Cybersecurity and geopolitical risks in financial markets

3. Emerging geopolitical risks and cybersecurity in supply chains

3.1. Shifts in motivations and actors

The profile of cyber-attackers has also diversified. While profit-driven cybercrime syndicates remain prominent, the geopolitical dimension has intensified. State‑linked actors target financial infrastructures not just for monetary gain, but also for strategic, geopolitical, or ideological reasons. These state‑linked cyber operation attackers may aim to undermine trust in a rival’s financial system, disrupt cross-border payment networks, or influence political negotiations (IMF, 2024[11]). The emergence of “hacktivist” collectives and ideological groups that seek to highlight socio-political grievances has added another layer of complexity, with attacks often timed to coincide with diplomatic tensions, sanctions announcements or high-level summits (NATO, 2024[24]).

Attackers are deploying increasingly complex and innovative techniques to target trading venues, clearinghouses, custodian banks, insurance providers, and other market participants. Cloud-based infrastructures, while offering scalability and cost-effectiveness, can become single points of failure if not properly secured (OECD, 2019[25]). Ransomware operators increasingly offer customisable exploits, while “Ransomware-as-a-Service (RaaS)” business models provide streamlined access to hacking tools for lower-skilled criminals. DDoS attacks, once relying on brute‑force attempts to overwhelm servers, now frequently use compromised IoT devices and leverage AI to target system vulnerabilities more accurately. Steganography, which conceals malware within seemingly benign data streams or transaction records, further complicates detection by blending malicious code with legitimate operations.

Simultaneously, cryptojacking (unauthorised cryptocurrency mining) and data manipulation attacks are on the rise. These subtler interventions can skew market data, slow settlement times, or alter pricing feeds from social media, thereby distorting risk assessments and eroding market integrity (ECB, 2022[26]). Repeated cases of “crypto hijacking” in which attackers steal or take over actual cryptocurrency assets or wallets, also underline the central role of cyber intrusions in many large thefts from the crypto‑asset ecosystem. In such cases, stolen assets are typically moved through various obfuscation techniques and across jurisdictions before re‑entering the financial system.

Anti-money laundering and countering the financing of terrorism (AML/CFT) systems are essential, but they come into play only once stolen crypto assets start being laundered. To limit the scale of losses and reduce the broader impact on financial markets, institutions must also strengthen ex‑ante protections, including robust cyber‑risk management, access controls, monitoring, and governance, to reduce opportunities for criminals to steal assets in the first place. Therefore, co‑ordinating cybersecurity standards, regulatory responses, and incident reporting frameworks across jurisdictions is now viewed as a critical pillar of global financial stability, since local breaches can assume systemic proportions as digital finance infrastructures become more seamlessly integrated worldwide (OECD, 2022[1]; 2019[27]; 2022[28]). Finally, detailed case studies and emerging areas of can be found in Annex A.

Box 1. Crypto security in a fragmented world

Several notable cases illustrate the evolving threat landscape. The Bangladesh Bank / SWIFT attack in 2016 demonstrated how weaknesses in local network security and global messaging authentication could be exploited to divert central bank funds. Recently, a broad international consensus has emerged on the need for strengthened co‑operation to counter cryptocurrency thefts by malicious cyber actors, including state‑linked entities, which exploit stolen digital assets to finance criminal activities such as cybercrimes and proliferation (G7, 2025[29]).

In 2024, hackers stole an estimated USD 2.2 billion from crypto platforms worldwide, a 17% increase over the previous year, bringing the 2022-2024 total to over USD 7.7 billion (TRM Labs, 2025[30]). The number of attacks also reached a record high of 303 incidents, up from 282 in 2023 (Chainalysis, 2025[31]). These figures reflect the growing scale of risk as the digital asset economy expands in size and complexity.

As shown in Figure 3.1, crypto-related theft has become a recurring threat over the past decade., Since 2018, annual losses have exceeded USD 1 billion in four out of seven years, with a peaking at USD 3.7 billion in 2022. Despite large investments in cybersecurity, companies continue to struggle to prevent large‑scale breaches.

In 2024, the average hack size reached USD 14 million, reflecting the concentration of losses in fewer but larger incidents (TRM Labs, 2025[30]). Nearly 70% of stolen funds came from attacks that targeted key security credentials such as private keys and seed phrases.1

This trend continued into 2025, when a major platform suffered a theft of USD 1.5 billion, the largest on record. Hackers exploited a vulnerability in the company’s Ethereum wallet and transferred funds to unidentified accounts. The theft triggered a 4% drop in Ethereum’s market value, raising new concerns about operational security and crisis preparedness across the sector (Masud, 2025[32]).

