From SBI to Binance, how financial institutions are becoming cyberattack targets

Some of the world's biggest financial institutions are facing growing cybersecurity threats, with hackers finding ways to exploit vulnerabilities in their systems and putting sensitive customer information and even money at risk.

Recent incidents involving cryptocurrency exchange Binance and Indian public sector lender State Bank of India (SBI) have once again put the spotlight on the issue. While Binance reported a security breach involving unauthorised cryptocurrency withdrawals estimated at around $6.3 billion, SBI is investigating a suspected data leak involving nearly 3,900 customer records.

The incidents come amid a sudden rise in cyberattacks targeting banks, non-banking financial companies (NBFCs), fintechs, and payment service providers in India.


In October, around 20 financial institutions were affected by cyberattacks in which hackers allegedly used stolen partner-bank credentials and weaknesses in payment systems to siphon off money, according to an ET report.

What happened at Binance?

Binance, the world's largest cryptocurrency exchange, reported a major security breach on October 29, with the estimated total impact at around $6.3 billion.

The exchange temporarily suspended deposits and withdrawals as a precaution and worked with law enforcement agencies and blockchain companies to trace the stolen assets.

Blockchain intelligence firms linked the attack to TraderTraitor, a hacking group associated with North Korea. It was later confirmed by the Federal Bureau of Investigation (FBI).

Binance said that it had covered 95% of the $6.3 billion stolen cryptocurrencies by using company money to buy replacement tokens. The remaining 5% of stolen tokens consist of assets that are less liquid and may take longer to source in the required amounts.

What happened at SBI?

India's largest lender, State Bank of India, is investigating a suspected data breach after around 3.75 lakh records linked to the bank surfaced on the dark web.

SBI received alerts about the possible exposure from its threat intelligence provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (Cert-In) on October 16.

A preliminary examination of the records identified 3,897 customer records containing personally identifiable information. The exposed information reportedly included customers' names, mobile numbers, email addresses, dates of birth, residential addresses and details linked to loan applications.

SBI activated its cyber incident response procedures and appointed an independent cybersecurity agency to investigate the incident.

How are hackers getting into these systems?

There are several ways cybercriminals can enter financial institutions' digital systems. Some of the most common ways are through stolen employee credentials, weak APIs, third-party service providers, and poor passwords.

Artificial intelligence is also making it easier for cybercriminals to identify weaknesses, automate tasks and carry out attacks at a faster pace.

Cert-In has warned that attackers may be using AI-assisted tools to identify vulnerable systems, conduct reconnaissance and execute fraudulent transactions.

In a separate advisory issued on October 15, the agency also flagged incidents in which AI agents accessed computer systems of Indian organisations without proper authorisation.

What can banks and financial companies do?

In its May 2026 blueprint, CERT-In outlined a series of measures that organisations, including banks, fintech companies and other financial institutions, should adopt to defend themselves against AI-assisted cyberattacks.

One of the key recommendations is adopting a Zero Trust security system. This means organisations should not automatically trust anyone accessing their networks, including employees and third-party vendors. Every user and device has to undergo regular identity checks before getting access to sensitive systems.

Cert-In has also asked organisations to continuously monitor their networks, payment APIs, cloud infrastructure and employee accounts to identify unusual activity. Another important measure is fixing software vulnerabilities quickly.

The blueprint also highlighted the need to strengthen security at third-party vendors. Banks depend on outside companies for cloud services, payment processing and software. A weakness in one of these providers can expose several connected organisations to cyber risks.

Cert-In has also recommended stronger security at the employee level, including multi-factor authentication, regular software updates and training to identify phishing emails and deepfake-based impersonation.