Hackers Hit the Money System: 14 Countries, One Month, No Bank Freeze

In roughly a month, banks and payment systems in fourteen countries reported intrusions, leaked records or money moved out of customer accounts. Almost none of it needed a government to freeze a bank. It came through an app, a vendor or an insider — and the money left as crypto.

In the past month, reports from at least fourteen countries describe the same shape of event: a bank, a payment system or a treasury loses money or records to an intrusion, and the institution discovers it after the fact.

Almost none of these cases involved a government ordering a bank to shut down. The entry points were ordinary: a banking app, a service provider with legitimate access, or a person inside who could open an account by hand. The exits were fast, and several ended in cryptocurrency.

The month, by region

Asia and the Pacific. In Taiwan, about 1.3 million US dollars was withdrawn from 418 SinoPac customers in a single day; the bank refunded the losses. In South Korea, 37 financial institutions were breached and roughly 473,000 records leaked. In Japan, more than 6.1 million dollars was taken from companies in Yamagata through calls impersonating their bank. In Indonesia, more than 6,600 Bank Jambi accounts were affected and about 8.8 million dollars moved out. In Singapore, 12.8 million dollars was transferred away. In Malaysia, nearly two million ringgit was withdrawn from an account belonging to a member of a royal household. In Vietnam, a deputy governor said hackers had been inside several banks for months without detection, and called for serious investment in security monitoring.

Europe and the Americas. In France, roughly 133 million dollars was taken from Crédit Mutuel Arkéa and converted into cryptocurrency; the banking app was disrupted for a time, and the bank said customer funds were not affected. In the United States, fourteen people in Dallas were charged with using SIM swaps and bribed insiders to reach accounts holding more than 373 million dollars, and a Florida company lost 6.5 million dollars through fifteen transfers in three days. In Canada, a former RBC employee was convicted of opening 43 fake accounts for organised crime. In Brazil, the central bank recorded 99 cyber incidents in nine months, 68 of them tied to fraud.

Elsewhere. Nepal's central bank told banks to take their websites offline after customers were tricked by fake KYC calls. Sri Lanka's treasury lost 2.5 million dollars to an email fraud. In Mexico, a criminal group used AI tools against the SPEI payment system.

What they have in common

Four things recur across otherwise unrelated cases.

AI is now in the attack, not the defence. Forged voices, generated documents and automated reconnaissance appear in several of the reports. The cost of a convincing impersonation has collapsed.

Identity is the perimeter. SIM swaps, fake KYC calls, accounts opened by staff: none of these defeats a firewall, because none of them attacks one. They arrive as a legitimate user.

Dwell time comes before the money. In Vietnam, and in several of the other cases, the intrusion ran for months before anything moved. Detection, not prevention, is where these were lost.

The exit is crypto. Money that leaves a bank account and becomes cryptocurrency is close to unrecoverable. The speed of the conversion is the whole point.

Why nobody has frozen a bank

No country has ordered a bank to suspend operations. That is not reassurance; it is a measure of how the attacks work. A freeze is the response to a bank that has failed. These attacks do not need the bank to fail — they need one credential, one insider, one unpatched integration, and a few hours.

The official response has been exercise, not shutdown. The G7 and the European Central Bank have been running cyber exercises and pressing banks to prepare AI-specific defence plans. The Managing Director of the IMF has warned that, if confidence erodes far enough, people may choose to keep cash at home.

If you hold the account

Do not keep everything in one banking app. Split operational money, savings and the emergency fund across institutions, so one compromised login is not the whole balance.
Turn on the alerts you ignore. A push for every transfer is the cheapest detection you will ever buy.
Treat a call from "your bank" as hostile by default. No legitimate bank needs your one-time code, your password, or remote access to your device.
Slow down the irreversible. A transfer that requires a second approval, or a delay on new payees, is worth the friction.

If you build the system

The uncomfortable lesson for institutions is that every one of these incidents ended in software. The call was routed by software. The account was opened in software. The transfer was approved, or not stopped, by software. The alert that nobody read was generated by software.

That is why the questions we ask before writing a line of code are the ones that decide whether a month like this one touches you:

A threat model that names each asset, the adversary, and what the business loses if it is taken or made to misbehave.

Least privilege that is enforced rather than documented — including for contractors and for the automation that already holds legitimate access.

Isolation between tenants and datasets that is proven by a test, not asserted in a brochure.

Supply chain discipline: dependencies pinned, reviewed, and inventoried, because most intrusions arrive through a component nobody chose deliberately.

Secrets that never live in a repository, a log line or a chat message.

And detection that a human actually reads at three in the morning.

ABN Asia

AI. Banking. Network Security. ABN Asia builds and reviews software for organisations that cannot afford to learn about an intrusion from a customer. We work with teams across the United States, the Netherlands, Hungary, Japan, South Korea, Singapore and Vietnam, and we would rather review a system before it is built than after it has failed.

If you run a bank, a payment system or any software that moves money, write to us at [email protected]. We will review the architecture, run a security assessment, or build it properly from the start.

Sources: reports compiled from regional press and official statements over the past month, including VnExpress (Vietnam), and central bank and regulator disclosures cited in each case. Figures are as reported by those sources.

Author

Ai-Banking-NetworkSecurity (ABN), ABN ASIA was founded by people with deep roots in academia, with work experience in the US, Holland, Hungary, Japan, South Korea, Singapore, and Vietnam. ABN Asia is where academia and technology meet opportunity. With our cutting-edge solutions and competent software development services, we're helping businesses level up and take on the global scene. Our commitment: Faster. Better. More reliable. In most cases: Cheaper as well.

Feel free to reach out to us whenever you require IT services, digital consulting, off-the-shelf software solutions, or if you'd like to send us requests for proposals (RFPs). You can contact us at [email protected]. We're ready to assist you with all your technology needs.