A series of cyberattacks across Europe, Asia and the cryptocurrency industry is raising difficult questions about the security of the global financial system. Banks have reported data breaches, government services have been forced offline, companies have faced multimillion-dollar ransom demands and Binance has suffered a cryptocurrency theft exceeding $6 billion. The incidents differ in scale and execution, but together they expose how vulnerable interconnected financial infrastructure can become when attackers exploit digital systems.
The growing concern is the role of artificial intelligence in accelerating cybercrime. Security researchers and financial authorities have identified attacks involving AI-assisted tools and autonomous agents, raising the possibility that attackers can automate reconnaissance, credential discovery and intrusion attempts across multiple targets. That does not mean every recent breach was independently confirmed to be AI-driven, but the pattern has become serious enough to attract attention from central banks and international policymakers.
Seven Incidents Highlight the Expanding Attack Surface
In France, Crédit Mutuel Arkéa confirmed on November 4 that a cyberattack enabled fraudulent transactions. Independent blockchain investigator ZachXBT estimated the losses at approximately €118 million, or $133 million, and traced funds through cryptocurrency exchanges. The bank has not confirmed that exact figure, although it acknowledged the order of magnitude. It temporarily suspended certain transactions, said customer assets would not be affected and began progressively restoring operations.
Belgium’s Federal Public Service Finance experienced a cyberattack detected during the night of October 27–28. Authorities isolated potentially compromised systems, taking the MyMinfin tax portal and other digital services offline. The government said the attack was stopped before applications were taken over or data was stolen, while affected filing deadlines were extended to November 16.
A separate European incident involved the European Banking Authority, not the European Central Bank. The EBA temporarily shut down its website on October 21 after being alerted to critical software vulnerabilities. It reported no breach or compromised data when services resumed the following day. This distinction matters because the original claims about malware being planted on an ECB website are not supported by the available October reporting.
South Korea has faced a particularly concerning wave of attacks against financial institutions. Shinhan Bank confirmed that approximately 25,000 customers had personal information exposed, including names, telephone numbers, annual incomes and loan-related details. Other banks and financial companies also reported breaches or attempted intrusions. Investigators have examined suspected AI-assisted attacks, including the use of automated tools to identify and extract customer records.
In Japan, GMO Internet Group disclosed unauthorized access to its Onamae.com Desktop Cloud service, with customer information taken and some users reporting suspicious transactions. Attackers demanded approximately $50 million in cryptocurrency and threatened to release information. The company refused to pay and sought government assistance, adding to pressure on Japanese authorities to strengthen cyber defences.
The international dimension is equally important. CrowdStrike-linked reporting described a China-linked operation using the ARTEX AI framework against more than 200 organizations across at least 14 countries in an 11-day period. Targets included government, telecommunications, pharmaceutical, semiconductor, defence and financial organizations. Researchers described the campaign as an escalation in the use of AI agents to coordinate multiple cyber intrusions.
The cryptocurrency industry has also suffered a historic breach. Binance reported that attackers stole approximately $6.36 billion from hot wallets across multiple blockchains on October 29. The FBI subsequently attributed the theft to North Korea’s TraderTraitor operation. Blockchain investigators have traced the movement of funds through multiple networks, while exchanges and token issuers have worked to freeze assets that could still be intercepted.
Financial Authorities Are Preparing for AI-Driven Attacks
The scale of these incidents has prompted policymakers to move beyond conventional cybersecurity discussions. On October 16, G7 finance leaders agreed to conduct tabletop exercises simulating AI-driven cyberattacks against financial institutions and critical services. The exercises are intended to test how governments, central banks and potentially private financial institutions coordinate their responses during major incidents.
The International Monetary Fund has also warned that cybercrime could undermine confidence in financial institutions. Managing Director Kristalina Georgieva cautioned that growing fraud could eventually drive people away from formal banking and back toward keeping cash at home, using the image of people storing money in shoeboxes under their beds.
That warning points to a risk beyond the money stolen in individual attacks. If customers cannot access banking applications, trust payment systems or feel confident that their personal information is protected, the consequences can spread beyond the original victims. A cyberattack against one institution can become a broader confidence problem when customers begin questioning the security of the systems on which everyday financial activity depends.
However, the incidents do not establish that the global financial system is already experiencing a coordinated crisis. They involve different attackers, vulnerabilities, targets and levels of confirmed damage. The more defensible conclusion is that the financial sector faces an increasingly complex threat environment in which automation can increase the speed and scale of attacks.
The challenge for banks, regulators and technology companies is to ensure that defensive capabilities develop as quickly as offensive tools. Stronger authentication, continuous monitoring, secure software updates, rapid incident coordination and tested recovery systems will be essential. The question is no longer simply whether an institution can prevent an intrusion, but whether it can contain one without disrupting the financial services that millions of people depend on.
About The Author
