Global equity flows weather the AI ​​storm

Cyberattacks targeting the financial sector are no longer limited to cryptocurrency trading platforms or customer accounts; Rather, it is now reaching the operational systems of financial institutions themselves, targeting the funds of banks, finance and insurance companies, in a development that highlights the breadth of risks facing the financial industry with the acceleration of digital transformation and the development of hacking tools.

For years, the most notable major cyberattacks have been linked to cryptocurrency trading platforms, some of which have been subject to billion-dollar thefts. The attack that targeted the Binance platform on October 29 brought this danger back to the forefront, after the US Federal Bureau of Investigation confirmed that a North Korean group was responsible for stealing digital assets worth more than $6 billion, according to the bureau’s estimates. In September, the Bitgate platform was subjected to an attack that resulted in the transfer of digital assets worth approximately $387 million.

But recent developments indicate that the scope of targeting is no longer limited to digital asset platforms, with attacks moving to banks, insurance and finance companies, and in some cases reaching funds belonging to the institutions themselves, instead of being limited to stealing customer assets or data.

In this context, the incident of the French bank Credit Mutuel Arkia being subjected to a cyber attack this week, during which the attackers were able to transfer about 100 million euros ($112.6 million) from an account affiliated with the bank to other financial institutions, once again highlighted the fragility of some digital security links, even in banking institutions subject to strict supervision.

The bank said that the attackers exploited a platform belonging to an external service provider to carry out fraudulent transfers, while customer accounts or assets were not affected. The bank informed the European regulatory authorities and judicial authorities about the incident, while the Public Prosecution Office in Paris opened an investigation into the incident.

The incident indicates that risks do not necessarily arise from a direct hack into the bank's systems; Rather, it may enter through external parties with whom sensitive financial operations are linked.

37 financial institutions were hacked in Korea

The incident coincided with the announcement by the South Korean Financial Services Authority, on Thursday, that 37 financial institutions were exposed to data breaches and leaks during the period from September 30 to November 3. The incidents included 4 commercial banks, 5 investment companies, 3 insurance companies, and 5 savings banks, in addition to electronic financing institutions, lending platforms, and companies providing virtual asset services.

The number of recorded hacking incidents reached 40, while the number of records whose data was leaked reached about 473,000. The authority explained that the leaked information included employee data, customers’ names, their national ID numbers, and their bank account numbers, but it has not yet recorded incidents of theft of customer account passwords, which is data that may allow direct illicit financial transactions to be carried out.

As for the money that was stolen, estimated at about one billion won ($745,000), most of it was money managed by small companies working in virtual asset trading, electronic financial services, and online lending, including money stored in hot digital wallets or balances, payment points, and deposits managed by these companies.

In response to these incidents, the Authority announced its intention to conduct security checks on 580 financial institutions and review their internal control systems before the end of November, with an emphasis on holding executive leadership accountable, including CEOs, in the event that negligence or negligence in managing security risks is proven.

These developments reveal the expansion of the scope of targeting to include multiple episodes of the financial industry, from traditional banks to investment and insurance companies and digital financial institutions, at a time when fears are increasing about employing artificial intelligence techniques to accelerate and expand hacking operations.

Artificial intelligence accelerates attacks

In India, the Computer Emergency Response Agency warned of an escalating hacking campaign targeting non-banking finance companies, digital lending platforms, fintech companies, payments aggregators, payment service providers and cryptocurrency platforms. The agency named the entity responsible for the campaign “Crafty Falcon,” noting that it uses artificial intelligence tools available to the public to automate reconnaissance and infiltration operations and target payment and disbursement systems.

The agency identified a set of tools used in the attacks; Among them is Artex, a toolkit based on large language models. Bentagy, a multi-agent autonomous penetration testing system; Cairn, an attack path search engine, along with the Cyber ​​Strike AI framework.

These tools allow the implementation of integrated chains of attacks automatically and at high speed, while creating and refining large numbers of attack codes and scripts, and then modifying the hacking methods according to the responses of the targeted systems. Thus, the role of artificial intelligence is not limited to helping the attacker search for vulnerabilities; Rather, it extends to implementing successive stages of the attack and adapting them automatically, making it more difficult to detect and contain it in a timely manner.

The agency pointed out that attackers take advantage of holidays, weekends, and periods when levels of security monitoring are low, and they also re-target institutions that have previously been hacked, especially if the vulnerabilities that allowed the first attacks have not been addressed. Press reports indicated that researchers linked at least two of the tools used to Chinese parties, but the Indian agency did not attribute the campaign to a specific country.

