Binance's $6.3 billion theft began with a fake interview and 2 more

What people are saying

Posts on Mastodon say attackers went through a refrigeration contractor to tamper with freezers holding donated blood at France's national blood service, the Établissement français du sang (EFS). Early replies read the lack of any claim of responsibility as a sign of state actors. Others tied it to the European supermarket attacks. In that wave, chains in at least seven European countries reported overnight temperature spikes in their refrigerators and freezers.

What holds up

Cyberattaque.org reports that on the night of November 1 to 2, 2026, an attack on Coolworld, an EFS contractor, changed temperatures on equipment that stores blood products. The freezers, normally held near -30 °C, were reportedly programmed to reach 110 °C. That figure is a setpoint. The temperature requested of a controller, the temperature measured in the unit and the temperature reached inside the stored product are three different things.

20 Minutes reports, citing the Ministry of Health, that a technician detected the attack in time. The same outlet says the attackers exploited a weakness at the external subcontractor Coolworld. EFS later said frozen plasma intended for patients was also affected. No destroyed plasma, compromised transfusion or patient harm has been confirmed.

The number of sites, the duration and the temperatures the blood products actually reached have not been disclosed. The method has not been published either. No formal link to the supermarket attacks has been established.

The verdict: partly confirmed. The core event is established. Attribution, scale and any connection to the wider wave are not.

Inside the threads

The largest camp read the absence of a claim as a sign of a state actor. In our reading that is speculation. A skeptical camp doubted the story because the original report came from Le Canard enchaîné, which one commenter called satirical. A French commenter answered that investigative journalism is a major part of its reputation. The same skeptic later pointed to an official EFS statement and noted that, unlike in the supermarkets, monitoring and alarm systems had worked. Practitioners kept returning to one design point: remote monitoring and remote control should be split, and alerts are usually all an operator needs remotely. Some replies assumed the same controller flaws as in the supermarket attacks. There is no public evidence that Coolworld's equipment belongs to the controller families named in the French alert.

Our take

The headline number is the least useful detail here. The part that matters for a security leader is that a cold-chain supplier's remote access became a path into a healthcare provider's operational technology (OT). In our reading, the warning signs were already public. We think many organizations still treat facilities vendors as outside the security program. That gap is where this kind of incident happens.

What to do

• List every supplier with remote access to refrigeration, building management or other OT. Then follow the alert from France's National Cybersecurity Agency (ANSSI): remove management interfaces exposed to the internet and restrict remote maintenance to secured connections.
• Check whether you run the controller families named in alert CERTFR-2026-ALE-012, and confirm that firmware is current.
• Separate vendor monitoring from setpoint control, and require local approval for changes to setpoints.
• Route temperature alarms that do not depend on the vendor to your own on-call staff, and test them.