OANDA Securities Japan has delayed processing some customer withdrawals on October 22, 2026, as a precaution after a cyberattack at GMO Internet’s Onamae.com Desktop Cloud hosting service raised concerns that MetaTrader login credentials stored on rented trading servers could have been viewed by an unauthorized party.
The Japanese brokerage reportedly postponed requests submitted before 11 a.m. Thursday while it carried out security checks, with the affected transfers scheduled for processing from 11 a.m. Friday, October 23. OANDA expected the payments to reach registered bank accounts by approximately 4 p.m. Friday, subject to those checks and normal payment procedures. This is a temporary, locally scoped delay rather than evidence that OANDA’s worldwide brokerage business has suspended withdrawals.
The underlying incident is confirmed by GMO itself. On October 21, the company disclosed unauthorized access affecting its Onamae.com Desktop Cloud service, with malicious programs installed in some user environments and as many as 26,739 servers potentially exposed. That is a count of possibly affected servers, not a confirmed tally of compromised MetaTrader trading accounts, stolen customer deposits or successful unauthorized withdrawals.
What Has OANDA Japan Changed About Withdrawals?
Reporting on the October 22 customer notice says OANDA delayed Thursday’s pre-11 a.m. withdrawal batch while verifying account security following the incident at an external service provider. The company expected to resume processing that batch at 11 a.m. Friday and have payments arrive at client banks by around 4 p.m.
Requests submitted before 11 a.m. on October 23 were expected to follow the usual workflow. The notice has been described as a measure to prevent unauthorized withdrawals, not a response to a reported inability to meet customer liabilities. OANDA also stated that client assets remained segregated under Japan’s applicable customer-money requirements.
Because the exact October 22 notice was not available on an independently accessible official page at the time of this review, the detailed resumption schedule is attributed to reporting on that communication. Actual transfer completion and the outcome of individual security reviews had not yet been independently confirmed.
OANDA’s normal withdrawal guidance says customers making a request before 11 a.m. on a weekday generally receive funds by approximately 3 p.m. that day, while later requests are processed on the next business day. The exceptional delay therefore matters most to customers who expected Thursday settlement and instead faced an additional business day.
A withdrawal being postponed for identity and security verification does not mean a broker has suffered a liquidity crisis. The publicly available information provides no evidence of missing client money or a confirmed fraudulent bank transfer at OANDA Japan.
What Did GMO Confirm About the Onamae.com Breach?
GMO Internet’s October 21 incident notice says it discovered on October 20 that an unauthorized third party had installed malicious software in some Onamae.com Desktop Cloud customer server environments. Information stored on those servers might have been viewed.
The provider began systematically shutting down all Desktop Cloud plans at 4 a.m. Japan time on October 21 to reduce further risk, and had not published a firm reopening date. Its estimate of 26,739 potentially affected servers represents the reach of the investigation, not proof that each machine carried malware or that every renter lost private information.
GMO stated that it had not confirmed misuse of viewed information or leakage of the customer personal data that it holds. It also said it did not retain payment-card data in the affected service. Those assurances do not exclude the possibility that account passwords or other confidential information stored by customers inside their rented servers was accessible.
The hosting product is used by retail forex traders to run MetaTrader 4, MetaTrader 5 and Expert Advisor strategies continuously without keeping a personal computer powered on around the clock. A compromise at this layer can therefore expose broker-specific trading credentials even when the brokerage’s own trading and banking systems have not been penetrated.
GMO urged customers who stored authentication details on the affected servers to change those passwords promptly, including credentials reused on other services. It also warned about phishing messages exploiting public concern over the incident.
Why Could a Rented Trading Server Expose MetaTrader Accounts?
A virtual private server can store terminal configuration, trading scripts, broker server names and credentials needed to reconnect a MetaTrader application after restarts. If an attacker reaches that environment, they may be able to read configuration files or observe application activity, depending on the actual compromise and how the platform stores sensitive information.
But MetaTrader trading credentials are not interchangeable with the authenticated withdrawal process through a broker’s secure client portal. On OANDA Japan, a prior official notice required a Google Authenticator one-time code when submitting withdrawal requests or changing registered recipient bank details.
