South Korea Bank Hacks: What AI Actually Did, and What Builders Should Learn

South Korea is treating a week of intrusions at seven financial firms as the country's first large suspected AI-assisted cyberattack. President Lee Jae Myung said AI models appear to have been used, police have opened a full investigation, and regulators have ordered emergency security checks across roughly 500 financial companies. The attackers reportedly did not touch core payment systems. They went through side doors: a loan broker portal, an employee mobile work-support system, a sales-support platform and outsourced developer accounts.

The hard facts are narrower than the headlines. About 66,000 people had personal or loan data exposed, officials have not named the AI tool involved, and the evidence of AI use so far is a set of traces on one server. This post lays out what is confirmed, corrects a number that is circulating wrongly, and turns the incident into a practical checklist for anyone who builds or defends systems in the agent era.

A green umbrella shelters a small block from falling fragments, illustrating defense against suspected AI-driven attacks on Korean banks

Update (October 11, 2026): bank CEOs face parliamentary audits this month

The political fallout is now scheduled. The Korea Times reports that the Financial Supervisory Service audit is set for October 17 and the National Policy Committee's final audit session for October 22. Rep. Park Sang-hyuk of the ruling Democratic Party plans to seek testimony from the heads of KB Kookmin, Shinhan, Hana, Woori and NH NongHyup, though the paper says it is unclear whether the CEOs will be named as witnesses, and the deadline for Financial Services Commission audit witnesses has already passed.

Pressure is expected to fall hardest on Lee Hwan-ju (KB Kookmin), Jung Sang-hyuk (Shinhan) and Lee Ho-seong (Hana), whose banks reported customer-information breaches. All five CEOs' terms expire at the end of the year, so how they answer on cybersecurity could affect reappointment. Woori and NH NongHyup reported hacking attempts with no confirmed leaks.

Reporting on the date conflicts. A later Korea Times report says the National Assembly's Policy Affairs Committee approved summoning the five CEOs as witnesses for the Financial Supervisory Service parliamentary audit on October 19, which does not match the October 17 and 22 dates above. Check the National Assembly schedule before relying on any one date. Some summaries also say the Financial Security Institute warned about AI-agent attacks in a September 17 briefing for about 160 security officials; we could not confirm that in the coverage we could search, so treat it as unverified. The same summaries say the attacker was identified by a leaked résumé; as covered below, CrowdStrike says the personal details cannot be definitively tied to him.

Update (October 9, 2026): ARTEX's developer says the project is now closed-source

Reuters correspondent Brenda Goh reports, as summarized in Techmeme's roundup, that the Chinese developer of ARTEX says it has converted the AI agent into a closed-source project after CrowdStrike said the tool was used to hack South Korean banks. We could only read the headline and summary of that report, not the full article, so details such as the developer's stated reasons and wording are not included here.

What this changes, and what it does not:

• Future versions are no longer inspectable. Defenders and researchers can no longer read new code the way they could when the project was public, which makes detection signatures and behavior analysis harder.
• Existing copies remain. The earlier open-source releases were already downloaded and mirrored. AhnLab, as covered above, found instances of the tool on roughly 600 IP addresses, and closing the repository does not remove those copies.
• It is not an admission of anything. The report, as summarized, describes a licensing change by the developer. It does not say the developer was involved in the attacks, and CrowdStrike's own assessment, which names no adversary, is unchanged.

For defenders, the practical takeaway from the CrowdStrike report still applies: the attacks relied on credential stuffing against side-door systems, so rate limits, multi-factor authentication and anomaly detection matter more than which agent framework drives the traffic.

Update (October 9, 2026): China's foreign ministry responds, but does not flatly deny

On October 8, 2026, Chinese foreign ministry spokesperson Mao Ning answered a question about the case at a regular press briefing. Reuters, as republished by Claims Journal, reports that she said the ministry was not familiar with the case and that China "as a matter of principle has consistently opposed and combated hacking activities." South Korea's Kyunghyang Shinmun gives more of the quote: "We are not well aware of the specifics," and China "opposes and combats hacking activities in accordance with the law and also opposes the dissemination of false information driven by political intent." It adds that she said the international community should strengthen cooperation and set new international norms for cyberspace. Kyunghyang's English text is machine-translated, so the wording may differ slightly from the Chinese original.

