A week after the record theft from Binance, two more financial institutions were robbed within days of each other: one in Brazil, one in France. Neither attack has been tied to Binance or to each other. What they share is more useful to a small business than any attribution: the money left through systems the victims trusted, and how fast the theft was reported decided how much of it could be stopped.
Mercado Bitcoin: "contained," and then four more hours
In the early hours of 2 November, an attacker began moving cryptocurrency out of Mercado Bitcoin. According to the blockchain-analysis firm Bitquery, the exchange's online wallets on ten blockchains were drained in about 25 minutes; the Ethereum wallet alone lost $29.5 million in 24 minutes. That afternoon the exchange said it had "quickly identified and contained a security incident," suspended deposits and withdrawals, and said there had been no customer loss and no data leak.
Blockchain analysts tell a less tidy story. Bitquery found that after the exchange's "contained" statement, the attacker emptied more than 36,000 customer deposit addresses on Ethereum over roughly four more hours, plus smaller numbers on other blockchains. The amounts in each were tiny, about $266,000 in total, but analysts say it shows the attacker could sign transactions for customer deposit addresses, not only for the exchange's own wallets. Mercado Bitcoin has not said how the attacker got in.
Stablecoin issuers, led by Tether and Circle, froze part of the stolen funds, and Mercado Bitcoin says more than $15 million is now frozen. The exchange says it will restore each customer's balance from its own funds. Its website reopens in read-only mode on 9 November so customers can check their balances; trading and withdrawals will return later, after independent testing.
Crédit Mutuel Arkéa: through the supplier, out of the bank's own account
The French case did not start with the bank. It started on 2 November with ZachXBT, an independent blockchain investigator, who flagged more than $106 million being withdrawn from crypto exchanges on behalf of an unnamed European entity, later raising the figure to over $133 million. Overnight into 4 November he named the entity: Crédit Mutuel Arkéa.
The bank confirmed it the same day. The attackers "went through the platform of one of our service providers," it said, and then "used Crédit Mutuel Arkéa's own account to make transactions to other banking players." The money was converted to cryptocurrency on specialist platforms. The bank ruled out human error, described "a sophisticated attack from outside," and has not named the provider. It denied media reports that Fortuneo was the entry point. Customer accounts and data were not accessed, though some customers could not make transfers in the bank's apps on 4 November.
The bank filed a complaint that morning and the Paris prosecutor's cybercrime section opened an investigation into an organized attack on a data system. Part of the funds was blocked. ZachXBT's view is that slow disclosure let more than $30 million be laundered that could otherwise have been frozen.
What a small business should take from this
The supplier path is the business email compromise path. Arkéa's money did not leave because someone broke into the bank's vault. It left through a provider's platform that was trusted to initiate payments. That is, at a much larger scale, exactly how most invoice fraud against small businesses works: a supplier's email account is compromised, the bank details on an invoice change, and the payment goes out through your own perfectly legitimate banking process.
Minutes matter more than attribution. In both cases, the money that was recovered was recovered because a third party, a stablecoin issuer or an exchange, froze it quickly. In Arkéa's case an outside investigator noticed before the bank said anything. For a business that has wired money to a fraudster, the equivalent is calling the bank's fraud line in the first hour. After a day or two, the money is usually gone.
"Contained" is a claim, not a fact. Mercado Bitcoin said the attack was contained while it was, according to the blockchain, still running. Any organization's first statement in an incident is a best guess. If your provider tells you an incident is over, ask what evidence that is based on.
Keep the operating balance small. Exchanges keep only part of their funds in online wallets precisely because those are the ones that can be stolen quickly. A business can do the same with its bank accounts: keep the account that payments go out from funded for what it needs, and the rest somewhere that takes more steps to move.
What to actually do
Verify every change to payment details by phone. Use a number you already had, not one in the message asking for the change, and require a second person to approve the change before money moves.
Use your bank's own controls. Dual approval for outgoing transfers, daily limits, and alerts on new payees are usually free. Turn them on.
Know which suppliers can move your money. Payroll providers, payment platforms, bookkeepers with banking access: list them, and ask each what protections they have and how they would tell you if they were breached.
Write down who calls the bank. Decide now who contacts your bank's fraud line if a payment goes wrong, and report it to the police and, in the US, to the FBI at ic3.gov. Do it within the hour.
Do not keep business funds on crypto exchanges. If your business holds cryptocurrency for any reason, it does not belong on an exchange longer than necessary.
The summary
A Brazilian exchange and a French bank, a few days apart, unconnected as far as anyone can tell. In one, the attacker was still emptying wallets hours after the incident was declared contained. In the other, money left through a supplier's platform, and an outside investigator raised the alarm before the bank did.
The defenses that would have helped are the same ones that protect a 50-person company from invoice fraud: control who can move money, verify every change, keep the payment account lean, and call the bank fast.
Sources
- Hackers drain more than $46 million from Brazil's Mercado Bitcoin — The Record
- Mercado Bitcoin sofre ataque hacker de US$ 40 mi, mas descarta perdas para clientes — Bloomberg Línea
- Mercado Bitcoin sofre ataque hacker dias depois da Binance — InfoMoney
- Mercado Bitcoin hack investigation — Bitquery
- Mercado Bitcoin hack continued hours after exchange said attack was contained — CoinDesk
- Mercado Bitcoin marca reabertura da corretora — Livecoins
- French bank confirms cyber heist — The Record
- Crédit Mutuel Arkéa: cyberattaque pour près de 100 millions d'euros, enquête ouverte — AFP, via Boursorama
- Ce que l'on sait du piratage du Crédit Mutuel Arkéa — franceinfo
