Skip to main content

 

AI cyber breach of a big bank is close at hand

Financial Times UK
Anil Kashyap is a pro­fessor of eco­nom­ics and fin­ance at Chicago Booth. Kath­ryn Judge, pro­fessor at Columbia Law School, con­trib­uted to this piece Anil Kashyap
4 Nov 2026

The cyber heist at Bin­ance already offers a num­ber of les­sons for investors, reg­u­lat­ors and poli­cy­makers.

Poli­cy­makers routinely plan, via war games and stress tests, for a vari­ety of fin­an­cial sta­bil­ity risks. One thing that sets cyber attacks apart from most other risks is that it is a ques­tion of when a major fin­an­cial insti­tu­tion will be com­prom­ised, not if.

One par­lour game among fin­an­cial sta­bil­ity experts is to spec­u­late about why we have not yet had a massive breach. The Bin­ance debacle sug­gests one pos­sib­il­ity — maybe banks and con­ven­tion­ally reg­u­lated fin­an­cial infra­struc­ture are no longer the most invit­ing tar­gets.

If the crypto eco­sys­tem has been suf­fi­ciently care­less about guard­ing against attacks, then that is where those seek­ing to profit from cyber crime will shift.

But there should not be much com­fort to be taken from that.

Major banks are under con­stant attack. The law of large num­bers, coupled with the way increas­ingly advanced AI empowers attack­ers, sug­gests it is only a mat­ter of time before a sub­stan­tial attack suc­ceeds.

It is some­times said that the rise of AI will allow insti­tu­tions to fight back against cyber attacks on an equal foot­ing. That is too optim­istic.

AI can and should be used to identify vul­ner­ab­il­it­ies and will be part of the efforts to address them. But as the recent hack of the AI model and data repos­it­ory Hug­ging Face makes clear, we can­not trust to tech­no­logy alone.

Efforts to address defi­cien­cies will depend on humans, who can’t work and adapt as quickly as AI. Hence defence efforts will lag behind the attack­ers.

The early reports on the Bin­ance hack point to the poten­tial involve­ment of state-sponsored attack­ers.

Indi­vidual insti­tu­tions will never have suf­fi­cient resources to battle such act­ors, and it’s unreas­on­able to expect that they can. While there is some cooper­a­tion among major fin­an­cial insti­tu­tions to share inform­a­tion, gov­ern­ments have a vital role to play in cre­at­ing stand­ards that pro­tect their cit­izens’ best interests.

For the bank­ing sys­tem, there is an over­sight regime in place to help address the risks of an AI attack. The same is not true in the crypto eco­sys­tem. The lack of rig­or­ous over­sight might pro­mote innov­a­tion, but it also makes crypto com­pan­ies vul­ner­able. Right now, a Bin­ance-type attack may not under­mine faith in the broader fin­an­cial sys­tem. But if the crypto eco­sys­tem con­tin­ues to grow and become more integ­rated with the tra­di­tional fin­an­cial sys­tem, the impact could be far more dev­ast­at­ing. One tru­ism about cyber risks is that an organ­isa­tion (or a fin­an­cial sys­tem) is only as strong as its weak­est link.

Another reason to worry is that crim­in­als and other hos­tile act­ors could use the crypto eco­sys­tem to train AI agents on how best to hack fin­an­cial insti­tu­tions. AI is improv­ing by leaps and bounds. Dif­fer­ent insti­tu­tions use dif­fer­ent defences. But learn­ing how to hack one sys­tem can provide insights into how to attack another.

If the func­tion­ing of a major fin­an­cial insti­tu­tion, or a key part of the estab­lished fin­an­cial infra­struc­ture, is com­prom­ised, that could quickly sow wide­spread dis­trust of the fin­an­cial sys­tem. Trust is the grease that allows the fin­an­cial sys­tem to func­tion and to sup­port busi­nesses and house­holds.

