Is it?

Cursor's security announcement was posted on Oct 29 and says that the malicious extension was live "between about 2:27am PT and 1:35pm PT today"

This article says the attack took place "on Thursday" (which means Oct 29) and began at 4pm ET (which is 1pm PT)

and Binance has been tweeting that the cause of the hack may be a compromised employee laptop. yikes

Good question, would be interesting to see an exact timeline on both side-by-side (confirmed events, not reporting).