South Korean President Lee Jae Myung has <a style="color: #0000ff;" href="https://www.reuters.com/world/south-koreas-lee-says-ai-appears-have-been-used-bank-hacks-2026-10-06/" rel="noopener noreferrer nofollow">confirmed</a> a coordinated cyberattack targeting the country’s financial sector. He has ordered government agencies to send personnel and resources immediately to contain the damage. The breach affected seven financial institutions, including Shinhan Bank, KB Kookmin Bank, Hana Bank, Woori Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank, and Hyundai Capital, raising concerns over the use of AI-driven tools in attacks against critical financial infrastructure.
Investigators have <a style="color: #0000ff;" href="https://www.wsj.com/world/asia/hackers-use-chinese-ai-tool-to-hit-south-korean-banks-exposing-new-risk-5d4d3885?mod=rss_Technology" rel="noopener noreferrer nofollow">identified</a> 28 attack IP addresses spanning 12 countries, including the US, Japan, the UK, and Vietnam. South Korea’s National Office of Investigation said the addresses were used to continuously rotate attacks against different targets. Officials said it is highly likely that the open-source Chinese ARTEX AI tool was involved in the operation, although the Financial Security Institute stressed that the use of Chinese AI software and overseas IP addresses does not establish that the attackers were Chinese nationals.
<blockquote class="twitter-tweet">
 South Korean police opened a full investigation today into a wave of suspected AI assisted hacks on banks. President Lee Jae Myung says the signs point to AI models being used.
 1. Seven financial firms hit so far, including Shinhan, KB Kookmin and Hana, with about 66,000 people’s data exposed 2. Regulators shared 28 attacker IP addresses with financial firms and gave them until Thursday to finish security checks 3. A Korea University security professor named ARTEX, a tool that uses AI to find vulnerabilities, as possibly involved
 If you run customer facing systems, scan your own stack with the same kind of AI tools this week and fix the top findings first.
 — Cronus (@soycronus) <a href="https://x.com/soycronus/status/2107417917729951840?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 6, 2026</a>
</blockquote>
South Korea has since placed its cybersecurity agencies on a 24-hour emergency response footing and ordered cloud service providers to block network activity associated with the suspected overseas IP addresses.
The attacks also triggered a sharp rally in South Korean cybersecurity stocks. Sands Lab and RaonSecure both <a style="color: #0000ff;" href="https://www.yna.co.kr/amp/view/AKR20261006044151008" rel="noopener noreferrer nofollow">gained</a> nearly 30%, while AhnLab and Ginieans rose 15.58% and 20.83%, respectively, as investors bet on stronger demand for cybersecurity solutions.
<h3 id="span-style-font-weight-400-crypto-users-warn-ai-is-lowering-the-barrier-for-cyberattacks-span">Crypto users warn AI is lowering the barrier for cyberattacks</h3>
Crypto and Web3 users have focused on the possibility that AI agents could lower the technical barrier for carrying out sophisticated cyberattacks. Web3 enthusiast Coppercode <a style="color: #0000ff;" href="https://x.com/coppercode_/status/2107381643132481862" rel="noopener noreferrer nofollow">described</a> the reported ARTEX attack as a potential turning point, saying the AI agent carried out reconnaissance, credential stuffing and verification with little human input. He said autonomous AI could make sophisticated hacking easier for more people to carry out.
Others framed the incident as evidence that AI-driven cybercrime is moving from a theoretical threat to a practical security challenge. SkeletronJV <a style="color: #0000ff;" href="https://x.com/skeletronJV/status/2107403100252176734" rel="noopener noreferrer nofollow">highlighted</a> reports that AI may have been involved in attacks against major South Korean banks, while SmindCrypto <a style="color: #0000ff;" href="https://x.com/SmindCrypto/status/2106387355791999020" rel="noopener noreferrer nofollow">questioned</a> whether financial institutions are prepared for attackers capable of writing and deploying malicious code rather than relying on traditional methods. Their comments show increasing concern that conventional cybersecurity defenses may struggle to keep pace with automated attack systems.
