Three major incidents were disclosed this week, each tracing back to a trusted external relationship rather than a perimeter breach. Binance published a post-incident report on the largest crypto theft on record. France’s national blood service confirmed an attack on its refrigeration contractor. And Crédit Mutuel Arkéa disclosed that roughly €100 million had been moved out of its own corporate account. Here’s a closer look at this week’s top cybersecurity headlines.
Binance confirmed the loss of approximately $6.34 billion in digital assets on 29 October, and published its incident report on 3 November. The FBI attributed the theft to North Korea on 1 November, naming TraderTraitor, the group previously responsible for the $1.5 billion Bybit hack in February 2025. Pyongyang rejected the finding, with Kim Yo-jong describing it as a grave political provocation. The intrusion began in June, when a Wallet DevOps engineer installed a tampered build of Homebrew while sourcing an AI coding tool. Binance’s security team detected the compromise, reimaged the device and rotated credentials, but the attackers had already mapped his role and identified colleagues on the wallet infrastructure team. In September they targeted a second engineer through a job-hunting platform, conducting two interview rounds including one with a fabricated CEO, before supplying a malicious coding assignment that the engineer executed on a corporate laptop. The payload replaced the legitimate pyenv binary in the Homebrew directory and evaded Binance’s endpoint controls. On 20 October the attackers used that device together with an internal Binance AI tool to compromise two further engineers, obtaining a container deployment token that granted access to the internal wallet-signing service. They then exploited Ethereum’s EIP-7702 delegation mechanism to assign an attacker-controlled smart contract partial execution rights over a hot wallet.
Tether, Circle and other partners froze close to $3 billion within 24 hours. Binance reports $2.85 billion frozen or intercepted and assets 98 percent replenished. Co-founder Changpeng Zhao stated that a hack of this scale means serious security failures occurred.
Source: Help Net Security, NBC News citing Reuters
The Établissement français du sang confirmed that a cybersecurity incident affecting Coolworld, the contractor maintaining its cold storage equipment, compromised monitoring and control systems at three EFS sites overnight on 1 November. The affected facilities, including locations in Bourgogne-Franche-Comté, held blood samples and plasma intended for transfusion and medicine manufacture. Temperature and defrosting thresholds were reset from approximately minus 30°C to 110°C. EFS stated that monitoring and alarm systems detected the anomalies quickly, allowing staff to act before any products or samples were compromised. No blood products were lost and collection and distribution continued without interruption. Coolworld attributed the underlying vulnerability to a third-party component. ANSSI and the Health Ministry are investigating. The incident coincided with a broader wave against retail refrigeration that AFP reports affected at least nine European countries, with more than 100 stores involved. Documented cases include an ICA store in Boda, Sweden reaching 55°C, a Selver freezer in Estonia set to 50°C, and 15 Carrefour stores in Belgium, where federal prosecutors have opened an investigation.
SentinelOne assesses Russian-aligned actors as credible suspects while stating attribution remains open, and multiple sources note that the shared targeting of refrigeration does not establish the incidents as a single campaign. Forescout has identified nearly 13,000 exposed refrigeration services across 99 countries.
Source: France 24, NBC News citing AP, SentinelOne Labs
Crédit Mutuel Arkéa disclosed on 4 November that it had been the victim of an attack enabling fraudulent transactions, confirming to Reuters the following day that approximately €100 million, around $112 million, had been taken. Le Télégramme reported a figure of $133 million, which the bank declined to confirm while acknowledging the scale of the losses. The attackers reached the bank through a service provider’s platform and executed transfers from Arkéa’s own corporate account to other banking institutions. Client accounts were not accessed and customers incurred no losses. The funds were converted into cryptocurrency on specialised platforms, with a portion subsequently blocked and recovery efforts ongoing. Arkéa states the incident is contained, has explicitly excluded human error, and characterises it as a sophisticated external attack, while releasing no detail on method or attribution. The investigation is proceeding as an attack on an automated data processing system by an organised group. The bank’s application was unavailable and transfers were suspended on 4 November, and customers have been advised to remain alert to phishing.
For context, Arkéa reported a net profit of €230 million in the first half of 2026. Independent blockchain investigator ZachXBT identified the suspicious flows on 2 November, two days before the bank’s disclosure, initially estimating over $106 million before revising the figure upward.
Source: France 24 citing AFP, Inquirer citing AFP
None of these three incidents required an attacker to defeat a perimeter control. Binance was compromised through a recruitment process its employee engaged with voluntarily. EFS was reached through a maintenance contractor with remote access to its cold storage. Arkéa’s funds moved through a service provider’s platform, and an external investigator identified the activity before the bank disclosed it. Third-party access and social engineering remain well-documented attack paths; what distinguishes this week is the value extracted through them.
Stay vigilant and informed, tune in next week for more updates in InfosecTrain’s CyberWatch Weekly!