The reference study on the cyber risk of crypto platforms put forward a thesis that the events of 2026 have extended, with unexpected severity, to the traditional banking sector: cyber risk is no longer a residual operational risk; it has become a systematic pricing factor for financial counterparties, whether crypto-based or banking institutions.
The incidents recorded between February and November 2026 reveal a vulnerability landscape that overlaps, almost point for point, with the typology established for cryptocurrency exchanges:
(1) Crédit Mutuel Arkéa (France, November 2026) suffered a “sophisticated attack originating from outside” estimated by specialists at 118 million euros ($133M). Arkéa confirmed only the “order of magnitude” and stated that no customers had been affected. The attack was routed through an IT platform belonging to a service provider, confirming critical dependence on third-party suppliers as a primary attack vector, precisely the “distributed attack surface” model identified for CEXs in 2026.
(2) Bank Jambi (Indonesia, February 2026) fell victim to an intrusion that enabled the misappropriation of funds belonging to 6,000 customers, amounting to 143 billion rupiah (≈ $8.8M). Investigators detected that the funds had passed through crypto wallets. The modus operandi combined system intrusion, customer data exfiltration, and money laundering through digital assets, a CeFi–DeFi hybridization reminiscent of the KelpDAO–Aave contagion.
(3) Ueno Bank (Paraguay, November 2026) collapsed following a cyberattack that exposed a balance-sheet shortfall and insolvency below 50%. The bank held $850 million in public funds; its failure led to the freezing of deposits belonging to 3 million customers and the removal of the President of the Republic. This is the first documented case in which a banking cyberattack has triggered a systemic political crisis, a contagion risk extending far beyond the institution itself.
(5) The South Korean wave (September–November 2026) affected 16 financial institutions, including ShinhanBankENG , KB Kookmin, BNK Busan, and Hana, with approximately 100,000 personal records exposed, including 25,000 from Shinhan alone. The attackers’ servers contained references to ARTEX AI, an automated security testing tool based on AI agents. The attack was described as “directed by artificial intelligence agents”, a first that brings the @BIS_org prediction regarding frontier AI cyber threats into tangible reality.
The problem posed by these incidents and that the #CCCRI framework already solves for CEXs, is threefold:
a) Quantify ex ante the probability and severity of an extreme loss involving a banking counterparty, taking into account interbank contagion and supplier concentration.
b) Price the cost of this risk into cash, collateral, and banking counterparty exposures that is, transform a qualitative assessment of “soundness” into a cyber risk spread comparable to a CDS spread.
c) Reduce the response time between detecting an anomaly and deactivating an exposure, given that AI-assisted attacks now unfold within hours, or even minutes.
The study presents a structured mapping of banking incidents in 2026, listing attacks, affected institutions, countries, impacts and main vectors.
In Févr. 2026, Bank Jambi in Indonesia suffered system intrusion, fund diversion and crypto laundering, causing losses of 143 Md IDR (≈ 8,8 M$) and affecting 6 000 clients.
From Sept.–Nov. 2026, South Korean banks experienced data exfiltration, possibly AI-assisted, involving ≈ 100 000 records, including 25 000 for Shinhan.
In Nov. 2026, Arkéa reported a third-party platform compromise with an impact of ≈ 118 M€, while clients were unaffected.
Ueno Bank’s cyberattack led to bankruptcy, 3 M blocked clients and 850 M$ in public funds affected. Separately, 128 Japanese shinkin banks experienced a non-cyber equipment failure.
The analysis identifies three regimes: supplier compromise, AI-assisted attacks and data exfiltration, and cyberattacks triggering solvency crises. It emphasizes supply-chain resilience, shorter remediation windows and the interaction between cyber and credit risks.
