The $6.3 billion that hackers drained from Binance, the world's largest cryptocurrency exchange, on October 29 was, at first, easy to frame as a crypto-only problem. Less than a week later, that framing collapsed. Crédit Mutuel Arkéa, a French lender, disclosed that attackers had made off with roughly €100 million ($112 million) from its systems.

The back-to-back breaches underscore that cyber heists now threaten traditional banks, not just digital-asset platforms. In both cases, the attackers' entry point was human or third-party trust rather than a direct breach of core systems.

“The threats facing banks are overwhelming”

Industry figures argue the episode says as much about conventional finance as it does about crypto. “If a company like Binance can lose billions of dollars, the threats facing banks are overwhelming,” said Ryan Kirkley, cofounder and CEO of Global Settlement, which develops blockchain infrastructure for banks. Speaking at the Digital Asset Summit in London on November 10, he added: “It is impossible for the average bank to stay secure.”

Binance's founder and former chief executive, Changpeng Zhao, went further. “If a crypto exchange can be hacked, banks are in a worse position, in my opinion,” he told CoinDesk in the days after the heist.

How the Binance breach happened

The attackers behind the Binance theft combined social engineering with malicious software to take control of crypto wallets and drain them of funds. In a staged recruitment campaign, they arranged a series of fake job interviews designed to persuade a Binance engineer to unwittingly download malware, giving the hackers a route into the company's internal systems.

The damage has since been partially contained. The FBI has seized $1.2 billion of the stolen cryptocurrency, and Binance confirmed it had “replenished” approximately 98% of the total impacted amount. Even so, that seizure covers less than a fifth of the original haul, leaving the majority of the stolen assets unrecovered.

“Not automatically safer”

According to Katerina Mitrokotsa, professor of cybersecurity at the University of St. Gallen in Switzerland, the weaknesses exploited at Binance are not unique to crypto: the same vulnerabilities exist inside traditional financial institutions. “Banks are not automatically safer just because they are regulated,” she said.

Regulators on both sides of the Atlantic have been paying close attention. In the United States, the Federal Reserve and the Office of the Comptroller of the Currency began calling banks on November 2 to ask about unusual activity and service disruptions, Reuters reported. In July, the European Central Bank wrote to the chief executives of 110 banks warning about the risks of frontier AI models, which it said are making it “quicker and cheaper to identify and exploit vulnerabilities in IT systems.”

Where banks hold an edge

Traditional lenders do have some advantages over crypto platforms, according to Vivien Mura, chief technology officer of Orange Cyberdefense, the cybersecurity arm of French telecoms group Orange. The EU's Digital Operational Resilience Act (DORA), in force since January 2025, requires banks to test their defenses and report cyber incidents. “They also benefit from mechanisms crypto platforms lack, such as the ability to block or reverse payments and close cooperation with supervisors and law enforcement,” Mura said.

He acknowledged, however, that those advantages only go so far. “Banks are better placed to absorb and recover from a major attack, but they are not necessarily better at preventing one.”

Suppliers and legacy systems

Mitrokotsa identifies two persistent weak spots: the long chain of outside suppliers banks rely on—a risk DORA seeks to address by bringing the most critical providers under direct EU supervision—and the aging technology many banks still run.

Both were in play at Crédit Mutuel Arkéa. There, hackers gained access through an unnamed service provider and used the bank's own account to carry out transactions. The lender told customers the incident had “no impact” on their assets.

“Compromised suppliers, staff with privileged access, fake job approaches and the misuse of internal tools have been recognized risks for years and are not unique to any one sector,” Lee Elliott, director of resilience and cyber at UK Finance, the British banking industry body, told Fortune. He added that banks also benefit from the sector's practice of sharing threat intelligence through initiatives such as the Financial Sector Cyber Collaboration Centre.

When a refrigerator becomes an entry point

Attackers are already probing Europe's aging IT estate beyond banking. Since October, hackers have hijacked internet-connected refrigeration systems at supermarkets in more than a dozen countries and at three French blood banks. Danfoss, which manufactured the electronic temperature controllers, said most affected units were older models that no longer receive security updates.

“A fridge doesn't look like a security risk, and that's exactly why attackers like it,” Mitrokotsa said. “Banks have the same problem. Many still run core systems that are decades old, next to old servers, building control systems and suppliers' remote access.”

Her advice is for banks to start by knowing every device connected to their networks, then make sure that the ones with no need to reach core systems are cut off from them.

Banks could even learn from crypto, she added. “Some exchanges split control of a key between several parties, so no single computer can approve a transfer on its own, much like a vault that needs two keys turned at once. An attacker who compromises one laptop gets only part of what they need.”

AI agents add a new layer of risk

Personal AI agents present another emerging challenge for financial institutions. Consumers increasingly use digital assistants—such as Meta's Muse—to make purchases or pay bills on their behalf.

Some banks have moved to shut the door. Citigroup and Bank of America have restricted AI agents from accessing customer accounts, and JPMorgan Chase chief executive Jamie Dimon has urged financial institutions not to allow autonomous AI agents to handle banking payments, warning of their “treacherous” risk. In the U.K., HSBC, Nationwide, NatWest, Barclays and Lloyds have also blocked AI agents from accessing their accounts.

Other European lenders are taking a middle path. Santander and ING let agents make payments, but only within limits the customer sets in advance or after the customer approves each purchase.

With the number of cyber threats mounting—and with most of the $6.3 billion stolen from Binance still outstanding—the Crédit Mutuel Arkéa hack is unlikely to be the last attack on Europe's financial sector.

This story was originally published by Fortune: fortune.com