The CEO wasn't kidnapped.
He was sprayed with Mace which meant that he had to get his eyes examined for possible damage.
During that examination, his retinal scan was captured without his knowledge.
So, there was no reason to change the retinal scan access as no-one knew it had been compromised.
vault where 8 billion of money stored.
There was no vault with money stored in it.
The vault contained a computer with access to the Bank's headquarters which they needed access to.
Using that access, they could manipulate the computer to
transfer relatively small amounts of money from hundreds of corporations all over South East Asia into her account.
Which totalled $8 billion.