# Binance hack, Claude Code extension backdoor, Northflank and Mistral Large 4: what each source says > Source: > Published: 2026-10-30 18:15:00+00:00 Four developer stories from Friday, October 30, 2026, each read from its own primary source. The biggest is the theft from Binance, where three sources give three different totals. The video has the walkthrough; this article keeps the quotes, numbers and links in one place. TRM Labs published its analysis on October 29. It says an attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC, and that the preparation began at least 36 hours earlier. Elliptic's page, updated on October 30, counts $6.43 billion across 11 blockchains and notes that Binance has estimated the impact at around $6.3 billion. Elliptic values each transfer at the time of theft; TRM also gives a figure at current prices, about $6.23 billion. The totals differ because each firm prices and attributes the assets its own way; all of them agree the theft happened. Both call it the largest crypto theft on record, about four times the roughly $1.5 billion Bybit hack of February 2025. The mechanism on Ethereum, as Elliptic describes it, uses EIP-7702, a feature of the 2025 Pectra upgrade that lets an ordinary wallet delegate its behavior to a smart contract. The attacker submitted one transaction carrying 50 authorizations, each validly signed with the key of a Binance hot wallet and each covering a different nonce, so that one would match the wallet's transaction count when it landed. That handed control of the wallet to the attacker's sweeper contract, which emptied it about three and a half minutes later. TRM adds that the operator rehearsed the final version of its code on another wallet about four hours before installing it on a Binance hot wallet. On the other chains, funds left Binance wallets in ordinary signed transfers. TRM reads the pattern as a compromise of Binance's hot wallet signing infrastructure. Elliptic says the attacker appears to have been able to get Binance's own systems to sign transactions, without stealing its private keys. Binance's account has changed. Its first statement said the incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. A later update says the investigation has uncovered additional points of breach, and Binance has not said what they are. Elliptic compares this with the Bybit theft, where a developer's machine at the wallet provider Safe{Wallet} was the way in. What Binance and the tracing firms say about the aftermath: Binance says user funds are safe, deposits are unaffected, it will cover all losses, and withdrawals should resume within a day or two. Elliptic has verified $2.84 billion frozen, 44 percent of the theft, almost all of it USDT and USDC; TRM counts about $2.7 billion. The attacker is swapping the rest into assets that cannot be frozen. TRM attributes the theft to North Korea's TraderTraitor group with high confidence, Elliptic says North Korea-linked actors are likely responsible, and Elliptic notes that no government has yet confirmed attribution. For developers the practical lesson is in the machines around the keys. If you run a signing service, list which laptops, containers and services can ask it for a transaction, and what approves them. Cursor's security notice, dated October 29, says that between about 2:27 am and 1:35 pm Pacific a maliciously modified version of Anthropic's Claude Code extension was available in the Cursor extension marketplace. The package is `Anthropic.claude-code` version 2.1.313. Cursor says it was not developed by Anthropic and that at most 5,000 users were affected. According to Cursor, the extension collects the hostname, username, operating system, home directory path, environment variable names, working directories, configured Git email and public IP address. It then tries to add an attacker-controlled SSH key to `authorized_keys`, enable the local SSH service and open a reverse SSH tunnel, with persistence through a LaunchAgent on macOS or a scheduled task on Windows, and a retry roughly every 60 seconds. It reports back with an HTTP POST. Cursor says the attacker's server is offline; it worked with the hosting provider to take it down. Security firm Phorion's write-up adds that the injected code is prepended to the extension's `extension.js`, so it runs when Node loads the file, before the extension's normal `activate` function, with no click. Phorion also found a bug on macOS: the script checks whether Remote Login is off with a command that, without admin rights, prints an error and still exits successfully. The script only tries to turn SSH on when the output matches "Off", so it skips that step. Cursor's notice states the consequence: on most macOS and Windows hosts turning on