AI service keys stolen, and Binance lost $6.3 billion

October 2026 brought a series of serious cyberattacks. Some hit services that companies use to work with AI, while another ended up as the largest crypto theft ever.

Keys to AI services leaked

Cloud Security Alliance Labs describes four incidents. Fireworks AI discovered a breach around October 6 and disclosed it on October 9. Internal credentials had been used without authorization, which gave access to data that included third-party API keys for a limited number of customer accounts. An API key works like a password that lets a program use a service. How the attackers obtained the credentials is not stated in the note.

On October 17, OpenCode Console said that about 1.4 percent of users had keys for OpenAI, Anthropic and Google exposed. On October 21, customers' environment variables at Railway were accessed, and some were decrypted. The same day, LiteLLM version 1.107.0 turned out to be malicious and stole keys for cloud and AI providers.

According to Cloud Security Alliance, the pattern is to target intermediaries that store customers' keys. That lets attackers obtain the keys without going directly after the providers or end users. No vendor has publicly pointed to a single actor behind the incidents, and the idea of a coordinated campaign so far comes only from Railway.

Fake extension on Cursor's marketplace

On October 29, a malicious version (2.1.313) of the Claude Code extension sat for about 11 hours on Cursor's extension marketplace, GovInfoSecurity reports. It could add the attacker's SSH key and attempt to open a backdoor to the computer. It also collected system information, Git credentials and environment variables.

Cursor says that at most 5,000 users were affected. Anthropic says that a malicious actor used access to Cursor's marketplace to publish a modified extension, and that Anthropic was not involved itself. The attacker's identity has not been disclosed.

Binance drained in 20 minutes

The same day, October 29, about $6.3 billion in cryptocurrency was drained from Binance's wallets on ten blockchains, Al Jazeera reports. Most of it disappeared in roughly 20 minutes. That surpasses the $1.5 billion Bybit theft in February 2025.

TRM Labs and Chainalysis assess with high confidence that the North Korean entity TraderTraitor, linked to Lazarus Group, was behind it. Binance itself says the investigation has not pointed to any single party responsible. The company found multiple entry points but no signs of leaked private keys. About $3 billion has been frozen, and Binance has pledged to cover all losses.

The sources do not indicate that the three cases are connected.