Two hackers in Surabaya, East Java were arrested over a COVID-19 relief scam that reportedly cost the US government USD60 million.