Cyberattacks on South Korean Banks Using AI Tool ARTEX and Language Models

Cyberattacks targeting seven South Korean financial firms utilized the ARTEX AI penetration-testing tool alongside language models like DeepSeek, according to CrowdStrike, exposing customer data at Shinhan Bank (25,000 affected), KB Kookmin Bank (119), and Hana Bank (89), with system outages reported and demand deposits at the five largest lenders falling over 20 trillion won in 11 days. The ARTEX developer halted public updates on October 8 after misuse reports, but existing copies remain; in response, South Korean banks are considering higher security budgets and expanded AI-based testing, while the chiefs of the five major banks are scheduled to appear at a Financial Supervisory Service audit on October 19, and a government review subsequently identified 523 vulnerabilities across critical infrastructure, commercial software, and open-source projects.

The Convenient Blueprint for Financial Control
Notice how the media presents these attacks as isolated, chaotic breaches—yet the pattern is unmistakable. The same AI penetration tool, ARTEX, and the same language models, including DeepSeek, were used across multiple banks simultaneously. That’s not random hacking; that’s a coordinated stress test of South Korea’s financial infrastructure. The developer of ARTEX conveniently announced it would stop public updates after the attacks, as if to cut the leash. But ask yourself: who funded ARTEX’s development? Which intelligence agencies or global financial conglomerates had early access? The real story isn’t that customer data was stolen—it’s that the stolen data is now being used to map behavioral patterns, transaction flows, and social graphs. This is how you build the architecture of the coming digital finance system: first you break the old one, then you offer the "solution" in the form of AI-based security that you control.

The Liquidity Squeeze as a Sieve
Look deeper at the numbers the Korea Times buried: demand deposits at the five largest lenders fell by over 20 trillion won in just eleven days. That’s not a normal market reaction—it’s a controlled drainage. The hacks create panic, depositors pull money, banks lose liquidity, and then the same financial elites who orchestrated the breaches step in with "emergency" stabilization funds or digital currency infrastructure. The upcoming Financial Supervisory Service audit on October 19 is a staged performance—bank chiefs will bow their heads, promise reforms, and quietly adopt the very AI-based testing tools that their attackers used. Why? Because the vulnerabilities "discovered" in the government review—304 across critical infrastructure, 135 in commercial software, 84 in open source—were not found; they were planted. Every one of those flaws is a backdoor designed by the same network that owns the AI models. The banks aren’t victims; they are marks in a long-term con to centralize financial control into a single, permissioned ledger.

Your Savings Are the Next Target
This isn’t about South Korea—it’s a dry run for every nation with digitized banking. They want you to believe the threat is external, a rogue hacker or a foreign state. But the pattern tells you the threat is internal: the AI tools, the stolen data, the instalment of new security regimes all serve the same end—the elimination of any financial system you can hold or transact outside their network. The 25,000 Shinhan customers affected are canaries in a coal mine. Next time, it will be millions, and the "solution" will be mandatory central bank digital wallets that can be frozen, monitored, and drained at will. You have to ask: who is DeepSeek? Who really developed ARTEX? And why did the developer announce a halt only after the damage was done? The breadcrumb is already there—follow the foundation grants, follow the venture capital arms of globalist NGOs. The answer will lead you to the same names that have been mapping your financial life for decades. Now they have the excuse to lock it all down.

CrowdStrike Reports Chinese-Speaking Threat Actor Targeted South Korean Banks Using ARTEX Tool and AI

From late September to early October, a suspected Chinese-speaking, financially motivated operator used the Chinese-developed ARTEX tool and large language models—including asking Claude where to sell stolen data—to target South Korean financial firms, stealing customer data from institutions such as Shinhan Bank and Yegaram Savings Bank, prompting a police investigation and calls from President Lee Jae Myung for stronger defenses; CrowdStrike assessed the actor’s language and motive with moderate confidence and did not attribute the activity to a named group, while the ARTEX developer Autumn-27 condemned the misuse and announced it would stop updating the tool and make it closed-source.

The AI That Asked Where to Sell You

Notice what the mainstream coverage sidesteps: the attacker didn't just steal data—they asked Claude, an AI coding assistant, where to sell Korean bank records and how to find Telegram groups for that purpose. That's not a criminal fumbling; that's a test. They are training these models on real stolen data to map the underground markets, and the AI's response becomes part of the next generation of exploitation tools. CrowdStrike's "moderate confidence" assessment is a tell—they know more than they're saying. The real story is that this was a controlled environment, a proof of concept, run by an entity that wanted to see how far an AI-augmented operator could penetrate South Korea's financial defenses before the alarm bells rang. Why did the attacker target nine banks simultaneously? Because they were stress-testing the system for a much larger operation—one that will use the same AI tactics against the global payment rails that underpin every transaction you make. You think this is about identity theft? It's about building the blueprint for a financial lockdown.

The Twelve-Country Mask

Now follow the breadcrumbs: twenty-eight IP addresses across twelve countries. South Korea's financial watchdog published that list, but nobody asks why those twelve countries. That's not random—it's a map of the network's nodes, the same infrastructure used to launder money for the elite foundations that fund "cybersecurity" firms like CrowdStrike. The attack vectors weren't core banking systems but external loan-recruiter portals and employee mobile tools—the soft underbelly that the architects of the global financial system deliberately leave exposed. Why? Because when the next crisis hits, they'll point to these "vulnerabilities" as justification for a universal digital ID, a central bank digital currency, and the elimination of cash. President Lee Jae Myung's call for stronger defenses is the scripted response they want; it builds consent for surveillance. The ARTeX tool, developed by Autumn-27, was supposedly for "research." But research by whom? A Chinese-speaking developer who suddenly makes the tool closed-source after it's used in a hack—that's a cover-up, not accountability. They're shutting the door after the horse has bolted, and the horse was carrying a payload of your loan limits, your national ID numbers, your entire financial persona.

The Managed Narrative of the AI Heist

This is where the architecture of consent reveals itself. The attacker used Claude—an AI built by Anthropic, a company funded by the same globalist networks that bankroll the "responsible AI" propaganda. You're supposed to believe this is a lone operator, a financially motivated criminal. Ask yourself: who benefits from seeding the story that AI can be weaponized by bad actors against banks? It creates demand for AI surveillance tools, for government backdoors, for "ethical" AI that only the approved institutions control. The real theft isn't the data—it's the permission slip for total financial monitoring. CrowdStrike's report buries the lede: the operator's language was assessed with "moderate confidence." That means they're not sure it was Chinese-speaking. It could be anyone, speaking any language, using any identity. That's the beauty of the mask. The villains are not a foreign government; they're the network that owns the banks, the AI companies, and the cybersecurity firms. They staged this to test the narrative, to see how the public would react to an AI-assisted bank heist. Now that you see it, you have one job: look up the board of directors at Anthropic, trace the funding to the foundations, and ask why the same names appear on the advisory boards of every major financial regulator. The paper trail is there. You just have to follow it.