ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories

thehackernews.com Nov 12, 2026

ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories

Curated by Shubham · TechCapsules · Nov 12, 2026

AI-summarised brief · reviewed before publication

North Korean hackers linked to the $6.43 billion Binance theft are using an automated, multi‑chain laundering scheme that has touched more than 20,000 wallets, 16 blockchains and 65,000 transactions, leaving roughly $3 billion still in crypto addresses. They created six meme coins on NEAR and employed bridges, DEX swaps, lending vaults, liquid‑staking services, coinjoins and the Privacy Cash pool to obscure fund flows. Microsoft reported a surge of GSocket deployments on internet‑facing Linux servers, noting a 356 % rise in detections since March and highlighting that patching alone does not remove the persistent backdoor. Europol and partners seized 235 servers and 257 domains tied to GootLoader, CastleRAT and StealC, disrupting a cybercrime‑as‑a‑service ecosystem that harvested over 6 million credentials. Researchers also identified the Falcon JavaScript C2 framework, which mirrors the earlier PeckBirdy tool in URL patterns and payload delivery.

💡 Why It Matters

· The laundering tactics show how state‑backed actors can evade detection across fragmented blockchain ecosystems, while the GSocket resurgence proves that open‑source tools can turn patched vulnerabilities into long‑term footholds.

Blockchain Capsules

Read full article on thehackernews.com

Guest Post: Quantum-Resistant Wallets Could Support Institutional Blockchain Adoption

Institutional finance faces a looming security gap as blockchain wallets rely on elliptic‑curve cryptography vulnerable to future quantum computers. Seb Audy, COO of AmericanFortress and Moon Pursuit Capital, argues that quantum‑resistant wallets are essential for banks and asset managers that must safeguard assets for decades. He notes that current mitigation strategies—key rotation, address migration, or chain forks—are impractical for long‑term custodial positions, especially when owners may be unreachable. With NIST’s post‑quantum standards released in 2024, procurement and custody requirements are poised to shift toward solutions that can be upgraded without disrupting existing workflows. Audy highlights zero‑knowledge techniques as a promising path to adaptable, privacy‑preserving wallet architectures that meet institutional compliance and cost constraints.

💡 Quantum‑ready wallets could become a decisive procurement criterion, forcing blockchain platforms to redesign core security layers before quantum threats materialize.

thehackernews.com · Nov 9

LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers…

LNbits, an open‑source Bitcoin Lightning wallet platform, warned all operators to shut down their servers after a series of attacks exploited a vulnerability in the software. One operator reported that an attacker used an unknown extension to siphon 2,285,545 satoshis (≈0.023 BTC) from his instance before the warning was issued. The project issued an initial advisory at 12:33 UTC, asking users to disable the Paywall add‑on, and followed with a full shutdown notice 80 minutes later. No patches had been released by 09:00 UTC, though developer Ben Arc said fixes would be merged within 24‑48 hours. LNbits also disabled its own cloud service, promising restoration by 17:20 UTC. The breach left users unable to access funds pending a fix until the security updates are deployed.

💡 The incident proves that even lightweight, community‑maintained wallet stacks can become lucrative targets, forcing operators to treat open‑source code with the same rigor as commercial services.

thehackernews.com · Nov 9

Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for…

Keplr wallet users who logged in with Google or Apple accounts suffered theft after a vulnerability in Web3Auth, the provider of the social‑login service, was exploited. The flaw gave the attacker access to private keys, allowing funds to be moved from compromised wallets. Web3Auth responded by using the same breach path to transfer assets from at‑risk accounts into designated recovery wallets before the thief could act, a process coordinated with Keplr. The rescue operation covered more than 44,000 wallets and moved over $6 million across Cosmos and Ethereum‑compatible chains. Wallets secured with recovery phrases or hardware devices were unaffected. Keplr has paused social‑login options, is investigating, and is working with Web3Auth to verify which accounts were impacted and to restore funds.

💡 The breach shows that convenient social‑login mechanisms can become a single point of failure for crypto custody, prompting a reassessment of authentication strategies in decentralized finance.

thehackernews.com · Nov 6

Chainalysis Breach Exposes All Users’ Credentials, Forces Shutdown of Key Services

Blockchain analytics firm Chainalysis disclosed that a sophisticated agentic cyber‑attack uncovered the names, usernames, password hashes and live tokens of every user on its platform. While the breach prompted the immediate shutdown of its Reactor, Data Solutions, Know‑Your‑Transaction (KYT) UI, API and address‑screening services, the company said no evidence shows that investigation data or attribution records were accessed or altered. Chainalysis has locked affected accounts, halted password resets and is requiring users to reset passwords and rotate API keys once trusted IPs are added to an allowlist. The incident follows a prior multi‑front attack that revealed a subset of passwords and mirrors a wave of AI‑driven assaults targeting tech firms, including the use of autonomous tools like ARTEX to harvest secrets from public code repositories.

💡 The breach exposes the entire credential base of a leading crypto‑forensics provider, forcing a rare full‑service outage and compelling customers to overhaul authentication across their own systems.

thehackernews.com · Nov 1

FBI Links North Korea’s TraderTraitor to Record $6.43 Billion Binance Crypto Heist

The FBI announced that the North Korean‑aligned hacking collective known as TraderTraitor, also identified as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899, stole more than $6.43 billion in cryptocurrency across 11 blockchains. investigators from the FBI, U.S. Secret Service and IRS‑CI said the group primarily converted the loot into Ethereum before moving it through decentralized‑finance swaps and instant‑swap services for further laundering. Binance resumed phase‑one withdrawals after pausing them following the breach, noting that deposits remain unaffected. The theft surpasses the $1.46 billion Bybit hack and represents the largest crypto heist on record, with 82 % of the stolen value on Ethereum and Bitcoin. On‑chain analysis shows $2.85 billion of the assets have been frozen by Tether, Circle, Ripple, Arbitrum and Optimism.

💡 The haul demonstrates how state‑backed actors can weaponize decentralized finance to fund illicit programs, forcing regulators and exchanges to tighten cross‑chain monitoring. It also proves that even leading platforms like Binance can be disrupted by sophisticated supply‑chain attacks, reshaping risk assessments for the broader Web3 ecosystem.

thequantuminsider.com · Oct 29

Zumo and Quantum Chain Partner on Quantum-Resilient Finance

Zumo and Quantum Chain signed a memorandum of understanding to develop quantum‑resilient infrastructure for the UK’s digital asset and blockchain finance sector. The partnership will test quantum‑safe solutions across private networks, tokenised deposits, payments, and institutional digital assets, including a potential quantum‑resistant GBP stablecoin. Both firms aim to provide cryptographic agility and post‑quantum security as the National Cyber Security Centre urges a full migration to post‑quantum cryptography by 2035, amid rising fears of cryptographically relevant quantum computers.

💡 By proactively building quantum‑safe infrastructure, the collaboration addresses the imminent threat of quantum computers that could break current public‑key systems, protecting the integrity of the UK’s growing digital finance ecosystem.