The risks are not limited to the use of artificial intelligence or direct penetration of enterprise systems; Foreign service companies have become one of the main weaknesses in the financial sector. Banking institutions and insurance companies rely on external providers to operate technical platforms, process payments, manage data, and provide other services, which makes hacking one of these providers a potential gateway to accessing the operations of multiple financial institutions.

The seriousness of this type of attack is that the organization may not be a direct target for attackers, yet its operations or data are exposed to risk as a result of the hacking of a company that provides a service to it. Also, joint reliance on limited service providers may expand the scope of damages, so that the impact of the breach does not stop at the targeted company first; Rather, it extends to a number of associated institutions.

...and in Japan as well

The Japanese figures, in turn, reflect the expanding threat associated with financial fraud; Losses from private fraud in the country reached 261 billion yen during the first nine months of the year, an increase of 48.3 billion yen year-on-year.

The Japanese National Police Agency announced the launch of a mechanism to exchange account data used in fraud with 807 financial institutions, with the aim of early identification of accounts receiving money from fraud victims, and enabling police and financial institutions to intervene before additional losses occur. These numbers are not limited to electronic breaches; Rather, it includes a broader spectrum of financial fraud, including those that use digital channels and bank accounts to transfer money.

These incidents do not necessarily mean the existence of a single coordinated global campaign, but they reveal the diversity of methods for targeting financial institutions. From impersonating bank employees and manipulating transfers to hacking suppliers and service providers and exploiting artificial intelligence tools, as well as using bank accounts and digital channels to transfer stolen funds and hide their tracks.

The repercussions of these attacks are not limited to lost funds and leaked data; Rather, it extends to increasing the financial burdens borne by institutions to protect their systems and restore their operations after breaches, at a time when the cost of protection and recovery has become an increasingly important part of risk management in the financial sector.

A mounting bill for protection and recovery

The increased risks are reflected in the amount of spending that financial institutions allocate to strengthen their digital defenses.

A survey conducted by PricewaterhouseCoopers and published in February 2026 showed that about 74 percent of banks around the world plan to increase their budgets allocated to cybersecurity during the year, an indication that digital protection has become a high priority in spending and risk management plans.

At the level of the global economy, Gartner expects spending on information security to rise to $244 billion in 2026, compared to about $213 billion in 2025, noting that these numbers include various economic sectors and are not limited to financial institutions.

On the other hand, International Monetary Fund estimates reveal the extent of the losses to which the sector is exposed. Direct losses resulting from reported cyber incidents in financial institutions amounted to about $2.5 billion between 2020 and 2023. The Fund warned that indirect losses exceed direct losses many times over, which means that the actual cost may be much higher than the recorded numbers, especially in light of not all incidents being reported.

These indirect losses include the costs of service interruptions and operational disruptions, technical investigations and recovery of systems and data, as well as legal and regulatory burdens and decreased customer confidence. Thus, the value of the stolen funds alone does not reflect the extent of the damage that may befall the institution; The repercussions of the hack can continue even after systems are restored and services are running again.

According to a report by the British Treasury published in July 2026, the average cost of recovering from ransomware attacks at financial institutions globally rose to 2.04 million pounds sterling in 2024, excluding ransom payments, compared to 1.76 million pounds the previous year. This reflects the high burdens associated with restoring systems and processes, even without taking into account the amounts that organizations may pay to attackers in exchange for decryption or data recovery.

A threat to financial stability

The repercussions of the attacks do not stop at direct financial losses; It may extend to disrupting services and payments and harming customer confidence, threatening financial stability, especially with the increasing interconnectedness between banks and financial services companies and their reliance on a common technological structure.

In a research study published by the International Monetary Fund in March 2026, which examined the development of cyber incidents and digital fraud in the financial sector across 162 countries and 20 economic sectors, incidents related to the financial sector constituted about 10 percent of the total cyber incidents observed during the past decade. These incidents were mainly concentrated in the banking and securities sectors, while electronic fraud cases approached three times their previous levels.

The Fund warned that available data may underestimate the actual extent of risks, due to underreporting of some incidents and data gaps between countries. He pointed out that the interconnection between financial institutions and their dependence on common systems and service providers may expand the impact of attacks from one institution to another, threatening the continuity of services, payments, customer confidence, and financial stability.

Thus, protecting banking systems is no longer the responsibility of technology departments alone; Rather, it has become an essential part of risk management, governance and oversight of external parties. With the development of attack tools supported by artificial intelligence and the expansion of reliance on digital services, the ability of financial institutions to detect and contain intrusions and ensure the continuity of their services has become a factor influencing the safety of the financial sector as a whole.

