The Week $6.3 Billion Was Stolen in Twenty Minutes

North Korea pulls off the biggest crypto theft on record, a spy plot around Nvidia's CEO, Europe rewrites the rules on your data, Tailscale's PoCs go public without warning, and one packet that could own almost every server on earth.

Welcome to Friday. If your week felt like one long stream of "BREAKING", you weren't imagining it. Money moved faster than anyone could freeze it, a privacy law bent toward AI, and some of the most basic layers we build on turned out to have cracks in them.

The thread running through it all is trust in the things we don't look at. A hot wallet trusted its own signatures. Servers trust the network they boot from. Users trust that "encrypted" on the box means encrypted in the box. This week, a lot of that trust got tested at once. So pour something nice, and let's go through it.

1. North Korea's $6.3 billion Binance heist

It started on Thursday evening with about $2.5B leaving a single Binance hot wallet in one transaction to a brand-new address, triggered by a wallet funded through Tornado Cash. By Friday, blockchain analysis firm TRM said North Korea's TraderTraitor unit was behind it: $6.3B taken from hot wallets on 10 blockchains, mostly in about 20 minutes, the largest crypto theft on record. Tether and Circle froze about $1.8B in stablecoins, but the $1.4B in bitcoin was split within minutes into 19 wallets that no one can freeze.

The attacker submitted 50 authorisations signed with the wallet's own private key under Ethereum's EIP-7702, each only valid for one transaction number, because the wallet was still busy and they couldn't predict which number would be live. One matched, installed a sweeper contract, and minutes later the wallet was emptied of $1.6B in USDT, 167,464 ETH and 60+ other tokens. Only that key, or the system holding it, can produce those signatures, and how the attacker got them is still unknown. Binance says user funds are "completely safe" but hasn't explained how. Until it does, the real question isn't the size of the number but what happened inside the signing system.
See our post

2. US officials believe Nvidia's CEO is the target of a Chinese spy plot

US officials believe Jensen Huang is the target of a Chinese intelligence operation. They believe Alice Huang, a Megaspeed executive seen at his side in Taiwan, is a Chinese intelligence asset, and President Trump has been briefed.

3. Europe moves to let AI train on your personal data without consent

EU governments approved a GDPR change that would make AI training a possible "legitimate interest", judged case by case, so companies could train on Europeans' personal data without asking. Privacy group noyb says OpenAI, Google and Meta could tap decades of collected data with almost no limits, and Max Schrems calls it a "digital expropriation" of Europeans.

GDPR was built on the idea that you decide what happens to your data. "Legitimate interest, judged case by case" quietly shifts that decision to the company and, after the fact, to a regulator. That last step, Parliament, is where this is still open, so if you work in privacy or just care about it, this is the one to watch over the coming months.

4. Eleven Tailscale flaws dumped online, without responsible disclosure

Researcher Erica Windisch skipped coordinated disclosure and published 11 unpatched Tailscale flaws. In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node to the network. When our post picked up a Community Note doubting it, Tailscale itself called them "serious security issues", saying a user let in on an ordinary account may gain elevated privileges, with a patch due the same day.

If you run Tailscale SSH, check that you're on the patched release, and take a fresh look at who can join your tailnet and with what rights.

5. One packet that hijacks a server before Secure Boot even looks

Researchers from Anthropic and Google found a flaw that lets a single crafted packet hijack a server during network boot, before Secure Boot checks the operating system. CVE-2026-97631 sits in TianoCore EDK II, code that lives in the UEFI firmware of most servers, which is why almost all servers on earth are affected.

Firmware fixes move slowly, through every hardware vendor's own update cycle, so expect a long tail here. In the meantime, if you don't need network boot (PXE) on a machine, switching it off is recommended.

Also worth your attention

A developer dared anyone to steal a Bitcoin key from a server left unpatched against the PHP2Shell flaws; a hacker cracked it in 19 hours, only to find the creator had loaded the wrong key.

https://x.com/IntCyberDigest/status/2114387760912159083

Proton's CEO called a staffer's plea to pentest new code before release "bullshit and loser thinking", as its CTO said AI wrote 90% of its code in October.

https://x.com/IntCyberDigest/status/2115821962073137276

Lenovo's "hardware encrypted" ThinkPlus FU100 fingerprint stick turned out to hold an ordinary, unencrypted SD card, and Lenovo's stopgap fix was to cover it in epoxy.

https://x.com/IntCyberDigest/status/2115898968597012674

Sam Altman told Stanford students he no longer thinks the industry can "just patch all the bugs", saying most leaders patched after Claude Mythos and moved on while "the models have kept going."

https://x.com/IntCyberDigest/status/2113736972279611452

A bug bounty hunter says they rooted their Samsung TV and found an AI model tracking what they watch and the ads they skip.

https://x.com/IntCyberDigest/status/2114356807741104266

Before you log off

If there's one thing to carry into the weekend, it's that the scariest stories this week weren't about clever new tricks. They were about things we were told to trust: a signing key, a boot process, a label on a USB stick, a law that was meant to protect us. As a follower of us put it:

So here's a small, very doable assignment: pick one thing you rely on and have never actually checked. The firmware version on a server, the devices in your tailnet, the encryption claim on that drive in your drawer. Check it.

Tonight, close the laptop. You've earned it.