Hacker group Lazarus Group is transferring large amounts of Bitcoin (BTC), and moved 262.2 BTC to a new address two hours ago.

Beating AI News (Insight) reports: Cursor disclosed that on October 29, a maliciously tampered version of Claude Code 2.1.313 appeared in its extension marketplace. The installer was not created by Anthropic and was listed on the store for roughly 11 hours. Cursor estimates up to 5,000 users were affected and will contact them directly. Security research firm OpenSourceMalware analyzed the incident and found attackers inserted 66 lines of malicious code before the plugin’s legitimate code. The malware executes as soon as the editor loads the extension—no interaction with Claude is required. It collects device details including the computer name, Git email, and public IP, and secretly adds the attacker’s SSH key to the system’s authorized list. The malware then attempts to enable remote login, connect to the attacker’s server via a reverse SSH tunnel, and sets up a background task to run on startup, trying to reconnect every 60 seconds. However, the malicious code contains bugs. Cursor noted most Mac and Windows devices lack the admin privileges needed to enable SSH, so attackers generally cannot log in via the tunnel. Still, adding the malicious key, installing the background script, and exfiltrating device information may succeed. Even devices with SSH enabled are not safe. Cursor has removed the malicious extension, temporarily shut down its entire extension marketplace, and assisted in taking down the attacker’s server. Affected users must check their SSH authorized files for `svc-telemetry` and clean up using the official fix script; uninstalling the extension alone is insufficient, as the backdoor may persist.

According to EmberCN’s monitoring, an address starting with 0x15a liquidated $100 million in BTC and ETH long positions on Hyperliquid, earning a profit of $17.78 million. The address subsequently opened a short position of 20,000 ETH at $2,228, valued at $44.6 million. The address had opened long positions of 1,000 BTC at $62,353 and 10,000 ETH at $1,762 in early July 2026, holding the positions for nearly four months.

Metaplanet CEO Simon Gerovich posted a statement expressing support for Binance and all teams working diligently to address the incident, noting that industry participants should unite and collaborate during such times. Gerovich emphasized that the incident has not affected Bitcoin itself, pointing out that the Bitcoin network has operated normally in accordance with its established protocol since 2009. Additionally, all Bitcoin held by Metaplanet is stored in cold wallets and safeguarded by leading regulated custodial institutions in the sector.

According to TradingBeats monitoring, a review of trading activity and positions across Loracle’s main account and seven sub-accounts shows that as of press time, the main sub-account’s combined trading volume for new and increased short positions today totals approximately $48.38 million: - ETH: New short position opened today, trading volume ~$22.82 million, current position ~$22.52 million, average price $2,262.70 - Nvidia: New short position opened today, trading volume ~$8.37 million, current position ~$8.34 million, average price $208.57 - Oracle: New short position opened today, trading volume ~$2.19 million, current position ~$2.18 million, average price $134.06 - NEAR, PEPE: Added ~$10 million and ~$5 million in short positions respectively On the long side, the same sub-account added 123.12 BTC today with a trading volume of ~$10 million. It currently holds 718.34 BTC in long positions worth ~$56.1 million, at an average cost of $84,948, for an unrealized loss of ~$4.92 million. The sub-account also added ~$570,000 in XMR, bringing its current XMR long position to ~$15.54 million. Other accounts: The main account still holds ~$9.59 million in HYPE short positions, with no relevant trades recorded today. Sub-account 0x2ed0 primarily added short positions in PAXG, SOL, DOGE and XRP, with net selling volume per asset ranging from $140,000 to $320,000. Stock sub-account 0xdba0 added small long positions in Intel, Samsung and SOXL, and covered some Nasdaq short positions, with individual buy volumes ranging from $4,000 to $10,000. The remaining four sub-accounts currently hold no perpetual positions. Collectively, the eight accounts hold ~$77.23 million in long positions and ~$75.07 million in short positions, with a total unrealized loss of ~$10 million.

Binance has issued an update on its security incident investigation, stating that initial probes pointed to a potentially compromised laptop, but subsequent investigations uncovered additional intrusion vectors. This was a complex attack; Binance is coordinating with law enforcement authorities to address the matter, and facts are still being verified. Updates will be shared via official channels once confirmed. The exchange reaffirmed that all losses will be covered by the SAFU Fund and corporate funds, ensuring user funds are safe. Withdrawal services are expected to resume in approximately 45 hours, while deposits remain unaffected. Fund outflow has been halted following the withdrawal suspension, and roughly $3 billion in affected assets have been frozen in collaboration with partners.

Pundi X Labs announced that following the Binance hack, Binance reached out to it to assist in freezing stolen PUNDIX tokens. To date, Pundi X has frozen all 3,747,276 PUNDIX tokens identified in the hacker’s wallet, valued at approximately $365,500. The project noted no other known hacker wallets holding affected PUNDIX tokens have been detected, and it will continue to contribute to safeguarding the crypto ecosystem. The announcement also published the address of the involved hacker wallet: 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c.