If it is badly dam­aged in a cyber attack instig­ated by a hos­tile nation or non­state actor, it will not be eas­ily regained. The sys­temic rami­fic­a­tions could be far­reach­ing.

Banks invest heav­ily in guard­ing against these risks, and the US Treas­ury depart­ment and bank reg­u­lat­ors have been work­ing with reg­u­lated fin­an­cial insti­tu­tions to pro­mote pre­pared­ness. But both the size and the nature of private sec­tor invest­ments are going to fall short of what is required to pro­tect the resi­li­ence of the fin­an­cial sys­tem.

Poli­cy­makers should recog­nise the attack on Bin­ance for what it is: a warn­ing shot of poten­tially far worse things to come.

Guard­ing against hacks that steal bil­lions of dol­lars and under­mine faith in fin­ance requires the pub­lic sec­tor to work closely with the private sec­tor to enhance resi­li­ence and to develop plans should things go awry.

And allow­ing the crypto world — a large and grow­ing part of fin­ance — to remain sub­ject to min­imal over­sight com­prom­ises our national well­being. Innov­a­tion is good but it needs to be coupled with appro­pri­ate over­sight.

From this issue
Financial Times UK
4 Nov 2026
Read entire issue

Comments

Post a Comment

Popular posts from this blog

Image
  Real lessons of Trump’s impetuous action Venezuela may yet fall into chaos but president’s readiness to act contrasts with Britain’s lawyerly approach to governing Daniel Finkelstein @DANNYTHEFINK Within hours of snatching Maduro Donald Trump faced reporters Next image  › Ten minutes after the capture of Nicolás Maduro was announced on social media, the White House correspondent of the New York Times wanted words from the administration for his paper’s rolling news coverage. Fortunately, he knew just who to call. He dialled the president of the United States. Donald Trump answered after only three rings and gave him an interview on the spot. It was 4.30 in the morning. A few hours later the president, looking slightly worse for wear, held a press conference and told a startled collection of correspondents gathered at his Palm Beach social club that he now intended to “run Venezuela”. There were no answers on how he intended to do this or even how he intended to be in a posit...
Read more
Image
  Opinion | Waging War Lawfully Is Crucial to Defending Civilization Dec. 8, 2025 12:13 pm  ET Alec Guinness in "The Bridge on the River Kwai" during its production in Sri Lanka, 1957.   /Associated Press In David Lean’s classic 1957  movie , “The Bridge on the River Kwai,” Alec Guinness plays the punctiliously correct English Col. Nicholson leading his fellow prisoners of war in dutiful observance of a wartime code of honor. His determination that they do as ordered by their Japanese captors and build a bridge that completes a critical section of the Rangoon-to-Singapore railroad appalls his own men but is matched by his insistence that the Japanese also observe the laws of war on prisoner treatment. The camp commandant, Col. Saito (Sessue Hayakawa), is as incredulous as he is furious and erupts when Nicholson lectures him about playing by the rules. “Do not speak to me of rules!” Saito explodes. “This is war! This is not a game of cricket!” Advertisement Lean’s mov...
Read more
Image
  The Fun Shortage Is Real, and It’s Making America Miserable With fewer places to relax and socialize, and steeper prices for entry, having fun is quantifiably harder than it used to be. Illustration: Rob Farmer for Bloomberg Businessweek Save Translate Over the course of the past two decades, the US has lost 2,000 golf courses and 7,000 bars and nightclubs, and Americans now own 1.3 million fewer boats. It’s prohibitively expensive to open a new summer camp and practically impossible to build a beachfront resort or marina. Venue shortages afflict musicians looking for performance spaces, children looking to play in local sports leagues and adults looking to go out dancing. The best time to book a rental for this summer was last summer, and the best time to book for next summer is … well, it may already be too late. America appears to be suffering from a fun shortage. For the industries supplying recreational amenities, this deficit is a business opportunity. But for everyone not ...
Read more