- Post History
- Subscribe to RSS Feed
- Mark as New
- Mark as Read
- Bookmark
- Subscribe
- Printer Friendly Page
- Report Inappropriate Content
44m ago
North Korean hackers have stolen about 6.75 billion dollars in crypto, according to Chainalysis, and they started with banks. As a ServiceNow architect working with banks on AI governance, I keep coming back to one pattern in every bank heist they have pulled off. None of them broke a system. Every one of them borrowed trust.
In this article I walk through three heists, the one lesson each teaches, and how I would answer it on the platform with ServiceNow AI Control Tower, Integrated Risk Management (IRM), Third-party Risk Management and Business Continuity Management. Everything shown uses a fictional bank and sample data.
Lesson 1: Trusted access (Bangladesh Bank, 2016)
Attackers used Bangladesh Bank's own access to the SWIFT payment network to order close to one billion dollars out of its account at the Federal Reserve Bank of New York. Most orders were stopped, but 81 million dollars got through, as NPR Planet Money reported. The FBI later traced the heist to the Lazarus Group, according to The Daily Star.
This was not a broken network. It was wire fraud sent through the bank's own trusted channel.
What I build in ServiceNow GRC: a payment risk in IRM with its loss expressed in dollars, linked to controls such as tightly held payment access, out of band verification of high value payments, and daily reconciliation. The board sees the risk in money, not in vulnerabilities.
Lesson 2: A trusted screen from a trusted vendor (Bybit, 2025)
In February 2025, the FBI attributed the 1.5 billion dollar Bybit hack to North Korea. According to NCC Group's technical analysis, attackers compromised a developer machine at Bybit's wallet software vendor and altered what the approval screen showed. The signers approved what looked like a routine transfer.
The process worked. The trust behind it failed.
What I build: Third-party risk management for every vendor in the payment approval path, with a profile, a risk tier, an owner and continuous outside cyber ratings, so a vendor whose risk is rising is flagged before it becomes the next Bybit.
Lesson 3: Trusted people (the Texas laptop farms, 2026)
The U.S. State Department has warned that North Korean IT workers use AI to hide their identities. In September 2026, the FBI searched more than 40 homes in Texas used as laptop farms, in schemes affecting more than 70 U.S. companies, as the U.S. Department of Justice announced. Companies shipped laptops to new remote hires, and operatives worked inside their networks from overseas.
This is the insider threat in the age of AI. Nobody broke in. They were hired.
What I build: hiring and remote access risks owned in IRM, with controls for live identity verification and for warning signs in remote access, plus a channel for employees to report concerns.
The new signer: AI agents that move money
Here is why this matters for AI governance right now. Banks are deploying AI agents that review payments and recommend approvals. That agent is the new signer. If someone feeds it manipulated data, it becomes the next screen that tells a lie.
This is where ServiceNow AI Control Tower earns its place. In my demo bank, I use it to answer four board questions for every AI system that can move money:
-
What can we lose? The risk in dollars, from IRM.
-
Who owns it? The AI inventory shows eight AI systems, four rated high risk. The wire transfer review agent has a named owner, a stated purpose and a high risk rating.
-
Can we prove the control works? The agent is assessed against the NIST AI Risk Management Framework and the Colorado AI Act. Sixteen controls, six not yet met.
-
Where is the gap? The most critical open issue: independent verification of the transaction details shown to the agent has not been tested. That is the exact Bybit gap, now written down, owned and prioritized.
The number I want every board to see: the bank scores 87 percent overall, while the wire agent scores 63 percent on its own. A healthy average can hide the weakest link, and attackers go straight for the weakest link. That is the case for AI agent governance, and for agentic AI governance more broadly: you govern the agent like anyone else who can move money.
When the heist gets through anyway
Prevention sometimes fails. At Bangladesh Bank, how fast the response moved decided how much was lost. So I close the loop with operational resilience: a business impact analysis for the payment service, a tabletop exercise of the heist scenario, and a crisis workspace where every response task has an owner.
Free checklist
I have turned the four board questions and ten controls from these heists into a free Bank Heist Readiness Checklist. You can download it here: Bank Heist Readiness Checklist. The full walkthrough is in my video on TechTalk with Bill:
Over to you
Cyber crime is business risk, and AI risk management is now part of it. How is your organization governing the AI agents that touch payments? Please share what is working for you in the comments.
Bill Martin
ServiceNow Certified Technical Architect and MVP
