According to sources familiar with the matter, the Industrial and Commercial Bank of China injected capital into its U.S. unit to help pay BNY Mellon $9 billion in unsettled trades and hired a cybersecurity firm to enable it to resume normal business after a ransomware attack.
On Nov 10, ICBC's US unit told market participants that it hoped to complete the cyber review over the weekend, but sources said it would likely extend into next week. Meanwhile, the bank is said to be trading using manual processes.
The specifics, including the cash injection for unresolved trades, have not previously been disclosed.
Lockbit, a widely deployed ransomware first seen on Russian-language cybercrime forums in January 2020, claimed responsibility for the ransomware attack. It is the most recent in a series of ransom demands made by hackers this year.
The cyberattack sent shockwaves through the US Treasury market, where ICBC acts as a broker for hedge funds and other market participants, assisting them in trading securities. While the market disruption was limited, it highlighted the resilience of a market that underpins global finance.
When the hack occurred earlier this week, ICBC was unable to access its systems, leaving it temporarily owing BNY $9 billion for unresolved trades, according to two of the sources. Treasury settlement is handled solely by the custody bank.