Hackers Target Banks: Could Crypto Become the Safe Haven?

On October 29, 2026, more than $6 billion moved out of Binance wallets in approximately 20 minutes. Just six days later, a major French banking group announced that attackers had withdrawn around €100 million from its own account, rather than from customer accounts. Between these two incidents, South Korean banks were reporting breaches one after another, a major Indian bank was investigating a data leak, and a Swiss bank had joined the list of ransomware victims.

There is no evidence that a single actor was behind all these incidents, and that is precisely what makes the situation dangerous. Hackers do not need a coordinated campaign when they can exploit the same vulnerabilities across different institutions: an employee deceived through a fake job interview, an external service provider used as an entry point, or internal access privileges being abused. Artificial intelligence is making the process of identifying and exploiting these weaknesses faster, cheaper, and more scalable.

This raises an important question for anyone keeping money in a bank or on a crypto platform: If traditional banks can be hacked, does that make crypto a better alternative? Yet the crypto sector itself has recently witnessed what was described as the largest theft in its history. The answer, therefore, is neither a simple yes nor no. It is far more complicated.

20 Minutes That Shook Binance

On October 29, 2026, approximately $6.36 billion was transferred out of Binance wallets across ten blockchain networks, with most of the movement occurring within roughly 20 minutes, according to findings documented by TRM Labs and reported by Security Affairs. Two days later, the FBI attributed the operation to North Korea and its TraderTraitor unit, the same group linked to the 2025 Bybit theft.

Notably, the attack did not break encryption or compromise the blockchain protocol itself. According to Binance's preliminary account, the attackers used social engineering, fake job interviews, malware, and compromised devices to gain access to the transaction-signing environment. Platform engineers were also lured into fraudulent recruitment interviews, a tactic associated with North Korean-linked hacking groups. In other words, the weakest link was a human being with access privileges, not the code.

Banks Enter the Picture: The Crédit Mutuel Arkéa Incident

Just days after the Binance attack, the banking sector faced a different kind of incident. The funds were not initially digital assets held in an on-chain wallet. According to Crédit Mutuel Arkéa, fraudulent transfers originated from the banking group's own account and were sent to other financial institutions before potentially being converted into cryptocurrencies through specialized platforms. Reuters, citing experts through Insurance Journal, reported that the theft of funds directly from a traditional bank is relatively rare.

The bank was not the first to bring the incident to public attention. On November 2, independent investigator ZachXBT warned of suspected losses exceeding $106 million at an unnamed European entity. He later raised his estimate to more than $133 million after identifying additional outflows, before naming Arkéa as the potential victim.

The identification therefore came from outside the institution, based on tracking the suspected movement of funds. However, this does not establish that external monitoring detected the incident before the bank did. Arkéa says it notified the authorities and regulators after discovering the attack.

On November 4, the banking group announced that the attackers had gained access through a platform operated by one of its service providers. It also denied that its digital bank, Fortunéo, was the point of entry. The attackers used Arkéa's own account to execute the transfers.

As for the amount stolen, the group cited approximately €100 million and did not confirm higher estimates circulated by media outlets, including €118 million, or roughly $133 million. It said that some of the funds had been frozen and recovery efforts were ongoing, making it too early to determine the final financial impact. The group also confirmed that customer funds were unaffected, although some transfers were delayed due to precautionary restrictions. Operations resumed following security checks.

Several critical questions remain unanswered: What permissions did the service provider's platform grant? How were the transfers authorized? What did the receiving institutions detect, and when were they alerted?

This incident also highlights an important difference in transparency. Bank transfers are recorded in internal systems accessible only to relevant parties, whereas transactions on public blockchain networks can be examined externally.

Bitquery tracked $108.8 million in USDC outflows from wallets it identified as belonging to Kraken, Crypto.com, and OKX, moving to 15 addresses over approximately 21 hours. However, the company clarified that it could not access bank transfers or the platforms' internal accounts. Therefore, its findings do not independently establish a connection to Arkéa, and the tracked amount should not be treated as confirmation of the bank's losses.

