Cursor, Polymarket and Binance were all hit on 29 October 2026, and each attack ran through something the victim trusted, not through flawed code or cryptography. A popular recap of that week holds in outline but needs two corrections: the Cursor backdoor was a tampered copy of Anthropic’s extension, and the Linux root exploit covers servers with one network feature enabled.
Table of Contents
Three attacks landed on 29 October 2026, and each went through something the victim already trusted. A tampered Claude Code extension reached Cursor users through Cursor’s own marketplace, a hijacked page-speed script emptied about $2.7 million from Polymarket traders, and about $6.3 billion left Binance by the exchange’s own estimate, which Elliptic’s analysts call almost certainly the largest known theft of any kind. The first two are textbook supply chain attacks. The third began, in Binance’s early account, with a compromised engineer’s laptop, which puts it in the same family: the attackers went around the code, not through it.
Fireship’s recap video of 3 November, titled The worst week in cybersecurity history… so far, stitches these together with a fourth story, Anthropic’s report that an unreleased Claude model can get root on unpatched Linux servers. Each of the four claims in its description has a documented basis. Each also shrinks or shifts once it is set against the primary record.
A four-part recap with a sponsor attached
The description of the video lists four items: Cursor shipping a backdoor, Polymarket getting drained, North Korea carrying out the largest theft in human history, and an unreleased Anthropic model getting root on any unpatched Linux server. Above that list sits an offer for a free 14-day trial of CodeRabbit Secure. The video carries a sponsor message, which does not make its facts wrong but is part of how the story reaches the viewer.
The four claims were checked against vendor statements, Anthropic’s own research post, an analyst’s tracing of the stolen funds and press coverage. Three survive with edits. The fourth, the Linux claim, is accurate about the demonstration and wider than the demonstration about its reach.
The corrections change what a reader should do on Monday morning. They also show how one company, Anthropic, appears in two roles in the same week: as the owner of the extension that was compromised and as the author of the exploit research.
The Cursor extension was tampered with, not written by Cursor
On 29 October, versions 2.1.312 and 2.1.313 of the anthropic.claude-code extension sat in Cursor’s extension marketplace for about 11 hours, and the code inside them was not what Anthropic wrote. Anthropic’s Felix Rieseberg said a malicious actor used access to Cursor’s marketplace to publish a tampered copy that Anthropic neither built nor published, and that Anthropic’s own channels were unaffected. The video’s phrase, Cursor shipped a backdoor, is therefore true of the distribution and false of the authorship. How the attacker obtained publishing access was not explained in the coverage reviewed.
The payload was real. A loader placed in front of the extension’s code ran on load, with no click needed, and tried to add an attacker’s SSH key, enable SSH, open a reverse tunnel and set up persistence. Cursor said enabling the local SSH service needs administrator rights that the extension lacks on most macOS and Windows machines, so on most systems that step failed. Uninstalling the extension does not remove the backdoor, because the payload drops standalone scripts that keep running. Cursor pulled the versions, suspended and rebuilt its marketplace, rotated keys and found no other tampered extensions.
The sources disagree on one point. The security firm Phorion first reported the malicious build on Open VSX, while Anthropic and a researcher at Manifold Security say it appeared only in Cursor’s marketplace. Cursor’s first estimate, at most 5,000 affected users, is a ceiling rather than a count.
Polymarket lost $2.7 million to a page-speed script
Polymarket’s international site loaded a real-user-monitoring script from DebugBear, a UK performance vendor. On 29 October a different file answered at the same address, and it went looking for signed-in traders. Polymarket says 726 wallets were affected and is refunding about $2.7 million. Bitquery counted 737 accounts and 985 withdrawals, and loss estimates run from roughly $2.6 million to $2.73 million. That spread looks like a difference in counting method, not a dispute about events.
DebugBear says attackers compromised its DNS records through its domain registrar and that it has found no sign of a break-in to its own systems. The malicious code reused the access a logged-in trader already had. Hudson Rock, which reviewed the file, found no routine for stealing passwords, seed phrases or private keys, because the script asked the account’s own signer to approve the transfers. No smart contract or Polymarket server was breached.
Reflectiz, a web-security vendor that sells monitoring for this exact risk, notes that a Content Security Policy allowlist trusted the vendor’s domain and so could not see that the file had changed, while Subresource Integrity pinning would have rejected it. It was Polymarket’s second third-party script incident in four months, after a June case that Reflectiz puts at around $3 million. Polymarket is refunding $3.9 million in total, including about $1.2 million for losses during its trading pause.
Binance lost $6.3 billion, and the cause is only partly explained
The claim that North Korea carried out the largest theft in human history rests on Elliptic’s analysis and the FBI’s attribution. Elliptic measured $6.43 billion stolen on 29 October, against Binance’s own estimate of about $6.3 billion and TRM Labs’ $6.36 billion. Elliptic calls it almost certainly the largest single theft of any kind, more than four times the $1.46 billion taken from Bybit in 2025. On 31 October the FBI attributed the theft to TraderTraitor, its name for a North Korean state-sponsored group. The attribution is official; the method is not fully explained.
Binance first said its investigation pointed to a compromised DevOps engineer’s laptop, then said it had found additional points of breach. Co-CEO Richard Teng described a complex attack that was not carried out by one person, and said the attacker’s tooling erased its own traces. Elliptic’s on-chain reading is that the attacker got Binance’s own systems to sign transactions instead of stealing keys, using a wallet-delegation feature on Ethereum called EIP-7702. Binance said it found no evidence of a private key leak.
