Seoul's 4.7 Trillion Won AI Bet Collides With a Bank Breach and a Chip Export Boom

On 6 October, The Decoder reported that South Korea plans to fund a homegrown frontier model through government-backed equity investments worth 4.7 trillion won, about $3.49 billion. The money sits in the proposed 2027 budget, so parliament still has to approve it. A second funding track would push Korean-built models into the wider economy.

The same week, the country's Financial Services Commission convened an emergency meeting over intrusions at Shinhan Bank and KB Kookmin Bank, according to BleepingComputer. Both lenders hold more than $400 billion in assets.

The contrast is the story. Seoul is trying to buy its way into the top tier of AI, while attackers are already using AI-shaped tooling against the banks that sit at the centre of its economy.

What the money buys

The proposed figure is roughly nine times the 530 billion won, about $390 million, that the government pledged to five companies when the current competition kicked off, The Decoder reported. The two finalists in that contest, LG AI Research, SK Telecom and Upstage, will not automatically receive extra funding. Instead the government is opening a fresh competition that startups can enter. Officials have said Korea cannot match the largest US companies but can compete with leading Chinese open models.

For scale, The Decoder puts combined 2026 investment plans by Google, Amazon, Microsoft and Meta at around $725 billion, mostly for AI data centres. Seoul's 4.7 trillion won is a rounding error next to that.

The chip side of the ledger looks stronger. Rest of World reported on 28 September that Samsung and SK Hynix together control 83% of the global memory chip market, and both are racing to deepen ties with Nvidia and OpenAI. SK Hynix broke ground in August on a $4 billion advanced packaging facility in Indiana. Samsung has run its own sequence: an AI-RAN collaboration with Nvidia in March 2025, Stargate in October 2025, ChatGPT Enterprise and Codex for all Samsung Electronics employees in Korea in June 2026, and a September 2026 announcement with OpenAI on next-generation chips.

Christopher Miller of the Fletcher School told Rest of World that the question of technology leadership still matters but is now assessed alongside capacity. Ben Reynolds of Rhodium Group said Nvidia's allocation decisions remain the main factor in high-bandwidth memory market share, and that Samsung's competitiveness depends above all on taking share from SK Hynix as a supplier for Nvidia's Vera Rubin.

The breach next door

On 5 October, BleepingComputer reported that the FSC held an emergency meeting and confirmed a data breach at Shinhan Bank, with other incidents at Kookmin Bank and Hana Bank. Local reports cited in that piece put the Shinhan leak at 25,000 customers and a Kookmin leak at credit card data belonging to 119,000 clients. Tom's Hardware, citing The New York Times, reported at least 25,000 Shinhan customers affected last week, 99 customers plus 20 current or former Kookmin employees, and 89 Hana Bank customers. The two accounts of the Kookmin figure diverge, and neither bank has published a customer count.

Yonhap reported that a server used in the attacks carried an HTML page title containing a Chinese-language string associated with ARTEX AI, an open-source penetration-testing system that automates information gathering, vulnerability discovery and attack-path planning. BleepingComputer notes that the banks and financial authorities have not confirmed its use, and that the string does not link the attacks to any particular actor. Moon Jong-hyun, head of the Genian Security Center, wrote on LinkedIn that several threat analysts believe AI-based automation was involved.

President Lee Jae-myung said there were signs the hackers used AI models, "causing considerable public concern and anxiety", and that he had instructed his cabinet to confirm the situation and minimise damage, according to Tom's Hardware. "It's now become possible to use AI to hack with ease even without specialized skills," Lee said at a livestreamed cabinet meeting.

Anthropic reported the first instance of an AI-orchestrated cyberattack in November 2025, Tom's Hardware noted, allegedly orchestrated by a Chinese state-linked actor.

Exports, budgets and the sovereignty argument

The financial logic behind the AI push comes from chips. South Korea's semiconductor exports have dominated recent trade data, with record monthly shipments through late 2025 and into 2026 driving equity gains, as reported across Yonhap and Bloomberg headlines in the dossier. That concentration carries its own risk, and the same export engine is now the target of a different kind of attack.

On 6 October, The Hacker News reported that Linux backdoors targeting telecom and network appliances in South Korea and Taiwan are disguising traffic as email security products. Rapid7 found a new BPFDoor variant and a BPF Rekoobe build aimed at South Korean systems, impersonating the PID file of SpamSniper, a Korean anti-spam product, and rotating through ten Linux daemon names. A separate implant, AVERAT, was deployed against Taiwanese appliances.

"Once security vendors wrote static network signatures (Suricata/Snort) to detect these Layer 4 anomalies, the operators began targeting the edge proxies," Rapid7 said, according to The Hacker News. The activity is linked to a group tracked as Red Menshen, which has hit telecom providers across the Middle East and Asia since 2021.

Espionage aimed at AI policy is running in parallel. On 4 October, The Hacker News reported that Proofpoint attributed a China-nexus group, TA419, to credential phishing against AI experts at US think tanks, universities and law firms. One February 2026 email to an AI policy expert carried the subject line "Request for Feedback on Military Integration of Claude" and impersonated a prominent Anthropic employee. Proofpoint said the activity "likely supports wider Chinese intelligence objectives to better understand ongoing developments within the U.S. AI policy and regulatory landscape".

The consulting view is that this mix of industrial policy and security exposure is now normal. Omdia's 30 September outlook named four forces for 2027: AI rebalancing from investment to monetisation, supply chain disruption as the "new normal", digital sovereignty, and physical AI. It said more than 100 countries are pursuing digital sovereignty initiatives, and that 59% of organisations expect AI budgets to rise by 10% or more in 2027. Omdia also flagged that hardware delays are already hitting 60% of PC channel partners.

For Seoul, sovereignty has a hardware dimension too. The Diplomat reported on 6 October that South Korea's AI chip boom is deepening economic concentration risk, and that the country's semiconductor exports account for a large share of total shipments. Samsung and SK Hynix remain deeply exposed to China through legacy plants, Rest of World noted, so courting Washington costs them business in Beijing.

None of this makes the 4.7 trillion won a bad bet. It makes it a bet placed while the ground under it is moving: a parliament that has not yet approved the money, a bank sector still counting the cost of the past fortnight, and two chipmakers whose American relationships are also their Chinese liability.