Two Cyberattacks, One Banking Wake-Up Call

Two attacks hit the headlines within three weeks. One emptied crypto wallets. The other spoiled food in supermarkets. They look unrelated.

They share one lesson. Neither attacker broke encryption. Both walked in through people and forgotten devices. Banks have plenty of both.

Attack one: a $6.3bn job interview

On 29 October 2026, Binance lost about $6.3bn in the largest crypto theft on record. Blockchain analysts at Chainalysis link the attack to TraderTraitor, a North Korean hacking group.

Binance’s incident report shows the attack took five months.

• June. A wallet engineer downloaded a compromised developer tool he found through a search engine. Binance cleaned the machine, but the attackers had already mapped his role and his colleagues.
• September. Attackers posed as recruiters and approached a second engineer who was job hunting. After several interview rounds, including a video call with a fake chief executive, he downloaded a “coding test” that carried malware.
• 20 October. Using his computer and an internal AI tool, the attackers took control of systems used by two wallet developers.
• 29 October. A malicious script hit the wallet-signing service. It drained 233 million XRP from five hot wallets in four minutes, then moved on to other assets.

About $2.85bn had been frozen or intercepted by 3 November. Binance has pledged to cover all customer losses.

Attack two: fridges turned into ovens

On the night of 11 October, hackers gained remote access to refrigeration controllers in hundreds of French supermarkets. Intermarché, Carrefour, Coopérative U, Monoprix and E.Leclerc were all hit.

The attackers forced units into defrost mode. Temperatures climbed as high as 50°C. Food spoiled and several stores reported fires. Intermarché’s chief executive put the losses at tens of millions of euros in a single day.

A second wave followed on 2 November. It reached Belgium, Sweden, Ireland, the Netherlands, Portugal, Italy, Finland, Estonia and Luxembourg.

The entry points were basic:

• Controllers running outdated firmware
• Default passwords never changed
• Control systems exposed to the public internet for remote maintenance
• Networks managed by outside contractors, outside the retailer’s own security

France has since accused Iran of sabotage, according to NPR. No group has claimed the attacks.

What this means for banks

• The attackers already rob banks. North Korean hackers stole $81m from Bangladesh Bank through SWIFT in 2016.
• Every bank has a signing service. Payment approvals, SWIFT terminals and treasury systems do the same job as Binance’s wallet signer.
• Instant payments leave no time to react. Binance lost funds in minutes. Real-time rails move bank money just as fast.
• Banks own “fridges” too. Data-centre cooling, power units, CCTV, door access and ATMs all sit on networks. Shut down the cooling in a server room and core banking goes offline.
• Hiring is now an attack route. Banks compete for digital talent. Engineers who are job hunting make easy targets.

Eight weak spots and how to fix them

1. People who can be tricked

   The Binance breach began with a fake recruiter and a coding test.

   Fix: Train staff to spot fake recruiters. Block unapproved tools and outside coding tests on work laptops. Run endpoint detection on every device.

2. Devices nobody tracks

   Many banks cannot list every ATM, camera, cooling unit and controller on their network.

   Fix: Build and maintain a full inventory of connected devices. You cannot protect what you cannot see.

3. Admin panels open to the internet

   Europe’s fridge controllers were reachable from anywhere, some with default passwords.

   Fix: Move management interfaces behind a VPN with multi-factor authentication. Remove every default password.

4. Vendor access that never closes

   Contractor-managed systems were a key route into the supermarkets.

   Fix: Grant vendor access for a set time, monitor each session, and revoke it automatically.

5. One login that can move money

   Stolen credentials let one script drain Binance’s hot wallets.

   Fix: Require two approvers for large transfers and system changes. Issue hardware security keys to privileged staff.

6. Payments faster than your monitoring

   Four minutes is shorter than most fraud teams’ response time.

   Fix: Set velocity limits. Auto-pause unusual transactions within seconds and review them before release.

7. Legacy systems too fragile to patch

   Old cores, unsupported ATM software and flat networks let one breach spread everywhere. Banks delay updates because updates mean downtime.

   Fix: Segment the network so building systems never reach core banking. Plan the move to platforms that take security updates without long outages.

8. AI tools with wide access

   Binance’s attackers used an internal AI tool to reach deeper systems.

   Fix: Give AI assistants the least access they need. Log every action and review permissions regularly.

The African picture

African banks and mobile money operators already face these threats.

• INTERPOL’s 2026 assessment found AI involved in about 55% of reported cybercrime across 26 African countries.
• Reported losses rose from about $192m in 2024 to about $484m.
• 97% of responding countries reported mobile money fraud. East Africa is the main hub.
• South Africa’s digital banking crime losses reached R2.4bn in 2025, according to Sabric. Banking apps accounted for more than 70%.

Many institutions on the continent run older cores, shared branch networks and lean security teams. Instant payment rails keep growing. That mix rewards attackers who move fast.

Coordination helps. Binance froze $2.85bn because exchanges, stablecoin issuers and law enforcement acted within hours. Banks that share fraud intelligence gain the same advantage.

FAQ

Which of these eight weak spots would your bank fail today?