GoKawiil
Tech News
Binance reported that an attacker gained access to its withdrawal systems through a compromised DevOps engineer's laptop, using that foothold to reach a service container and submit unauthorized withdrawal transactions totaling an estimated $6.3 billion. The exchange said no wallet private keys were leaked and has revoked the affected address's authorization while a full technical investigation continues.
Certificate authority eMudhra revoked eight intermediate certificates after researcher Wayne found their P-384 private keys were generated with values under 256, making them trivially recoverable. eMudhra said a script error in April 2025 produced the weak keys, which were mistakenly used for signing instead of properly generated ones, and some were cross-signed by Sectigo. Mozilla, Google and Apple have since blocked the compromised certificates in their browsers and operating systems.
Security researchers identified a vulnerability dubbed 'SneakPeek' in Anthropic's Claude Code Desktop application, located in its file preview feature. The flaw reportedly lets attackers silently exfiltrate sensitive developer credentials, including SSH private keys, AWS credentials, and Claude OAuth tokens, without requiring any user interaction.
Crypto exchange Bitget disclosed a $388 million security breach and said it is 'very likely' the work of North Korean hackers. The company stated that user private keys were not compromised and that a bitcoin-backed protection fund will cover the losses, while withdrawals remain frozen pending an investigation.
Cold wallets are cryptocurrency storage methods that never connect to the internet, protecting the private keys needed to prove ownership of blockchain assets. These range from simple paper wallets listing 12 or 24 recovery words to dedicated hardware devices that sign transactions internally before connecting briefly via USB, Bluetooth or NFC to authorize transfers.