AI-assisted cyberattacks hit banks, lenders and crypto firms from South Korea to Latin America
A run of cyberattacks on financial firms over the past few weeks shows how artificial intelligence is making hacking faster and cheaper. Investigators say AI tools were used against banks in South Korea and Latin America and to clone a voice in a €95m fraud at an Italian bank, while Indian lenders, a Japanese trading platform, the Bitget crypto exchange and Australian regulators are dealing with their own attacks and warnings. The incidents are separate and have not been linked to a single group.
Banks, lenders and crypto platforms in several countries have been hit by cyberattacks in recent weeks, and in a number of cases investigators say the attackers leaned on artificial intelligence. The incidents are separate, and authorities have not linked them to one group, but together they have pushed governments and central banks to treat AI-driven hacking as a threat to the financial system.
Animated map of the attacks:
🚨 BREAKING: Hackers are hitting banks in 7 countries at the same time.
— @USronaldcarter October 29, 2026
South Korea has been hit hardest. Investigators in Seoul found traces of Artex AI, a Chinese-developed penetration-testing tool, in intrusions at major banks, the Wall Street Journal reported; the security firm CrowdStrike said the attacker also used Claude agents. By 14 October the Financial Services Commission counted 16 affected firms, including Shinhan, KB Kookmin, BNK Busan and Hana banks, and about 100,000 exposed records. On 28 October Daishin Securities said data on 38,490 customers had been compromised, and the crypto exchange Bithumb and Mirae Asset Global Investments reported incidents, bringing the publicly identified total to 20 firms, according to The Korea Times.
In Latin America, the security firm Straiker says a long-running criminal group known as CyberCartel built an attack system on commercial AI models, including Anthropic's Claude, xAI's Grok and Moonshot AI's Kimi, and aimed it at more than 400 banks, payment providers and other financial targets. Straiker stresses that the figure counts targets, not confirmed breaches; it found a database of stolen credentials and said Anthropic had cut the group's access to Claude.
In Italy, fraudsters used a fake WhatsApp message from Intesa Sanpaolo chief executive Carlo Messina and an AI-cloned voice of a well-known lawyer to get Fideuram, the group's private bank, to wire about €95m abroad, Reuters reported in September. The scam took place in February; about €53m has been recovered, while roughly €36m is still missing after being converted into crypto. Milan prosecutors are investigating.
In India, smaller non-bank lenders have lost an estimated ₹300 crore (₹3bn) to cyberattacks in about two months, with nearly 150 complaints filed, The Economic Times reported on 29 October, citing officials. The national cyber agency CERT-In had warned on 9 October that attackers were exploiting weak apps and payment interfaces, stealing banking credentials and pushing through unauthorised transfers. Officials warned that AI tools could make such fraud easier.
In crypto, Bitget said on 24 September that about $351.6m had been taken from its hot and warm wallets, a figure it later raised to $387.5m. The exchange says the attacker spoofed transfer data in a backend system and suspects North Korean hackers; it has not said AI was involved. In Japan, hackers broke into GMO Internet's cloud service for automated currency trading, which may have exposed up to 26,739 servers, and demanded $50m in crypto, which the company refused to pay. Five currency brokers reported customer losses, and Prime Minister Sanae Takaichi ordered an emergency cybersecurity package on 26 October. GMO's founder, Masatoshi Kumagai, said AI had dramatically lowered the bar for sophisticated attacks.
In Australia, the Australian Signals Directorate's annual report, released on 27 October, says it sent more than 4,400 warnings about potentially malicious activity in 2025-26, almost 80% more than a year earlier, and that AI is making attacks faster and more convincing. David Bradbury, deputy chair of the prudential regulator APRA, warned that an AI-amplified attack "could actually start to clean out people's accounts" in the superannuation system.
Regulators are preparing for worse. G7 finance ministers and central bankers agreed on 16 October to run exercises simulating AI-driven cyberattacks on banks, and the European Central Bank gave euro-area banks until the end of October to hand in plans for defending against AI-enabled attacks, Reuters reported.