Risky Business #858: Binance Heist, LLMjacking, and a Multitude of Breaches
This episode of Risky Business dissects a $6.3 billion Binance hot wallet incident, introduces Google's 'LLMjacking' threat, and covers breaches at Amadeus, Northflank, and DHS.
The latest episode of the Risky Business podcast, hosted by Patrick Gray and featuring special guest co-host Ciaran Martin, former CEO of the UK’s National Cyber Security Centre, delves into a packed week of cybersecurity news. A significant portion of the discussion revolves around a reported $6.3 billion heist from Binance's hot wallet. While described as "clunky," the incident highlights the persistent threats to cryptocurrency exchanges and the potential for substantial financial losses, even if the execution was not sophisticated.
Adding to the financial sector's woes, Brazil's Mercado Bitcoin reportedly lost "millions" in a separate attack, underscoring the ongoing vulnerability of digital asset platforms. The podcast also introduces a new term coined by Google: "LLMjacking." This phenomenon refers to malicious actors exploiting large language models (LLMs) and associated cloud infrastructure to rack up exorbitant costs, potentially reaching $1 million per instance, by running unauthorized or resource-intensive operations.
The episode touches upon several notable data breaches, including incidents affecting Amadeus, a major travel technology company, and the U.S. Department of Homeland Security (DHS), which experienced a personnel data leak. The breach at Northflank, a cloud-native platform, is also discussed, with attackers reportedly abusing customers' AI API keys, further linking the discussion to the emerging threats around AI infrastructure.
Beyond these major incidents, the podcast covers a range of other security events. These include a breach at DebugBear involving a compromised script, Chainalysis reporting "offensive agentic techniques" being used against them, and Trezor warning of a potential crypto-theft implant in its hardware wallets. The discussion also touches on a second wave of suspected cyberattacks targeting supermarket freezers across Europe and a breach at the Philippine Overseas Employment Administration exposing migrant worker data.
Technical vulnerabilities and exploits are also on the agenda. The show mentions the exploitation of a Cisco SD-WAN flaw leading to the deployment of custom KeyDrift malware, and critical vulnerabilities in GitLab (CVE-2026-97229) and the Linux kernel (MPTCP servers). The "SMS of Death" exploit for Android, which can remotely crash unpatched phones, and the ongoing exploitation of Oracle flaws are also highlighted.
Furthermore, the podcast addresses the growing concern of state-sponsored cyber activities, referencing Russia's AI-powered hacks in Ukraine and the "Volt Typhoon" campaign. The discovery and disruption of a million-device Android malware botnet by Google, and the patching of two more zero-day vulnerabilities in Ivanti Connect Secure, which have been chained in attacks, round out the extensive list of topics covered.
Finally, the episode features a segment with Tod Beardsley from runZero discussing the looming post-quantum cryptography crisis and how CISOs can leverage this transition to clean up legacy systems and remove end-of-life products. The breadth of topics covered in this single episode underscores the dynamic and often overwhelming nature of the current cybersecurity landscape.
This new report from Cyber Security News details the specific tactics employed by LLMJacking threat actors, including the use of tiny validation requests to evade detection and the exploitation of a LiteLLM flaw (CVE-2026-40217) for persistent gateway control. It also highlights the emergence of 'LLM Mixers,' services that resell unauthorized AI access, contributing to the over $1 million in cloud bills reported by some victims.