Some aggregator headlines say "China denies AI tool use." That is stronger than what these two outlets report. The spokesperson said she lacked details. She did not say that no Chinese-made tool was used, and she did not address the ARTEX tool by name in the quoted remarks.

Two other points from the same reports:

• The suspect disputes the identification. Kyunghyang reports that the Telegram user "YY," whom CrowdStrike's analysis linked to the personal details found in the attacker's sessions, told the newspaper he is a convenience store employee in Zhengzhou, Henan Province, not a hacker. He said the personal information was wrong. CrowdStrike itself says the information is not enough to identify the person with certainty. As in the section above, we do not republish the personal details.
• CrowdStrike's confidence level has not changed. Reuters quotes the report: the actor is "likely a Chinese speaker and financially motivated," assessed with moderate confidence from the Chinese-developed tool and Chinese-language prompts. CrowdStrike has not attributed the activity to a named adversary or to the Chinese state.

Reuters also reports that at least nine South Korean banks have disclosed, or been reported by local media as, targets since late September. Our earlier figure of seven firms comes from the Korean investigators' first count. Treat the higher number as a media-reported count, not an official one. Anthropic and South Korean police did not respond to Reuters' requests for comment.

Update (October 8, 2026): CrowdStrike's primary report on ARTEX, the models and the operator's own logs

On October 7, 2026, CrowdStrike published its own analysis, Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance, from its Counter Adversary Operations team. It replaces our earlier secondhand summary, which relied on The Decoder. Here is what the primary report says, and what it deliberately does not.

The headline findings

• Timeframe and outcome. A targeted campaign against South Korean financial organizations, active from late September to early October 2026, that resulted in exfiltrated data. CrowdStrike says the number of affected organizations is still unconfirmed.
• Attribution. Not attributed to a named adversary. CrowdStrike assesses with moderate confidence that the actor is likely Chinese-speaking and financially motivated, based on the use of a Chinese-developed tool and Chinese-language prompts.
• The tool. ARTEX, a recently released open-source agentic penetration-testing tool developed in China, used alongside large language models.
• How the bank breaches are described. Citing industry reporting, CrowdStrike notes one bank's loan progress inquiry service used by financial brokers was breached, and another bank's employee mobile work-support system was compromised. It also notes overlapping IP addresses across victims and references to the string ARTEX in HTML files on a reportedly attacker-controlled server.

What the open directories revealed

CrowdStrike found exposed directories on attacker-controlled infrastructure containing Claude Code session histories, ARTEX configuration files and Claude memory files. One was a CLAUDE.md file holding a Chinese-language pentesting prompt that told the model how to conduct the work. These files, CrowdStrike says, gave "direct insight into the threat actor's operational methodology and tooling."

The sessions show a two-server design:

The models. The ARTEX instance used DeepSeek v4.1-flash as its primary LLM backend. The actor supplemented it with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions, and likely reached DeepSeek through an LLM API proxy or reseller. Nine proxy IP addresses were also observed during the activity; CrowdStrike lists them as indicators in its report, so defenders should take them from the source.

Two things not to over-read

1. "Claude Code logs" is about the harness, not a breach. Claude Code is a coding-agent program the actor ran, and its session history and memory files were left in an exposed directory. That does not mean Anthropic's systems were compromised. The report is also not explicit about which model answered in each Claude Code session, so do not assume a specific lab's model did the work. The Decoder's wording that DeepSeek, GLM and Grok were "the models behind" the intrusions compresses this: per CrowdStrike, DeepSeek was ARTEX's main backend and the other two supplemented additional sessions.
2. Personal details about a possible operator are unconfirmed. CrowdStrike's report includes personal details that appeared in one session and a Telegram username that recurred in unrelated vulnerability research. It says the information cannot definitively associate those details with the actor. We are intentionally not republishing them: if the link is wrong, it would name an innocent person. Read the original if you need them for defense work.

Other observations from the logs. The actor asked a model where threat actors typically sell Korean breach data and for help finding Korean Telegram data-sale groups, which suggests a monetization motive. CrowdStrike also notes the same actor used AI to draft a researcher-style résumé citing the campaign, which is a sign of how casually the tooling was used.

