Binance hack, a tampered Claude Code extension in Cursor's marketplace, the Northflank incident and Mistral Large 4: four developer stories in one Daily Diff

What this video covers

• Binance wallets on ten blockchains sent funds to addresses controlled by one attacker on October 29, 2026, most of it within about 20 minutes starting around 20:05 UTC, according to TRM Labs. TRM counts about USD 6.36 billion, Elliptic USD 6.43 billion (values at the time of theft) and Binance has estimated around USD 6.3 billion; TRM and Elliptic both call it the largest crypto theft on record, about four times the roughly USD 1.5 billion Bybit hack of February 2025.
• Elliptic describes the Ethereum mechanism: one transaction carried 50 authorizations signed with the key of a Binance hot wallet, each for a different nonce so that one would match, using EIP-7702 from the 2025 Pectra upgrade to delegate the wallet to the attacker's contract, which emptied it minutes later. On the other chains funds moved in ordinary signed transfers, which TRM reads as a compromise of Binance's signing infrastructure. Binance's first statement mentioned a compromised DevOps engineer's laptop and a service container; a later update said there were additional points of breach and did not name them.
• Binance says user funds are safe, deposits are unaffected, it will cover all losses and withdrawals should resume within a day or two. Elliptic counts USD 2.84 billion (44 percent) frozen and TRM about USD 2.7 billion. TRM attributes the theft to North Korea's TraderTraitor group with high confidence, Elliptic says it is likely, and no government has confirmed attribution.
• Cursor's security notice says Anthropic.claude-code version 2.1.313 in the Cursor marketplace was maliciously modified, not written by Anthropic, and available from about 2:27 am to 1:35 pm PT on October 29, 2026, with at most 5,000 users affected. The injected code runs when the extension file loads, collects host details, tries to add an SSH key, open a reverse tunnel and persist; Cursor says the SSH step fails on most machines but the key, persistence and host report still happen, and that the attacker's server is offline. Check authorized_keys for the comment svc-telemetry. The notice does not say how the modified build got in.
• Phorion's analysis finds a bug in the malware: on macOS it checks whether remote login is off with a command that, without admin rights, prints an error and exits successfully, so the script skips enabling SSH. Cursor removed the version, shut down and rebuilt its marketplace, rotated keys and found no other tampered extensions.
• Northflank's status page for the security incident lists a Wiz threat alert at 11:43 UTC on October 30, 2026, a first network patch at 12:02, a request to rotate environment variables at 13:40 and, at 13:58, an instruction to assume all environment variables have been decrypted and to disable or rotate all keys. It says multiple users confirm their AI keys have been used and that secret rotation for Postgres and MongoDB was enabled for all users at 15:12. No post-mortem was published when this page was prepared.
• Mistral released the weights of Mistral Large 4 on October 29, 2026: about 1 trillion parameters in a mixture-of-experts design with roughly 50 billion active, trained, Mistral says, on 3,800 Nvidia Blackwell chips. The Mistral Ecosystem Open-Weight License is a modified MIT license; a business that offers the model to third parties as a service through an API or hosted endpoints needs a separate commercial license, and internal use is exempt. Benchmark results such as 19.7 percent on FrontierCode 2.0 and 41 percent on Terminal-Bench 4.0 are Mistral's own claims.

Transcript

Cold open: whose signature moved Binance's money?

0:00 Crypto security is supposed to mean guarding the private keys. In Binance's case, Elliptic says the attacker got Binance's own systems to sign billions of dollars of withdrawals. In this video, four stories. How did attackers get Binance to sign withdrawals itself? What did a tampered Claude Code extension try to install? What should you rotate after Northflank? And what does Mistral's license let you do with a trillion parameters?

0:24 There is also one clause in one of these stories that decides who may host a trillion parameter model. I will save it for the end. It's Friday, October thirtieth, and this is The Daily Diff. A hot wallet is the crypto wallet an exchange keeps online so withdrawals go out instantly. Think of the cash drawer at a bank, except the drawer is connected to the internet. Story one.

Story one: how did attackers get Binance to sign the withdrawals?

0:43 On Thursday evening, Binance wallets on ten blockchains started sending their balances to addresses controlled by one attacker. TRM Labs says most of it left in about twenty minutes, beginning at five past eight UTC. The total depends on who counts. Binance estimates about six point three billion dollars. TRM counts six point three six, and Elliptic counts six point four three. Either way it is the largest crypto theft on record,

1:09 roughly four times the Bybit hack from twenty twenty five. Elliptic describes the mechanism. On Ethereum, one transaction carried fifty authorizations, each signed with that hot wallet's key and each with a different transaction counter, so one was sure to match. A feature from the twenty twenty five Pectra upgrade then handed the wallet to the attacker's contract, which emptied it three and a half minutes later. How did the attacker get Binance to sign?

