On the evening of February 4, 2016, malware running on computers at Bangladesh Bank's central operations center began submitting transfer requests over the SWIFT interbank messaging network. The requests asked the Federal Reserve Bank of New York, where Bangladesh Bank held its US dollar reserve account, to transfer a total of $951 million to accounts in the Philippines, Sri Lanka, and other Asian destinations. The Fed processed five of the requests before the transfers were blocked - through a combination of an alert Fed operator, a routing error that sent one large transfer to Sri Lanka rather than its intended destination, and a spelling error on one transfer that triggered a routine fraud check. The five completed transfers moved $81 million into accounts in Manila.

The $81 million that was transferred was almost entirely unrecoverable. It moved through the Rizal Commercial Banking Corporation in Manila into casinos - which in the Philippines are not required to report suspicious transactions to anti-money-laundering authorities - and was dispersed. The Lazarus Group, working on behalf of North Korea, conducted the attack. The Bangladesh Bank heist was the most successful bank robbery in history, executed remotely by a state intelligence agency, and it demonstrated that the financial system's core transaction infrastructure could be exploited from the outside by an adversary who could compromise a single member bank's internal network.

The SWIFT Network and Its Assumptions

SWIFT (Society for Worldwide Interbank Financial Telecommunication) is the messaging network that financial institutions use to communicate payment instructions to each other. A SWIFT message from Bangladesh Bank to the New York Fed is an instruction to debit Bangladesh Bank's account and credit a beneficiary. The security model assumes that SWIFT messages originate from authorized operators at member institutions and that the local systems generating and transmitting those messages have not been compromised.

Bangladesh Bank used SWIFT Alliance Access software on dedicated computers to compose and transmit messages. The Lazarus Group had compromised these computers through a multi-month intrusion that began with spear phishing. Once inside Bangladesh Bank's network, they spent time learning the SWIFT procedures, studying how legitimate transfers were composed, and developing malware that could submit SWIFT messages using the Bank's own credentials and software.

The custom malware - analyzed by BAE Systems and later named evtdiag.exe, msoutc.exe, and other components - was designed specifically for the Bangladesh Bank SWIFT environment. It could delete SWIFT transaction records from the local database after submission (preventing the bank from seeing what had been sent), manipulate the printed SWIFT transaction logs that the bank used for reconciliation, and modify balance confirmation messages coming back from SWIFT to show the pre-theft balance. The attackers had essentially written a heist toolkit customized for this specific bank's IT environment.

[TECHNICAL NOTE]
The Bangladesh Bank SWIFT malware's database manipulation was particularly sophisticated. SWIFT Alliance Access stores transaction records in a local Oracle database. The malware connected to this database and deleted rows corresponding to the fraudulent transfers after they were submitted - preventing bank staff from seeing the transactions in their SWIFT interface. It also intercepted and modified printer output to remove the fraudulent transactions from printed reports, and manipulated the SWIFT confirmation messages that would have shown outgoing transfers to the bank's monitoring. The result was that the bank's own systems were concealing the theft while it was in progress.

The Timing and the Errors

The attack's timing was carefully chosen. The transfers were submitted on a Thursday evening New York time - Friday morning in Bangladesh. Bangladesh Bank was closed for the Muslim holy day (Thursday-Friday is the Bangladeshi weekend). The Fed would process transfers on Friday (New York business day). By the time Bangladesh Bank staff returned on Sunday, the five transfers had completed and the money had moved.

The $870 million in transfers that did not complete were blocked for multiple reasons. One large transfer to a Sri Lanka account was flagged because the routing used "fandation" instead of "foundation" - SWIFT flagged the spelling error for manual review. A bank in the transfer chain for several of the Philippine transfers noticed that the beneficiary account names included the word "Jupiter," which matched the name of a blacklisted entity in their compliance screening system - the accounts were at Jupiter Street in Manila, but the name match triggered a hold. The Federal Reserve itself became suspicious when the volume of Bangladesh Bank transfers on that single day was unusual.

