North Korea stole $6.3 billion... and that’s not even the worst part Transcript, AI Summary & Key Points

00:00 Last week, while you were busy researching how to buy emergency rice and beans in bulk, a group of guys who technically aren't supposed to have internet access pulled off the largest theft in human history, a code editor owned by a rocket company spent 11 hours letting anyone SSH into your laptop. A prediction market got robbed in the middle of investigating its own customers for treason.

00:17 Anthropic showed that an unreleased cloud model could get root on any unpatched Linux server just by sending it TCP packets. In today's video, we'll break down just another Thursday in this godforsaken hell hole we're trapped in. It is November 3rd, 2026, and you're watching the code report. You know, I would love nothing more than to just talk about the latest JavaScript framework, but here we are again.

00:38 This time, it started last Thursday in the middle of the night when Cursor shipped a new official Claude code extension. Unfortunately, they shipped it without actually knowing they shipped it. that the extension would scan your machine for any keys or tokens it could find and then set up a back door for attackers to come in later and steal them. It was only up for about 11 hours, but that was still long enough for around 5,000 people to install it.

01:01 But thankfully, the back door required admin rights, which most people don't give to their text editor, and so the blast radius was pretty limited. And meanwhile, around that same time, users on Poly Market started noticing that their funds were being drained simply by logging into the website. Now, this isn't that unusual for Poly Market users, but what was unusual was this time it wasn't their fault.

01:19 It turns out a script from a company called Debug Bear that Poly Market uses for performance monitoring was hijacked to sell all your current positions before wiring the proceeds to a hard-coded wallet. The hackers ended up getting over $2 million worth of funds before Poly Market pulled the script, which seems like a lot until you realize it's just a small price to pay on the road to destroying the lives of millions of young men across the world.

01:41 Thankfully for Poly Market, the news didn't last long because just a few hours later, people started noticing something was up with Binance and it was way worse. In about 20 minutes, 6.3 billion with a B worth of crypto across 10 different blockchains left Binance's hot wallets, which makes this the biggest theft in recorded history. According to Binance, a DevOps laptop was compromised, which allowed the attackers to submit withdrawal requests, and then Binance's own system signed them.

02:07 The next day, the FBI came out and said they believe that the North Korean group Trader Trader was behind the attack, which was the same group that stole 1.5 billion from Bybit last year. The good news is that if you had money on Binance is that it stopped being your problem pretty quickly since crypto isn't actually decentralized. If Tether and Circle froze about $3 billion of the stolen stable coins within an hour and then Binance froze all withdrawals and spent the weekend refilling its wallets out of its own

02:34 treasury and insurance funds. But by Sunday, withdrawals were back on and yesterday they posted proof of reserves showing everyone's balance was fully backed again. The to which the users responded by kindly withdrawing 3.6 billion from Binance anyway. And that wasn't even the worst part of the week. Back in early October, a Linux kernel maintainer named Eric Dumisette pushed a simple twoline fix that delayed freeing some memory until the colonel is sure nothing is still reading it.

02:58 At the time, it didn't seem like a big deal, and nobody really paid attention to it until a few weeks later when it got a 9.8. 8 out of 10 on the CVSS scale, which is the industry's way of ranking how bad a security bug is. It turns out that since 2016, every Linux kernel has had a bug in the code that handles new TCP connections. The way it works is every connection starts with the client sending a hello packet and the server sending one back.

03:23 Normally, that first packet is pretty uninteresting, but you're allowed to attach a few extra options to it if you want the kernel to save those so it can use them when it builds its reply. The problem is that if the client sends the same hello twice at just the right moment, the two parts of the kernel end up working on the same connection at once and one of them can free that saved memory while the other one is still reading it.

03:43 And so the server ends up building its reply out of memory that's already been freed, which means whatever else got written there in the meantime ends up in the reply. And if an attacker controls what that is, they can control what the colonel does next. Now, getting that timing right is pretty tricky, which is why Red Hat initially rated it as a moderate 5.9 and figured the worst case scenario was that the kernel would just crash.

04:03 Because if the exploit only works in one in a million tries, it's basically safe as long as the person trying it gets bored and runs out of money. The problem is that world no longer exists, which is exactly what Anthropic proved on October 27th when its red team published a post saying they handed the bug to an unreleased claude model. And in about 48 minutes, the model had hit the timing enough times to get the server to leak a kernel memory address back to it.

04:25 And just 5 minutes after that, it was able to start running commands as root. The Debian and Oracle had patched kernels out within one day of the CVE. Red Hat took another two weeks to decide it was serious and finally shipped fixes over the weekend and Ubuntu still doesn't have one. But at least you can protect your own code base with Code Rabbit, the sponsor of today's video.

04:43 They got tired of seeing me make videos about new exploits hitting the timeline every week like this. So they just launched Code Rabbit Secure to provide continuous code security that's powered by actual reasoning instead of brittle reggex rules that their security agents are designed to think like an attacker in order to hunt for real vulnerabilities across your entire codebase.

05:01 Then it prioritizes actual risks based on reachability, exploitability, and blast radius. and it explains the problem to you in plain English and suggests a fix you can approve in merge from the diff. The Code Rabbit Secure reviews every PR before merge and you can also schedule deep scans across your full codebase to protect your back door 24/7. This start with a free 14-day trial at the link below. No credit card required. This has been the Code Report. Thanks for watching and I will see you in the next one.