A live model in four parts: why rational attackers price the banking core out and chase crypto instead; when that core faces catastrophic loss; what extreme-value theory can honestly say about a tail nobody has seen; and how one breach spreads through the interbank network. Everything below is a model you can drive.
An attacker is a rational investor: expected payoff = P(breach)·Value·(1 − P(recovery))·(1 − laundering haircut) − P(caught)·penalty − cost. Pick a venue, move its dials, and watch the ranking reorder. The decisive term is recovery — transaction finality.
Editing the bank.
Net, after recovery, laundering friction and expected punishment.
The bank’s payoff to an attacker as its clawback capability varies. Raise recovery and the prize evaporates — this is the whole defence.
A loss-distribution model: attacks arrive (Poisson), each causes a loss (log-normal body + heavy Pareto tail), and the largest can cascade through interbank exposure. Monte-Carlo gives the annual-loss distribution, a Cyber-VaR, Expected Shortfall and — the honest form of “when” — a return period.
Moving a generative dial re-simulates instantly; threshold and horizon recompute without re-running.
Years simulated per run. More years sharpen the deep tail at the cost of a slightly longer run.
Everyday years (below the 99.5th percentile), with VaR lines.
P(annual loss > x), log–log. A straight-ish decline means power-law catastrophe risk.
| Annual loss ≥ | P(in a year) | Return period | P(within horizon) |
|---|
Above a high enough threshold u, exceedances of almost any loss distribution follow a Generalized Pareto Distribution (the Pickands–Balkema–de Haan theorem). Fit one to the incidents in your record, extrapolate to the 1-in-1,000-year loss, and check it against the full simulation, which plays the truth. Shorten the record to see how little a few decades can tell you.
The fit sees only the incidents inside this window. The rest of the simulation stays hidden as the truth to check against.
Waiting for the simulation in 02.
Each dot is one year’s loss, placed at how rarely a year that bad occurs. The fit models single incidents, then adds an ordinary year’s other losses on top, a second-order correction for heavy-tailed sums. Right of the dashed line, the fit is extrapolating past your record.
Average overshoot above each threshold. A GPD tail plots as a straight line; the fitted line runs from u upward.
α estimated from the k largest incidents. Where it settles is the tail index; the dashed line is the value planted in the simulation.
Banks hold claims on each other, so an equity loss at one bank marks down the assets of every bank that lent to it, and so on round after round (linear DebtRank). Hit one bank, or a shared vendor that many banks depend on, and watch the loss travel. Once the spectral radius ρ(Λ) of the exposure matrix passes 1, shocks stop dying out.
A cyber event wipes out part of the equity of the bank or banks it hits. Exposure counts each bank’s claims on other banks as a multiple of its own equity. Tap a bank in the network to hit it.
Five core banks inside, the periphery outside. Node size is total assets; colour is equity lost. Red lines show losses moving each round, then the total passed along each link once the cascade settles.
Share of all bank equity lost after each round of propagation.
Contagion multiplier across exposure levels for this scenario. It turns explosive where ρ(Λ) = 1.