North Korean Hackers Exploit Binance, BlackX Bootkit Bypasses
This digest covers sophisticated North Korean cyberattacks on Binance and iOS/Android devices, a new UEFI bootkit, Anthropic's AI model identity system, and
The biggest stories today highlight the ongoing sophistication of cyberattacks, with North Korean hackers compromising Binance through elaborate social engineering and Russian APT29 group using n-day exploits on mobile devices. Meanwhile, a new bootkit, BlackX, demonstrates continued weaknesses in Windows Secure Boot, underlining the persistent challenge of system integrity.
TL;DR
- North Korean Hackers Used Fake Job Interview and Malware to Orchestrate $6.3 Billion Binance Heist — North Korean hackers from the TraderTraitor group stole $6.3 billion from Binance by tricking a software engineer into downloading malware during a fake job interview process.
- BlackX UEFI Bootkit Bypasses Secure Boot on Fully Patched Windows Machines, Exploiting Microsoft's Vulnerability Fixes — The BlackX UEFI bootkit exploited a logic flaw (CVE-2022-21894) in the Windows boot manager to bypass Secure Boot on fully patched Windows machines, similar to BlackLotus.
- Russian APT29 Group Uses N-Day Exploits in Zero-Click Attacks on iOS and Android Devices — A watering hole campaign attributed to Russian APT29 exploited n-day vulnerabilities in iOS 16.7, iOS 18.5, and Chrome for Android 139-145 to steal sensitive user data.
- Researchers Warned of North Korean Hacking Tactics Years Before Binance Heist — Binance confirmed North Korean hackers used fake social media profiles and job offers to trick an employee into downloading malware, leading to a $6.3 billion crypto theft.
- Next.js 16.4 Stabilizes
ensureStaticfor Enforcing Fully Static Route Output — Next.js 16.4 has stabilized theensureStaticguardrail, allowing developers to lock routes as fully static and prevent unintended dynamic rendering from shared layouts orfetch()calls. - Anthropic Develops FlashProve, an Open-Source System to Cryptographically Verify AI Model Identity — Anthropic is developing FlashProve, an open-source system providing cryptographic proof that an AI model produced a specific output, without revealing model weights.
- Google DeepMind Employees Urge Removal of Non-Disparagement Clauses on AI Risk Warnings — UK-based Google DeepMind employees are pressing leadership to eliminate non-disparagement clauses that prevent former employees from publicly warning about AI risks.
- German Government Warns Lawmakers of Potential Spyware Attacks on iPhones After Apple Threat Notifications — Germany's federal cybersecurity office (BSI) warned lawmakers and public figures that their iPhones might be compromised by government-backed spyware after Apple issued threat notifications.
- DavidAU Releases Qwen3.8-27B-Ultimate-Heretic-Uncensored-Turbo-Brilliance-50x-AGI-NEO-GGUF Model on Hugging Face — A new fine-tuned model, Qwen3.8-27B-Ultimate-Heretic-Uncensored-Turbo-Brilliance-50x-AGI-NEO-GGUF, combines Fable Fusion 711 and Qwen 3.8 27B with additional AGI constructs.
- AMD Reports Strong Q3 Revenue Growth, Data Center Revenue Up 97% to $8.5 Billion — AMD's Q3 revenue rose 45% year-over-year to $13.38 billion, exceeding estimates, driven by a 97% increase in Data Center revenue to $8.5 billion.
North Korean Hackers Used Fake Job Interview and Malware to Orchestrate $6.3 Billion Binance Heist
Top story · Security · The Register · 2026-11-04
North Korean cryptocurrency thieves, attributed to the TraderTraitor operation (linked to Lazarus Group), executed a sophisticated, multi-stage campaign resulting in a $6.3 billion heist from Binance on October 29. The attack began in June with a supply chain compromise of an engineer's Homebrew installation, which exposed their role and colleagues on the wallet infrastructure team, despite malware detection and device replacement.
In September, a second software engineer was targeted via a legitimate job-hunting platform. The attackers, posing as a project director and CEO, conducted fake video interviews, building trust, and eventually instructed the engineer to download a malware-laced code repository during a second interview. This malware replaced a legitimate development tool component with a malicious version, executing commands and establishing communication with an attacker-controlled external server.
The attackers then accessed internal AI tooling and took over endpoints of two other wallet team engineers. One engineer had previously downloaded password-stealing malware months earlier. Using stolen credentials, the hackers compromised a third engineer with access to systems controlling billions in crypto.
