I work for a company that analyzes transactions and detects account takeovers and thefts at banks. Banks call us when they suffer a loss or series of losses. When they call us these losses are typically over $300,000 and the largest attack we've seen is for about $1.5M. We do NOT deal with the biggest banks, mostly regional and local banks. In case you didn't know, there are about 15,000 banks and credit unions in the U.S., so there are a lot of targets for criminals. Not all these banks have assets worth stealing, and not all of them are even on line. By our estimate, roughly 6,000-8,000 of these banks are sufficiently interesting and available to be targets of criminals.
So can I give you a real number? No, because we don't deal with the biggest banks and we also don't talk to all 15,000 banks. But I can tell you that having worked with several hundred banks, these so-called cybercriminals are stealing a lot of money. Yes, true, the banks that call us self-select, so I am NOT saying that every bank is losing $1M/year. But we do see hundreds of banks with losses that seem to indicate that the criminals are stealing tens of millions, and possibly hundreds of millions of dollars. FWIW.
P.S. They are also successfully stealing a lot of money from brokerage houses, so that gets added to their haul, also.