Bank Cyber Incidents, Nov 2026: What's Confirmed
TL;DR · the short version
A thread going around on 4 and 5 November 2026 said banks and payment systems were being hit in 7, or 15, places at once. It is not one coordinated event. Several separate incidents are confirmed: Crédit Mutuel Arkéa (France) said it suffered a cyberattack on 4 November in which an attacker made fraudulent transfers from the bank's own account after compromising a service provider, with no loss to customers; SinoPac (Taiwan) refunded 418 customers on 3 November after an overseas vendor's flaw was exploited; South Korea's FSC counts 40 incidents at 37 firms between 30 September and 3 November; Belgium's FPS Finance suspended MyMinfin on 28 October; and the FBI blames North Korea for the 29 October Binance theft. Other items in the thread are fraud, insider cases, old events or have no source we could find.
A thread circulating on 4 and 5 November 2026 said banks and payment systems were being hit "in 7, or 15, places at once". The evidence does not show one coordinated event. It shows several separate incidents in the same few weeks. The strongest are Crédit Mutuel Arkéa (France, 4 November), SinoPac (Taiwan, 3 November), South Korean financial firms (30 September to 3 November), Belgium's FPS Finance (28 October) and the Binance theft (29 October). Other items in the thread are fraud, insider cases, events from earlier years, or have no source we could find.
Who this is for: security, fraud and payments leaders at banks, fintechs and the companies that bank with them.
Independent analysis. PlayCISO is not affiliated with any organisation named here. Facts are as reported on 5 November 2026 and may change. Several sources are news reports of statements, not the statements themselves; we say so where it matters.
Confirmed vs not yet known
Confirmed by the organisation or a regulator: Arkéa suffered a "sophisticated attack" and says customers lost nothing. SinoPac refunded all affected customers on 3 November and blames a vendor's flaw. Korea's FSC counts 40 incidents at 37 firms. Belgium's FPS Finance suspended MyMinfin. The FBI attributes the Binance theft to North Korea.
Outside estimates, not the victim's figure: Arkéa's EUR 118 million (more than $133 million) is ZachXBT's blockchain tracing. Binance's duration and chain count differ between TRM Labs and Elliptic.
Not known yet: who attacked Arkéa, SinoPac and the Belgian ministry; the final Arkéa loss; which supplier was involved at Arkéa; whether the Korean incidents share one actor; whether any of these cases are linked to each other.
What is confirmed, item by item
Crédit Mutuel Arkéa, France
Arkéa confirmed in a press notice on Wednesday 4 November that it had suffered a "sophisticated attack". Per The Record, it said attackers used the bank's own account to make transfers after compromising an unnamed supplier, going through a service provider's platform to reach the group. Arkéa says customer accounts were not accessed. France 24 reports it said clients "did not suffer any losses", that the attack was "contained", and that part of the funds has been blocked. The amount is where the thread overreaches: EUR 118 million (more than $133 million) is ZachXBT's tracing of exchange withdrawals and laundering. Arkéa declined to confirm it, saying (per The Record) only that it could "validate the order of magnitude"; France 24 reports about EUR 100 million. The bank says the final loss is not established and does not threaten its solvency.
SinoPac, Taiwan
On 3 November, 418 customers had 427 transfers totalling about NT$41.76 million moved out of their accounts, mostly NT$100,000 each, all to one Fubon Bank account, according to Taiwanese reporting of the bank's briefing. SinoPac says it returned all of it by 14:51 the same day, took its new app offline, and attributes the incident to hackers exploiting a security configuration issue at the supplier of its new online banking transaction system. Reporting says no personal-data leak has been identified. Who is behind it is not confirmed.
South Korea
The Financial Services Commission counts 40 incidents at 37 firms between 30 September and 3 November, with about 473,000 records leaked, and will inspect more than 580 financial firms (per Hankook Ilbo). "Firms" includes non-banks such as crypto and fintech companies. The Shinhan Bank leak (reported at about 25,000 customers, via a loan-agent inquiry portal) is one incident inside this wave, so do not add it to the 473,000. The AI-agent link is a presumption reported from industry sources (see below).