1:37 Binance's first statement said a DevOps engineer's laptop may have been compromised, giving access to a service container that could submit unauthorized withdrawals. A later update says there were additional points of breach and does not name them. Bybit's way in was also a developer's machine, Elliptic notes. Binance says user funds are safe, deposits are unaffected, and it will cover all losses. Withdrawals are paused and expected back within a day or two.

2:02 Elliptic counts forty four percent frozen. TRM attributes the theft to North Korea's TraderTraitor group with high confidence, Elliptic says likely, and no government has confirmed it. The lesson sits in the machines around the keys. I would audit what can ask your signing system for a transaction. Story two. On Thursday, for about eleven hours, the Cursor extension

Story two: what did the tampered Claude Code extension try to install?

2:23 marketplace served a modified build of Anthropic's Claude Code extension, version two point one point three one three. Cursor says Anthropic did not write it, and that at most five thousand people installed it. The injected code sits in front of the extension's normal code, so it runs the moment the editor loads the file, with no click. Cursor says it collects the hostname, username and environment variable names, tries to add an attacker's SSH key, and tries to open a reverse tunnel that retries every minute.

2:53 The odd detail is a bug, found by the security firm Phorion. On a Mac, the script checks whether remote login is off with a command that, without admin rights, prints an error and still reports success. The script never sees the word off, so it assumes remote login is on and skips turning it on. Cursor says the login step fails on most machines, though the key, the persistence and the report still happen. If you updated on Thursday, search your SSH authorized keys file for the comment

3:21 S V C telemetry. Cursor says uninstalling the extension may not be enough, because the payload drops its own scripts, so use its removal scripts and rotate credentials from a trusted machine. Cursor shut down and rebuilt its marketplace, and the attacker's server is offline. Its notice does not say how the modified build got in.

Story three: what should you rotate after the Northflank incident?

3:39 Story three. Northflank runs services, databases and builds for developers. Its status page lists a security incident, and the timeline begins at eleven forty three UTC on Friday, with an alert from the security company Wiz. Nineteen minutes later came the first network patch. By one forty customers were told to rotate environment variables immediately. Eighteen minutes after that the message changed to assume every environment variable has been decrypted, and disable or rotate all keys. Then the line that touches your bill.

4:10 The page says multiple users are confirming that their AI keys have been used. By three twelve, Northflank had switched on secret rotation for Postgres and MongoDB add-ons for all users, and it recommends turning off public exposure on those add-ons if you enabled it. Networking, builds and add-ons are listed as in major outage, and there is no post-mortem yet, so how the attacker got in is not public. Rotate every secret on workloads, secret groups and global secrets,

4:37 starting with keys that bill per use, like AI provider keys. Then check each provider's usage page for calls you did not make.

Story four: what can you do with the Mistral Large 4 weights?

4:45 Story four. On October sixth I told you Mistral Large 4 was in preview and the weights were promised for the end of October. On Thursday the weights landed, with two days to spare. Mistral nicknames it Le Chonk, which suits a model with a trillion parameters. Hacker News gave the announcement over sixteen hundred points. It is a mixture of experts. Of its one trillion parameters, about fifty billion are active for each token, using four of a hundred and twenty eight experts.

5:11 Mistral says it trained the model on thirty eight hundred Nvidia Blackwell chips in its own European data centers. The benchmark chart is Mistral's. It says Large 4 leads Cognition's private FrontierCode test at nineteen point seven percent, and scores forty one percent on Terminal Bench four. On the Artificial Analysis coding index it ties the best open model while using forty seven percent fewer tokens.

5:33 Only Claude Opus 5.5 beat it in a blind human preference test, Mistral says. Now the clause I saved. The license is a modified MIT, free for commercial and non-commercial use. But a business that gives third parties access to the model through an API or hosted endpoints needs a separate commercial license from Mistral. Using it inside your own company is exempt. If you'd rather read this than hear me say it, the diff lands in your inbox

6:02 every morning, free at the daily diff dot dev, link below. So today's verdict is NEEDS REVIEW.

Verdict: NEEDS REVIEW

6:08 I'd review it because Binance has not named its breach points, Cursor has not said how the build got in, Northflank has no post-mortem yet, and the Mistral chart is Mistral's own. Tell me in the comments if you'd have stamped it differently. And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.

Sources

1. North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in HistoryTRM Labs
2. The largest theft in history: North Korea likely behind the $6.4 billion Binance hackElliptic
3. The $6.3 Billion Binance Hack Was Pulled Off in Just 20 MinutesWIRED
4. Blockchain intelligence firms link North Korea to $6.3B hack on BinanceAP via NPR
5. Security notice: malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension MarketplaceCursor
6. Official Claude Code Extension Compromise: Security AdvisoryPhorion
7. Northflank security incidentNorthflank status page
8. We're releasing the weights of Mistral Large 4Mistral AI
9. Mistral-Large-4-1T-A52B model card and licenseHugging Face (Mistral AI)