By Priya Raman

Europe’s banks must act after a $6.3 billion theft from Binance, the world’s largest cryptocurrency exchange, on October 29: staff deception and malware exposed weaknesses that also threaten traditional lenders. Less than a week later, Crédit Mutuel Arkéa disclosed that hackers had taken roughly €100 million ($112 million).

How did the attackers breach the targets?

The Binance hackers combined social engineering (manipulating people into unsafe actions) with malicious software (code designed to compromise systems). They arranged fake job interviews that persuaded an engineer to download malware, gained access to company systems and drained crypto wallets.

At Crédit Mutuel Arkéa, hackers used the bank’s own account to execute transactions after gaining access through an unnamed service provider. The bank told customers the incident had no impact on their assets.

The FBI has seized $1.2 billion of the stolen cryptocurrency, and Binance has confirmed that it replenished approximately 98% of the total amount affected.

Ryan Kirkley, cofounder and CEO of Global Settlement, which develops blockchain infrastructure for banks, delivered a blunt warning at the Digital Asset Summit in London on November 10: "It is impossible for the average bank to stay secure." He called the threats facing banks overwhelming.

Binance founder and former CEO Changpeng Zhao told CoinDesk days after the heist that, in his view, banks would be in a worse position if a crypto exchange could be hacked.

What does regulation buy banks?

Katerina Mitrokotsa, professor of cybersecurity at the University of St. Gallen in Switzerland, said banks are not automatically safer merely because they are regulated. The vulnerabilities exposed at Binance are not confined to crypto platforms, she said.

In the United States, the Federal Reserve and Office of the Comptroller of the Currency began calling banks on November 2 about unusual activity and service disruptions, according to Reuters. In July, the European Central Bank warned chief executives of 110 banks about frontier AI models (the most capable AI systems), which make it quicker and cheaper to identify and exploit information-technology vulnerabilities.

The European Union’s Digital Operational Resilience Act (DORA), in force since January 2025, requires banks to test defenses and report cyber incidents. Vivien Mura, chief technology officer of Orange Cyberdefense, the cybersecurity arm of French telecoms group Orange, said banks retain tools crypto platforms lack: they can block or reverse payments and cooperate with regulatory supervisors and law enforcement.

"Banks are better placed to absorb and recover from a major attack, but they are not necessarily better at preventing one," Mura said. Those advantages support recovery rather than guaranteeing prevention.

Where are banks most exposed?

Mitrokotsa identified two structural weaknesses: long chains of outside suppliers and aging technology. DORA brings the most critical technology providers under direct European Union supervision, but supplier dependence and an aging technology base remain major exposure points.

Lee Elliott, director of resilience and cyber at UK Finance, the British banking industry body, said compromised suppliers, staff with privileged access (high-level system permissions), fake job approaches and misuse of internal tools had posed recognized risks for years and were not unique to any sector.

Banks can strengthen their defenses through initiatives such as the Financial Sector Cyber Collaboration Centre, which supports threat-information sharing.

Attackers are already exploiting Europe’s aging technology systems. Since October, hackers have hijacked internet-connected refrigeration systems at supermarkets in more than a dozen countries and at three blood banks in France. Danfoss, which made the electronic temperature controllers, said most affected units were older models that no longer receive security updates.

Mitrokotsa said refrigerators appear harmless, which is precisely why attackers target them. Many banks still run core systems (software underpinning essential services) that are decades old alongside aging servers, building-control systems and suppliers’ remote-access connections. Her starting recommendation is to inventory every device connected to a bank network, then isolate any device that does not need access to core systems.

Some crypto exchanges provide a design lesson, Mitrokotsa added. They split control of a cryptographic key (the secret that authorizes a transfer) among several parties, so no single computer can approve a transfer; compromising one laptop yields only part of the authority an attacker needs. The model limits what one compromised machine can unlock.

How are banks handling autonomous AI agents?

Personal AI agents (software that acts for a user) create another exposure as consumers increasingly use digital assistants, including Meta’s Muse, to make purchases or pay bills. Financial institutions are drawing boundaries around account access and payment authority.

• Citigroup and Bank of America have restricted agents from accessing customer accounts.
• HSBC, Nationwide, NatWest, Barclays and Lloyds have also blocked AI agents from accessing accounts in the United Kingdom.
• JPMorgan Chase chief executive Jamie Dimon has urged financial institutions not to let autonomous agents handle banking payments, warning about their potentially treacherous risk.
• Santander and ING take a middle path in Europe, allowing agents to make payments within limits the customer sets in advance or with approval for each purchase.

The Crédit Mutuel Arkéa attack is unlikely to be the last cyber strike on Europe’s financial sector. Banks should treat supplier access, privileged staff, aging devices and agent permissions as one control problem: inventory every connection, isolate core systems and limit the authority any single machine or vendor can exercise.