Binance’s $6.3 Billion Hack Exposes Europe’s Bank Risk

The $6.3 billion Binance hack on October 29 was followed less than a week later by a roughly €100 million ($112 million) theft at French lender Crédit Mutuel Arkéa. Binance was the world’s largest cryptocurrency exchange.

In the bank attack, attackers gained access through an unnamed service provider. They then used the bank’s own account to execute transactions; the bank told customers their assets were unaffected.

What do the attacks reveal about bank risk?

Global Settlement develops blockchain infrastructure (distributed-ledger systems) for banks. Cofounder and CEO Ryan Kirkley warned at London’s Digital Asset Summit on November 10: “If a company like Binance can lose billions of dollars, the threats facing banks are overwhelming. It is impossible for the average bank to stay secure.”

The Binance operation combined social engineering (manipulating people) with malicious software. Fake job interviews persuaded a Binance engineer to inadvertently download malware, which gave attackers access to company systems and control of crypto wallets they drained. Binance founder and former CEO Changpeng Zhao said days later that, in his opinion, a hacked crypto exchange leaves banks in a worse position.

The FBI has seized $1.2 billion of the stolen cryptocurrency, while Binance confirmed it had replenished approximately 98% of the total impacted amount. Despite that recovery, the attack method exposed supplier, staff-access and software weaknesses that also exist in conventional banks.

Can regulation reduce the exposure?

Katerina Mitrokotsa, professor of cybersecurity at the University of St. Gallen in Switzerland, said banks are not automatically safer because they are regulated. She identified two weak points:

• the long chain of outside suppliers on which banks rely;
• aging technology that many institutions still run.

Since January 2025, the EU’s Digital Operational Resilience Act (DORA), the rule for banks’ operational and cyber resilience, has required them to test defenses and report cyber incidents. DORA also seeks direct EU supervision of the most critical providers, an attempt to reduce supplier-chain exposure.

In July, the European Central Bank wrote to the chief executives of 110 banks about frontier AI models (the most advanced AI systems). The ECB warned that these models make it quicker and cheaper to identify and exploit vulnerabilities in information-technology systems.

On November 2, the Federal Reserve and Office of the Comptroller of the Currency began calling banks about unusual activity and service disruptions. Banks retain tools that crypto platforms lack, including the ability to block or reverse payments and cooperate with supervisors and law enforcement.

Vivien Mura, chief technology officer of Orange Cyberdefense, the cybersecurity arm of French telecoms group Orange, said recovery tools do not equal prevention. He stated: “Banks are better placed to absorb and recover from a major attack, but they are not necessarily better at preventing one.”

Where does the attack surface remain?

Lee Elliott, director of resilience and cyber at UK Finance, the British banking industry body, said compromised suppliers, staff with privileged access, fake job approaches and misuse of internal tools have been recognized risks for years and are not unique to one sector. Banks also benefit from shared threat intelligence (information about attacks) through the Financial Sector Cyber Collaboration Centre.

Attackers have already targeted aging connected equipment. Since October, hackers have hijacked internet-connected refrigeration systems at supermarkets in more than a dozen countries and at three French blood banks. Danfoss, which made the electronic temperature controllers, said most affected units were older models no longer receiving security updates.

Mitrokotsa said a refrigerator appears harmless, which makes it attractive to attackers, while banks still run core systems decades old alongside old servers, building-control systems and suppliers’ remote access. Her first instruction is to inventory every device connected to bank networks, then cut off devices that have no need to reach core systems.

Banks can adopt a control used in crypto. Some exchanges divide control of a transfer key among several parties, so no single computer can approve a transfer, much like a vault requiring two keys. Compromising one laptop then gives an attacker only part of the authority needed.

How should banks handle AI payment agents?

Personal AI agents (software assistants that act for customers) add a new risk. Consumers increasingly use digital assistants, including Meta’s Muse, to make purchases or pay bills