Figure 4. Crypto hacking activity by year: Total value stolen and number of incidents (2015‑2024)

Source: Chainalysis (2025[31]), The Chainalysis 2025 Crypto Crime Report, https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2025/.

Governments and law enforcement agencies have made efforts to disrupt crypto-related crime, including shutting down major services used to obscure stolen funds. Yet these actions have had limited impact. In response, cybercriminals have shifted to more difficult-to-monitor alternatives. Transactions now often move across platforms and blockchains within hours, making it extremely difficult for authorities to trace or freeze assets in time.

In 2024, state‑linked actors were responsible for nearly USD 800 million in crypto theft, representing about 35% of total crypto theft losses that year (TRM Labs, 2025[30]). Other estimates place the figure at USD 1.34 billion, or about 61% of stolen digital assets in 2024. Chainalysis (2025[31]). The scale and speed of these activities, combined with the use of stolen crypto to fund weapons programmes, represent a serious threat to international financial and geopolitical stability.2

The events of 2024 and early 2025 show that crypto crime is no longer a fringe issue, and that it has become a growing vulnerability at the intersection of finance, technology, and national security. To better understand these risks, authorities increasingly rely on scenario analysis and cyber stress testing, underlining the value of investment in cyber resilience, particularly where incidents affecting SMEs and non-financial firms are under-reported.

1. In 2024, nearly 70% of total stolen crypto originated from compromises of infrastructure credentials. Specifically, private keys and seed phrases. These are essential to accessing and controlling digital wallets. Once compromised, assets can be moved instantly and irreversibly to attacker-controlled accounts, often without triggering alarms.

2. Organisation-driven hacking groups, such as Lazarus, have grown more sophisticated, frequently targeting crypto platforms and using hard-to-trace laundering methods. Following law enforcement actions against centralised mixers, these actors migrated to decentralised services. Their operations now rely on fast-moving, cross-platform transfers that outpace traditional monitoring and enforcement tools.

3.2. Geopolitical landscape and strategic targeting

The geopolitical landscape is increasingly intertwined with digital finance and cybersecurity. Organisation-driven intelligence actors and organised cybercriminal syndicates are regularly implicated in attacks that appear designed not merely to steal resources but to achieve broader strategic objectives (Crosignani, Macchiavelli and Silva, 2023[10]). Russia’s aggression against Ukraine in 2022 exemplifies how geopolitical tensions can catalyse a surge in region-specific financial cyber-attacks aimed at disrupting liquidity flows, undermining investor sentiment, and exerting indirect pressure on political adversaries (IMF, 2024[11]) Other geopolitical flashpoints, such as trade disputes, territorial disagreements, and regional tensions create conditions conducive to cyber aggression directed at financial intermediaries.

Notably, organised cybercriminal groups and, in some cases, state‑linked actors may align cyber incidents with geopolitical events (e.g. sanctions, critical negotiations or international summits) (CERT-EU, 2026[33]; OECD, 2022[1]). Attacks on cross-border payment networks, clearance systems, and trade finance platforms can hamper the free flow of capital and goods, thereby negatively impacting foreign policy goals. In this sense, financial cybersecurity is no longer merely a technical or compliance issue; it has become a domain of international security and diplomatic strategy (IMF, 2024[11]; BIS, 2023[34]).

Figure 3.2 indicates that the number of cyber incidents has increased in the regions exposed to these geopolitical risks. One prominent example is the ransomware NotPetya attacks1 against Ukrainian banks, firms, and the government in mid-2017. This attack resulted in large‑scale disruption of IT systems, including compromised access to information and disrupted supply chains. Notably, attackers did not keep track of the decryption codes, suggesting that financial gain was not a primary goal (Crosignani, Macchiavelli and Silva, 2023[10]).

Figure 5. Number of cyber incidents

Note: The Cyber Events Database collects publicly available information on cyber events from 2014 onwards. It was created to address the lack of consistent, well-structured data necessary for making strategic decisions about how to invest resources to prevent and respond to cyber events.

Source: Yahoo Finance (https://fr.finance.yahoo.com/) for BTC price, Center for International & Security Studies at Maryland, Cyber Events Database with the OECD staff compilation.

