In the past, cyberattacks causing damage to financial institutions were commonly associated with bank system breaches, password thefts, or unauthorized access to customer account data.
Today, financial cybercrime is evolving as AI technology enables criminals to operate with greater subtlety, speed, and complexity.
Since early 2026, cyber incidents involving the financial sector have been reported across multiple countries, affecting banks, securities firms, cryptocurrency trading platforms, and non-bank financial companies.
Some cases involved AI-generated voice impersonations of executives to trick fund transfers, others used AI tools to penetrate systems and steal data, while some incidents remain under investigation regarding AI's degree of involvement.
These events demonstrate that cyber risks have become a critical challenge for the global financial industry, as damages extend beyond stolen money to customer data, trust, and financial system stability.
A striking example of AI's dangers occurred in February 2026 when Fideuram, a personal banking unit of Intesa Sanpaolo—the largest bank in Italy—lost approximately 95 million euros (about 108 million US dollars) to fraudsters who used AI to impersonate senior executives.
According to a Reuters report on 25 September 2026, the incident began when Paolo Molesini, then president of Fideuram, received a WhatsApp message appearing to come from Carlo Messina, CEO of Intesa Sanpaolo, stating there was an urgent international transaction requiring assistance.
The criminals further enhanced credibility by calling using AI-cloned voices of partners from a law firm, convincing the recipient that the call was genuinely related to the transaction.
Believing it was an executive order, Molesini instructed the finance team to execute multiple fund transfers to foreign accounts, mostly in China and Hong Kong.
However, the bank detected irregularities shortly after and coordinated with authorities across several countries to trace the transferred funds.
Thanks to cooperation among Chinese, Portuguese, and Italian authorities, about 53 million euros were recovered, while approximately 36 million euros remain missing and are reported to have been converted into cryptocurrency assets.
Another significant event occurred in the cryptocurrency market when Bitget, a major digital asset trading platform, disclosed that its system detected abnormal fund transfers and its risk control system automatically suspended all withdrawals on the platform.
The total damage was about 388 million US dollars, affecting 12 wallets across 11 blockchains and 12 asset types. The attackers exploited a zero-day vulnerability in a third-party security product to access internal management systems.
They then used stolen high-privilege credentials to issue fake withdrawal commands directly to wallets, bypassing withdrawal risk checks and erasing traces afterward. Bitget has not identified the perpetrators but CEO Gracy Chen suspects possible North Korean involvement.
South Korea Faces Wave of Cyberattacks on More Than 20 Financial Institutions
In late September, South Korea confronted ongoing cyberattacks in its financial sector, initially targeting several banks before spreading to securities firms, investment management companies, and cryptocurrency trading platforms.
Shinhan Bank was among the affected institutions, with customer data of about 25,700 individuals leaked, followed by KB Kookmin Bank and Hana Bank.
These incidents prompted the Financial Supervisory Commission (FSC) of South Korea to hold emergency meetings in early October, while President Lee Jae-myung ordered investigations into data breaches in both financial and government sectors.
On 7–8 October, cybersecurity firm CrowdStrike assessed with moderate confidence that the attackers were likely Chinese-speaking groups motivated by financial gain, employing the ARTEX penetration testing tool developed in China alongside multiple AI models and traditional attack techniques.
During this period, data of around 68,000 individuals from seven financial institutions were extracted. International media reports named various AI models involved, including DeepSeek, GLM, Grok, and Claude agents.
Damage continued to escalate. On 14 October, South Korean authorities disclosed that 16 companies had been victimized with about 100,000 data records leaked, cautioning that the figures might rise further.
By 28 October, Daishin Securities, Mirae Asset Global Investments, and Bithumb reported additional security incidents, increasing the number of affected institutions to approximately 20.
On 21 October, Japan faced a major cyberattack when GMO Internet Group revealed that Onamae.com Desktop Cloud—a virtual desktop rental service for retail investors using automated foreign exchange (FX) trading software—was accessed without authorization.
