Binance $6.3B Theft, Linux Kernel Bug Spark Week of Major Hacks

It's November 3rd, 2026, and the tech world has just experienced a tumultuous week, marked by unprecedented cyberattacks and critical vulnerabilities.

Cursor's Accidental Backdoor

Last Thursday, Cursor, a code editor owned by a rocket company, inadvertently shipped a new official Claude code extension. This extension, unbeknownst to Cursor, was designed to scan users' machines for keys and tokens, subsequently setting up a backdoor for attackers. The extension was live for approximately 11 hours, during which about 5,000 people installed it. Fortunately, the backdoor required administrative rights, which most users do not grant to their text editors, limiting the potential "blast radius" of the exploit.

Poly Market Funds Drained

Around the same time, users of Poly Market, a prediction market platform, reported their funds being drained simply by logging into the website. This incident was not due to user error. Instead, a script from Debug Bear, a company Poly Market uses for performance monitoring, was hijacked. The attackers used this hijacked script to sell users' current positions and wire the proceeds to a hard-coded wallet. Over $2 million in funds were stolen before Poly Market managed to pull the malicious script.

Binance Suffers Largest Crypto Theft in History

Just hours after the Poly Market incident, a far more significant event unfolded at Binance. In roughly 20 minutes, $6.3 billion worth of crypto across 10 different blockchains was siphoned from Binance's hot wallets, marking the largest theft in recorded history. Binance attributed the breach to a compromised DevOps laptop, which allowed attackers to submit withdrawal requests that were then signed by Binance's own system.

The FBI later identified the North Korean group "Trader Trader" as responsible for the attack, the same group that stole $1.5 billion from Bybit the previous year. Despite the massive scale of the theft, the impact on individual users was mitigated due to the centralized nature of crypto. Tether and Circle froze approximately $3 billion of the stolen stablecoins within an hour. Binance subsequently froze all withdrawals and spent the weekend replenishing its wallets using its treasury and insurance funds. By Sunday, withdrawals resumed, and Binance posted proof of reserves, demonstrating that all user balances were fully backed. However, users responded by withdrawing an additional $3.6 billion from the platform.

Critical Linux Kernel Vulnerability (CVE-2026-XXXX)

The week's events also highlighted a severe vulnerability in the Linux kernel. In early October, Linux kernel maintainer Eric Dumisette pushed a two-line fix that delayed freeing memory until the kernel was certain it was no longer being read. This seemingly minor fix was later rated 9.8 out of 10 on the CVSS scale, indicating a critical security bug.

It was discovered that since 2016, every Linux kernel has contained a flaw in the code handling new TCP connections. The vulnerability arises when a client sends the same "hello" packet twice at a precise moment. This causes two parts of the kernel to process the same connection simultaneously, leading one part to free saved memory while the other is still reading it. Consequently, the server constructs its reply using freed memory, which can contain arbitrary data written there in the interim. If an attacker controls this data, they can manipulate the kernel's subsequent actions.

Initially, Red Hat rated this vulnerability as moderate (5.9), believing the worst-case scenario was a kernel crash, given the difficulty of achieving the precise timing required for exploitation. However, Anthropic's red team disproved this on October 27th. They tasked an unreleased Claude AI model with exploiting the bug. In just 48 minutes, the model successfully hit the timing enough times to leak a kernel memory address. Five minutes later, it was able to execute commands as root.

Debian and Oracle released patched kernels within a day of the CVE announcement. Red Hat took two more weeks to acknowledge the severity and shipped fixes over the weekend. Ubuntu, however, still lacks a patch.

Code Rabbit Secure: A Solution for Code Security

In light of these ongoing security challenges, Code Rabbit has launched Code Rabbit Secure. This service aims to provide continuous code security powered by "actual reasoning" rather than brittle regex rules. Its security agents are designed to think like attackers, hunting for real vulnerabilities across entire codebases. Code Rabbit Secure prioritizes risks based on reachability, exploitability, and blast radius, explaining problems in plain English and suggesting fixes that can be approved and merged directly from the diff. It reviews every pull request before merging and offers scheduled deep scans for comprehensive codebase protection.