Four cybersecurity developments on November 4 brought new disclosures about compromised financial infrastructure, stolen cryptocurrency and weaknesses in transaction controls. In today’s crypto security roundup, Chainalysis confirmed that some customer passwords were exposed during an ongoing attack, French bank Crédit Mutuel Arkéa identified a third-party platform used in a suspected $133 million theft, and Bitquery traced the Mercado Bitcoin hacker’s access to more than 36,000 deposit addresses. Separately, researchers detailed a flash-loan attack against InsurancePool and CoreVault on BNB Chain that generated approximately $111,000 in attacker proceeds.
Chainalysis confirms password exposure as screening services go offline
Blockchain intelligence firm Chainalysis confirmed on November 4 that an on-path cyberattack exposed passwords belonging to a subset of its customers, expanding the previously disclosed impact of a security incident first reported on October 30.
In an update published at 9:50 a.m. EST, the company said it had identified the credential-exposure mechanism, contained it and begun notifying affected customers. Chainalysis started locking impacted accounts and requiring password resets as a precaution.
The company emphasized that its investigation had found no evidence that the affected customer accounts were improperly accessed. The confirmation of password exposure therefore does not establish that attackers used those credentials to enter customer accounts or retrieve their investigation records.
Forty minutes later, Chainalysis reported abnormal activity affecting its transaction-screening products. At 10:30 a.m. EST, it said it had taken its Know Your Transaction (KYT) user interface and API offline, together with other address-screening services and the login page. Reactor, Data Solutions and Chain Beta also remained unavailable.
The password reset instruction was there, but the login page wasn’t. Chainalysis acknowledged that customers receiving reset notifications could not immediately complete the process through its normal login system. The shutdown temporarly interrupted access to several products used by cryptocurrency firms and financial institutions for transaction monitoring and investigations.
The November 4 disclosure also updates the company’s October 30 assessment, which found no indication that clear-text passwords, authentication secrets or session tokens had been accessed. That earlier statement was based on the investigation at the time; the subsequent on-path finding established a narrower credential-exposure event that had not previously been confirmed.
On November 2, Chainalysis had deliberately kept its transaction-monitoring products operating while taking Reactor and Data Solutions offline. The abnormal activity reported two days later changed that decision, extending the interruption to compliance-screening systems.
Chainalysis previously stated that the incident was unrelated to the October 29 Binance security breach and subsequent cryptocurrency laundering investigations, even though its researchers had been actively tracing the stolen assets.
The company has not disclosed the number of affected customer accounts, the precise technical conditions that enabled the on-path attack or a confirmed timetable for restoring every affected product.
Crédit Mutuel Arkéa identifies third-party entry point in $133M attack
French banking group Crédit Mutuel Arkéa disclosed new technical details on November 4 concerning an attack involving fraudulent transfers from its own institutional account, clarifying how attackers reached the bank and addressing reports that approximately €118 million ($133 million) had been stolen.
In its additonal statement, the bank said attackers entered through a platform operated by one of its service providers, rather than directly through Fortuneo, its online banking subsidiary.
The bank’s account, not a Fortuneo customer’s, was what moved the money. According to Arkéa, the attackers used its institutional account to execute transfers toward other banking institutions, potentially enabling subsequent conversion of the funds into cryptocurrency through specialized platforms.
Arkéa explicitly denied reports that Fortuneo had been the entry point. It also stated that the incident had not involved accounts belonging to customers of its banking networks or subsidiaries.
The bank’s initial November 4 announcement said the incident had been contained and that operations were gradually resuming after additional security checks. The group temporarily suspended certain transfers to prevent further unauthorized movements, causing delays for some customers without affecting their account balances.
Asked directly whether €118 million had been stolen, Arkéa declined to confirm the exact figure. It acknowledged that the reported amount was broadly consistent with the scale under investigation but said the final financial impact had not been established.
Some funds had already been blocked, while recovery efforts and forensic investigations continued. The numbers are close in scale, not the same thing as a confirmed loss.
The bank said the sums involved were insufficient to threaten its financial strength. It also reported cooperation with judicial, police and supervisory authorities and described the incident as a sophisticated external attack rather than an internal human error.
The new disclosure identifies a service-provider access route and the use of the bank’s own account, but does not name the provider, identify the receiving banks or establish how much money was ultimately converted into cryptocurrency. Those details remain necessary to reconcile the reported €118 million exposure with the final unrecovered loss.
Mercado Bitcoin hacker emptied 36,042 deposit addresses
A November 4 forensic investigation by blockchain analytics firm Bitquery estimates that approximately $48.6 million was transferred from wallets associated with Brazilian cryptocurrency exchange Mercado Bitcoin across ten blockchains during its November 2 security incident.
