One engineer, one coding assignment from a recruiter who didn't exist, and about six weeks later, roughly six point three billion dollars in crypto was gone. You're listening to Lantern Cybersecurity Daily, and it's Wednesday, November 4th. On the rundown: Binance explains how its October 29 theft happened, a server security tool's own update channel delivers a credential stealer, and the ARTEX AI framework turns up in another breach, this time at WorkOS.
BleepingComputer, on the incident report Binance published Tuesday:
By October 20, the attackers had used the compromised engineer's computer and an internal AI tool to compromise two additional employees working on Binance's wallet infrastructure, obtaining credentials and a container deployment token. On October 29, the hackers used the stolen credentials to deploy a malicious script and gain unauthorized access to Binance's wallet signing service, allowing them to transfer billions of dollars in cryptocurrency across multiple blockchains.
This is Binance's own account. The FBI attributes the theft to the North Korean state-backed group TraderTraitor, also tracked as Lazarus. Binance says it started in September. Someone posing as a recruiter approached a software engineer through a real job platform, set up two interviews, and the second one ended with a coding assignment to download from a code repository. And the homework turned out to be the payload. According to Binance, the malware swapped out the pyenv executable in the engineer's Homebrew directory on macOS, so a normal developer tool became the attackers' command channel. Endpoint protection didn't catch it. For defenders, the key point is that the first laptop wasn't where the money was. The attackers moved from it to two people who worked on wallet infrastructure, collected credentials and a deployment token, and used those to reach the signing service. Binance also says they abused Ethereum's EIP-7702 authorization mechanism and kept draining funds after withdrawals were suspended. So if you run a small team, you probably aren't guarding billions, but you do have developers who take coding tests from strangers. The question is how far a single developer's credentials can reach. Binance says it has rebuilt the affected systems and revoked the stolen credentials, and that about two point eight five billion dollars had been frozen or intercepted as of November 3rd. Independent firms are reviewing its findings, so for now the details come only from Binance.
Next, BleepingComputer on a compromised security product:
OpsShield, the cPGuard developer, published an alert earlier today saying the attack began on November 2 at 02:06 UTC and affected versions 5.88.12 through 5.88.19. The vendor says that it detected the compromise and stopped the malicious distribution within 12 hours after the attacker pushed the compromised cPGuard versions.
cPGuard is malware scanning and firewall software for Linux web servers, and it's popular with hosting companies and admins who run cPanel, DirectAdmin or Plesk. OpsShield says the attacker logged into its update CDN with compromised credentials. It doesn't yet know how those credentials were obtained. So the tool you installed to protect the server is the thing that robbed it. The script collected Linux password hashes, the root database configuration, root shell history, and root's SSH authorization and known-hosts files. A company spokesperson told BleepingComputer that 2,946 servers were affected, and that OpsShield's billing database was copied too. OpsShield has published specific steps. Update every cPGuard server to version 5.88.25 or later, which the company says removes the backdoor and the staged files. Then reset passwords and rotate database credentials, cloud secrets and SSH keys. OpsShield is clear that updating won't make stolen credentials safe again. Small teams can't ignore this one. If any of your servers updated during that roughly twelve-hour window, assume the secrets on it have been exposed. OpsShield says some servers may not have checked in during that window, but it can't confirm which ones. Do the rotation.
And BleepingComputer on a breach at a developer identity platform:
Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications. According to the company, the attacker used an AI offensive security framework to automate reconnaissance and exploitation attempts. Based on evidence from the investigation, no WorkOS app data or production services were accessed or affected.
Yesterday we covered CrowdStrike's report on ARTEX, the multi-agent penetration-testing framework it tied to a campaign against more than two hundred organizations. WorkOS founder Michael Grinich now says ARTEX was used against WorkOS too. Investigators found user agents including artex-enrich in the attacker's web requests. WorkOS says it spotted unauthorized access to an internal sales app on October 30th. WorkOS handles single sign-on and user management for at least three thousand companies, including OpenAI, Anthropic and Cursor, so the next part matters. The company says no app data or production services were touched. What leaked was CRM contacts, account histories, and summaries and excerpts from sales calls, support threads and customer Slack conversations. That's still useful material for a phisher, since a fake message that cites your real support history is far more convincing. WorkOS is warning customers about social engineering and says it will notify affected customers directly. One thing to be careful about: the tool is the same, but nobody has connected this attacker to Vapor Panda. Forks of ARTEX kept circulating after it went private. Grinich says the incident is fully contained and has promised more detail once the investigation is done.
A quick recommendation. If you want to know what the systems we keep talking about actually run on, try The Data Center Daily, our sister show. It's a daily briefing on AI compute: hyperscaler spending, the power grid, semiconductor supply, and the energy markets being reshaped by AI at scale.
Here's today's checklist. Treat coding tests from strangers as untrusted code, rotate everything on any cPGuard server that updated on November 2nd, and if you're a WorkOS customer, be suspicious of any message that knows a little too much about your account. Same time tomorrow. Lantern Cybersecurity Daily comes to you from Lantern Podcasts. Take care out there.