ICBC Financial Services LockBit ransomware (2023)

On 9 November 2023, LockBit ransomware disrupted the U.S. broker-dealer arm of Industrial and Commercial Bank of China (ICBC) — the world's largest bank by total assets. The disruption was severe enough that over $9 billion of trades backed by U.S. Treasury securities failed to settle on time, and ICBC staff resorted to sending settlement details by USB stick carried by a messenger physically across Manhattan.

What happened

ICBC Financial Services is the U.S.-based broker-dealer subsidiary of Industrial and Commercial Bank of China. On 9 November 2023 its systems were encrypted by LockBit ransomware. The unit was temporarily unable to access its corporate email — let alone its settlement infrastructure. Bank staff, facing imminent failed deliveries, wrote settlement instructions to USB drives and hand-delivered them to counterparties via a messenger.

The Treasury-market impact was unusually visible: more than $62 billion of U.S. Treasury trades failed to deliver in a single day. Bank-of-China-parent capital injections covered the unsettled exposure, and the market normalised after roughly four trading days.

Researchers analysing artefacts from the intrusion concluded that LockBit had likely exploited the Citrix Bleed vulnerability (CVE-2023-4966) — the same flaw exploited in the contemporaneous Boeing attack — to gain initial access.

In February 2024, the U.S. Treasury sanctioned Ivan Gennadievich Kondratiev ("Bassterlord", "Fisheye"), a Russian national identified as a LockBit affiliate and leader of the National Hazard Society affiliate sub-group — part of a coordinated U.S./UK takedown effort against LockBit's infrastructure.

Impact

• More than $9 billion of trades backed by U.S. Treasuries failed to settle on time.
• $62 billion of Treasury trades failed to deliver in one day.
• Settlement instructions hand-delivered by USB stick across Manhattan.
• ICBC parent capital injections covered unsettled trades.
• U.S. Treasury sanctions on a named LockBit affiliate; precursor to the international LockBit takedown in 2024.

Why it matters

ICBC is the case where ransomware moved markets: a single criminal-encryption event at the U.S. broker-dealer of a Chinese state bank rippled into a measurable disruption of U.S. Treasury settlement. The contrast between the high-frequency electronic infrastructure of modern finance and the physical USB-stick contingency that kept trades flowing has been studied by every G7 financial regulator since.