Financial Times writes that a comprehensive AI-driven cyberattack on a major bank is approaching inevitability, pointing to the recent Binance hack as a warning of far worse scenarios in traditional finance (FT, 2026). The article does not go into detail about the scale of the Binance incident, but uses it as an example of how quickly attackers can now exploit weaknesses in financial infrastructure.

The myth of the invulnerable bank vault

The banking sector has for years relied on the notion that core systems are physically isolated — so-called "air-gapping" — and thus inaccessible to external attackers. In practice, this is an architectural impossibility. Modern banking operations require continuous, real-time communication with settlement hubs such as Fedwire, CHIPS and Target2, payment networks like Visa and Mastercard, as well as round-the-clock SWIFT messaging.

What banks actually use is logical network segmentation — firewalls, VLANs and VPN connections — not physical isolation. Once an attacker is inside the network, it's about lateral movement and privilege escalation to reach the payment engines, not about physically breaking into a vault.

Air-gap has never been a wall — it has been a door someone forgot to lock
AI Hackers vs. the Banks: A Matter of When, Not If - Bilde 1

History repeats itself

Several landmark cases illustrate just how vulnerable "secured" banking systems have actually been. In February 2016, Lazarus Group, a North Korean-linked threat actor, managed to steal $81 million from Bangladesh Bank after using spear-phishing to gain access to internal workstations and from there to the bank's SWIFT terminals (ISACA; DOJ).

Even more extensive was the Carbanak/Anunak campaign, which from 2013 and for several years onward hit over 100 financial institutions in more than 30 countries, with total losses estimated at around $1 billion. The attackers used phishing and keyloggers to study employees' routines for months before directly manipulating account balances in the databases (Kaspersky/Securelist).

In 2018, Cosmos Cooperative Bank in India showed how attackers could set up a fake payment switch running parallel to the bank's own, thereby approving thousands of fraudulent withdrawals without touching the core system itself.

$81 mill.
Lost in the Bangladesh Bank heist (2016)
$1 bn
Estimated loss from the Carbanak campaign (2013–2016+)
$13.5 mill.
Lost in the Cosmos Bank attack (2018)
AI Hackers vs. the Banks: A Matter of When, Not If - Bilde 2

Why AI changes the rules of the game

What these cases have in common is that human phishing, coding errors and manual administrative bridges — not physical break-ins — were the entry point. AI tools now make this kind of reconnaissance, phishing customization and vulnerability exploitation far faster and more precise. Where the Carbanak group spent months manually studying employees' routines, generative AI models could in theory automate large parts of this process.

SWIFT itself has acknowledged the problem. After the Bangladesh heist, the organization launched a security program (CSP) that explicitly requires network segmentation rather than air-gapping, precisely because member terminals sit on ordinary IT networks that need external access and updates.

An AI-driven cyberattack on a bank is not a question of if it happens, but when

The crypto market in risk-off mode

The news comes at a time when the crypto market is already marked by nervousness. Bitcoin is trading around $77,700, and the fear index (Fear & Greed) stands at 34 out of 100 — a level signaling fear rather than greed among investors. In such a climate, new security concerns, whether involving crypto exchanges or traditional banks, could further amplify risk aversion.

It is worth emphasizing that neither the FT article nor the available source material documents a concrete, executed AI-driven bank attack to date. The warning concerns probability and trend, not a confirmed incident — but the history of how often "secure" systems have proven vulnerable lends weight to the warning.