Key facts
- Heist amount: $6.3 billion
- Targeted Binance on October 29
- Attributed to TraderTraitor (Lazarus Group)
- Social engineering involved fake job interviews
- Malware delivered via a code repository during an interview assignment
Why it matters: This incident is a stark reminder for all organizations, especially those handling high-value assets, to implement stringent security measures around employee onboarding, software installations, and access management. Engineers must be trained to recognize advanced social engineering tactics, and security teams need robust endpoint detection and response, especially for internal AI tooling access.
Advanced social engineering combined with supply chain compromise and compromised internal tooling enabled North Korean hackers to execute a record $6.3 billion cryptocurrency heist.
BlackX UEFI Bootkit Bypasses Secure Boot on Fully Patched Windows Machines, Exploiting Microsoft's Vulnerability Fixes
Security · Ars Technica · 2026-11-03
A new UEFI bootkit, BlackX, has been discovered bypassing Secure Boot on fully patched Windows 11 systems, mirroring the capabilities of the BlackLotus malware from 2023. BlackX exploits "Baton Drop," a logic flaw (CVE-2022-21894) in the Windows boot manager, which allows it to run malicious code before the OS and many security defenses load.
Microsoft had patched CVE-2022-21894 in 2022 and issued additional updates in 2023 and 2024 to revoke trust in vulnerable boot manager certificates. However, organizations infected by BlackX had these patches installed, indicating that the vulnerability persists, potentially due to Microsoft's lack of clarity around Secure Boot protections. UEFI bootkits are stealthy, persistent, and difficult to detect, surviving OS reinstallation if the boot partition is infected.
Key facts
- Bootkit name: BlackX
- Exploits logic flaw "Baton Drop" (CVE-2022-21894)
- Bypasses Secure Boot on fully patched Windows machines
- Similar to BlackLotus UEFI bootkit
- Microsoft patched the vulnerability in 2022, with additional updates in 2023 and 2024
Why it matters: Systems engineers and security professionals managing Windows fleets must recognize that fully patched systems can still be vulnerable to UEFI bootkits. This necessitates specialized security tools for UEFI detection, a review of Microsoft's Secure Boot guidance, and potentially enhanced integrity monitoring of the boot chain to detect early-stage compromises that traditional antivirus might miss.
Despite patching, UEFI bootkits like BlackX can still bypass Windows Secure Boot, highlighting a critical persistent vulnerability in the boot chain.
Russian APT29 Group Uses N-Day Exploits in Zero-Click Attacks on iOS and Android Devices
Security · BleepingComputer · 2026-11-04
APT29, also known as Midnight Blizzard, is conducting a large-scale watering hole attack targeting iOS and Android users by compromising legitimate and impersonated websites. The initial JavaScript payload profiles visitors to deploy platform-specific n-day exploit chains without user interaction.
The exploits target vulnerabilities like CVE-2025-43529, CVE-2024-27834 (iOS 16.7), CVE-2026-20700 (iOS 18.5), CVE-2026-3910, and CVE-2025-27038 (Chrome for Android 139-145). These enable the extraction of cookies, messaging app databases, Keychain credentials, location data, and photos. No persistence mechanism was established by the payloads, meaning a device reboot stops malicious activity until another visit to a compromised site.
Sekoia researchers attributed the operation to APT29 based on infrastructure overlaps and attack similarities to past campaigns. Apple and Google have patched all exploited flaws, urging users to update their devices.
Key facts
- Targets iOS 16.7, iOS 18.5, and Chrome for Android versions 139-145 (excluding 143)
- Exploits CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2026-3910, CVE-2025-27038
- Payloads extract cookies, messaging app databases, Keychain credentials, location data, photos
- Attributed to APT29 (Midnight Blizzard) by Sekoia
Why it matters: Backend and systems engineers should prioritize patching mobile devices, especially those used for work, to mitigate the risk of zero-click n-day exploits from sophisticated threat actors. This highlights the critical need for continuous security updates and vigilance against watering hole attacks.
N-day exploits continue to be a potent threat for sophisticated actors like APT29, requiring immediate patching of all mobile devices to prevent data theft.
🔗 Read more at BleepingComputer
Researchers Warned of North Korean Hacking Tactics Years Before Binance Heist
Security · TechCrunch · 2026-11-04
Binance confirmed that North Korean hackers employed a months-long social engineering scheme involving fake social media profiles and job offers to trick a software engineer into downloading malicious software. This ultimately led to the theft of $6.3 billion in crypto, prompting Binance to suspend customer withdrawals.
