MONDAY, NOVEMBER 2, 2026
Shut it down, then update
Good morning. On this day in 1920, KDKA, the first commercial radio station, opened with election results. Midterms are tomorrow.
In today's issue:
- A bitcoin payment tool tells merchants to switch off their servers
- Trigger.dev says an attacker reached customer secrets
- The FBI names North Korea in the Binance heist
Presented by Cyhornet - Not sure who patches your self-hosted tools? Cyhornet builds security and compliance programs for small businesses. cyhornet.com
TOP STORY
SHUT IT DOWN
BTCPay to merchants: pull the plug
BTCPay Server, a free, open-source tool businesses use to accept bitcoin, told users on Sunday to shut down their servers after reports that attackers were draining "hot wallets," which keep their signing keys on the internet-connected server. Founder Nicolas Dorier said the reports appear to involve versions older than 2.4.2 and that the attacker logged in as an administrator, CoinDesk reported. The team doesn't yet know how. BTCPay later said it found an attack vector aimed at version 2.4.1 and older, with no credible reports of drains on the latest 2.4.7, The Defiant reported. Losses and the number of hit servers haven't been disclosed.
Why it matters: Self-hosted tools don't patch themselves. Running BTCPay? Keep it offline until it's on 2.4.7, and move hot-wallet funds you don't need today to cold storage.
Sources: coindesk.com | thedefiant.io
QUICK HITS
BREACH WATCH
Trigger.dev's secrets got out. The developer automation platform said Sunday that an attacker gained unauthorized access to environment variables for a subset of organizations. It blocked the exploit and emailed affected owners but hasn't said how many were hit.
What to do: Customers should rotate stored keys at the services that issued them. trigger.dev
NATION-STATE
The FBI names the Binance thief. The FBI said Saturday that North Korea's "TraderTraitor" hackers stole more than $6 billion from Binance on or about October 29. It asked crypto firms to block transactions tied to addresses it published.
What to do: Ignore anyone offering to recover lost crypto for a fee. therecord.media
MONEY MOVES
A big week for the AI trade. Midterms, earnings from Apple, AMD and Palantir, and the jobs report will test stocks after Alphabet and Amazon results sent the Nasdaq down 2.9% Friday, Reuters reported.
What to do: Job hunting? The jobs report is your hiring read. investing.com
WORTH YOUR MONEY
Paid GOAT for priority shipping that came late? The FTC is sending more than $100,000 to 6,205 GOAT customers who hadn't already been refunded, The Verge reported. Real refunds never ask for a fee. theverge.com
TODAY'S LEARNING
Huntress CEO Kyle Hanslovan and researcher Chris Ryan run a free live hacking demo, "Hacking The Tragic Quadrant," today at 7:00 PM ET. Expect ClickFix, device code phishing and AI prompt injection. bettersecurity.ai
YOUR TAKE
If a vendor told you to shut down a system right now, who on your team would make the call?
TRIVIA
On November 2, 1988, a worm launched from MIT became the first internet worm to grab mainstream headlines. What's it called? Reply or comment your answer.
TODAY IN HISTORY
On November 2, 2000, the Expedition 1 crew arrived at the International Space Station, starting a continuous human presence in space that hasn't broken since.
Trivia answer: The Morris worm.