Furthermore, observing transactions does not necessarily reveal wallet ownership or guarantee that funds can be recovered. A significant portion of the USDC was converted into Ether, and while a stablecoin issuer may have the ability to freeze its own tokens, that authority does not extend to freezing Ether.

The key takeaway is that attackers no longer need to compromise thousands of individual accounts. Gaining access to an institution's own account through a third party can be enough.

A Broader Wave of Cyberattacks

The situation is not limited to France, and there is no evidence that these incidents form part of a single coordinated campaign. Rather, they involve different institutions and attack methods.

In South Korea, Shinhan confirmed on September 30 that unauthorized access to a service used by loan brokers exposed the data of approximately 25,000 customers. Insurance Journal, citing Yonhap, reported that advanced AI tools may have been used in the attack.

Further disclosures followed, with KB Kookmin, Hana, BNK Busan, and Yegaram reporting similar breaches. The total eventually reached 37 institutions and 40 incidents since September 30.

In India, the State Bank of India, the country's largest bank, is investigating an attack suspected of exposing thousands of records. A threat actor on the dark web claimed to possess 375,000 records, although that claim remains unverified. Separately, microfinance company Spandana Sphoorty reported unauthorized transactions worth approximately 7.8 crore rupees, or around $822,000, on November 1.

In Switzerland, ransomware group Qilin announced on November 5 that it had breached Habib Bank Zurich, and the bank confirmed a cyber incident. In the United States, the personal information of 23,731 people at Peoples Bank was exposed following a breach involving an identity verification provider. Meanwhile, a Citizens Bank notice disclosed the exposure of Social Security numbers and dates of birth in an incident that occurred in September.

A clear common factor links these incidents: third-party service providers and external vendors, the same vulnerability pattern seen in the Arkéa and Peoples Bank cases.

Are We Witnessing a Single Coordinated Campaign?

The timing of these incidents makes it tempting to connect them. Binance was hit on October 29, followed by a wave of breaches affecting South Korean banks and then the Arkéa incident on November 4. At first glance, the pattern may suggest that a single actor is moving from one target to another.

However, the available evidence does not support that conclusion. Drawing stronger connections than the facts allow would undermine any serious analysis.

First, the suspected perpetrators differ. The FBI attributed the Binance attack to TraderTraitor, a unit linked to North Korea. Arkéa, meanwhile, has not disclosed who was responsible, and an investigation in Paris remains ongoing, with no findings publicly announced. Cyber Security News also noted that there is no evidence linking a specific hacking group to the Arkéa incident.

Second, the attack methods vary. Binance was targeted through social engineering and a compromise of its transaction-signing environment. Arkéa was breached through an external service provider's platform, while South Korean banks experienced unauthorized access involving services and intermediaries, resulting in customer data exposure.

Third, the objectives were different: the theft of billions of dollars in digital assets in one case, fraudulent transfers from an institutional account in another, and the collection of personal information in a third.

Science Times reported that the incidents observed between August and November involved different institutions and methods and did not constitute a coordinated global operation.

However, the absence of a single coordinated campaign does not mean there is no broader trend. The common denominator is not the attacker but the point of vulnerability: external vendors, internal access privileges, and human error.

AI tools, suspected in the South Korean case and flagged by India's cybersecurity agency, are lowering the cost of these attacks and expanding the pool of potential attackers. This is also a concern raised by the International Monetary Fund (IMF), which has warned that interconnected financial institutions and their reliance on shared service providers can allow an attack to spread from one institution to another.

The result is a threat environment involving not one enemy but a range of actors, including nation-states, ransomware groups, and individual hackers, all exploiting the same weaknesses.

This may be more dangerous than a coordinated campaign. Intelligence operations can help counter a specific group, but addressing structural vulnerabilities requires rethinking how the financial system itself is built.