CrowdStrike's assessment. The activity shows how AI tooling can let a financially motivated actor conduct multiple intrusions in a short span, and CrowdStrike expects adversaries to keep experimenting with AI to raise tempo and capability. In MITRE ATT&CK terms it lists T1583.003 (acquire infrastructure: virtual private server), T1588.007 (obtain capabilities: artificial intelligence) and T1090 (proxy).

What this changes in our post. The earlier open question, which AI tool was used, now has a named answer from a vendor with direct evidence: ARTEX with DeepSeek as the main model. The 66,000-person figure and the regulator findings below still come from Korean officials, and the Korean newspaper Khan's count of more than 25,000 Shinhan Bank records is reported secondhand. The defender checklist is unchanged and, if anything, reinforced: the weak points were side doors such as broker portals and employee work-support systems, and attacker operational security was poor enough to leave its own logs open on the internet. For the wider pattern of open agent frameworks and weak guardrails, see our coverage of Chinese hackers scaling attacks with DeepSeek, and for how this connects to the liability debate, our Felony Bench explainer.

More data: how big it was, who is responding, and why "complete amateur" misses the point

The numbers differ by outlet. Counts have moved as firms reported, and different publications use different baselines. Treat all of them as approximate until regulators publish a final tally.

The response so far. South Korea's National Police Agency opened a formal investigation through its cyber terror unit, the financial regulator held an emergency meeting, and President Lee Jae Myung called for a thorough investigation. We found no reported arrests or charges. At the time of the reports we saw, Anthropic, Korean police and China's foreign ministry had not responded to requests for comment.

The viral thread, and what it gets wrong. A widely shared post summarizing CrowdStrike's report called the attacker "truly legendary... a complete amateur," listing the open directory, the CLAUDE.md file, the "where can I sell this data" prompts, a résumé request, and then asserting that his name, phone number and home had "all been identified." Two corrections:

1. "Identified" overstates the report. CrowdStrike says personal details in one session likely belong to the actor, but that available information cannot definitively associate them with him. Several outlets repeat a "26-year-old" headline built on those same clues. A handle or a name in a chat session is a lead, not proof. We are deliberately not repeating the personal details here: if the link is wrong, publishing them points an angry internet at a stranger, and even if it is right, naming people is for investigators and courts.
2. "Amateur" is a judgment about opsec, not about harm. The mistakes were real. But by CrowdStrike's account the same person breached multiple financial organizations in a few weeks and exfiltrated data. Sloppy hygiene plus AI tooling still produced a campaign that took regulators by surprise. Underestimating the capability because the operator was careless is the wrong lesson.

The opsec failures, as a checklist for your own systems. The mistakes that exposed the actor are the same classes of mistake that expose companies running agents:

The defender takeaway cuts both ways. Attackers who use agents leave rich logs, which helped CrowdStrike. Your own agent logs are the same kind of artifact, and the same kind of liability, if they are exposed.

Still unknown. Which model answered which session, how much of the intrusion work was autonomous versus manual, the final victim count, whether any customer money moved, and whether anyone is charged. We will update this post as those facts arrive.

TL;DR: the incident in one table

Timeline: how the story unfolded

Shinhan Bank disclosed its breach on October 1, according to the Korea Herald. KB Kookmin detected suspicious activity on a Wednesday and shut down the affected server, and the Financial Services Commission held an emergency meeting on Friday. By Sunday, October 5, seven institutions had reported attacks. On Sunday the president ordered a thorough investigation, per the Korea Times, and on Tuesday, October 6, police launched a formal probe while Lee told a Cabinet meeting that "speed is of the essence" and called for accelerating AI technologies specialized in cybersecurity.

Two details stand out. First, JoongAng Daily reports the internet-only banks KakaoBank, Kbank and Toss Bank were targeted but defended successfully. Second, a follow-up JoongAng Daily report reports detection times that varied enormously: roughly 15 hours at Shinhan, about 41 hours at Hana and nearly 68 hours at KB Kookmin. The window between intrusion and detection is the part defenders control, and it is where this story is most instructive.

The number to correct: 28 IP addresses, not 19

Some summaries circulating on the day, including the one that surfaced this story in our queue, say a watchdog "pinpointed 19 IP addresses." The more detailed reporting we could verify says otherwise. The Korea Herald reports 28 distinct IP addresses were identified and shared with financial firms, and the same outlet notes regulators cautioned that the addresses do not necessarily indicate where the attackers sit, because traffic can be routed through other countries.

