Market Extra

How ransomware attack on ICBC rattled the Treasury market and shook up a 30-year bond auction

The U.S. unit of the Industrial & Commercial Bank of China (ICBC) was hit by a cyberattack that rattled the Treasury market this week.

Greg Baker/Agence France-Presse/Getty Images

Referenced Symbols

It was a trading day unlike any other for traders in the $25 trillion Treasury market, with a 30-year bond auction seen as having been partially undermined by a cyberattack on the U.S. unit of a Chinese bank.

In recapping Treasury’s poorly received $24 billion bond auction on Thursday, traders said the weaker-than-expected results likely had at least something to do with this week’s ransomware hit on the American arm of Industrial & Commercial Bank of China, known as ICBC. That attack reportedly caused disruptions across the market and had some impact on liquidity, with the Financial Times citing unnamed sources as saying hedge funds and asset managers were forced to reroute trades.

Traders were grappling on Friday to answer the question of what created the sudden lack of interest at the auction, which went so badly that it also shook up U.S. stock investors. Thursday’s sale was the worst since November 2021, based on the extent to which primary dealers were forced to step in and pick up the slack in demand, one trader said. And it reinforced a recent pattern of weak auctions for the 30-year bond that may not bode well for future sales of that long-dated maturity.

It’s possible that bonds simply “look much less attractive” following a recent “explosive rally” since late October, according to Charlie McElligott, a cross-asset macro strategist at Nomura Securities in New York. However, “this might be the case of ‘more than meets the eye’ to this ‘ugly auction evidencing low demand for duration’ story,” he wrote in a note.

“One dynamic that makes yesterday’s ugly auction results murky was the ICBC cyberattack described across various financial media, which gunked-up anybody who clears UST trades through them, and made it so that many dealers were then likely unable to trade with those clients until resolved, on account of unsettled trades which weren’t able to be matched,” McElligott said.

Adding to Thursday’s uncertainty was another random event. Federal Reserve Chairman Jerome Powell appeared on stage in an International Monetary Fund panel, was interrupted by a climate protester, and then uttered a seven-letter expletive that could be heard on the event’s livestream.

Powell’s policy-related remarks, which indicated the central bank might take further action to control inflation, “didn’t help things and kind of spooked people again,” said John Farawell, head of municipal trading at New York bond underwriter Roosevelt & Cross.

Read: Fed’s Powell Made Cryptic Comments. How He’s Guiding the Market.

On Friday, the Treasury market found stabilization as buyers returned to segments of government debt in a sign that calm was being restored. A rush of buying was seen on the 30-year bond BX:TMUBMUSD30Y, sending its yield down to 4.733% and to a third straight weekly decline.

Meanwhile, Bloomberg News reported that the repercussions of the ICBC cyberattack included an inability to deliver U.S. debt that was being pledged as collateral. ICBC’s U.S. unit was forced to rely on a messenger carrying a USB stick across Manhattan to complete disrupted trades, according to the news service, which also described Thursday’s $24 billion 30-year bond auction as one of the worst in a decade.

The ICBC attack “might have had a dramatic impact on the auction. I don’t know how much, but I also can’t imagine it didn’t,” said Tom di Galoma, co-head of global rates trading for BTIG in New York. “When people see that there are trade-settlement issues, there’s a willingness to back off and that’s exactly what happened yesterday. Institutional accounts were saying, ‘We don’t know who is settling this trade.’ If the cyberattack hadn’t happened, I think the auction would have gone a lot better.”

Ben Emons, a senior portfolio manager and head of fixed income for NewEdge Wealth in New York, said that once the Treasury market got upended by the ICBC cyberattack, the bad auction, and the interruption during Powell’s appearance, liquidity on U.S. government debt “was, for a moment, a dark matter.”