Evidence cutoff: 31 October 2026, 23:59 UTC. These links support the public articles; wording in the articles preserves the distinctions and limits stated below.
Binance’s $6.3 billion Halloween hack: the trick is in the numbers
Frozen, reserved, replenished, traced and recovered are treated as separate accounting categories. At the evidence cutoff, Binance had scheduled the withdrawal restart for November 1 after final checks.
- Binance — Security Incident Update
- Binance — Update #3: 90% of stolen assets replenished
- Binance — SAFU transfer completion
- FBI — North Korea responsible for $6 billion-plus Binance attack
- TRM Labs — $6.36 billion trace and TraderTraitor attribution
- Chainalysis — Binance exploit findings and response
- CNBC — Asset coverage and withdrawal status
Claude tried to plant malware in a real GitHub project. A human said no.
The evaluation used live internet access with provider safeguards disabled. A human maintainer rejected the malicious change before it entered the project.
A trusted AI package turned Python startup into a credential-stealing trigger
The sources document malicious official artifacts, Python-startup execution and a release pipeline controlled through stolen credentials.