Binance says it will cover all losses from its SAFU fund and company funds. Elliptic had verified $2.85 billion as frozen or seized, 44 percent of the total and almost all of it stablecoins. As of 1 November the attacker still held about $3.25 billion in assets that no issuer can freeze.
The Linux root exploit needs a feature the video leaves out
Anthropic’s research post of 27 October describes five exploit chains written by an unreleased internal model after initial prompting, covering Chrome, Safari, Android, Windows and Linux. The Linux chain gives a remote attacker root with no credentials, but Anthropic specifies that it targets servers with a multipath TCP listener. In its test, the model needed 48 minutes to leak a kernel address and five more to run a command. The video’s version, any unpatched Linux server, drops that condition. The demonstrated attack needs an MPTCP listener.
TuxCare, which sells kernel patching, adds the practical detail. Stock RHEL 8, 9 and 10 ship with MPTCP off, while Go programs built with version 1.24 or later enable it on listening sockets by default. The underlying bug sits in the IPv4 TCP handshake, and the Go Security Team will not rule out similar attacks without MPTCP, though nobody has publicly shown one.
This is not a zero day. The fix landed upstream on 5 October and the CVE, number 2026-98432, was published on 15 October. Debian had a fixed kernel the next day, while Red Hat and Ubuntu had shipped none as of 30 October. The Hacker News adds that the capability claim rests on Anthropic’s own account, since the CVE record describes an IPv4 TCP fix rather than a multipath one, and TuxCare found no independent public reproduction and no exploitation in the wild.
One pattern across the week, and what to check now
Elliptic spells out the pattern for Binance and for Bybit before it: the infrastructure and people around the wallets were compromised, not the cryptography. Cursor’s case fits, with a hijacked publishing path, and so does Polymarket’s, with a vendor’s DNS. In all three the attacker went through infrastructure and people rather than through flaws in the victim’s own code, as far as the public record shows. The shared weakness is unwatched trust.
For anyone running developer machines, that means checking each Cursor install for extension versions 2.1.312 or 2.1.313, looking in the SSH authorized keys file for an entry labelled svc-telemetry, and rotating credentials, since uninstalling is not enough. For anyone loading third-party scripts on pages where money or data moves, pinning files with Subresource Integrity, where the vendor allows it, is the check that would have caught the swap. For Linux operators, the command ss -H -lMn lists MPTCP listeners, and the first move is a fixed kernel from the distribution.
Three developments would change this reading: an independent reproduction of Anthropic’s chain, a published root cause for the Cursor marketplace compromise, or Binance naming its additional points of breach.
Author:
Jan Bielik
CEO & Founder of Webiano Digital & Marketing Agency
This article is an original analysis supported by the sources cited below
The worst week in cybersecurity history… so far
The video under examination, published by Fireship on 3 November 2026; its description lists the four claims tested here and opens with a CodeRabbit Secure trial offer.
Discovering and exploiting vulnerabilities in critical, real-world software with Claude
Anthropic’s 27 October post describing five exploit chains, including the Linux chain that targets servers with a multipath TCP listener, with its 48-minute and five-minute timings.
Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
Independent reporting that separates what can be verified with vendors from what rests on Anthropic’s account, including the mismatch between the CVE description and the stated multipath TCP target.
CVE-2026-98432 Linux Kernel TCP Flaw, Claude’s Claimed Root Exploit and Which Distros Are Patched
A kernel-patching vendor’s timeline of the fix, distribution patch status as of 30 October, the MPTCP defaults in Go and RHEL, and the absence of independent reproduction.
The largest theft in history: North Korea behind the $6.4 billion Binance hack
Elliptic’s tracing of the $6.43 billion theft, its comparison with Bybit, the on-chain method, frozen amounts and the FBI attribution of 31 October.
$6.3 billion Binance hack was likely work of North Korea, blockchain intel firms say
CBS and AP coverage of Binance’s early statements about a compromised laptop, additional points of breach, the TRM Labs figure and the FBI attribution.
Malicious Claude Code Extension Served in Cursor Supply Chain Attack
Reporting on the 11-hour window, Anthropic’s statement that it did not build the tampered copy, the payload’s behaviour and Cursor’s response.
Claude Code extension poisoned with persistent SSH backdoor
Detail on the payload, the persistence methods, Cursor’s cleanup advice and the dispute over whether the build also appeared on Open VSX.
Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script
Account of the script swap, DebugBear’s registrar DNS explanation, Hudson Rock’s review of the code, the 726-wallet figure and the $3.9 million refund.
Polymarket Hack: How a Hijacked DebugBear Script Drained $2.7M
A web-security vendor’s timeline with the 737-account and 985-withdrawal counts, and its explanation of why a Content Security Policy missed the swap while Subresource Integrity would not have.
| Citing this article? Brief excerpts are welcome. Please credit Webiano.digital, name the author where stated, and include a link to https://webiano.digital and to this original article. Full or substantial republication requires prior written permission. Read our Copyright and Content Use Policy. |
This article was prepared with the assistance of artificial intelligence tools. The content underwent expert human review, and Webiano Digital & Marketing Agency assumes editorial responsibility for its final version and publication.
