Banco Unión

Summary

A cyberattack compromised the official X (formerly Twitter) account of a major Bolivian financial institution, with attackers hijacking the verified profile to impersonate the country's president and promote a fraudulent cryptocurrency dubbed "$Bolivia." The threat actors changed the account's display name to that of President Luis Arce and used his official image to lend credibility to the scheme, publishing announcements about the supposed launch of a "new national digital asset." The incident raised significant alarm among users due to the account's official verification status and the institution's prominent role in Bolivia's financial system. As of the time of reporting, neither the affected bank nor state authorities had issued an official public statement addressing the breach or the cryptocurrency scam.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Banco Unión, one of the most relevant financial institutions within Bolivia's banking system, became the target of a cyberattack directed at its official account on the social media platform X. The attackers compromised the verified account, which had previously served as a legitimate communication channel for the bank, and used it as a vehicle to promote a fraudulent cryptocurrency referred to as "$Bolivia." By seizing control of the account, the threat actors were able to broadcast deceptive content directly to the institution's followers, exploiting the credibility associated with Banco Unión's verified status and its prominent position in the national financial sector.

The intrusion involved identity manipulation tactics. The attackers altered the account's display name to that of Bolivian President Luis Arce and incorporated his official image into the profile or accompanying posts in order to lend greater legitimacy to the fraudulent scheme. Using these elements, the attackers published messages announcing what they described as the launch of a "new national digital asset," a claim designed to attract attention and encourage user engagement with the fake cryptocurrency promotion. The combination of a high-profile institutional account, presidential imagery, and a topic of public interest—cryptocurrency—created conditions under which unsuspecting users could be misled. The exact technical method used to compromise the account was not disclosed in available reporting.

The incident generated concern among Banco Unión's users and the broader public, given that the compromised account carried official verification, a marker typically associated with authentic institutional communication. The verified status amplified the potential reach of the fraudulent messages, as followers and other platform users could reasonably assume that any content distributed through the account reflected the official position of the bank. The use of President Arce's name and image further increased the perceived authority of the promotion, raising the risk that individuals might interact with the promoted cryptocurrency in the belief that it had institutional or governmental backing.

As of the date of reporting, neither Banco Unión nor Bolivian state authorities had issued an official public statement addressing the cyberattack or its consequences. The absence of a formal communication left the scope of the compromise, the number of users potentially affected, and any operational impact on the bank's internal systems unconfirmed in publicly available sources. No information was provided regarding detection mechanisms, containment measures, account recovery procedures, or coordination with platform operators or law enforcement entities. The financial institution's other communication channels and core banking services were not described as being affected within the available reporting, which focused solely on the compromise of the social media account.

Sources

Sources available to members: 1 source.