Artificial Intelligence: A Double-Edged Sword

Artificial intelligence does not create cyberattacks from nothing, but it makes them faster, cheaper, and more scalable. The IMF warns that AI enables attackers to automate phishing campaigns, generate convincing fraudulent content, and identify vulnerabilities more quickly.

According to India's cybersecurity agency, tools such as Artex and PentAGI can automate entire attack chains and adapt their techniques based on how the targeted system responds.

At the FutureSec summit in Dubai, experts in the banking sector said that more than 95% of incidents begin with social engineering. They also warned that AI-generated phishing messages are becoming difficult to detect, even for cybersecurity professionals.

The same pattern appeared in the Binance incident, where AI-powered internal tools were reportedly used as part of the attack chain.

However, AI is also being used for defense. In 2025, Bloomberg reported that AI-powered systems at Binance and Kraken detected and stopped attempts to bribe customer support employees in multiple languages before the schemes could escalate.

The race, therefore, is not simply between humans and machines, but between those who can deploy these tools more effectively and more quickly.

Is Crypto the Alternative?

This is the question many readers are asking after these incidents. Three points help put the issue into perspective.

First, the vulnerability does not necessarily lie in banks or blockchain technology themselves, but in human and operational weaknesses. Binance was compromised through employees, devices, and signing privileges, while Arkéa was targeted through a service provider. The type of asset stolen may differ, but the underlying point of failure is similar.

Second, crypto remains an attractive target for attackers. CertiK, citing Cointelegraph, estimated that North Korea-linked actors stole approximately $6.75 billion between 2016 and early 2026 across 263 documented incidents.

The irony is that the funds stolen from Arkéa were reportedly converted into crypto, as these channels can facilitate the concealment of transaction trails. In other words, crypto can serve both as a target for theft and as a channel for moving stolen funds.

Third, transparency is an advantage rather than a weakness. Public blockchain networks make transactions visible, allowing investigators to track the movement of funds quickly.

The FBI issued a list containing 628 addresses, according to figures compiled by FourWeekMBA, while Binance said it had frozen or intercepted approximately $2.85 billion. This level of external transaction visibility is difficult to replicate in a closed traditional banking system.

On the other hand, Binance committed to covering the losses and announced that it had compensated users for 90% of the stolen assets by October 31. However, this depended on the financial strength of an individual company, rather than a depositor protection framework such as the deposit insurance systems available at regulated banks. A platform without sufficient reserves cannot necessarily compensate affected users.

Crypto, therefore, is not a safer alternative by default, just as traditional banks are not an absolute safe haven. Anyone holding assets on an exchange is placing trust in its operational security, much as they would when depositing money in a bank.

Self-custody, meanwhile, transfers responsibility to the user, a burden that not everyone is equipped to manage.

What Changes Now?

The IMF describes cybersecurity as a financial stability issue, not merely a technical one. It calls for mapping interconnections across the financial system and identifying concentrations of risk among external service providers.

In Europe, the Digital Operational Resilience Act (DORA) came into effect in January 2025 to address these risks. In South Korea, regulators decided to inspect 580 financial institutions before the end of November and hold executives accountable if negligence is established.

Individual users should also take practical precautions rather than simply follow the news:

• Diversify your assets instead of keeping everything on a single platform.

• Enable two-factor authentication, preferably using physical security keys where possible.

• Review a platform's compensation policy and deposit protection arrangements before depositing funds.

• Be extremely cautious of unsolicited job offers and unfamiliar links, as they can serve as entry points for major cyberattacks.

Ultimately, the issue is no longer about choosing whether to trust banks or crypto, but about who controls the keys and who monitors their use.

As money moves across increasingly interconnected networks, the greatest risk does not always come from breaking into the strongest systems. It may begin with the weakest link: an employee with excessive privileges, an external service provider, or a key that falls into the wrong hands.

In the digital financial world, the most dangerous vulnerability may be the person behind the system, not the system itself.