Researchers have consistently warned about these long-running social engineering attacks, a known tactic of the North Korean regime. Binance's own account indicates they faced at least 57 suspected attacks from North Korea, highlighting the persistent threat posed by state-sponsored actors.
Despite replacing a compromised laptop, hackers exploited stolen credentials to access internal tools and eventually compromise a third engineer with control over significant crypto assets. The incident underscores the ongoing challenge for companies to defend against sophisticated social engineering that bypasses security controls.
Key facts
- Binance confirmed a $6.3 billion crypto theft
- Hackers posed as recruiters for fake job offers
- Malware installed on a work-issued laptop
- Binance faced at least 57 suspected North Korean attacks
Why it matters: This reinforces the need for robust security training beyond basic phishing awareness, emphasizing the patient and multi-stage nature of state-sponsored social engineering. Engineers should be wary of any unsolicited software downloads or code repositories, even during seemingly legitimate interactions, and organizations must enforce strict access controls and zero-trust principles to limit lateral movement post-compromise.
Even with repeated warnings, sophisticated social engineering by state-sponsored actors remains a primary vector for major security breaches, demanding rigorous defense-in-depth and employee vigilance.
Next.js 16.4 Stabilizes ensureStatic for Enforcing Fully Static Route Output
Developer Tools · DEV Community · 2026-11-03
Next.js 16.4.0 has stabilized the ensureStatic guardrail, a feature designed to enforce fully static output for routes. This prevents scenarios where a route intended to be static becomes dynamic due to an unnoticed fetch() call or other dynamic content in a shared layout.
Before stabilization, this issue could lead to routes rendering on every request without developers realizing it until performance metrics degraded. The ensureStatic feature now explicitly checks for dynamic rendering conditions within a route and its subtree, refusing to ship routes that violate the static constraint. This helps developers maintain predictable performance and caching behavior, especially when using App Router and Server Components with cacheComponents: true.
Key facts
- Feature name:
ensureStatic - Stabilized in Next.js 16.4.0 (verified against 16.4.3)
- Prevents unintended dynamic rendering of static routes
- Relevant for App Router and Server Components users with
cacheComponents: true
Why it matters: Frontend and backend engineers working with Next.js App Router can now use ensureStatic to prevent subtle performance regressions caused by accidental dynamic content. This is crucial for optimizing build times, server load, and leveraging CDN caching effectively, ensuring routes perform as expected and don't silently become dynamic.
ensureStaticin Next.js 16.4 provides a critical guardrail to reliably maintain fully static routes, preventing silent performance degradation from dynamic content.
Anthropic Develops FlashProve, an Open-Source System to Cryptographically Verify AI Model Identity
Cloud & Infrastructure · TechCrunch · 2026-11-04
Anthropic announced FlashProve, an open-source system designed for "provable inference" to verify the identity of an AI model producing a given output. This system generates a cryptographic proof, akin to a mathematical guarantee, ensuring the output originated from the claimed model.
FlashProve aims to prevent AI companies from secretly substituting cheaper models or inflating performance results with more expensive ones. It can also verify claims by third parties that a task was performed by a specific advanced model. The system requires AI labs to publish a model "fingerprint" that does not expose internal weights, making it compatible with commercial models.
The system is designed for lightweight verification, allowing checks on local devices. Anthropic has released a detailed technical specification and working code on GitHub under an open-source license. Research is ongoing, with no immediate plans for deployment.
⚠️ Heads up: Research in the system is ongoing, and there are no plans to deploy it at Anthropic or any other lab.
Key facts
- System name: FlashProve
- Provides "provable inference" via cryptographic proof
- Fingerprints do not reveal model weights
- Open-source license, code available on GitHub
Why it matters: For engineers integrating third-party AI models or building AI-powered services, FlashProve could provide a critical trust layer, allowing verification of model integrity and preventing undisclosed changes or false claims about model usage. This could be particularly relevant for compliance and auditing in sensitive applications.
FlashProve offers a method to cryptographically verify AI model outputs, enhancing trust and transparency in AI model deployment and usage.
Google DeepMind Employees Urge Removal of Non-Disparagement Clauses on AI Risk Warnings
AI Models · Techmeme · 2026-11-04
Employees at Google DeepMind in the UK are advocating for the removal of non-disparagement clauses from employment agreements. These clauses currently restrict current and former employees from publicly raising concerns or issuing warnings about potential risks associated with AI, even after leaving the company.
The push from employees highlights an ongoing tension within the AI industry regarding ethical considerations, safety, and the ability of researchers and developers to speak freely about the societal impacts of advanced AI systems.