Belgium, FPS Finance
On Wednesday 28 October FPS Finance said it was investigating a cyberattack and had temporarily suspended access to MyMinfin. Its statement: "there is no indication that a data breach has occurred or that any data has been stolen" (as quoted by The Record). Taxpayers with a 31 October deadline for certain income were promised extra time; a new date was to be announced. Other outlets reported more services offline.
Binance
On 29 October about $6.3 billion in assets left Binance. TRM Labs puts it at about $6.36 billion and attributes it to TraderTraitor with high confidence; the FBI alert of 31 October names North Korea (TraderTraitor) and says more than $6 billion was stolen. TRM says most outflows happened in about 20 minutes from 20:05 UTC across ten blockchains; Elliptic reports a longer window and eleven chains. President Trump said he did not know it was North Korea. See our earlier post on how the attacker dodged the USDT freeze.
Brazil and Singapore, with caveats
Brazil: the central bank's Financial Stability Report (27 October, as reported by Soubrasilia) counts 99 cyber incidents reported across the financial system from January to September 2026, against 76 in all of 2025, and 68 of the 99 are classed as fraud. That is system-wide reported incidents, mostly fraud, not 99 bank hacks. We read press coverage, not the report. Singapore: a company paid US$12.8 million to a Cambodian account on 13 October after business email compromise; Singapore police said on 29 October the full sum was recovered with Cambodian police and OCBC. That is corporate payment fraud, not a bank breach.
Claimed but not confirmed
- "ECB website malware on 22 October 2026". We found no 2026 report. The only match is a 2019 incident (ECB press release, 15 August 2019).
- Finance as a target of the China-linked AI-agent campaign. CrowdStrike's reported target list covers other sectors; we found no source that lists finance.
- "14 countries in 11 days". Appears only in secondary reports; we could not find it in a primary CrowdStrike page.
- Binance laundering detail (Monero swaps, 27,553 ETH, fake IDs). Not found in TRM, Elliptic or Help Net Security.
- Vietnam: hackers "months inside bank systems". No source found.
- Mexico: SPEI theft. The only basis is vendor research (Straiker, via Infobae) on exposed credentials, including SPEI settlement credentials. No confirmed theft or arrests.
- AI agents behind the Korean incidents. A presumption from industry sources, not a regulator finding.
What the thread got wrong
- Fraud, insider and impersonation cases listed as bank hacks: Singapore (business email fraud), a Canadian ex-bank adviser convicted over fraudulent accounts (insider), a New Zealand man who impersonated police to a government agency, a Malaysian civil suit against two banks (allegations only), and a Dallas indictment of alleged corrupt insiders (the $373 million is the balance of targeted accounts, not an amount stolen).
- Old events presented as this month: Bank Jambi (Indonesia, February 2026, arrests announced in July), Yamagata (Japan, voice-phishing theft on 10 March 2025, announced July 2026), Sri Lanka Treasury (October 2025 to January 2026, parliamentary report July 2026), and a Florida wire case (March 2026, now a lawsuit).
- Two unrelated Nepal items merged: a KYC phone scam and website shutdowns after the PHP2Shell flaw.
- Estimates stated as bank facts: the Arkéa amount, and "a bank lockdown" with no order we could find.
Timeline
| When (2026) | What | Source |
|---|---|---|
| 30 Sep to 3 Nov | Korea's FSC counts 40 incidents at 37 firms, about 473,000 records | Hankook Ilbo (FSC figures) |
| 13 Oct / 29 Oct | Singapore firm pays US$12.8M after email fraud; police announce full recovery | The Star |
| 27 Oct | Brazil central bank report: 99 reported incidents Jan to Sep, 68 fraud | Soubrasilia (on the BCB report) |
| 28 Oct (Wed) | Belgium's FPS Finance suspends MyMinfin after a cyberattack; no sign of data theft | The Record |
| 29 Oct | About $6.3B leaves Binance | TRM Labs |
| 31 Oct | FBI alert attributes the Binance theft to North Korea (TraderTraitor) | FBI alert as reported by BleepingComputer / ITV |
| 3 Nov | SinoPac: 418 customers, NT$41.76M, refunded by 14:51 | Yahoo Taiwan |
| 4 Nov (Wed) | Arkéa confirms a "sophisticated attack"; clients lose nothing, per the bank | The Record; France 24 |
The common thread
It is not a mass lockdown of banks. The two clearest bank cases, Arkéa and SinoPac, both point at a supplier or service-provider route: a compromised provider platform at Arkéa and a flaw in a vendor's banking system at SinoPac. Much of the rest of the thread is social engineering: callers impersonating staff, forged authorisation letters and insiders paid to look up accounts. Neither pattern needs a new kind of attack. Both put weight on controls most firms already own: who can reach the payments rails, and what happens when payment details change.
