Crypto's biggest withdrawal.

CyberWire Daily covers the $6.3 billion Binance theft, an actively exploited GitLab RCE, North Korean IT-worker sanctions, a Polymarket third-party compromise, and Cisco Talos' AI-enabled NickC2 malware. Dave Bittner also interviews Josh Devon, CEO of Sondera, about proving and constraining AI agents for regulated enterprises.

Key points

• Binance says attackers likely compromised a DevOps laptop and manipulated signing systems, stealing $6.3 billion across 10 blockchains in 20 minutes.
• CISA ordered federal agencies to patch an actively exploited maximum-severity GitLab remote code execution flaw by Sunday.
• Treasury sanctioned Russian and North Korean actors tied to laundering crypto from fake IT-worker operations that fund Pyongyang.
• Polymarket traced its outage to compromised DebugBear code; attackers reportedly stole more than $2.1 million in crypto.
• Cisco Talos found NickC2 malware using OpenAI APIs during intrusions, potentially charging victims for attacker requests.
• Josh Devon says enterprises need deterministic, provable controls for AI agents before granting them sensitive access.