Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed
Global Financial Service Disruptions
When banks, exchanges, brokers and payment providers unexpectedly stop customers moving money. A restriction is recorded as a fact; its cause is a separate, sourced judgement, and an unexplained restriction is never presented as an attack.
On a fixed panel of 54 provider status feeds, restrictions rose from 48 to 58 between the two most recent 14-day windows, within normal variation. What changed is the cause mix: nine restrictions with confirmed cyber causes began in the last 14 days against one in the 14 days before, led by the Binance withdrawal freeze, Credit Mutuel Arkea and a Japanese hosting breach that reached FX brokers. Historical coverage is too uneven to call a multi-year acceleration.
Where restrictions were recorded
Countries shaded by number of verified records; select one to filter. Red dot: confirmed cyber cause. Open amber ring: unexplained. Grey: other causes. Counts reflect where DFX searched as much as where events happened.
Live: provider-posted restrictions
Raised automatically when a financial provider's own status page says customers cannot withdraw, deposit, transfer, settle or trade. Unclassified until an analyst reviews them; hand-checked precision of the rule on 30 posts was 87%.
Coverage is reduced: DFX is not reading 105 of 124 status feeds, because their robots.txt does not allow it or could not be read, while we move to the incident feeds providers publish.
- FlutterwaveNov 6 06:56 UTC · payment processorCause not yet classifiedcard authresolved
[NGN] Service Alert: Intermittent Card Transaction Failures
- XenditNov 6 06:40 UTC · payment processorCause not yet classifiedpayoutsresolved
Payouts Disruption in Indonesia
- FlutterwaveNov 5 22:19 UTC · payment processorCause not yet classifiedpayoutsactive
[NGN] Service Alert: Pending Payouts on Flutterwave for Business (F4B)
- XenditNov 5 21:50 UTC · payment processorCause not yet classifieddeposits0 h
EWALLET TRUEMONEY Thailand Disruption
- XenditNov 5 21:30 UTC · payment processorCause not yet classifiedpayoutsresolved
Payouts Disruption in Indonesia
- FlutterwaveNov 5 18:15 UTC · payment processorCause not yet classifiedcard authresolved
Service Alert: BIN Service Disruption – Impact on Card Transactions
- XenditNov 5 17:10 UTC · payment processorCause not yet classifiedpayoutsresolved
Payouts Disruption in Philippines
- XenditNov 5 15:30 UTC · payment processorCause not yet classifiedtransferspayoutsresolved
Payouts Disruption in Indonesia
- CurrencycloudNov 5 14:39 UTC · payment processorCause not yet classifiedpayoutsresolved
Potential delays to funding
- FlutterwaveNov 5 14:09 UTC · payment processorCause not yet classifiedtransfersresolved
[NGN] Service Alert: Intermittent Name Enquiry Failures
- ToastNov 5 10:47 UTC · payment processorCause not yet classifieddepositsresolved
Deposit Delay
- KrakenNov 5 10:19 UTC · crypto exchangeCause not yet classifiedwithdrawalsdepositspayoutsactive
Deposit and Withdrawal Delays on Multiple Networks
- XenditNov 5 07:50 UTC · payment processorCause not yet classifiedpayouts0.2 h
Payouts Disruption in Philippines
- XenditNov 5 05:37 UTC · payment processorCause not yet classifieddeposits0.3 h
QR_CODE XENDIT Indonesia Disruption
- XenditNov 5 05:37 UTC · payment processorCause not yet classifieddeposits0.3 h
EWALLET DANA Indonesia Disruption
Active restriction tracker
Verified restrictions not yet reported as fully restored.
- Mercado BitcoinNov 2 06:24 UTC · BR · crypto exchangeConfirmed cyberwithdrawalsdepositstradingallactive
Brazil's largest crypto exchange Mercado Bitcoin was drained of about USD 36M to 49M from hot wallets across at least 10 chains on 2 Nov 2026 and took the whole platform offline, suspending deposits and withdrawals. It pledged to cover all...
- Credit Mutuel ArkeaNov 1 12:25 UTC · FR · commercial bankConfirmed cybertransfers outrecovering
Credit Mutuel Arkea announced on 4 Nov 2026 that it had been the victim of an attack that allowed fraudulent operations; attackers came in through a service provider's platform and used the bank's own account to send transfers to other...
- GMO Payment Gateway (Issuing Support Service for Life Card Vpreca)Oct 30 · JP · payment processorConfirmed cybercard authactive
GMO Payment Gateway disclosed on 2 Nov 2026 that a function it runs for Life Card's Vpreca prepaid card was used without authorization on 30 Oct, affecting 69 accounts' data, and that it suspended part of the affected services pending...
- Binance2026-10-29T20:05Z (approx; see conflicts) · XX · crypto exchangeConfirmed cyberwithdrawalsrecovering
Binance paused all crypto withdrawals on 29 Oct 2026 after attackers drained hot wallets of about USD 6.3B, the largest crypto theft on record. Withdrawals resumed in phases from 1 Nov starting with Bitcoin, with USD 3.6B net outflow in...
- OANDA Japan (OANDA Securities)Oct 22 · JP · brokerageConfirmed cyberwithdrawalstradingrecovering
OANDA Japan held all client withdrawals requested on 22 Oct 2026 for security checks after the GMO Internet VPS breach exposed clients' MetaTrader logins, releasing them on 23 Oct. On 26 Oct it confirmed unauthorized trades and restricted...
- BankMobile (BM Technologies)Sep 1 00:00 UTC · US · fintechConfirmed cyberpayoutsachonline bankingactive
After attackers took over BankMobile student refund accounts, the California Community Colleges Chancellor's Office directed districts to pause electronic aid disbursements through BM Technologies from early October 2026 and pay by paper...
