AI-powered attacks hit South Korean financial institutions

The recent attacks on South Korean financial institutions have revealed how hackers utilize AI technology to commit crimes faster than ever. An investigation conducted by CrowdStrike on October 7 revealed traces of AI-assisted hacking, raising fears that the impacts could spread throughout the financial system and not be limited to the banks under attack.

ARTEX and Claude Code left in the attackers’ own files

The attackers made mistakes by leaving behind valuable clues. CrowdStrike’s Ashley Campion discovered some publicly exposed server directories with Claude Code session records, memory files, and configurations related to ARTEX, an open-source penetration-testing tool developed in China.

In the time span from late September to the beginning of October, the hacker utilized ARTEX along with large language models for the purpose of attacking financial institutions.

CrowdStrike was unable to identify the group responsible for the attack nor the number of victims. It claims with moderate confidence that the hacker spoke Chinese and was motivated by financial gain. It didn’t find any indications of state involvement.

Seven firms, tens of thousands of records

According to a previous report by Cryptopolitan, seven banks were hacked.

Shinhan Bank reported 25,727 compromised records while KB Kookmin reported 119, Hana recorded 89 and BNK Busan reported data on 11 outsourced developers. Yegaram Savings Bank notified around 40,000 affected customers, Welcome Savings Bank reported 2,200 corporate records breaches, and Hyundai Capital reported 146 loan agents being affected.

It took a long time before the attacks were detected. According to reports, Shinhan managed to detect the intrusion within 15 hours, Hana required almost 42 hours, and KB Kookmin detected the breach in 68 hours.

The government of South Korea cancelled its plans to expand exemptions from its network-separation rules. In a meeting on October 4, FSC Chairman Lee Eog-weon advocated for increased vigilance. The regulators ordered security inspections of around 500 companies.

Reports from Korea pointed at the fact that the attackers used external services with a lower protection level rather than using the actual banking systems that were controlled by the banks.

Why faster attacks cost more

The IMF’s June report found that AI-enabled adversary activity rose 89% between 2024 and 2025. Average breakout time fell to 29 minutes.

AI can help attackers find vulnerabilities and exploit them faster, leaving banks less time to respond.

BIS researchers Juan Carlos Crisanto, Adrien Currat and Jeffery Yong warned in their September paper:

“This window to detect, decide on and respond to such attacks has narrowed dramatically.”

Meanwhile, PwC’s 2027 survey found that 84% of security and finance leaders expect larger cybersecurity budgets. Yet only 22% would allow AI to act fully autonomously in defense.

How one bank’s breach can reach the rest

The OECD warns that cyberattacks can spread through shared technology providers and financial networks. Breaches have also been linked to deposit withdrawals, weaker lending, falling valuations and higher borrowing costs.

The BIS raises similar concerns about banks relying on the same cloud and AI providers.

Still, the Korean breaches have not caused demonstrated financial contagion or direct theft of bank funds. Regulators are now tasked with making security more stringent, overseeing third-party vendors more closely, and ensuring financial institutions can quickly bounce back before the spread of a cyberattack occurs.

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.