What security leaders should do this week
- Review third-party and fintech vendor access. List every supplier that can initiate, approve or reach payment or transfer functions, and what credentials and network paths they hold. Our vendor risk tool and scorecard give a structure.
- Add step-up on wire and instant-payment changes. Require a second approver or fresh authentication for new beneficiaries, raised limits and changed payment details.
- Verify payment-detail changes by callback to a number you already hold, never one from the request. The Singapore case began with an email asking to pay a new account. See the BEC response checklist.
- Monitor for same-day multi-account transfers to a single destination, the SinoPac pattern (427 transfers to one account), and make sure someone can freeze it quickly.
- Alert on crypto off-ramp and high-velocity transfers from your own accounts, and know who can call exchanges and stablecoin issuers to freeze funds. Review leaked credential response for vendor and admin accounts.
- Prepare your incident communications. Arkéa told customers early that their money was not affected; SinoPac refunded the same day. Decide in advance who says what, and rehearse. If extortion is part of an incident, see the ransom payment legality and coverage gate.
- Read the AI-agent claims carefully. The reporting is mixed; see our ARTEX write-up. Faster attacks are plausible, but the Korean link is still a presumption.
FAQ
Are banks being hacked at the same time?
Not as one coordinated event, as far as the evidence shows. Several separate incidents were confirmed in the same few weeks, with different causes and no source linking them. Several items in the viral thread are fraud, insider cases or older events.
Is my money safe at Crédit Mutuel Arkéa?
Arkéa says customer accounts were not accessed and clients "did not suffer any losses": the attacker used the bank's own account. That is the bank's statement and the investigation is ongoing. Watch your statements and be wary of calls or messages about "security".
Did North Korea steal $6 billion from Binance?
The FBI alert of 31 October attributes the theft of more than $6 billion to North Korea (TraderTraitor). TRM Labs puts it at about $6.36 billion. Trackers differ on duration and chain count, and President Trump publicly said he did not know it was North Korea.
Is there a bank lockdown coming?
We found no government order. Some institutions took services offline themselves, and the ECB asked about 110 supervised banks for AI-cyber action plans by 31 October. That is supervision, not a lockdown. We cannot prove a negative, so check your own regulator.
How much did the Arkéa attackers take?
Not confirmed by the bank. The more than $133 million (EUR 118 million) figure is ZachXBT's tracing. The Record reports the bank said it could "validate the order of magnitude"; France 24 reports about EUR 100 million. Arkéa says the final loss is not established.
Was South Korea hit by AI-agent hacking?
The FSC reports 40 incidents at 37 firms from 30 September to 3 November and about 473,000 records leaked. The AI-agent link is a presumption from industry sources, not a confirmed finding.
Sources
Accessed 5 November 2026. Primary statements first where we could reach them; most links below are news reports of those statements.
- The Record: French bank confirms cyber heist (Arkéa)
- France 24: French regional bank says cyberattack caused fraudulent transactions (4 Nov 2026)
- Yahoo News Taiwan: SinoPac transfers of NT$41.76 million, funds returned
- Hankook Ilbo: FSC figures on financial-sector incidents
- Korea JoongAng Daily: 28 IP addresses behind recent attacks
- The Record: Cyberattack disrupts Belgian tax services (FPS Finance)
- TRM Labs: North Korea steals $6.36 billion from Binance
- BleepingComputer: FBI links Binance heist to North Korean hackers (FBI alert, 31 Oct)
- The Star: Singapore firm recovers US$12.8 million
- Soubrasilia: cyber incidents in the financial system (Banco Central REF, 27 Oct 2026)
- ECB press release, 15 August 2019 (the only match for the "ECB website malware" claim)
This article is general information, not legal or financial advice.