- Resolv (USR)Mar 22 · stablecoin issuerConfirmed cyberwithdrawalsrecovering
An attacker used a compromised minting key to create about 80M USD of unbacked Resolv USR around 22 Mar 2026; Resolv paused the protocol and limited redemptions to verified pre-incident holders as USR lost its peg.
Verified significant restrictions by month
Tier 1 research records (broad, unexpected, an hour or more or reported by a regulator or credible outlet). Red is the confirmed-cyber share. Search depth was much greater for October 2026 than for earlier months, so this chart cannot show acceleration on its own.
Early-warning watchlist: unexplained restrictions
Verified restrictions from the last 45 days with no established cause. Listed because the cause is unknown, not because an attack is suspected.
Shared infrastructure
Providers named in two or more verified records. A shared provider is a documented dependency, not evidence of a shared compromise.
- GMO Internet (Onamae.com Desktop Cloud): FXTF, OANDA Japan (OANDA Securities), Gaitame Finest, Five unnamed Japanese FX firms (retail FX brokers)
Case library
Tier 1 restrictions of severity 4 or 5, newest first.
- Mercado BitcoinNov 2 06:24 UTC · BR · crypto exchangeConfirmed cyberwithdrawalsdepositstradingallactive
Brazil's largest crypto exchange Mercado Bitcoin was drained of about USD 36M to 49M from hot wallets across at least 10 chains on 2 Nov 2026 and took the whole platform offline, suspending deposits and withdrawals. It pledged to cover all...
- Credit Mutuel ArkeaNov 1 12:25 UTC · FR · commercial bankConfirmed cybertransfers outrecovering
Credit Mutuel Arkea announced on 4 Nov 2026 that it had been the victim of an attack that allowed fraudulent operations; attackers came in through a service provider's platform and used the bank's own account to send transfers to other...
- Binance2026-10-29T20:05Z (approx; see conflicts) · XX · crypto exchangeConfirmed cyberwithdrawalsrecovering
Binance paused all crypto withdrawals on 29 Oct 2026 after attackers drained hot wallets of about USD 6.3B, the largest crypto theft on record. Withdrawals resumed in phases from 1 Nov starting with Bitcoin, with USD 3.6B net outflow in...
- BitgetSep 24 · SC · crypto exchangeConfirmed cyberwithdrawalspayoutsunknown
Bitget suspended all withdrawals after a USD 387.5M hot wallet theft on 24 Sep 2026. The halt began before the window but persisted into it: other tokens, fiat and P2P withdrawals were scheduled to return on 2 Oct. Bitget blamed a...
- UpbitNov 26 19:42 UTC · KR · crypto exchangeConfirmed cyberwithdrawalsdepositsunknown
South Korea's largest exchange Upbit detected an unauthorized transfer of about 44.5B KRW in Solana-network assets at 04:42 KST on 27 Nov 2025 and suspended all crypto deposits and withdrawals. It reported to KISA and the FSS and promised...
- NobitexJun 18 · IR · crypto exchangeConfirmed cyberallunknown
Iran's largest crypto exchange Nobitex was hit on 18 Jun 2025 by Predatory Sparrow, which burned about 90M USD and later leaked source code. The exchange took its website and app offline, stopping all customer activity.
- BybitFeb 21 · AE · crypto exchangeConfirmed cyberwithdrawalsresolved
Bybit lost about 1.5B USD in ETH from a cold wallet on 21 Feb 2025, the largest crypto theft on record. Withdrawals were not suspended but were heavily delayed amid a run of over 350,000 requests; the CEO said all were processed about 12...
- C-Edge Technologies (about 300 Indian cooperative and regional rural banks)Jul 29 · IN · core banking vendorConfirmed cyberinstant paymentsatmtransfers outresolved
A ransomware attack on core banking provider C-Edge Technologies led NPCI to cut it off from retail payment systems on 31 July 2024, leaving about 300 small Indian banks without UPI, IMPS or ATM service. NPCI restored connectivity on 1...
- WazirXJul 18 · IN · crypto exchangeConfirmed cyberwithdrawalstradingresolved
Indian exchange WazirX lost about USD 230m from a multisig wallet on 18 July 2024 and froze withdrawals and trading. Users faced a long freeze and a loss-socialisation scheme.
- Patelco Credit UnionJun 29 · US · credit unionConfirmed cyberonline bankingmobile appwiretransfers outresolved
California's Patelco Credit Union shut down online banking, wires and Zelle after a ransomware attack on 29 June 2024. Online and mobile banking returned around 15 July; the intruder had network access from 23 May.
- DMM BitcoinMay 31 · JP · crypto exchangeConfirmed cyberwithdrawalstradingresolved
On 31 May 2024 Japan's DMM Bitcoin lost 4,502.9 BTC in an unauthorized outflow and halted crypto withdrawals and new trading. The parent group backed customer balances and the exchange later wound down, transferring accounts to SBI VC...
- VNDirect SecuritiesMar 24 · VN · brokerageConfirmed cybertradingdepositsresolved
Vietnamese broker VNDirect was hit by a cyberattack on 24 March 2024 and both stock exchanges cut its trading connections the next day. Customers were unable to trade for more than a week while systems were restored in phases.
- ICBC Financial ServicesNov 8 · US · clearing settlementConfirmed cybermerchant settlementtradingresolved
The US broker-dealer arm of ICBC was hit by ransomware on 8 November 2023 and could not settle US Treasury trades for clients, forcing market participants to reroute. ICBC confirmed the attack and said it had cleared some trades by 9...