The Bangladesh Bank Heist: A Billion-Dollar Hack Undone by a Typo

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

In February 2016, hackers tried to steal roughly $1 billion from the central bank of Bangladesh without ever entering a building. Malware suspected to be a Dridex variant had been sitting inside Bangladesh Bank's systems since January, watching employees and learning the exact syntax of the SWIFT messaging network. Then, on the night of February 4th into the 5th, as the Bangladeshi weekend began, the attackers sent 35 fraudulent transfer instructions to the Federal Reserve Bank of New York.

This episode follows the money and the mistakes. The Fed flagged 30 of the requests, worth about $850 million, and a misspelling of the word foundation in a $20 million transfer to Sri Lanka drew the attention of Deutsche Bank. But $81 million still reached four dormant accounts at an RCBC branch in the Philippines, where a Chinese New Year bank holiday and a casino loophole in anti-money laundering law let it disappear. The trail leads to the Lazarus Group and North Korea's Reconnaissance General Bureau.

• The attackers timed the transfers for Thursday night in Bangladesh, when the bank's weekend had begun but the New York Fed was open and processing transactions.
• A $20 million transfer to the Shalika Foundation in Sri Lanka was stopped after Deutsche Bank noticed the word foundation was misspelled.
• The four RCBC accounts on Jupiter Street in Makati City were opened under fictitious identities in May 2015, nine months before the heist.
• Philippine casinos were excluded from anti-money laundering reporting rules, so the funds were converted to pesos and washed through casino chips and junket operators.
• Of the $81 million that reached the Philippines, only about $15 million has been recovered. RCBC paid a record fine of roughly $52.9 million, and SWIFT created its customer security program in response.