off ramped into physical luxury items (designer clothing, jewellery, high-end vehicles) or moved to foreign jurisdictions. However, as demonstrated by the Snapchat post in the Sheffield home invasion case, cybercriminal operational security (OPSEC) remains a primary vulnerability for law enforcement to exploit.

Unregistered P2P cryptocurrency exchanges continue to operate as a liquidity channel where illicit virtual funds can be converted into physical cash or clean bank transfers. By targeting the physical infrastructure where shadow financial activity meets the mainstream economy, law enforcement can starve wider cybercrime ecosystems of accessible liquidity.

Defensive Takeaways

Security teams, high-net-worth individuals, and institutional custodians must update defence models to protect against hybrid physical/digital vectors:

  • Operational Security (OPSEC) & Privacy: Minimise public disclosure of crypto holdings, wallet addresses, and physical locations. Threat actors frequently leverage social media OSINT to target victims for home invasions or vishing campaigns.
  • Absolute Protection of Seed Phrases: Never disclose seed phrases, recovery keys, or private keys to anyone. Legitimate financial institutions, exchanges, and law enforcement agencies will never request seed phrases or ask users to transfer funds to a "safe account".
  • Out-of-Band Verification: If contacted by someone claiming to be a police officer or exchange representative regarding asset security, hang up immediately. Independently verify the call by calling the official institution number.
  • Multi-Signature (Multi-Sig) & Time-Locked Storage: Implement multi-sig wallets requiring authorisations across geographically separated keys, alongside time-locked vaults. This mitigates the immediate risk of forced transfers during physical home invasions.

Relevant Sources

  1. https://www.independent.co.uk/tv/news/amazon-delivery-thief-londoncrytpcurrency-met-police-video-b2914193.html
  2. https://x.com/metpoliceuk/status/2019078494227997095
  3. https://www.rocu.police.uk/news/2026/may/ten-arrests-arrested-linked-to-alleged-crypto-currency-scam/
  4. https://news.met.police.uk/news/men-who-stole-more-than-4-pounds-million-of-crypto-are-jailed-511271
  5. https://www.fca.org.uk/news/press-releases/fca-and-partners-continues-crackdown-illegal-crypto-trading
Relevant CTI Sources

Apple Sued After Alleged Fake Crypto Wallet App Cost Users $1.8 Million

✇Security | TechRepublic
Por:Aminu Abdullahi
29 de Julho de 2026, 17:16

Three investors allege a fake Sparrow Wallet app listed in Apple’s App Store caused approximately $1.8 million in Bitcoin losses.

The post Apple Sued After Alleged Fake Crypto Wallet App Cost Users $1.8 Million appeared first on TechRepublic.

❌
❌