Nov 9, 2026 · 11 min
Credential breaches turn routine cyber flaws into cascading crises
French bank loses $133M in cyber heist, Chainalysis breach exposes every customer login, Attackers exploit OpenSSH flaw
The episode shows how third-party access, stored secrets, exposed credentials, and basic phone-security failures can rapidly become financial, operational, and personal disasters.
- 1A compromised provider allegedly enabled Crédit Mutuel Arkéa’s $133 million cryptocurrency theft and subsequent stablecoin laundering.
- 2Chainalysis says usernames, password hashes, and live tokens for every customer were exposed, prompting service shutdowns and credential resets.
- 3Attackers exploited an OpenSSH flaw within nine hours while leaked Cloud Code settings exposed thousands of credentials and secrets.
Don't miss
Attackers began exploiting the OpenSSH vulnerability less than nine hours after its disclosure, underscoring how little time administrators had to respond.
The brief
David Shipley opens with a cluster of incidents showing how attackers turn trusted infrastructure, developer conveniences, and delayed security decisions into high-impact failures.
Crédit Mutuel Arkéa reportedly lost up to $133 million after attackers entered through a third-party provider, moved funds across institutions, and converted them to stablecoins.
Chainalysis says its breach exposed usernames, password hashes, and live tokens for every customer, including government agencies, banks, and insurers, forcing major services offline.
A Cloud Code setting saved passwords and tokens in project files, while more than a thousand public GitHub copies exposed database, SSH, and AWS credentials.
The episode closes on speed and human vulnerability: OpenSSH was exploited within nine hours, while a British soldier’s phone-security failure led to blackmail and detention.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.