Four cryptocurrency security developments have emerged from investigations on November 5, covering a $1.013 million Avalanche smart-contract exploit, a confirmed security breach at derivatives trading platform SignalPlus, a coordinated wallet-draining campaign that stole at least $4.16 million across multiple blockchains, and new tracing that expands a suspected French banking-related crypto theft to $126 million. The cases involve different attack methods, from faulty smart-contract accounting to compromised employee devices and suspicious exchange withdrawals. Several of the latest findings concern incidents that began weeks earlier, making the distinction between the original attack and the subsequent forensic disclosure important.
GCSA reconstructs $1.013 million Avalanche TranchePool exploit
A newly published investigation by the Global Cybersecurity Alliance (GCSA) has reconstructed how an attacker drained 1,013,353.61 USDC from an Avalanche TranchePool through a cross-day accounting vulnerability. The exploit occurred on October 27–28, but GCSA published its technical investigation on November 5.
The attack involved two transactions executed 202 seconds apart, across blocks 98731443 and 98731606. The vulnerable contract was identified as 0xe25cb545bdd47a8ec2d08001cb5661b00d47621a.
At 23:56:41 UTC on October 27, the attacker used an Aave V3 flash loan to borrow 1,013,353.61 USDC. The funds were deposited into a newly created tranche and withdrawn again within the same transaction. The attacker then repaid the flash loan, including approximately $506.68 in fees. The first transaction left the vault’s overall USDC balance unchanged.
That first transaction looked like a round trip, because that is exactly what it was. Its purpose was to establish a tranche record that could be exploited after the daily accounting reset.
At 00:00:03 UTC on October 28, the attacker submitted the same withdrawal calldata again. The contract’s settlement function had reset the previously withdrawn amount to zero when the UTC date changed, before checking the available withdrawal limit. The system therefore treated the previously exhausted tranche as eligible for another full withdrawal.
The second transaction transferred another 1,013,353.61 USDC from the vault, emptying its remaining balance. The accounting mechanism did not properly distinguish between a daily withdrawal counter and the cumulative amount already withdrawn, while the contract also failed to verify that sufficient funds remained in the vault before executing the transfer.
GCSA’s analysis identifies a contract-level accounting vulnerability rather than a compromise of the Avalanche network itself. The investigation highlights how a daily reset can become exploitable when the same accounting field controls both withdrawal limits and settlement state. The full GCSA technical investigation provides the transaction sequence, contract address and reconstructed vulnerability mechanism.
SignalPlus confirms breach involving compromised vendor contact
SignalPlus confirmed that attackers compromised its internal infrastructure after hijacking a Telegram account belonging to a contact at one of its third-party technology vendors. The derivatives trading platform disclosed the incident on November 5 at 13:28:23 UTC, although the intrusion itself began in the early hours of November 4.
According to SignalPlus, the attacker impersonated the vendor contact and approached one of its engineers through Telegram before sending a malicious Microsoft Teams meeting invitation. The engineer’s computer was subsequently compromised, giving the attacker a route into the company’s internal infrastructure.
SignalPlus said the attacker began using the engineer’s access privileges to target its internal network on November 4. The company detected and contained the intrusion, reporting total customer losses below $82,000. It said reimbursements had already begun on a case-by-case basis and pledged to compensate all affected users in full.
The company also acknowledged a separate weakness in its security arrangements: mandatory IP whitelisting had not been enforced for exchange API access. It accepted responsibility for the oversight and said it would strengthen API restrictions, endpoint security, internal access controls and key management.
The incident prompted immediate action from connected exchanges. Binance and Deribit revoked API credentials associated with SignalPlus as a precaution. Binance said its own systems were unaffected and customer funds remained safe, while Deribit reported no evidence that its infrastructure or data had been compromised.
SignalPlus temporarily suspended its terminal services while conducting a wider security review and applying patches. The company expected to restore services in phases over the following days, but the November 5 disclosure did not confirm that the process had been completed.
The attack adds another example of how third-party trading infrastructure can expose exchange-connected accounts even without a direct breach of an exchange’s own systems. The earlier Binance security incident and associated crypto-security developments provide further context for the operational pressure facing cryptocurrency platforms following recent attacks.
Bitquery traces at least $4.16 million in coordinated wallet drains
Blockchain analytics firm Bitquery has identified at least $4.06 million in USDT stolen from 365 TRON wallets through a coordinated network of 43 collector addresses funded by a common fee wallet. Its investigation, published on November 5, examined transactions between October 5 and November 4 and identified another 65 drained wallets across eight additional blockchain networks, involving at least $103,000 in further losses.
