The reference study on the cyber risk of crypto platforms put forward a thesis that the events of 2026 have extended, with unexpected severity, to the traditional banking sector: cyber risk is no longer a residual operational risk; it has become a systematic pricing factor for financial counterparties, whether crypto-based or banking institutions.
The incidents recorded between February and November 2026 reveal a vulnerability landscape that overlaps, almost point for point, with the typology established for cryptocurrency exchanges:
(1) Crédit Mutuel Arkéa (France, November 2026) suffered a “sophisticated attack originating from outside” estimated by specialists at 118 million euros ($133M). Arkéa confirmed only the “order of magnitude” and stated that no customers had been affected. The attack was routed through an IT platform belonging to a service provider, confirming critical dependence on third-party suppliers as a primary attack vector, precisely the “distributed attack surface” model identified for CEXs in 2026.
(2) Bank Jambi (Indonesia, February 2026) fell victim to an intrusion that enabled the misappropriation of funds belonging to 6,000 customers, amounting to 143 billion rupiah (≈ $8.8M). Investigators detected that the funds had passed through crypto wallets. The modus operandi combined system intrusion, customer data exfiltration, and money laundering through digital assets, a CeFi–DeFi hybridization reminiscent of the KelpDAO–Aave contagion.