The investigation provides substantial new detail beyond the initial reports of more than $40 million in suspicious Mercado Bitcoin outflows, including evidence that the suspected attacker could initiate transfers from thousands of individual customer deposit addresses.
Bitquery identified 36,042 Ethereum deposit addresses that sent their balances to an attacker-controlled wallet between 12:27 and 16:56 UTC on November 2. The transactions continued for approximately four hours after Mercado Bitcoin publicly indicated that the attack had been contained.
The stopping point announced by Mercado Bitcoin and the wallet activity, they did not line up.
Bitquery estimates that the Ethereum deposit-address sweeps represented approximately $266,000 in transferred assets. That amount forms part of the wider traced outflows, not an additonal $266,000 loss to be added to the $48.6 million estimate. The address count also does not establish that 36,042 distinct customers were affected.
The researchers found that individual deposit addresses had signed their own outgoing transactions. This pattern suggests that the attacker obtained access to the keys or signing infrastructure responsible for processing deposits, rather than merely draining the exchange’s central hot wallets.
The precise compromise mechanism remains unknown. Access to an automated signing service could produce similar blockchain activity without requiring every individual private key to have been separately extracted.
The latest investigation also estimates that approximately $11.8 million in affected assets had been frozen by five token issuers, including Tether, Circle and Paxos. Bitquery reported that the attacker subsequently sold around $11.9 million worth of tokens for ETH during November 3 and 4.
The findings suggest a second possible exposure beyond Mercado Bitcoin. Bitquery traced approximately $391,000 transferred from wallets predominantly associated, through its address-attribution data, with cryptocurrency exchange BitMart. The transfers began before the principal Mercado Bitcoin outflows.
BitMart has not publicly confirmed the wallet ownership or an associated security incident. The researcher seperately cautioned that the address labels and transaction patterns do not establish how the wallets were compromised or whether a common infrastructure provider was involved.
The deposit-address findings have a relevant precedent in CoinDCX’s confirmed $15.99 million loss involving previously compromised deposit addresses. In that October case, deposits continued arriving in older wallets after a security incident, and a failure in automated sweeping left funds exposed. No shared attacker or vulnerability has been established between the exchanges.
Mercado Bitcoin has maintained that customers will not bear financial losses from its incident. Bitquery’s findings describe blockchain transfers, not a verified reconciliation of the exchange’s customer liabilities, reserves or ultimate recoveries. Its latest transaction snapshot was taken on November 4, meaning later asset movements are not included.
CoreVault flash-loan attack yields about $111,000 in BNB
Blockchain security researchers identified a suspected price-manipulation attack involving the InsurancePool and CoreVault contracts on BNB Chain, with TenArmor estimating approximately $112,300 in losses in an alert published early on November 4.
A subsequent investigation by Onchain Lens reconstructed a transaction involving a flash loan valued at approximately $143.6 million in wrapped BNB (WBNB), borrowed through Moolah, a lending protocol associated with Lista DAO.
The attacker allegedly used the borrowed funds to execute large swaps that distorted liquidity-pool prices, allowing CoreVault’s redemption mechanism to calculate an abnormally high payout from InsurancePool.
The manipulated redemption released approximately 260.21 BNB, valued at around $180,300. The attacker then reversed the swaps and repaid the borrowed WBNB, leaving approximately 160.26 BNB, or $111,000, in proceeds before gas fees.
Big loan, considerably smaller profit. The $143.6 million was temporary capital borrowed and repaid within the transaction, while the approximately $180,300 redemption was the gross amount withdrawn through the manipulated mechanism. Neither figure represents the attacker’s final net proceeds.
Onchain Lens separately estimated InsurancePool’s net depletion at approximately $179,500, reflecting a different measure from the attacker’s retained gain. CertiK also reported that the pricing manipulation amplified the redemption by roughly 33 times.
The transaction can be examined through the recorded BNB Chain transaction, which confirms execution in block 131,507,810 at 21:50:20 UTC on November 3, before the November 4 security alerts. The record includes transfers involving more than 207,000 WBNB, consistent with the large flash-loan sequence described by investigators.
The transaction executed succesfully, but the published findings do not yet establish the exact contract-level pricing flaw, whether the vulnerable mechanism has been disabled or how the affected pool will be replenished.
Unlike the Mercado Bitcoin incident, where the unresolved investigation centers on access to wallet-signing infrastructure, the CoreVault case involves the apparent misuse of pricing information within smart-contract redemption logic. A full technical post-mortem would be required to determine which safeguards failed and whether other contracts relying on the same price source remain exposed.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574