The Bangladesh Bank Heist

Background

Bangladesh Bank, the central bank of Bangladesh, held a U.S. dollar account at the Federal Reserve Bank of New York that it used to settle international transactions. Access to that account, like that of thousands of other financial institutions worldwide, depended on the SWIFT (Society for Worldwide Interbank Financial Telecommunication) messaging network, which banks use to authenticate and route payment instructions. Investigators later determined that attackers had compromised Bangladesh Bank's internal network months before the theft, reportedly gaining an initial foothold as early as January 2016 and using that access to study the bank's payment procedures and install malware capable of manipulating SWIFT transaction records.

The February 2016 Heist

On the night of February 4-5, 2016, during a weekend closure in Bangladesh, the attackers used compromised SWIFT credentials to issue thirty-five fraudulent payment instructions directing the Federal Reserve Bank of New York to transfer just under $1 billion out of Bangladesh Bank's account to accounts in the Philippines and Sri Lanka. Most of the requests were blocked or flagged, in part because one instruction misspelled the recipient "Shalika Foundation" as "Shalika Fandation," which prompted a routing bank to seek clarification and led to roughly $850 million in transfers being halted. Despite this, five transactions totaling $101 million went through: $81 million was wired to accounts at Rizal Commercial Banking Corporation (RCBC) in the Philippines, and $20 million was sent to Sri Lanka, where a further spelling anomaly in a beneficiary name helped a Sri Lankan bank flag and freeze that transfer.

Laundering the Funds

The $81 million that reached the Philippines was quickly withdrawn from RCBC accounts and funneled through the Philippine casino industry, which at the time was exempt from the country's anti-money-laundering regulations. Funds were converted into casino chips, gambled, and cashed out through junket operators, making the money extremely difficult to trace or recover. Bangladesh Bank did not detect the fraud until February 8, 2016, when the bank's Dhaka office reopened after the weekend, by which point most of the diverted funds had already been laundered. Ultimately only a small fraction, around $15 million, was ever recovered from the Philippines, while the full $20 million intercepted en route to Sri Lanka was returned.

Investigation and Attribution

The incident triggered investigations by Bangladeshi authorities, the FBI, and private security firms including Symantec and BAE Systems, which identified code overlaps between the malware used in the heist and tools previously linked to the 2014 Sony Pictures hack and other intrusions attributed to North Korea's Lazarus Group. In September 2018, the U.S. Department of Justice unsealed a criminal complaint charging North Korean programmer Park Jin Hyok with conspiracy to commit computer fraud and related offenses, tying him to a broader pattern of Lazarus Group activity that included the Sony Pictures hack, the WannaCry ransomware outbreak, and attempted SWIFT fraud against multiple banks, including Bangladesh Bank. The Philippine central bank, Bangko Sentral ng Pilipinas, separately fined RCBC roughly 1 billion pesos in 2016 for anti-money-laundering violations connected to handling the stolen funds, and a former RCBC branch manager, Maia Santos Deguito, was convicted of money laundering in relation to the case in 2019.

Significance and Legacy

The Bangladesh Bank heist is widely regarded as the first publicly documented case of a state-linked actor using a cyberattack to attempt large-scale theft directly from the global banking system, rather than for espionage, sabotage, or ideological disruption. It demonstrated that the SWIFT network's security was only as strong as the weakest member bank's internal defenses, prompting SWIFT to launch its Customer Security Programme in 2016, which introduced mandatory security controls, attestation requirements, and information-sharing obligations for member institutions. The case also became a reference point for how nation-states, particularly North Korea, have used financially motivated cyber operations to circumvent international sanctions, a pattern security researchers have since tracked across numerous subsequent SWIFT-related bank intrusions and cryptocurrency thefts attributed to the same group.

Timeline

• 2016-01Attackers reportedly gain initial access to Bangladesh Bank's internal network and begin surveilling SWIFT payment procedures.
• 2016-02-04Thirty-five fraudulent SWIFT instructions are issued attempting to transfer nearly $1 billion from Bangladesh Bank's Federal Reserve account.
• 2016-02-05Five transactions totaling $101 million are executed, sending $81 million to the Philippines and $20 million to Sri Lanka; a misspelling halts roughly $850 million in further transfers.
• 2016-02-08Bangladesh Bank's Dhaka office reopens after the weekend and discovers the fraudulent transfers.
• 2016-03Bangladesh Bank Governor Atiur Rahman resigns amid fallout from the heist.
• 2016-08Philippine central bank fines Rizal Commercial Banking Corporation (RCBC) roughly 1 billion pesos for anti-money-laundering violations tied to the case.
• 2018-09U.S. Department of Justice unseals a criminal complaint charging North Korean programmer Park Jin Hyok in connection with the heist and other Lazarus Group operations.
• 2019-01Former RCBC branch manager Maia Santos Deguito is convicted of money laundering in relation to the stolen funds.