3.3. Geopolitical risks and cyber incidents

Geopolitical tensions increasingly shape both the motives and the capabilities for disruptive cyber operations. In periods of heightened geopolitical risk, financially motivated crime can overlap with strategically motivated campaigns that seek to disrupt payment flows, undermine confidence, or impose costs on rivals, making financial institutions and financial market infrastructures attractive targets. Importantly, the impact is rarely contained to a single victim: modern financial institutions and markets are closely interconnected through digital media, enabling cyber incidents to propagate through third‑party providers and supply chain relationships. These features can amplify operational disruptions into broader liquidity strains and potentially systemic impacts, including disruptions to critical financial functions, erosion of market confidence, and contagion across interconnected institutions and markets. Figure 3.3 therefore provides a descriptive illustration of whether cyber incident activity tends to co-move with geopolitical risk over time (Crosignani, Macchiavelli and Silva, 2023[10]).

Figure 3.3 presents how the relationship between geopolitical risk and cyber incident activity evolves over time. To capture this dynamic behaviour, the figure presents rolling correlations over moving windows (e.g. 8, 12, or 16 quarters). Each point on the chart reflects how the two variables have co-moved during the preceding window.

This approach makes it possible to observe whether the association between geopolitical tensions and cyber incidents strengthens or weakens as global conditions shift. Although correlation does not imply causality, the rolling estimates reveal that in several periods, especially during episodes of heightened geopolitical uncertainty, the two series tend to move together more closely. This persistent positive co-movement suggests that rising geopolitical risk is often accompanied by elevated cyber activity, including disruptions affecting supply chains and critical infrastructure.

Figure 6. Geopolitical risks and cyber incidents across OECD countries

Note: Geopolitical risk is measured using the “Recent GPR” index by Caldara and Iacoviello (2022), constructed from newspaper text counts (1985–present; 1985‑2019=100). Quarterly values are computed as quarterly averages of the monthly index. “Co-movement” is measured as a Pearson correlation computed over moving windows of 84/120 months (7/10 years). Series may be log-transformed to reduce scale effects (e.g. log(1+incidents), log(GPR)). Correlation is descriptive and does not imply causality. Data downloaded from https://www.matteoiacoviello.com/gpr.htm on 19, January 2026. Number of G7 cyber incidents data are from the Zywave/Advisen Standard Cyber Loss Insight Feed and OECD calculations, where it covers NAICS 21 (Mining), 22 (Utility), 31‑33 (Manufacturing), NAICS 522 (Credit Intermediation and Related Activities). Series are quarterly counts of recorded cyber incidents. The most recent quarters may be subject to reporting lags and should be interpreted with caution.

Source: Caldara, Dario and Matteo Iacoviello (2022[35]), “Measuring Geopolitical Risk,” American Economic Review, April, 112(4), pp.1 194‑1 225; Zywave/Advisen Standard Cyber Loss Insight Feed, and OECD calculations.

By allowing the correlation to vary through time rather than imposing a single average measure, the rolling-window method highlights that the link between geopolitics and cyber threats is not constant but becomes more pronounced during specific periods of inter-state tension.

Geopolitical tensions could amplify these risks. Targeted cyber operations can be used to circumvent sanctions, disrupt cross-border capital flows or send political signals. Financial institutions, particularly those involved in cross-border payment and settlement, become attractive targets in this context. Episodes around recent conflicts illustrate how cyber activity can increase in periods of heightened geopolitical stress, targeting not only financial institutions but also critical infrastructures that support trade and capital flows.

Recent work on state‑linked cyber activity targeting crypto‑asset markets further highlights the economic-security dimension of cyber risk (Chainalysis, 2026[36]). In this context, “economic security” refers to the risk that cyber incidents facilitate illicit cross-border flows, support sanctions evasion or proliferation finance, and undermine confidence in payment, settlement, and digital-asset market infrastructure. It demonstrates its increased scale and sophistication, and illustrates how cyber operations, financial crime and geopolitical considerations are becoming increasingly interlinked. These developments highlight the growing interlinkages between cyber risk, financial crime and geopolitical dynamics, and underscore the importance of understanding how such risks can propagate through interconnected financial systems, including by testing the resilience and adaptability of AML/CFT frameworks.

