You go to sleep with your trading bot running, and when you wake up, you find it still placing orders, but the order placer is no longer you. Japanese IT giant GMO Internet has a cloud hosting service called "(Onamemae.com) Desktop Cloud," where many people rent Windows servers to run MT4 and MT5 forex automated trading 24/7. On October 19th, some clients reported abnormalities. On October 20th, GMO discovered third-party malware on some servers. At 4 AM on October 21st, all servers began to be shut down one by one. Possibly 26,739 servers were affected, but it was too late to shut them down. These servers stored users' brokerage login information. Hackers obtained this information and directly logged into other people's accounts to place random orders. TBS interviewed a 44-year-old man who had been trading forex for 10 years: In about 2 seconds, he lost approximately 4.16 million yen. He said, "The balance is zero." The hacker initially claimed to have "damaged" 6.6 billion yen in accounts, later changing his claim to 7.7 billion yen. This is the attacker's version, unverified by any third party. However, the real drama unfolded with the subsequent ransomware attack. On October 21st, the first ransom note demanded $50 million in cryptocurrency, payable by 5 PM that day. GMO refused. The hacker then offered $1 million, promising not to release the ransomware if payment was made by noon on October 27th. They also claimed they could target accounts at over 70 brokerage and forex companies both domestically and internationally. With only 2% of the initial amount remaining, GMO still refused to pay. Their reasoning was that payment didn't guarantee the data would be deleted. However, around 12:30 PM today, after the deadline, personal information purportedly belonging to a GMO user began appearing online; its authenticity remains unconfirmed. The fire has spread to the stock market and the government. GMO Group's stock price fell more than 15% on Monday. Japanese Financial Minister Satsuki Katayama said that five forex companies have reported losses to their clients, and brokerage FXTF has directly blocked all overseas IP addresses from logging into MT4 and MT5. GMO has also requested the government to use its "proactive network defense" authority to cripple the hackers' infrastructure; this authority only took effect on October 1st. Compensation plan: 5,000 yen per existing user. Realized losses from unauthorized transactions confirmed by GMO will be borne by GMO. Users switching to another GMO cloud service can use it for free for 6 months. What does this have to do with the cryptocurrency market? First, GMO also has ties to exchanges. Its Thai-operated exchange, http://(Z.com)EX, which holds a Thai license, was just acquired last week. Secondly, and most importantly, many people in the cryptocurrency space also store their quantitative trading bots and exchange API keys on cloud servers. What was stolen this time is this "key that places orders for you." Bots can monitor the market for you 24/7, but they can also work for hackers 24/7. Is your API key still enabled for withdrawals? Is it bound to an IP whitelist? GMO Hacker Ransomware: Quantitative Trading API Security