Absolutely, if there's a moderately anonymous way to get significant sums of money out of something, sophisticated attackers will spend significant effort and even % of funds to extract it. That includes bribery, phishing, spamming, as well as the usual hacking and cracking exploits.

As you mention, the other issue is that this is often invisible (or even hidden by) to those who created the system that allowed the extraction.