3.4. Global cybersecurity and supply chain

Building on the link between geopolitical tensions and increased cyber activity discussed above, the growing incidence of disruptions affecting critical ICT and service dependencies suggests that cyber risk is also taking a more networked form. For financial stability purposes, the relevant supply chain is not the broad logistics or manufacturing chain, but the set of critical third-party services on which financial firms and market infrastructures rely, such as cloud providers, managed service providers, software vendors, data centres, messaging services, and other outsourced technology functions. When many institutions depend on the same provider or service for critical operations, a disruption has the potential to create simultaneous operational stress, delay recovery, and amplify spillovers across markets. However, the potential for this type of cascading disruption depends on how the service provider designs and distributes these services, and how financial institutions use these services and develop their own operational resilience. Figure 3.4 shows that the level of exposure of financial institutions’ third-party service providers to cyber-threats has risen steadily over time, particularly in recent years, while episodes of high geopolitical risk appear intermittently. This suggests that the exposure level is driven by both increasing global interconnectedness and recurring geopolitical tensions.

Figure 7. Financial institutions: rising third‑party (vendor) exposure in cyber incidents

Note: In this chart, “supply chain-related” incidents refer to incidents affecting critical ICT and service dependencies relevant to financial institutions. Data are from the Zywave/Advisen Standard Cyber Loss Insight Feed and OECD calculations. The red line plots the share (%) of cyber incidents affecting financial institutions that are classified as third‑party/vendor‑related, computed as a 12‑quarter (3‑year) rolling share. Shaded areas indicate quarters of high geopolitical risk, defined as quarters in the top quartile of the quarterly average geopolitical risk (GPR) index from Caldara and Iacoviello (2022) (data downloaded on 9 April 2026).

Source: Caldara, Dario and Matteo Iacoviello (2022[35]), “Measuring Geopolitical Risk,” American Economic Review, April, 112(4), pp.1 194‑1 225.; Zywave/Advisen Standard Cyber Loss Insight Feed and OECD calculations.

3.5. Economic security considerations and broader market confidence

Cybersecurity safeguards are integral to broader economic security agendas, particularly as economies digitise and become increasingly reliant on interconnected systems (Barbara and Grewe, 2024[37]). In financial markets, this increasingly translates into heightened attention to cross-border dependencies and third-party concentration risks, where disruptions at a shared provider can spill over rapidly across markets and sectors (FSB, 2024[2]).

The connection between cybersecurity and economic security is illustrated by the fact that an attack can disrupt not only the operations of directly hit firms but also severely affect downstream customers through global supply chains (OECD, 2022[1]). Evidence from the 2017 NotPetya cyberattack shows that estimated losses of indirectly affected firms were several times larger than those borne by directly targeted firms, highlighting how vulnerabilities in digital infrastructure can propagate widely and jeopardise the broader economy (Crosignani, Macchiavelli and Silva, 2023[10]).The July 2024 global IT outage caused by a software update highlighted that even non-malicious disruptions at concentrated technology providers can generate widespread operational outages, testing operational resilience and affecting market confidence (FCA, 2024[15]).

Firms’ responses, such as shifting to suppliers and providers with stronger security postures, underscore that robust digital security is increasingly a competitive and strategic advantage, particularly under geopolitical uncertainty (Crosignani, Macchiavelli and Silva, 2023[10]). These findings suggest that cyber shocks can propagate through production and supply‑chain networks, generating indirect exposures that extend well beyond initially affected firms and may give rise to broader financial spillovers.

Effective digital security frameworks bolster investor confidence, supporting stable capital flows and resilient financial systems. In the context of heightened geopolitical uncertainty, countries with strong cyber safeguards are perceived as safer investment destinations, contributing to sustained FDI inflows, favourable credit ratings, and long-term economic stability. This link is especially salient for economies transitioning to advanced internet societies, where vulnerabilities in digital infrastructure can directly threaten national economic performance and strategic interests (Huang, Jiang and Zhang, 2021[38]).

Cyber resilience matters not only within the financial sector, but also in the non-financial corporate sector, where cyber incidents can weaken firm’s balance sheets and transmit risk to the financial system through credit channels (IMF, 2024[11]). Clear distinctions of the transmission mechanism are essential for effective policy design. The relationship is also increasingly shaped by policy and regulatory expectations that seek to strengthen cyber resilience, helping market participants price risk and respond to disruptions in a more orderly way.

