Tech news, 2 November 2026: the FBI names the Binance attacker, a vendor script drains Polymarket traders, a CVSS 10 LXD flaw and Aramco buys into HUMAIN

1. The FBI attributes the Binance theft to North Korea

The FBI attributed the theft of more than $6 billion from Binance to North Korea's TraderTraitor group, according to BleepingComputer, in line with earlier assessments from blockchain analytics firms; the agency did not publish the evidence behind the finding¹². Security Affairs reports the FBI expects the stolen assets to be laundered through decentralised finance platforms and instant swap services².

CTO take: a state attribution changes little technically but a lot commercially: boards, insurers and regulators will ask every firm that moves money how its signing and withdrawal paths are protected. Have the answer ready; the Binance hack: architecture lessons sets out the controls.

2. A hijacked vendor script drains Polymarket traders

Malicious code replaced a third-party performance-monitoring script loaded by Polymarket's website on 29 October and used signed-in traders' sessions to withdraw funds; Polymarket puts the loss at about $2.7 million and says it is reimbursing users³⁴. No seed phrases or private keys were needed, because the code acted with the access the open page already had³.

CTO take: every third-party script on a page where users can move money runs with their authority. Remove non-essential scripts from those pages, self-host the ones you keep with integrity checks, use a strict Content Security Policy, and require a fresh confirmation for withdrawals. This applies to fintechs, marketplaces and any app with stored balances.

3. A maximum-severity flaw in LXD and MicroCloud

Canonical rated CVE-2026-112816 at CVSS 10.0: vulnerable LXD versions checked every certificate in a presented chain against the trust store, letting an attacker with network access to the API impersonate a trusted client using only its public certificate⁵. Fixed releases are available for the supported LXD tracks and MicroCloud, and the Incus project, which reported the issue, has also released a fix⁵.

CTO take: if you run LXD, MicroCloud or Incus, patch now and confirm the installed version, then make sure the management API is not reachable from untrusted networks. It is another reminder to put infrastructure management interfaces behind a dedicated admin path, as in hardening a utility's management plane.

4. Aramco takes 49% of Saudi AI company HUMAIN

Aramco and the Public Investment Fund closed a deal giving an Aramco subsidiary 49% of HUMAIN, with PIF keeping 51%; Aramco is contributing about $2.6 billion in cash plus AI and digital assets⁶⁷.

CTO take: Saudi Arabia is concentrating its AI investment in one national platform with an industrial anchor customer. For companies selling AI into the Kingdom, expect more opportunities to build on local infrastructure and more questions about data residency under the PDPL. See fractional CTO in Saudi Arabia and Saudi PDPL and cross-border AI.

What I'd do this week

• List every third-party script on pages where users can move money, and remove what you can.
• Patch LXD, MicroCloud or Incus if you run them, and check the management API's exposure.
• Prepare a one-page answer on how your withdrawal and payment paths are protected.
• If you sell into Saudi Arabia, review your hosting and data residency plan.

See where I work, or analyse your challenge and bring the result to a call.