BREACH & RANSOMWARE

Threat actors compromised BTCPay Server installations running version 2.4.1 or earlier, draining Bitcoin and Litecoin from hot wallets. The breach demonstrates how lagging software updates can breach control‑area requirements for patch and vulnerability management, a key audit evidence point.

Attackers remotely changed temperature settings on refrigeration units in more than 115 stores across six European countries, leading to product loss and operational downtime. The incident underscores the need for robust OT access controls and continuous monitoring to satisfy audit‑ready control objectives.

Supermarket refrigeration systems in Belgium, Luxembourg, Sweden and Estonia were remotely set to 50 °C, destroying perishable stock. The incident underscores the importance of secure configuration and continuous monitoring of OT assets for audit readiness.

Chainalysis confirmed that attackers accessed user IDs, names, emails, and role labels on its platform. The breach underscores the importance of strong access‑control and MFA enforcement for audit readiness.

Synology reports a wave of C3RB3R ransomware attacks that target NAS devices running outdated DSM software. The ransomware leverages a December 2024 patchable vulnerability to encrypt files, highlighting the need for robust patch‑management controls for audit readiness.

Attackers impersonated IT support on Microsoft Teams, gained remote desktop access, and abused insecure Active Directory Certificate Services to issue privileged login certificates, leading to corporate data exfiltration. The breach underscores the importance of robust privileged‑access controls and secure certificate‑issuance processes for audit readiness.

Hackers breached the emergency‑alert apps of Ukraine and Russia, broadcasting false nuclear and chemical threat alerts that caused public panic. The episode underscores the importance of strong access controls and continuous monitoring for critical public‑safety systems.

The FBI confirmed that the North Korean “TraderTraitor” group siphoned over $6 billion from Binance on 29 Oct 2026 after compromising a DevOps engineer’s laptop. The breach highlights the importance of strong privileged‑access controls for audit and compliance readiness.

Chainalysis confirmed that an AI‑driven threat actor accessed internal tools and stole non‑sensitive customer records, including names, emails and user IDs. The breach underscores the importance of strong access‑control and continuous monitoring for audit readiness.

North Korean hackers stole over $6.3 billion from Binance and used automated swaps to launder the proceeds. Law‑enforcement supplied malicious address lists and urged the crypto ecosystem to block related transactions, highlighting a control‑assurance gap in transaction monitoring and third‑party oversight.

The FBI attributes a $6.36 billion crypto theft from Binance to the North‑Korean group TraderTraitor, which accessed privileged containers after compromising a DevOps engineer’s laptop. The breach highlights the need for robust identity‑and‑access‑control and continuous monitoring of privileged actions for audit readiness.

The FBI has named the North‑Korean APT ‘TraderTraitor’ as the actor behind a $6 billion crypto theft from Binance, achieved by compromising an engineer’s laptop to issue unauthorized withdrawals. The breach highlights gaps in privileged‑access controls that many crypto‑service providers must address to meet audit‑readiness expectations.

A malicious block‑loader was found in the Magento CMS of deepveindrilling.com, affecting 953 e‑commerce sites. The incident underscores the need for secure configuration and continuous monitoring of third‑party platforms to satisfy multiple compliance controls.

A threat actor released personal and employment details for over 40,000 DHS staff, exposing gaps in access control and incident‑response evidence. Organizations should verify least‑privilege policies and ensure audit‑ready logging.

The FBI has identified 628 wallets tied to North Korea’s TraderTraitor group, linked to the $6.3 billion Binance breach. The attribution highlights gaps in vendor oversight and transaction monitoring that organizations must address to maintain audit‑ready controls.

Binance confirmed that attackers moved about $6.3 billion in crypto from its hot‑wallets after compromising privileged API credentials. The breach highlights the importance of robust identity and access controls for financial platforms.

Polymarket’s website was compromised by a malicious third‑party page‑speed script that silently sold traders’ positions and moved $2.7 M to attacker wallets. The breach underscores the importance of continuous vendor‑risk monitoring and evidence‑driven control assurance.

The FBI has linked a $6 billion cryptocurrency theft from Binance to the North‑Korean‑aligned group TraderTraitor. The breach underscores gaps in privileged access controls for high‑value digital‑asset transfers, a key control area for audit readiness.

Northflank reported that attackers decrypted customers’ environment variables, resulting in unauthorized use of AI API keys. The event underscores the importance of strong secret‑management and continuous credential monitoring for audit readiness.

Polymarket disclosed that a malicious third‑party JavaScript file stole about $2.7 million in cryptocurrency from user wallets. The breach demonstrates the importance of robust vendor oversight and continuous script integrity monitoring for audit readiness.

Chainalysis disclosed that attackers accessed user IDs, names, email addresses and role labels using undefined “offensive agentic techniques.” No investigation data or credentials were found, but the event underscores the need for strong access‑control and MFA evidence for audit readiness.