Key facts
- Google DeepMind employees in UK are making the request
- Targeting non-disparagement clauses
- Clauses prevent public warnings about AI risks
- Applies even after employees leave Google
Why it matters: This internal pressure reflects growing concerns among AI developers about the ethical and safety implications of their work. For AI engineers, the ability to openly discuss potential risks could foster more responsible development and public discourse, potentially influencing future regulatory landscapes and industry best practices for AI safety.
The debate over non-disparagement clauses at Google DeepMind underscores the internal conflict over transparency and AI risk reporting within major AI labs.
German Government Warns Lawmakers of Potential Spyware Attacks on iPhones After Apple Threat Notifications
Security · TechCrunch · 2026-11-03
The German government, through its federal cybersecurity office (BSI), has issued a warning to politicians and public figures regarding potential government-backed spyware attacks on their iPhones. This warning follows Apple's recent threat notifications, which were sent to users in 99 countries, including members of the Bundestag.
Apple's notifications alert users if they may have been targeted by sophisticated spyware, often using zero-click exploits that do not require user interaction. While Apple does not attribute attacks to specific governments or confirm compromises, the BSI advises that anyone receiving such a notification should assume their device may be compromised. The identity of the attackers and the specific spyware used remain unclear, but the incident highlights the ongoing threat of mercenary spyware to civil society.
Key facts
- German BSI issued the warning
- Targets include members of the Bundestag and other public figures
- Follows Apple threat notifications sent to users in 99 countries
- Spyware often uses zero-click exploits
Why it matters: This serves as a reminder for engineers, particularly those handling sensitive data or in high-profile roles, that personal devices can be targets of sophisticated state-sponsored attacks. Implementing enhanced mobile device security, including regular OS updates, reviewing privacy settings, and using secure communication channels, is crucial.
Even with advanced mobile security, government-backed zero-click spyware remains a persistent and global threat to high-value targets.
Quick hits
- DavidAU Releases Qwen3.8-27B-Ultimate-Heretic-Uncensored-Turbo-Brilliance-50x-AGI-NEO-GGUF Model on Hugging Face (Hugging Face) — A new fine-tuned model, Qwen3.8-27B-Ultimate-Heretic-Uncensored-Turbo-Brilliance-50x-AGI-NEO-GGUF, combines Fable Fusion 711 and Qwen 3.8 27B with additional AGI constructs.
- AMD Reports Strong Q3 Revenue Growth, Data Center Revenue Up 97% to $8.5 Billion (Techmeme) — AMD's Q3 revenue rose 45% year-over-year to $13.38 billion, exceeding estimates, driven by a 97% increase in Data Center revenue to $8.5 billion.
What to watch
- How will Binance improve its network security following the $6.3 billion heist, and will the North Korean group TraderTraitor face further international repercussions?
- Will Anthropic's FlashProve system gain adoption among other AI labs, and how will its open-source development progress towards a deployable solution for verifiable AI inference?
- What specific actions will Microsoft take to address the underlying issues that allowed BlackX to bypass Secure Boot, and will their guidance on UEFI protections become clearer?
Sources
- North Korean Hackers Used Fake Job Interview and Malware to Orchestrate $6.3 Billion Binance Heist — The Register, 2026-11-04
- BlackX UEFI Bootkit Bypasses Secure Boot on Fully Patched Windows Machines, Exploiting Microsoft's Vulnerability Fixes — Ars Technica, 2026-11-03
- Russian APT29 Group Uses N-Day Exploits in Zero-Click Attacks on iOS and Android Devices — BleepingComputer, 2026-11-04
- Researchers Warned of North Korean Hacking Tactics Years Before Binance Heist — TechCrunch, 2026-11-04
- Next.js 16.4 Stabilizes ensureStatic for Enforcing Fully Static Route Output — DEV Community, 2026-11-03
- Anthropic Develops FlashProve, an Open-Source System to Cryptographically Verify AI Model Identity — TechCrunch, 2026-11-04
- Google DeepMind Employees Urge Removal of Non-Disparagement Clauses on AI Risk Warnings — Techmeme, 2026-11-04
- German Government Warns Lawmakers of Potential Spyware Attacks on iPhones After Apple Threat Notifications — TechCrunch, 2026-11-03
- DavidAU Releases Qwen3.8-27B-Ultimate-Heretic-Uncensored-Turbo-Brilliance-50x-AGI-NEO-GGUF Model on Hugging Face — Hugging Face, 2026-11-04
- AMD Reports Strong Q3 Revenue Growth, Data Center Revenue Up 97% to $8.5 Billion — Techmeme, 2026-11-04