Official Claude Code extension found backdoored, possibly linked to Binance hack
amasad · x · 2026-10-30
Amasad flags a badly underreported security incident: an official Claude Code extension was compromised and installed SSH backdoors on developer machines, and he asks whether it could be behind the Binance wallet drain.
Screenshots show the advisory timeline: the malicious Claude Code 2.1.313 package went live on Cursor's marketplace at 2:27 a.m.; the reported Binance drain began at 1:24 p.m. (20:24 UTC), 10h57m later; Cursor pulled the extension at 1:35 p.m., 11 minutes after the attack started. The backdoor affected macOS, Linux and Windows VS Code/Cursor users.
More from coding & agent
- Meta's coding model Muse Ember goes live on OpenRouter for agent sub-task fan-out — alexandr_wang · 2026-11-10
- Meta's Muse Ember coding model is now available in OpenCode — alexandr_wang · 2026-11-10
- OpenRSI scales recursive self-improvement to SGLang-Omni, +7.6%–344% throughput via 14 merged PRs — ChengleiSi · 2026-11-10
- OpenCode cuts memory 41% and OpenClaw starts 3.1x faster with Bun AoT — steipete · 2026-11-10
- Vibe-coded ambient music DAW 'Ambient Town' in a week with Push support — kieranklaassen · 2026-11-10
- GR00T 2's WAM API lets reasoning agents steer robots by pointing in the camera view — yukez · 2026-11-10