The violent wave of decline that hit Wall Street was not just a passing reaction to the results of the US midterm elections. Rather, it revealed cracks in the biggest bet that drove the rise of stocks during the current year: the investment boom in artificial intelligence. After months of record highs, investors found themselves facing increasing questions about the ability of technology companies to achieve returns that justify their huge spending, at a time when financing costs and political pressures threaten to slow the expansion of this technology infrastructure.

According to an analysis published by the Financial Times, the decline erased about $3.2 trillion from the market value of US stocks in one session, after the Democrats’ victory in the midterm elections turned into a spark that ignited a widespread selling wave, in a market that was already suffering from the accumulation of huge investment centers and growing concerns about financing the artificial intelligence boom.

The Nasdaq 100 index, which is heavy on technology stocks, fell by more than 6 percent on Thursday, before recovering part of its losses in Friday’s session, but it ended the week down 4.9 percent.

The political factor was not alone behind this transformation; Investors' fears have increased that the rise of Democrats will lead to tightening restrictions on the establishment of data centers, both at the federal level and in the states, threatening the expansion plans on which technology companies' growth expectations are based. These concerns gain particular importance with estimates that investments related to artificial intelligence will reach one trillion dollars over the next year.

The newspaper quoted Ludovic Subra, chief investment officer at the German company Allianz, as saying that the election results ended the assumption that the artificial intelligence sector would receive open financing without restrictions, indicating that the markets had begun to realize that expectations of unlimited growth alone were not a basis for evaluating companies.

This coincided with financial pressures that were accumulating before the elections. The third-quarter results raised questions about the balance between the massive capital spending of major technology companies and the growth in revenues from their core activities, while losses on debt instruments associated with companies specialized in providing cloud infrastructure fueled fears of expanding financing problems in the sector.

The danger of this transformation lies in the fact that the artificial intelligence boom was not only raising stock prices through the profits of chip and equipment manufacturers and data centers; It was also enhancing US economic growth expectations. Therefore, any slowdown in spending may simultaneously put pressure on corporate profits and economic expectations, weakening one of the most prominent drivers of the markets’ rise.

Investor withdrawal magnifies losses

But what turned the fears into a widespread selling wave was the simultaneous withdrawal of individual investors and hedge funds from their positions in stocks. After individual investors were accustomed to buying stocks at every price decline, this time they recorded net sales in individual stocks amounting to $388 million during the first two hours of trading on Thursday, according to Vanda Research data.

As the decline accelerated, hedge funds were forced to reduce their investment positions financed by borrowing, in a process known in the markets as reducing leverage, with the aim of reducing risks and providing liquidity. This simultaneous withdrawal led to increased selling pressure, after the investment positions that consolidated gains during the rise period turned into an additional source of losses.

JP Morgan informed its clients that Thursday was the worst day for hedge funds in terms of daily losses since the repercussions of the tariffs announced by US President Donald Trump in April of last year, indicating that the funds’ reduction in borrowing and exit from investment positions reached their strongest levels during a period of 20 days since the wave of selling that accompanied the “Covid-19” pandemic.

In an additional indication of the depth of the turmoil, the Wally Group of hedge funds announced the closure of part of its stock investment activities and the return of some funds to investors.

Is the artificial intelligence boom over?

Despite the partial rebound in technology stocks on Friday, investors remain divided over whether the selling wave represents a temporary correction of crowded investment positions, or the beginning of a deeper shift in evaluating the prospects for artificial intelligence. Some of them believe that political concerns are exaggerated, especially since many data center projects have already entered the construction stage, which makes stopping them completely unlikely. US jobs data also reinforced this view, after it showed the addition of 165,000 jobs in October, exceeding market expectations.

But on the other hand, investors believe that the recent turmoil may be an indication that the artificial intelligence boom has reached its peak, and that markets have begun to reconsider their assumptions about the volume of spending and future returns.

The Financial Times quotes Nikhil Srinivasan, chief investment officer at the Benzaiten Macro Fund, as believing that the markets may continue to decline, even if they witness temporary rebounds during the coming period, indicating that the re-evaluation of investments related to artificial intelligence may not be over yet.

What are the expectations?

In terms of trading expectations, the markets do not appear to be on the verge of quickly regaining stability at the beginning of the new week, despite the partial rebound recorded by technology stocks in Friday’s session. Reuters quoted analysts as saying that the process of eliminating investment positions financed by borrowing may continue, keeping volatility high, while questions related to financing artificial intelligence projects and the returns expected from them remain without clear answers.

While some investors believe that the selling wave may have exceeded its limits, others warn against considering the decline to have reached its end, noting that the markets have not yet absorbed the potential repercussions of political and regulatory shifts in the United States.

The most prominent test for the markets will be Tuesday, with the release of US inflation data, which may affect interest rate expectations, especially since futures contracts were pricing in a probability of about 80 percent for an interest rate hike.