That extra verification step reduces the risk that an exposed MT4 or MT5 login alone would enable a direct bank withdrawal. Nevertheless, credential exposure can still matter for unauthorized trades or account-information access where the compromised password permits those activities. The distinction between a trade-authorizing password and a read-only investor password is important when judging the potential impact.
The exact capabilities available to an intruder would depend on what credentials were stored, any additional security configuration, session status and how the brokerage validates actions. No complete public reconstruction of an attack against any specific OANDA customer’s account has been released.
A separate VT Markets customer allegation involving suspected MetaTrader access and pending withdrawals raised related technical questions about trading passwords and portal access. That dispute is unverified and unrelated to GMO’s confirmed service-provider breach.
What Happens to Automated Trading While Servers Are Offline?
The shutdown creates a second risk apart from credential theft: interruption of unattended trading strategies. A MetaTrader Expert Advisor running only on a suspended VPS cannot continue receiving prices and placing new instructions through that terminal while the hosting environment is unavailable.
Broker-side pending orders and stop-loss orders, however, may remain active on the broker’s own trade server even when the customer’s rented desktop terminal is offline. Which protections continue depends on the order type and execution environment. A locally managed trailing stop or script-based exit may behave differently from a stop order already accepted by the trading server.
Customers should therefore review open positions and account history through a trusted, supported trading channel, rather than assume either that all orders stopped or that every automated risk-management feature kept working. Changing passwords may require updating terminal configurations when service resumes.
That distinction recalls the risk of altered or absent protective orders during a separate SBI Securities FX restoration. The incidents are not connected, but they illustrate why service restoration does not automatically restore every element of a trader’s intended strategy.
OANDA Japan had already announced plans to discontinue MT4 by November 27, with cybersecurity considerations cited when the timetable was set earlier in 2026. The announced retirement was not a new reaction to this week’s GMO incident, and clients should not confuse the two timelines.
What Does the Incident Reveal About Broker Outsourcing?
The compromised platform is operated by GMO Internet, not by an OANDA trading-server operator. This illustrates the difference between a broker suffering a direct infrastructure breach and its customers being exposed through a separate technology provider that stores or processes their trading credentials.
Retail forex users often combine brokerage accounts with third-party VPS hosting, Expert Advisors, copy-trading tools and external analytics services. Each connection creates operational dependencies that may not be visible from the broker’s main login page or risk disclosures.
A provider’s estimate of potentially affected systems can also be mistaken for a measure of banking or trading losses. Here, 26,739 is the maximum class of servers GMO identified as potentially affected, not a verified number of exploited OANDA accounts or an amount of withdrawn money.
Security checks can be inconvenient, especially when a customer has planned to withdraw funds to meet another obligation. But they can also protect a customer while the brokerage evaluates whether associated credentials were compromised. A protective pause should be judged by whether it is clearly explained, proportionate and resolved within the promised timetable.
Other brokers have faced disputes where trading-account access and payment processing became entangled. An unrelated xChief customer complaint described missing MT4 access alongside a pending withdrawal; that was a customer allegation, not evidence of a broader connection to the Japanese hosting provider.
What Should Affected OANDA Traders Check Next?
Customers who used Onamae.com Desktop Cloud should identify all passwords and API-like credentials stored in their VPS environments and follow the provider’s instructions to rotate them. Where passwords were reused, the same secrets should be changed on the other services as well.
They should then inspect their MetaTrader trading history for unexpected orders, confirm that positions and protective orders match their intended exposure, and use OANDA’s official portal to examine pending withdrawals and registered bank details. Unsolicited emails purporting to offer emergency VPS recovery should not be trusted without independent verification.
The important next disclosures are whether GMO can establish which server environments were actually accessed, whether any credentials were copied, when the hosting service can safely reopen and whether OANDA’s Friday withdrawal schedule was completed.
As of October 22, the documented picture is a confirmed third-party VPS security incident and a reported one-day precautionary delay to part of OANDA Japan’s withdrawal processing. There is no confirmed evidence here of stolen OANDA client balances, successful unauthorized withdrawals or a worldwide disruption affecting other OANDA entities.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574