Traditional banks have suffered a series of attacks in recent months: France's Arkéa may have lost over $133 million, while most other incidents involved data breaches.

BlockBeats news, November 4: Today, French mutual credit group Crédit Mutuel Arkéa's online bank Fortuneo confirmed that it suffered a fraudulent cyber attack on November 1, with the scale potentially far exceeding the approximately $133 million previously monitored by third parties. The fraudsters were able to initiate transfers from Fortuneo and set the recipient names themselves, equivalent to being able to send funds to any account worldwide under self-chosen names. Sources close to the hacker community lean more toward an internal human vulnerability rather than a long-term stealthy intrusion into the payment system, and some analysts believe this attack may be a variant of "CEO fraud" carried out by French-speaking cyber actors, i.e., impersonating executives to trick employees into cooperating.

Over the past month or so, multiple traditional banks and financial institutions in South Korea, India, Latin America, and Europe and the United States have successively exposed cyber attacks. Most are still leaks of customer or employee data, with core transaction systems often not directly breached; cases like France's Crédit Mutuel Arkéa where funds were stolen and transferred into cryptocurrency channels remain a minority at present.

South Korea saw a round of attacks on financial institutions from late September to October, with about 16 institutions affected, including Shinhan, KB Kookmin, Hana, Busan Bank, as well as savings banks and Hyundai Capital, with approximately 100,000 pieces of personal information leaked, including names, phone numbers, income, loan amounts, and some including ID numbers. The attacks did not enter core transaction systems but instead came through side doors such as loan intermediary queries and employee office systems. CrowdStrike said the perpetrators are suspected to be Chinese-speaking individual hackers using the AI penetration tool ARTEX and calling large models such as Claude and DeepSeek; South Korean regulators said no customer funds have been stolen so far.

In August, New York State's Sawyer Savings Bank temporarily closed branches for about a week due to a suspected vendor vulnerability, saying no customer accounts were directly harmed or data maliciously used. In early September, Wyoming's Hilltop Bank temporarily closed locations and interrupted online and mobile banking due to a cybersecurity incident, saying it was to isolate the environment and protect customer data; the bank ultimately said no customer assets or data were stolen.

In mid-October, India's State Bank of India (SBI) confirmed that personal records of about 3,897 customers appeared on the dark web, including names, mobile numbers, dates of birth, addresses, and loan records. Preliminary analysis said the scale of related dark web records was about 375,000; SBI has notified each individually and said customer funds are safe.

In late October, more than 400 banks and payment institutions in Latin America suffered attacks. Security company Straiker said the criminal group CyberCartel used multiple models including Claude, Grok, and Kimi to form an automated attack system CARLIY0S, targeting more than 400 financial targets in Latin America; a snapshot of its loot repository on September 24 contained about 4,493 records, including credentials, API keys, and account information.