We could not reconcile the 19 figure with any primary report. It may reflect an earlier tally or a subset, so treat it as unverified. The practical lesson is the same either way: an IP list is a blocklist, not an attribution.

What is the evidence that AI was involved?

This is the question that matters most for the AI industry, and the honest answer is "suggestive, not conclusive."

• Political statements. President Lee said AI models appear to have been used in some recent attacks. FSC Chairman Lee Eog-weon said, "We cannot rule out the possibility that AI was used in the attacks."
• A server artifact. Reports say a web server believed to be used in a credential-stuffing attack on Shinhan Bank carried an HTML title in Chinese meaning "AI autonomous penetration testing console," matching the name of an open-source project called ARTEX.
• Behavior. Officials describe an automated, systematic pattern across many firms in a short window.

What is missing: no lab or vendor has attributed the activity to a specific model, no transcripts or tool logs have been published, and authorities have not named the AI tools involved. A page title proves someone ran or copied a dashboard. It does not prove that an LLM selected targets or wrote exploits. Credential stuffing, which replays leaked username and password pairs, is also a decades-old technique that does not need AI at all. Experts quoted in Korean coverage are weighing exactly that possibility.

What is ARTEX AI?

ARTEX is an open-source system, described in Chinese on its GitHub repository as an AI autonomous penetration-testing system. Based on the project's description and coverage of it, it chains LLM calls in a multi-agent design to automate the whole loop a human pentester follows: gather information, discover vulnerabilities, plan attack paths, run security tools, and verify whether a finding is real. We have not verified who operated the server in question, and finding a tool name on infrastructure does not tell you who was at the keyboard. Open-source pentest agents are legitimate security tooling that attackers can also run.

That dual-use shape is familiar. We covered the same asymmetry in Chinese hackers scaling attacks with DeepSeek and weaker guardrails, where open agent frameworks and lightly guarded models changed attacker economics, and in AI cyber guardrails that block US defenders, where the complaint was that defenders get refusals while attackers use open weights. An autonomous pentest console that anyone can download is the concrete product of that trend.

Why the side doors were the weak point

According to JoongAng Daily, the agents exploited internal and partner-facing systems rather than customer-facing channels: an employee mobile work-support system at KB Kookmin, a sales-support platform at Hana, a loan broker service portal at Shinhan. BNK reported 11 cases tied to outsourced developers, and Hyundai Capital's exposure involved mortgage loan agents. The Korea Times puts Hyundai Capital's number at 146 housing loan agents.

This pattern is not unique to Korea. Core banking systems are heavily audited. The brokers, agents and contractors around them are numerous, use varied tooling, and often authenticate with a password and nothing else. Automation changes the economics of attacking that long tail. A human attacker has to decide whether a small broker portal is worth an afternoon. An autonomous agent can try thousands of such portals in parallel for the cost of API calls or GPU time.

We saw a related lesson in Tailscale's analysis of the Hugging Face intrusion: no exotic vulnerability was needed, because long-lived credentials were the problem. The Korean case appears to rhyme, though the technical post-mortem has not been published.

What regulators have ordered

The FSC and Financial Supervisory Service have moved quickly:

1. The FSS alerted about 500 financial firms to the malicious IP addresses.
2. Firms must identify externally reachable IT assets and AI systems, audit authentication gaps and share attack IPs with the Korea Internet and Security Agency.
3. Emergency security checks are due Thursday.
4. Authorities warned that repeat failures would face "stern penalties."
5. A newly created Serious Crimes Investigation Agency may be notified, and 28 investigators across four cyber units are on the case.

Political pressure is rising too, with lawmakers citing "repeated security failures" ahead of parliamentary audits. For readers following Korea's broader AI posture, our South Korea AI ecosystem guide covers the sovereign-model and compute strategy this story now collides with: the same government that is investing in national AI is now asking how to defend against it.

What this means for people who build with AI

If you ship agents, APIs or partner portals, the incident suggests a short list of changes. None is novel; the news is that the cost of ignoring them dropped.

