Binance's incident report describes the $6.34 billion theft as a campaign spanning several months, rather than a single breach. In June, a wallet engineer installed a tampered Homebrew package. Binance replaced the device and rotated credentials, but the attacker had already identified members of the wallet infrastructure team. In September, a second engineer ran a fake interview assignment on a work laptop, allowing malware to replace pyenv without detection by endpoint security tools. On 20 October, the attacker used an internal AI tool to contact two engineers and obtain a container deployment token. Binance has not explained how the tool provided this level of access. Transfers began on 29 October at 20:05 UTC. The attacker used 50 signed transactions to establish an EIP-7702 delegation that remained active on-chain after withdrawals stopped. Because the hot wallet uses multi-party computation (MPC), Binance had no single key with which to revoke the delegation immediately. It cleared the delegation at 00:10 the following day. Partners froze or intercepted approximately $2.85 billion, and Binance says it will cover users' losses. The FBI has attributed the theft to TraderTraitor, a North Korean operation linked to Lazarus Group. North Korea denies responsibility.

The XCPE takedown addressed a botnet embedded in hardware before it reached customers. Google and its partners dismantled a network involving more than 1.3 million Android TV set-top boxes, which shipped with malware that rented out users' internet connections and conducted advertising fraud. The Google Threat Intelligence Group and other researchers concluded that Chinese manufacturer Videostrong Technology was responsible for incorporating the malware into the devices. Experts involved in the operation say the disruption is likely to cut off the botnet's access to more than 10 million further compromised systems, including Android-based healthcare devices and karaoke machines. Owners of the affected set-top boxes had no opportunity to avoid the initial infection: the malware was already part of the product as sold.

The cPGuard compromise exploited a security product's own update channel. On 2 November, an attacker breached the update system and distributed a malicious script to customers' Linux servers. According to developer OPSSHIELD, the script installed a backdoor and collected password hashes and other sensitive files from servers on which it ran. The attacker has since taken some of that data. Because the script was delivered through the product's normal update mechanism, affected servers received it as a routine software update, turning the security tool's trusted distribution channel into the route for compromise.

Binance disclosed that attackers first compromised a wallet engineer through a tampered Homebrew install, which revealed who worked on the wallet team. A fake recruiter then gave a second engineer a coding assignment that ran malware on a work laptop. Using an internal AI tool, the attacker took a deployment token and signed transactions through the wallet signing service.

The National Cyber Security Centre's State of the Cyber Nation report assesses that an AI-powered ransomware attack on UK critical national infrastructure is highly likely by 2028. It says hostile actors' AI adoption will probably increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation. The report adds that AI is exposing long-tolerated weaknesses, such as underinvestment and unnecessarily internet-connected technology, rather than creating new attack methods.

Attackers remotely altered refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other countries overnight into 2 November, heating fridges and freezers. Some stores discarded or removed chilled and frozen food, with affected chains reporting no more than several dozen stores each. Danfoss said its products were involved, as in an earlier attack on French supermarkets, though no group has claimed responsibility.

mSeven Software, maker of the mSecure password manager, emailed customers on 3 November 2026 about suspicious activity linked to the application. The company said it has launched an investigation with external cybersecurity experts, but has not stated what data was affected. The notice advises changing passwords, re-enrolling two-factor authentication methods and removing existing passkeys, prompting user questions about the scope of the incident.

Threat actors are using stolen cloud identity tokens and exposed API keys to hijack enterprise access to large language models, generating fraudulent charges of over $100,000 in a single day. Some victims accumulated cumulative charges of $1 million before access was revoked. The stolen access is pooled through so-called LLM Mixers, which proxy and resell it to underground subscribers.