This breach potentially affected up to 26,739 virtual servers, forcing the company to suspend FX trading services from the incident date. Some customers reported transactions they did not authorize.
Subsequently, the attackers demanded a ransom in cryptocurrency worth approximately 50 million US dollars, or about 8 billion yen.
The attackers also claimed to have leaked customer data. Retail investors using the service were warned to change passwords and revoke all logins after some login information for MetaTrader 4 and MetaTrader 5 platforms was compromised.
The impact extended beyond GMO, as Japan's Finance Minister Satsuki Katayama disclosed that five other FX companies—Goldenway Japan, Oanda Japan, Ava Trade Japan, Gaitame Finest, and Dukascopy Japan—reported customer impacts.
On 26 October, the Prime Minister ordered the Cabinet to urgently develop cyberattack countermeasures within one week, responding to multiple attacks in Japan, not limited to the GMO case.
AI-driven threats have also emerged in Latin America. The Information reported on a study by cybersecurity company Straiker finding that a criminal group called CyberCartel used multiple AI agents working collaboratively to attack over 400 banks and payment providers in the region.
This system, named CARLIY0S, is built on the open-source penetration testing framework PentAGI, with each AI model assigned specialized tasks.
Straiker noted traces of the group's operations, which appear to involve password and customer data theft and reduced human involvement in accessing bank accounts.
Additionally, credentials related to Mexico's payment infrastructure and interbank transfer system SPEI were found.
Australia has issued warnings about financial system risks. On 22 October, David Bradbury, Deputy Chair of the regulatory agency APRA, urged the country's pension funds to increase cybersecurity budgets and consider sharing defense resources among funds, according to Bloomberg.
This concern arises from fears that AI technology could enable increasingly sophisticated financial crimes, especially scams targeting the elderly population, who are vulnerable to losing retirement savings.
These risks stem from 2025 incidents where attackers logged into multiple fund members' accounts using stolen passwords from other sources, raising concerns about impacts on Australia's pension system with over 4.5 trillion Australian dollars in assets and more than 25 million member accounts.
Furthermore, Australia's Signals Intelligence Agency (ASD) annual cyber threat report noted about an 80% increase in attacks on businesses and government entities, warning that new technologies could be used to target citizens' retirement savings.
India is also experiencing significant financial sector damages. The Economic Times reported on 29 October that non-bank financial companies (NBFCs), especially smaller operators, lost approximately 3 billion rupees within two months.
Most complaints concentrated in Mumbai with about 30 cases, Delhi with over 25, and Chennai with 15 to 16 cases.
Experts believe tools from China such as ARTEX and CyberStrike, combined with open AI models like DeepSeek, Qwen, Kimi, and GLM, may have been used. However, this information is an expert assessment, not an official government conclusion.
The latest major incident occurred on 29 October, shaking the digital asset market when reports emerged that Binance was hacked, with attackers transferring approximately 6.36 billion US dollars from Binance wallets across 10 blockchain networks.
Most transactions occurred within about 20 minutes, potentially marking the largest cryptocurrency theft ever recorded.
Binance assessed the impact at around 6.3 billion dollars, stated that it had frozen about 3 billion dollars in assets, and confirmed it would cover all losses incurred.
It is evident that cyber threats against the financial sector are becoming increasingly diverse, and AI may be reducing the time and cost of cybercrimes while enhancing perpetrators' ability to build trust and evade detection systems.
For the financial industry, cybersecurity defense can no longer rely solely on traditional security systems but must elevate technology, transaction approval processes, identity verification, and collaboration between financial institutions and global regulators.
Follow stock and investment news with Thairath Money to help you achieve "Good Finance, Good Life" athttps://www.thairath.co.th/money/investment
Follow the Facebook page: Thairath Money at this linkhttps://www.facebook.com/ThairathMoney