1. Inventory every externally reachable asset

The FSC's first instruction was to identify externally accessible assets. Do the same: partner portals, staging hosts, internal tools exposed for contractors, forgotten admin panels. Anything an autonomous scanner can find, it will eventually try.

2. Kill password-only authentication on low-profile systems

Credential stuffing works because users reuse passwords. Require multi-factor authentication or passkeys on broker, vendor and contractor logins, and add rate limiting and breached-password checks. Fixing the portal nobody thinks about is worth more than another dashboard on the core system.

3. Shrink detection time

Fifteen hours versus sixty-eight is the difference between a contained incident and a long exfiltration. Alert on unusual query volume, enumeration patterns and logins from new infrastructure on side systems, not just on the core.

4. Minimize what the side doors can see

The reported exposure included income and loan limits, which are valuable for fraud and targeted phishing. Apply least privilege so a broker portal cannot read more customer fields than its job needs, and mask or tokenize identifiers such as resident registration numbers.

5. Test yourself with the same class of tool

Autonomous pentest agents are available to defenders too. Vendors are shipping defender products, such as those we covered in OpenAI Daybreak and Codex Security and Claude Mythos Preview and Project Glasswing. The VulnCheck analysis of AI-found bugs is a useful sober read on how often AI-discovered findings turn into real exploits. Run any such tool only against systems you own or are authorized to test.

6. Treat agent tooling as attack surface too

If you operate agents with credentials, the same logic applies in reverse: scope tokens narrowly and monitor tool calls. Our MCP security guide walks through the practical controls.

What people are asking

Is this the first AI cyberattack? No. Security vendors and governments have reported AI-assisted operations for more than a year, including the campaigns in our DeepSeek coverage above. What is notable here is a head of state publicly linking a domestic financial-sector incident to AI, and the breadth of institutions hit in a single week.

Should customers do anything? Standard hygiene applies: expect phishing that quotes real loan details, be suspicious of calls referencing your income or loan limits, change reused passwords and enable multi-factor authentication where offered. Follow your bank's own notification.

Does this prove open-source offensive AI should be restricted? Not on this evidence. The artifact is a console title on a server, the attribution is unconfirmed, and the underlying technique may be conventional credential stuffing. Policy conclusions drawn before the forensic report are premature, and the dual-use tradeoff is the same one security researchers have debated for decades.

Will the findings be published? Unknown. The investigation just started. We will update this post if police or the FSC release technical details, a confirmed tool attribution or revised victim counts.

Honest limitations of this write-up

We are relying on press reports from Korea Herald, Korea Times and JoongAng Daily, plus coverage of the ARTEX repository, rather than a government technical advisory, because none had been published when we wrote this. Victim counts differ slightly between outlets (for example 25,727 versus 25,729 at Shinhan), which usually reflects timing of disclosures. We could not independently verify the server artifact. Where reporting is thin we have said so rather than filling gaps.

Bottom line

The story to watch is not whether a chatbot "hacked a bank." It is that automated reconnaissance and attack tooling is cheap enough that the neglected edges of an organization, the broker portals and contractor accounts, are now worth attacking at scale. Whether or not ARTEX specifically turns out to be the culprit, the defensive response is the same: know your perimeter, harden authentication on the unglamorous systems, shorten detection time, and use the same automation on your own side.

Related reading

• CyberCartel used Claude, Grok and Kimi agents against 400+ Latin American financial targets

• One hacker, AI agents and about $5,000: Deere, SharkNinja and Cummins breached (Oct 19, 2026)

• ARTEX Global Edition: the English fork of the pentest agent, with defender rules

• Japan cyberattacks, September 2026: Times Car, Gyazo, Keio and Monogatari

• Chinese hackers scale attacks with DeepSeek and low guardrails

• AI cyber guardrails block US defenders

• Tailscale on the Hugging Face intrusion

• South Korea AI ecosystem 2026

• OpenAI Daybreak and Codex Security

• Claude Mythos Preview and Project Glasswing

• MCP security guide

• Felony Bench: AI agent legal liability and the CFAA

Details reflect press reporting as of October 6, 2026, updated October 8, 2026 with CrowdStrike's report; the investigation is ongoing and figures may change.

Related — October 22, 2026: Microsoft ties the same ARTEX tool to the ConnectWise Cloud Backup attack: what is confirmed and what to check.