The $81 million that completed moved from the New York Fed to RCBC Manila accounts in the names of individuals and companies that had been specifically opened for this purpose. Within 24 hours of the transfers completing, the accounts were emptied by the account holders working in coordination with the attackers. The money was converted to cash at the RCBC branch in a transaction that the bank's branch manager later admitted facilitating, and moved into Manila's casino ecosystem where it was dissipated.

The Recovery Failure

Bangladesh Bank discovered the fraud on Sunday when its SWIFT monitoring showed a discrepancy. It contacted the Fed on Monday, February 8. By then, the transfers had been completed for days and the cash had moved through casinos. Bangladesh Bank recovered $15 million through negotiations with RCBC and Philippine authorities but was never able to recover the remaining $66 million.

The Philippine Senate held hearings in which RCBC executives and the branch manager who facilitated the cash-out were questioned. The branch manager, Maia Santos-Deguito, was convicted of money laundering in 2019 and sentenced to 32 to 56 years in prison. RCBC was fined $21 million by the Philippines' central bank - the largest fine in Philippine banking history at the time - but the individuals who received the cash and carried it into the casino system were never prosecuted successfully.

Bangladesh Bank pursued civil litigation in New York against RCBC and the casinos for years. The cases were complicated by jurisdictional issues and by the difficulty of proving that specific casino revenues could be traced to the stolen funds.

[WARNING]
The Bangladesh Bank attack revealed that SWIFT's security model had a critical gap: the network trusted member institutions to secure their own access systems. A member bank whose computers were compromised would have its SWIFT access effectively stolen. SWIFT's initial response was criticized as defensive - emphasizing that SWIFT itself had not been breached and implying that member banks' security failures were their own problem. Subsequent SWIFT security programs (Customer Security Programme, CSP) introduced mandatory security controls and independent assessments for member institutions. The controls addressed obvious failures (two-factor authentication, network segmentation, security monitoring for SWIFT systems) that should have been standard practice but were not in place at Bangladesh Bank.

Lazarus Group Attribution

Attribution of the Bangladesh Bank heist to Lazarus Group / North Korea was developed through malware analysis. Researchers at BAE Systems, Symantec, and FireEye found code-level similarities between the Bangladesh Bank SWIFT malware and earlier Lazarus Group tools: shared encryption routines, identical string handling functions, and overlapping infrastructure. The same custom wiper malware used in the Sony Pictures attack appeared in tools used in the Bangladesh Bank operation.

The North Korean connection explained an otherwise puzzling aspect of the heist: the technical sophistication was high (custom malware, extended SWIFT reconnaissance, database manipulation), but the operational tradecraft for laundering the money was clumsy and almost unsuccessful. Nation-state intelligence agencies typically have strong technical capabilities but operate in money laundering through proxies with varying competence. The spelling error and the blacklisted name near-miss were human errors in the laundering chain, not in the intrusion.

North Korea's use of cyber theft to generate hard currency for the regime - which is cut off from the international financial system by sanctions - made the Bangladesh Bank heist and subsequent cryptocurrency thefts strategically coherent. The UN Panel of Experts estimated that Lazarus Group had stolen approximately $2 billion through cyber operations between 2015 and 2019 - a significant contribution to a sanctions-constrained economy's foreign currency reserves.

[IOC]
SWIFT fraud indicators and detection: Monitor SWIFT Alliance Access database queries - legitimate operations do not query or modify transaction records after submission; the Bangladesh Bank malware's database DELETE queries would be anomalous in any normal SWIFT environment. Implement SWIFT transaction monitoring that compares submitted messages against printed/displayed records - the Bangladesh Bank malware created discrepancies between these that should have been detectable. File integrity monitoring on SWIFT systems - the malware components (evtdiag.exe, etc.) were dropped to the SWIFT system directory. Network monitoring: SWIFT systems should only communicate with SWIFT infrastructure; outbound connections to non-SWIFT IPs from SWIFT systems are anomalous. Administrative: require SWIFT message authorization from two operators for large-value transfers; SWIFT's CPAC (Customer Payment Activity Controls) advisory threshold mechanism can flag unusual single-day transfer volumes. Bangladesh Bank had none of these controls in place.