From Gnosis Pay to SignalPlus, a Run of Smaller Breaches Follows Binance's $6.3 Billion Theft

Binance's $6.3 billion theft on October 29 was the largest in crypto history, but not the only recent incident. Since then a card provider, a Hong Kong trading platform, a Brazilian exchange, an Indian exchange, a payment-server project and a French bank have disclosed breaches, along with several DeFi protocols.

PeckShield counted 56 major attacks in October with losses of $6.48 billion and put 2026's total near $8.6 billion, TechFlow reported . CertiK put October at about $6.5 billion gross and $3.47 billion after $3.03 billion was frozen or returned, The Defiant reported .

Gnosis Pay told customers in an X post on November 6 that attackers accessed its legacy consumer card system on November 3, exposing card numbers, names, home addresses and linked wallet addresses. The system retires on December 20 and the company has not said how many customers were hit. Funds were unaffected. MapleStory Universe confirmed on November 12 that attackers reached part of its off-chain servers, exposing user data, with no assets stolen, per SlowMist .

SignalPlus, a Hong Kong-based derivatives tools provider, said a compromised Telegram account at a third-party vendor was used to send an engineer a fake Microsoft Teams invitation. Losses were under $82,000. Binance and Deribit revoked all linked API keys on November 5, and SignalPlus suspended services for a security review.

Mercado Bitcoin, Brazil's largest exchange, lost an estimated $49 million on November 2. About $11 million was frozen, and the exchange says it will cover the rest. Crypto deposits, withdrawals and trading remain suspended and it has not explained how attackers got in, Cointelegraph reported .

BitMart lost about $391,000 the same day, and its founder said the same group appeared responsible. BTCPay Server told operators on November 1 to shut down instances running version 2.4.1 or older after hot wallets were swept, and has not disclosed the loss, Bitbase reported .

Unocoin, one of India's oldest exchanges, has been offline since November 9. It detected unauthorised server access on November 6 and asked Fireblocks and BitGo to freeze its enterprise accounts, before subsequently flagging outgoing ETH transactions from a wallet linked to its BitGo setup on November 12. It says no customer funds have been lost, per its timeline .

BitGo published its own account on November 13. It said the wallet was a two-of-three multisignature setup in which Unocoin held the user and backup keys, that its review identified transfers across ERC-20 tokens, XRP, HBAR and EOS, and that a freeze stops BitGo signing but does not lock funds on the blockchain. It advised Unocoin to move remaining funds to new wallets with new keys, in its blog post .

“BitGo froze Unocoin’s enterprise days ago, and the freeze functioned as intended. The recent outgoing transaction was signed using the user and backup keys held by Unocoin and broadcast externally on-chain, without BitGo’s participation. BitGo’s systems were not breached. Our findings indicate that Unocoin lost funds; any impact on its customers’ balances would need to be confirmed by Unocoin.”

Unocoin says customer funds were not lost, while BitGo's reading is that Unocoin lost funds and customer impact is for the exchange to confirm. If a client holds 2 of 3 keys required to sign transactions, it defeats the whole purpose of a custody service. Arkham data showed about 81,000 related wallets at zero balances, and reports differ on what that shows, Bitcoin.com reported .

Polymarket's international platform lost about $2.7 million on October 29 after a third-party monitoring provider was compromised. Around October 31, at least 12 DeFi sites registered through Name.com were hijacked, costing users about $138,000, The Block reported . This week Across lost control of its website domain through social engineering at its registrar, Namecheap, and promised full compensation, per Huo Xing Cai Jing . SlowMist also warned that Swarm's bee-js 13.3.0 and Swarm Desktop 0.56.2 carried wallet-stealing malware.

Crédit Mutuel Arkéa confirmed on November 4 that a cyberattack enabled fraudulent transfers that were converted into crypto. Reuters reported over $100 million was stolen, which the bank confirmed, according to various reports. In a Les Echos exclusive yesterday, hackers gained access to the French banking group's network after breaching B4Finance, an external software provider used by its private equity arm, Arkéa Capital.

Once inside, the attackers bypassed internal security controls by generating fake Fortuneo IBANs to authorize instant payment transfers directly out of the bank's proprietary funds. The stolen money was quickly routed to legitimate European bank accounts before being dispersed across various cryptocurrency platforms. While the bank's chairman, Julien Carmona, noted that the unprecedented heist was likely aided by advanced AI models, the institution confirmed that customer accounts were completely unaffected and that authorities managed to freeze a portion of the fund

Smaller DeFi losses continue. Ankr's Ethereum bridge lost about $304,500 on November 9 to five forged withdrawal receipts, Initia lost $3.27 million while ACryptoS lost about $665,000 and said it can no longer operate , and SlowMist also lists zkLink Nova ($783,000), Troves ($667,000), and Edel Finance (about $300,000).

Most of these cases did not break cryptography. They went through people, vendors, keys and unpatched software: a fake recruiter at Binance, a fake meeting invite at SignalPlus, a monitoring vendor at Polymarket, a registrar at Across. The Justice Department described the same method at scale on Thursday in FaceStealer, a North Korean scheme that lures targets into fake video meetings and is tied to more than $400 million of thefts, The Record reported .

Recovery varies. Binance said it completed replacement of the $6.34 billion on November 12, and the Justice Department said more than $2.7 billion has been frozen, with court authorisation to seize or restrain more than $1.2 billion, attributing the theft to North Korea's TraderTraitor, according to its release . Mercado Bitcoin froze about $11 million of an estimated $49 million. Blockhead covered earlier cases in Bitget's hot-wallet breach and Keystone's hardware wallets .

For more on crypto tracing, be sure to read our previous pieces on tranparency and recovery .