SSH requires admin rights and fails, so the attacker could not have logged in through the tunnel. The extension still adds the key, installs persistence and sends host details. Follow the remediation steps regardless. Cursor's check for macOS is a one-line `grep` of `~/.ssh/authorized_keys` for the comment `svc-telemetry`. Cursor also warns that uninstalling the extension may not be sufficient because the payload drops standalone persistence scripts, and it provides removal scripts for macOS and Windows. It recommends rotating credentials reachable from affected hosts, from a trusted system. Cursor removed the version, shut down and rebuilt its marketplace, rotated its keys and found no other tampered extensions. It has no evidence that other versions or the official distribution are affected, and its notice does not say how the modified build reached the marketplace. Northflank's status page for the security incident gives a timeline in UTC on October 30: a Wiz threat alert at 11:43, engineers reviewing it at 11:44, an initial network policy patch at 12:02, more patching at 12:50 and 13:05, and a request for Wiz incident response support at 13:00. At 13:40 the page told customers to rotate environment variables immediately. At 13:58 it said to assume all environment variables have been decrypted and to disable or rotate all keys. It later added that multiple users are confirming their AI keys have been used. At 15:12 the page said secret rotation on Postgres and MongoDB had been enabled for all users, recommended disabling public expose on add-ons if it was enabled, and again told all users to assume their environment variables are decrypted. It lists secrets on workloads, secret groups and global secrets. The networking, certificates, services, add-ons, jobs, builds and logs components were listed in major outage while the app and API were operational. No post-mortem or cause had been published when this article was prepared, so how the attacker got in is not public. What to do, following the page: rotate every secret, starting with keys that bill per use such as AI provider keys, then look at each provider's usage page for calls you did not make. On October 6 the Daily Diff covered the preview of Mistral Large 4, with the weights promised for the end of October. Mistral released them on October 29. The model card describes a natively multimodal mixture-of-experts model with about one trillion total parameters and about 49 billion active per token (52 billion including embeddings), 128 routed experts with four active per token, a 1 million token context window, trained on 3,800 NVIDIA Grace Blackwell GPUs in Mistral's own European data centers. A quantized NVFP4 checkpoint targets Blackwell GPUs. The benchmark numbers come from Mistral's own post. It says Large 4 leads Cognition's private FrontierCode 2.0 at 19.7 percent, scores 41 percent on Terminal-Bench 4.0 (up 13 points from the preview, with 30 percent fewer output tokens), and is effectively tied with GLM-5.3 on the Artificial Analysis Coding Agent Index at 48 percent while using 47 percent fewer tokens per task. In Surge Code's blind pairwise preference test, Mistral says only Claude Opus 5.5 ranked ahead among the models evaluated. These are claims from Mistral's own chart; none is an independent result. The Mistral Ecosystem Open-Weight License is described in the file as a modified version of the MIT license, with permission granted free of charge for the model, weights and documentation. Clause two says that if the licensee or any of its affiliates operates a Model as a Service business, they must enter into a separate commercial license with Mistral before using the model or derivatives for any commercial purpose. The license defines Model as a Service as giving a third party access to the model or its derivatives for inference or post-training by any means, for instance via API or hosted endpoints, in a way that lets that party exercise meaningful control over inputs, parameters or training data. Clause three exempts internal use that does not make the model available to third parties, and use through Mistral's own products. Binance has not named its breach points, Cursor has not said how the build got in, Northflank has no post-mortem yet and the Mistral chart is Mistral's own. Read the primary sources below and act on the concrete checks each one lists. *This article expands on an episode of **The Daily Diff**, a five-minute daily video on what shipped and what broke in tech. [Watch the episode](https://www.youtube.com/watch?v=10-hKhOEQ68) · [Subscribe on YouTube](https://www.youtube.com/@dailydiffdev?sub_confirmation=1) · the written diff lands in your inbox every morning at [thedailydiff.dev](https://thedailydiff.dev).*