The week in breach news Nov 11, 2026

New reports reveal that hackers used a fake job interview as part of the elaborate scheme behind last week’s $6.3 billion Binance cyberattack, the largest cryptocurrency heist on record.

Binance confirmed that the attack was a detailed, multi-stage operation that began in June 2026 and unfolded over several months before culminating in the theft on October 29. The attack began when an employee on the wallet developer team downloaded a tampered tool from the internet. Binance detected the compromise, replaced the device and changed credentials, but the employee’s role and those of others on the wallet team had already been exposed. In September, a second software engineer downloaded a malicious code repository onto their personal computer after interviewing for what appeared to be a legitimate role, including a virtual meeting with the CEO of a fictitious company. On October 20, the attacker used the compromised computer along with an internal AI tool to gain control of two wallet developers’ systems.

Nine days later, the attacker used the second wallet developer’s computer with stolen credentials from the first to trigger a malicious script, removing 233.46 million XRP from five Binance hot wallets to an attacker-controlled address in just four minutes before withdrawing additional cryptocurrencies, including bitcoin.

Following the second wave of refrigeration cyberattacks that hit supermarkets across Europe, U.S. agencies have issued a warning that hackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide.

The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the U.S. Departments of Health and Human Services (HHS), Agriculture (USDA), and Transportation (DOT) have jointly warned critical infrastructure operators to secure vulnerable refrigeration controllers used in health care, food production, chemical facilities and transportation. The agencies say hackers are actively exploiting these systems, potentially causing food spoilage, equipment damage and fire hazards. The joint advisory specifically flags attackers exploiting weaknesses in unpatched or internet-accessible electronic temperature controllers and commercial refrigeration management systems.

The agencies said that every organization that depends on refrigeration and monitoring systems should assume it could be a target. These devices allow operators to monitor temperatures remotely, manage defrost cycles and control cooling equipment, making them a critical yet often overlooked part of an organization’s attack surface.

N-able took its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities in the platform.

On November 8, security researcher Sean Bales disclosed the vulnerabilities and published a GitHub repository called Able2Shell containing proof-of-concept exploits for the flaws. The vulnerabilities were tested against N-central Appliance 2026.4.0.31, a pre-release version of the software, with the researcher believing most, if not all, of the flaws also affect earlier versions. Notably, the researcher said the discovery of the vulnerabilities was AI-assisted.

The disclosed vulnerabilities include authentication bypasses, credential disclosure, arbitrary file writes, directory traversal, cross-site scripting (XSS), XML external entity (XXE) injection and remote code execution (RCE) flaws.

Hackers have pulled off a $133 million heist at French cooperative bank Crédit Mutuel Arkéa through a supply chain breach.

Crédit Mutuel Arkéa is a major French banking group with more than 5.8 million members and 211.5 billion euros in assets. The bank was targeted in a cyberattack that enabled fraudulent transactions of up to $133 million, forcing it to suspend certain systems in response. Reports of the incident first emerged on November 2 from blockchain fraud investigator ZachXBT, who flagged a large-scale unauthorized withdrawal from multiple centralized exchange accounts. Arkéa publicly disclosed the incident on November 4, assuring customers that the situation is under control and has no impact on their assets.

The bank confirmed that the attacker reached its network directly through a service provider’s platform and used Arkéa's own account to initiate transactions to other banking organizations, with customer assets remaining unaffected.

In yet another cryptocurrency breach, blockchain analytics company Chainalysis announced it fell victim to an AI-driven cyberattack that resulted in a data breach.

On October 30, Chainalysis confirmed it detected an external actor using offensive agentic techniques to gain unauthorized access to its systems and internal tools. The company said the attack did not result in the compromise of investigation content, transaction or query results, passwords in clear text or other credentials and secrets. However, customer data, including user IDs, full names, email addresses and organization role labels for users provisioned on the platform, was accessed. Given that names and email addresses were compromised, Chainalysis is advising users to watch for unexpected authentication prompts and password reset requests and to ensure that multifactor authentication (MFA) is enabled on their accounts.

The cryptocurrency sector continues to find itself firmly in the crosshairs of cybercriminals, with attacks on Binanceand COLDCARD alone resulting in billions of dollars in losses this year.