No Banking Lockdown: What Is Really Behind the Recent Bank Failures and Cyberattacks
Paraguay's central bank began a resolution of Ueno Bank after its solvency ratio fell below half the required minimum. The decision was announced on 3 November. Accounts and cards stopped working as a result of the intervention, not because of a hack. Reuters reports about 3 million customers lost access, although some local counts are lower.
Deposits are guaranteed up to about 228.3 million guaranies per person. AP reports that riot police used pepper spray and rubber pellets against protesters, that eight executives were detained and that 27 people were charged. President Santiago Peña announced his resignation on 5 November, which the Senate must ratify.
In Serbia, the central bank revoked Alta Banka's licence on 31 October, citing its finances and liquidity. Prosecutors allege that owner Davor Macura and two employees removed about 45 billion dinars (€383 million) from the bank's own vault. These allegations have not been tested in court. Insured deposits are covered up to €50,000.
Two cyber incidents, both different from the claims
Crédit Mutuel Arkéa confirmed on 4 November that a cyberattack had enabled fraudulent transactions. It has not confirmed the €118 million figure reported by Le Télégramme. The bank says some funds are frozen and customers will suffer no financial loss.
In Japan, attackers breached a GMO Internet remote-desktop service used by retail currency traders and placed unauthorised trades. According to GMO, they threatened to keep manipulating accounts at more than 70 securities and FX firms. That threat is not the same as confirmed fraud at all 70.
What regulators are actually doing
The IMF warned in October that AI is worsening the risk of cyberattacks on critical financial institutions. G7 finance leaders then agreed to hold tabletop exercises, which are simulations used to test response plans and update manuals. They do not rehearse a shutdown.
Axios reported that major US banks had found unauthorised third-party AI agents in customer accounts. These generally use the customer's own login details with the customer's permission, though some have acted independently of user instructions. Morgan Stanley says it has not seen "rogue AI agents" on its platforms. No confirmed customer losses have been reported.
US Treasury Secretary Scott Bessent has argued that stablecoins could raise demand for dollars and Treasury bills. That is a policy position, not evidence of a plan to switch off banks.
What this means for Pakistan
The State Bank launched its Cyber Shield strategy in February, and Finance Minister Muhammad Aurangzeb pressed banks on cyber readiness in May. In April, the SBP also allowed banks to open accounts for PVARA-licensed virtual asset service providers, bringing the two sectors closer together.
In our analysis, three lessons stand out.
First, vendors are a weak point. The Japanese breach came through a hosting service, not a broker, so banks should test their outside providers as hard as their own systems.
Second, banks and VASPs need fast coordination. Arkéa's stolen funds were reportedly routed through crypto exchange accounts, so a freeze may depend on how quickly both sides can act.
Third, customers need clear guidance. People should not hand their banking passwords to AI tools, or to anyone else.
Banks do fail and hackers do succeed, but neither fact proves a coordinated plan. The useful response is stronger defences and clearer protection for depositors.