The central finding is the relationship between the collector addresses and a common fee-funding wallet, TUYFAa8hHjeEW6bPqBJ4v3RjQR2uKM1Svk. The address supplied the TRX needed to pay transaction fees, allowing the investigators to connect multiple short-lived collector wallets that received funds from victims.
Bitquery found that the 43 collectors took USDT from 365 TRON addresses, with the investigation identifying transfers consistent with automated wallet draining. In one case, researchers matched a victim’s published iPhone theft account to the blockchain transactions almost to the second. The victim lost 16,428 USDT, followed 12 seconds later by the remaining TRX in the wallet.
The money subsequently moved through several routes, including CCE Cash, deBridge and NEAR Intents. The investigation also identified activity involving exchanges and cross-chain services that could provide additional points for tracing or potentially freezing funds.
There are important limits to the attribution. Bitquery explicitly cautioned that a shared fee wallet does not prove that a single criminal group controlled all 43 collectors, since wallet-draining tools and infrastructure can be sold or rented to multiple operators.
The findings also do not establish that Trust Wallet was compromised or that a particular iOS vulnerability caused every reported theft. The blockchain evidence identifies drained addresses and transaction relationships, but it generally cannot establish which wallet application or phone was used by each victim.
The investigation adds to earlier reporting on how iPhone spyware and exploit chains can expose cryptocurrency wallet information. The new on-chain evidence demonstrates the scale of the reported drains, but it does not establish that every affected device was infected through the same method.
At least $4.16 million in combined reported losses is now visible across the nine networks covered by Bitquery’s investigation. The figure remains a minimum based on the addresses and transactions included in its analysis, rather than a complete accounting of all potential victims.
Bitquery expands suspected Arkéa-linked theft tracing to $126 million
A separate Bitquery investigation has increased the traced cryptocurrency outflows associated with the suspected Crédit Mutuel Arkéa theft to $126.04 million, identifying withdrawals from Kraken, Crypto.com and OKX that reached 17 receiving wallets on November 1 and 2.
The new analysis expanded the earlier investigation by identifying two additional receiving wallets that were not included in the initial public address list. Kraken transferred approximately $17.2 million to those two wallets between 15:46 and 16:30 UTC on November 2, several hours after the first public allegations of the theft had emerged.
Bitquery subsequently followed the transaction flows across 526 addresses. Twelve of the original 17 receiving wallets had previously received payments from the same exchanges, with two showing activity dating back to May 2026. The pattern suggests that at least some of the receiving infrastructure existed well before the November transfers.
At the latest Ethereum balance snapshot, taken at 08:47 UTC on November 5, approximately $37.26 million remained in wallets linked by Bitquery to the suspected attacker. Around $95.8 million had already moved onward through bridges, exchange deposits, instant-swap services and other wallets.
Stablecoin freezes covered only a small portion of the identified funds. Tether had frozen approximately 1.14 million USDT, while another 540,000 USDT remained unfrozen. Circle had not frozen the approximately 1.71 million USDC still held in the identified wallet network at the time of the snapshot.
The investigation follows Crédit Mutuel Arkéa’s November 4 confirmation that attackers had exploited a third-party service-provider platform to access the bank’s institutional account and initiate fraudulent transfers to other banking institutions. The bank denied that Fortuneo, its online banking subsidiary, was the entry point and said customer accounts were not involved.
Arkéa initially placed the suspected amount at approximately €100 million and said investigations and recovery efforts were continuing. It has not independently confirmed Bitquery’s $126.04 million exchange-withdrawal reconstruction as the final amount stolen. Paris prosecutors have also opened an investigation into the incident.
The bank’s statement and the blockchain reconstruction are two different records, and they do not answer the same question. Bitquery has traced cryptocurrency movements that it associates with the suspected theft, but the bank’s original transfers took place through the banking system, meaning the complete connection between the two stages still depends on investigative evidence outside the blockchain.
The new findings nevertheless provide investigators with additional receiving addresses, exchange withdrawal records and potential intervention points. The two newly identified Kraken-funded wallets alone account for $17.2 million that was missing from the initial tracing exercise.
The expanded investigation follows DaveFinances’ earlier reporting on Crédit Mutuel Arkéa’s November 4 disclosure, which examined the bank’s explanation of the third-party access route and the distinction between the suspected financial exposure and confirmed customer losses.
Across these four developments, the evidence ranges from a reconstructed smart-contract exploit and a company-confirmed intrusion to large-scale blockchain tracing. The Avalanche case identifies a specific accounting failure, SignalPlus has acknowledged both the attack and its missing API safeguard, and Bitquery’s investigations have expanded the visible scale of two separate theft campaigns. Final recovery figures, complete attacker attribution and the full extent of affected users remain unresolved.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.