Box 2. Geopolitical and systemic risks in ASEAN

Geopolitical and supply chain dynamics are particularly salient for ASEAN. The region’s position as a rapidly growing digital economy makes it both a beneficiary of globalisation and a potential casualty of geopolitical cyber risks. In addition, Asian SMEs play a crucial role as suppliers, subcontractors, and distributors in an intricate regional value chain (Section 2.2) (OECD, 2020[39]). Multiple SME‑targeted attacks, especially if timed strategically, could degrade trust in ASEAN’s financial and logistical reliability, prompting investors and multinational corporations to reconsider their regional footprints (ASEAN, 2021[40]). These dynamics illustrate how structural constraints common in emerging and developing economies can act as “security‑hole” amplifiers, where resource limitations, uneven governance, and rapid digitalisation magnify the systemic consequences of cyber incidents.

ASEAN provides a particularly clear illustration of how these structural vulnerabilities manifest, given its SME‑dependent production networks, rapid expansion of digital‑finance ecosystems, and deep integration into global trade and logistics chains. Since the region is deeply embedded in global and regional value chains and depends heavily on cross‑border logistics, trade finance, and increasingly digitalised financial services, the operational shocks linked with cyber risks can spill over rapidly across firms and borders. This underscores why emerging and developing economies must be treated as critical nodes in global cyber‑risk assessments, as weaknesses in these jurisdictions can transmit shocks quickly across interconnected financial and logistical networks. Given that cyber shocks can propagate through supply chains, baseline cyber hygiene requirements for SMEs and vendors can be justified on systemic‑risk grounds, not only firm‑level protection (Crosignani, Macchiavelli and Silva, 2023[10]; Acemoglu et al., 2012[3]). In ASEAN’s increasingly digitalised financial ecosystem, these vulnerabilities also intersect with AML/CFT risks, as compromised SMEs or third‑party platforms can become conduits for cyber‑enabled fraud and illicit financial flows.

Figure 3.5 demonstrates that the ASEAN and East Asia region accounts for 5% of cyber incidents since 2014, the third highest behind only North America and Europe. Specifically, the People’s Republic of China (hereafter ‘China’)(22%), Japan (21%), and Korea (10%), account for around half of cyber incidents in this region, and the other half is the ASEAN member states: Singapore (10%), Thailand (10%), the Philippines (10%), Malaysia (6%), Indonesia (4%), Cambodia (3%), Viet Nam (3%).

Figure 8. Share of cyber incidents by region

Note: The Cyber Events Database collects publicly available information on cyber events, beginning in 2014 to the present day. It was created to address a lack of consistent, well-structured data necessary for making strategic decisions about how to invest resources to prevent and respond to cyber events. Cyber events in Myanmar and Lao PDR constituted negligible percentages.

Source: Center for International & Security Studies at Maryland, Cyber Events Database.

The ASEAN experience also illustrates how the structural vulnerabilities of emerging and developing economies can function as systemic “security holes” that amplify cyber risk across borders. Rapid digitalisation, coupled with uneven security maturity and high SME dependence, creates conditions similar to those described in Section 2Limited resources, weak governance baselines, and expanding attack surfaces increase the likelihood that latent vulnerabilities become entry points for large‑scale disruptions. In ASEAN, these dynamics are magnified by the region’s dense supply-chain interdependence and the rapid growth of digital finance, where SMEs routinely interface with payment platforms, logistics networks, and trade‑finance systems. As shown in Figure 3.5 and Annex A, the structural rise in incidents since 2019 aligns with this deepening interconnection and the persistence of basic hygiene gaps. This reinforces why emerging and developing economies – especially those serving as global production and financial gateways – must be treated as critical nodes in global cyber‑resilience planning: weaknesses at these junctions can propagate rapidly through supply chains, financial channels, and even AML/CFT systems, potentially elevating local lapses into internationally consequential shocks.

Further details are provided in Annexes: Annex A offers an extended examination of supply chain vulnerabilities and systemic risks in ASEAN, and Annex C presents the accompanying cyber-regulatory landscape.

Note

← 1.  Petya is the name of a ransomware that circulated in 2016. The victim was infected after opening a PDF file purporting to be the resume of a job applicant and, from there, the ransomware encrypted the master file table that serves as a roadmap for the hard drive, making the data on the computer unreachable. The victim was then asked to make a Bitcoin payment to get the hard drive decrypted. What seemed to be a new version of Petya spread quickly in June 2017.