In regex, hash(#) doesn't need escaping as it doesn't hold any special value.
In Java, you only need to escape opening curly braces { hence the correct regex you need to write is, #\{.*?} and in Java you need to escape \ character as it itself is a escape character hence the correct declaration should be #\\{.*?}
Try out this Java code,
public static void main(String[] args) {
String s = "Dear #{abc}, your balance is #{xyz}";
String regex = "#\\{.*?}";
System.out.println("Before: " + s);
s = s.replaceAll(regex, "test");
System.out.println("After: " + s);
}
Which prints following as desired,
Before: Dear #{abc}, your balance is #{xyz}
After: Dear test, your balance is test
Also, for grabbing any character non-exhaustively, you can write [^}]* instead of .*? as former will perform better.