In late October, hackers stole $6.3 billion from Binance, the world’s largest cryptocurrency exchange, and just days later, French lender Crédit Mutuel Arkéa lost roughly €100 million ($112 million) to cybercriminals. The back-to-back attacks underscore the growing threat of cyber heists to both crypto platforms and traditional banks. Ryan Kirkley, CEO of Global Settlement, warned that if a major exchange like Binance can be breached, the risks for banks are even greater. Changpeng Zhao, Binance’s founder, echoed this sentiment, stating that banks are in an even worse position when it comes to cybersecurity.
The Binance hack involved social engineering and malware, where attackers tricked an engineer into downloading malicious software during fake job interviews. The FBI has since recovered $1.2 billion of the stolen funds, and Binance has replenished about 98% of the total impacted amount. Experts note that the vulnerabilities exploited in the Binance attack are not unique to crypto and pose similar risks to traditional financial institutions. Katerina Mitrokotsa, a cybersecurity professor, emphasized that regulation alone does not make banks safer.
Regulators on both sides of the Atlantic have expressed concerns. In the U.S., the Federal Reserve and the Office of the Comptroller of the Currency have been probing banks for unusual activity, while the European Central Bank previously warned about the risks of frontier AI models. Banks do have some advantages, such as the EU’s Digital Operational Resilience Act (DORA), which requires cyber incident reporting and defense testing. However, Vivien Mura of Orange Cyberdefense acknowledged that these advantages do not necessarily prevent attacks.
Mitrokotsa highlighted two critical weak spots for banks: reliance on outside suppliers and aging technology. The Crédit Mutuel Arkéa breach, for instance, involved hackers using the bank’s own account after gaining access through a service provider. Additionally, attackers have been exploiting outdated IT systems, including internet-connected refrigeration systems in supermarkets and blood banks. Mitrokotsa suggested that banks could learn from crypto exchanges by implementing multi-party control systems to enhance security.
Another emerging risk for financial institutions is the use of personal AI agents for banking tasks. While some banks, like Citigroup and Bank of America, have restricted AI agents from accessing customer accounts, others, such as Santander and ING, allow limited use with customer approval. JPMorgan Chase’s CEO Jamie Dimon has warned of the “treacherous” risks associated with autonomous AI agents handling banking payments. With cyber threats on the rise, the Crédit Mutuel Arkéa hack is unlikely to be the last attack on Europe’s financial sector.