Demand deposits at South Korea’s five major commercial banks fell by more than ₩20 trillion (approximately $14.9 billion) in just one week after the start of October. Analysts suggest that customer trust in the financial sector has been shaken by a coordinated hacking incident exploiting artificial intelligence (AI), accelerating the flight of funds.
According to financial sector data compiled on October 11, demand deposits at the five major banks—KB Kookmin, Shinhan, Hana, Woori, and NH Nonghyup—stood at ₩655.3919 trillion (approximately $489.1 billion) as of October 7, down ₩20.133 trillion (approximately $15.0 billion) from ₩675.5249 trillion (approximately $504.1 billion) at the end of September. The amount that drained out in just four business days far exceeded the ₩10.7949 trillion (approximately $8.1 billion) gained during the entire month of September.
Demand deposits are funds that depositors can withdraw at any time without prior notice or special conditions. They hold corporate operating and settlement funds, personal living expenses, and investment standby capital, making balances highly sensitive to the timing of fund disbursements.
Time deposits also declined by ₩2.729 trillion (approximately $2.0 billion) over the same period, from ₩1,006.0871 trillion (approximately $750.8 billion) to ₩1,003.3581 trillion (approximately $748.8 billion). Time deposits had grown by ₩68.9037 trillion (approximately $51.4 billion) over five consecutive months from May through September, surpassing the ₩1,000 trillion (approximately $746.3 billion) mark for the first time ever in August, but the hacking incident has broken that growth momentum. The combined decline in demand and time deposits reached approximately ₩22.862 trillion (approximately $17.1 billion). In contrast, installment savings balances rose by ₩506.1 billion (approximately $377.7 million) to ₩46.781 trillion (approximately $34.9 billion) during the same period. The pattern suggests that lump-sum deposits saw outflows while small monthly installment savings were relatively less affected.
Some in the banking sector attribute the fund movements to seasonal factors, as corporate funds that flowed in at quarter-end are deployed at the start of the new quarter. Companies typically build up cash-like assets ahead of quarterly closings, inflating quarter-end balances, and then withdraw funds for payroll and transaction settlements once the new quarter begins.
However, the prevailing interpretation is that the hacking incident has compounded the effect. Seven financial institutions have confirmed customer data breaches from recent AI-driven hacking attacks: Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank, and Hyundai Capital. At Shinhan Bank alone, data on 25,729 individuals was leaked, along with 119 at KB Kookmin Bank, 89 at Hana Bank, approximately 40,000 at Yegaram Savings Bank, and up to 2,200 corporate customer records at Welcome Savings Bank. The five major banks stated that no secondary damage reports have been filed yet.
There are also criticisms that the financial sector recognized the AI hacking risk in advance but failed to prevent it. The Financial Security Institute reportedly shared security risks related to externally exposed assets with financial firms and urged them to respond just two weeks before the large-scale hacking incident occurred. At a seminar on responding to financial AI security threats held on September 17, actual AI agent infiltration cases and specific response directions were also presented.
Banks are belatedly expanding their information security budgets. KB Kookmin Bank plans to increase its information security budget to over ₩100 billion (approximately $74.6 million) next year. Shinhan Bank has set a policy to allocate the industry’s highest budget next year and is reportedly reviewing investment scale by analyzing other banks’ budget allocations and executions over the past three years. Hana Bank is pursuing the construction of a security system worth hundreds of billions of won, while Woori Bank is considering increasing its security system construction budget by more than 20% from this year. NH Nonghyup Bank also plans to expand information security investment next year, focusing on server security, AI safety verification, and vulnerability management.
Measures to prevent immediate additional damage are also continuing. KB Kookmin Bank has suspended the services and servers of its employee work support system directly related to the hacking incident, blocking access routes. Shinhan Bank has temporarily suspended six services—including loan agent application status inquiries, customer contact information lookups, and currency exchange application inquiries—and plans to resume them in phases after confirming their safety.
Banks are focusing on using AI to continuously monitor vulnerabilities and automate attack detection and blocking processes. A financial sector official said, “There have been no cases of direct damage yet,” but added, “We are strengthening security while seeking ways to restore customer trust.”
The key question is whether the decline in low-cost deposits such as demand deposits will persist. Demand deposits are a representative low-cost funding source for banks, and if the decline continues and is replaced by relatively higher-interest funds, funding costs could rise.
Banks’ average deposit rates have already been climbing. According to the Bank of Korea, the average interest rate on outstanding deposits at deposit banks stood at 2.20% per annum as of end-August, up 0.05 percentage points from the previous month-end. With average rates applied to existing deposit balances already rising, a further decline in low-cost deposits could limit banks’ ability to reduce funding costs.
A banking sector official said, “If low-cost deposits continue to decline during a period of rising rates, banks could face growing burdens,” adding, “If we have to secure the shortfall through time deposits or bank bonds at higher rates, managing funding costs becomes difficult.”
Click Here For The Original Source.