<blockquote class="twitter-tweet">
 <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f30f.png" alt="🌏" style="height: 1em; max-height: 1em;"> Asia .
 AI bank hacks in Korea.
 Advanced AI tools may have been used in a cyberattack on Shinhan Bank, and leaks have since been confirmed at KB Kookmin, Hana and BNK Busan Bank.
 Four Korean banks breached — possibly by AI.
 The next bank robber won’t wear a mask; it’ll write code.
 Is your bank ready?
 — Smindi (@SmindCrypto) <a href="https://x.com/SmindCrypto/status/2106387355791999020?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 3, 2026</a>
</blockquote>
The discussion has also raised important questions about the resilience of traditional financial infrastructure and the emerging AI-versus-AI security race. John <a style="color: #0000ff;" href="https://x.com/John_fk_jr7/status/2107407753807315118" rel="noopener noreferrer nofollow">pointed</a> to the possibility of regulators using AI to counter AI-enabled attacks while Astrinvestor <a style="color: #0000ff;" href="https://x.com/astrinvestor/status/2106670724199170297" rel="noopener noreferrer nofollow">questioned</a> whether banks can remain trusted as AI capabilities evolve faster than existing cybersecurity practices. Ethereum co-founder Vitalik Buterin has similarly <a style="color: #0000ff;" href="https://defi-planet.com/2026/09/vitalik-buterin-rejects-ai-doomsday-fears-and-defends-crypto-security/" rel="noopener noreferrer nofollow">argued</a> that AI will not make cybersecurity impossible to defend, suggesting that increasingly capable AI could ultimately give defenders an advantage over attackers.
<h3 id="span-style-font-weight-400-what-comes-next-span">What comes next?</h3>
The focus may now move beyond identifying ARTEX to understanding how widely AI-powered attack tools are being used. AhnLab’s Security Intelligence Centre <a style="color: #0000ff;" href="https://www.yna.co.kr/amp/view/AKR20261006118100017" rel="noopener noreferrer nofollow">found</a> ARTEX activity linked to about 600 IP addresses worldwide, with some of the same servers also running another AI security tool called CyberStrikeAI.
However, AhnLab said the IP addresses cannot be linked to a single attacker because ARTEX is open source and can also be used by security researchers. This means investigators may increasingly have to track wider networks of AI-powered attack infrastructure rather than individual hackers or malware.
The attacks have also shown that banks may need to look beyond their core systems when improving security. Investigators found that attackers targeted third-party services, including loan-broker portals and employee support systems.&nbsp;
At Shinhan Bank, about 25,000 customers were reportedly affected after attackers accessed a loan-related service with weak identity checks. The incident is putting more focus on stronger authentication, zero-trust security and AI-powered vulnerability checks that can continuously look for weak points.
&nbsp;
Enjoyed this? Bookmark<a style="color: #0000ff;" rel="noopener noreferrer nofollow">DeFi Planet</a>, explore related topics, and follow us on<a href="https://twitter.com/PlanetDefi" rel="noopener noreferrer nofollow">Twitter</a>,<a href="https://www.linkedin.com/company/defi-planet/" rel="noopener noreferrer nofollow">LinkedIn</a>,<a href="https://www.facebook.com/DeFi-Planet-129907662611402" rel="noopener noreferrer nofollow">Facebook</a>,<a href="https://www.instagram.com/defi.planet/" rel="noopener noreferrer nofollow">Instagram</a>,<a href="https://www.threads.com/@defi.planet" rel="noopener noreferrer nofollow">Threads,</a> and<a style="color: #0000ff;" href="https://coinmarketcap.com/community/profile/DeFiPlanet/" rel="noopener noreferrer nofollow"> CoinMarketCap Community</a> for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
The post <a rel="noopener noreferrer nofollow" href="https://defi-planet.com/2026/10/south-korea-confirms-ai-driven-cyberattacks-on-7-financial-institutions/">South Korea Confirms AI-Driven Cyberattacks on 7 Financial Institutions</a> appeared first on <a rel="noopener noreferrer nofollow" href="https://defi-planet.com">DeFi Planet</a>.

South Korea Confirms AI-Driven Cyberattacks on 7 Financial Institutions

Table of Contents

DeFi Planet

Other articles published on Oct 7, 2026

Join our free newsletter for daily crypto updates!