Binance says the record theft of about RM25.6 billion (US$6.3 billion) on 29 October began months earlier with a fake AI coding tool and a fake job interview. In the same week, a tampered Claude Code Extension A small add-on you install into an app, such as a browser or a code editor, to give it extra features. sat in Cursor's app store for about 11 hours.
Key points
- How it started: in June, a Binance engineer looked for a popular AI coding tool and installed a tampered copy from a fake download page. In September, in a Social engineering Tricking people, rather than computers, into giving access or running something harmful, for example with a fake job offer. trick, fake recruiters gave another engineer a coding test with hidden Malware Harmful software that steals data, spies on you or damages your computer.. The attackers then moved through Binance's own internal AI tools to the system that approves money transfers (Binance's report, via CNBC).
- Binance says it has put back 98% of the money from its own funds, and about RM11.6 billion (US$2.85 billion) has been frozen or seized. The FBI blames a North Korean hacking group called TraderTraitor. North Korea denies it.
- On 29 October, a tampered copy of the Claude Code extension was live in Cursor's extension store for about 11 hours and reached at most 5,000 users. It tried to plant a hidden Backdoor A hidden way into a computer or system that lets an attacker get back in later without the owner knowing. into their computers, a classic Supply chain attack A hack that hides harmful code inside a tool or update people trust, so it reaches many users at once.. Removing it is not enough: Cursor says to update to version 2.1.314 or later (Cursor, WIRED).
- AI also finds Vulnerability A weakness in software that an attacker could use to break in or cause harm. faster. Anthropic says an unreleased Claude model found and used a Linux bug that gives an attacker Root access Full control of a computer, able to read, change or delete anything on it., or full control, on some servers, in about 53 minutes by Fireship's count. A fix is out.
- Close to home: Prime Minister Anwar warned on 3 November that Malaysia could be a target for cyberattacks, and Bank Negara is meeting the banks about it (Lowyat.net, citing The Edge).
Why it matters: Attackers now go after the tools people install to use AI. Download AI tools only from the official site, be wary of coding tests from recruiters you don't know, and keep updates switched on.
Sources (6)
- Binance co-CEO Teng says hackers used fake job interviews to steal $6.3 billion in crypto · CNBC
- North Korea responsible for $6 billion Binance attack · FBI
- Claude Code extension security notice · Cursor
- Trojan malware targets thousands of Anthropic Claude developer systems · WIRED
- Fireship on AI-found Linux bugs and recent hacks · Fireship
- Anwar: Malaysia could be a target for cyberattacks · Lowyat.net




















