On the night of February 4-5, 2016, the Bangladesh Bank's account at the Federal Reserve Bank of New York was used to send 35 payment instructions via the SWIFT interbank messaging system, requesting transfers totaling $951 million. The instructions appeared legitimate: they used valid SWIFT message formats, the correct Bangladesh Bank credentials, and correct account routing. Five of the 35 instructions were processed before the fraud was detected. The successfully transferred amount was $101 million.

Of the $101 million transferred, $81 million reached the Philippines and was rapidly laundered through Manila casino operators in a scheme designed to make recovery impossible - casino proceeds in the Philippines were not subject to the anti-money-laundering regulations that applied to banks. $20 million went to Sri Lanka but was recovered when a spelling error - "fandation" instead of "foundation" in a beneficiary name - triggered a manual review at the Deutsche Bank intermediary. The remaining $850 million in instructions was blocked by the Federal Reserve when it noticed the volume of transfers to private accounts and the fact that several instructions were routed to a sanctioned entity called Shalika Foundation (a name flagged against OFAC lists).

The Lazarus Group Attack Chain

The heist was attributed to Lazarus Group, a North Korean state-sponsored threat actor. The compromise of the Bangladesh Bank's systems began months before the February transfer requests. Lazarus Group phished Bangladesh Bank employees with malicious emails, eventually obtaining access to systems on the bank's internal network. From there, the attackers spent months studying how the bank operated, how SWIFT transactions were initiated, and where the operational technology connecting to the SWIFT network was located.

Bangladesh Bank connected to the SWIFT network using Alliance Access software running on Windows systems. These systems were on the same network as regular banking IT - not isolated. The attackers installed custom malware on the SWIFT-connected systems that could monitor SWIFT transaction traffic, delete SWIFT transaction records from the bank's local logs (to prevent the bank from detecting the outgoing transfers), and suppress the automatic acknowledgment messages that SWIFT sent back to the originating bank.

Critically, the malware also tampered with the SWIFT Alliance Access printer. Bangladesh Bank used a physical printer to produce records of SWIFT transactions - an audit trail. The malware interfered with the printer system to prevent the fraudulent transaction records from being printed. Bank employees discovered the fraud on Monday morning, February 8, when they tried to print transaction records and the printer produced error messages rather than reports. By that time, the money had been in the Philippines for three days.

[TECHNICAL NOTE]
The Bangladesh Bank malware suite: Lazarus Group deployed multiple components. The primary malware was a SWIFT message injector that could submit transaction requests directly to the SWIFT Alliance Access software, bypassing normal authorization flows. A separate component monitored and deleted SWIFT transaction logs from the local database. A printer manipulator component interfered with the automatic printing of incoming SWIFT confirmations. The malware was tailored specifically to Bangladesh Bank's configuration - the attackers had spent months studying the exact software versions, database schemas, and operational procedures in use. The level of customization required intimate knowledge of Bangladesh Bank's specific implementation, suggesting either insider assistance or very thorough reconnaissance. The attack exploited the fact that Bangladesh Bank's SWIFT infrastructure was connected to the general bank network rather than being isolated on a separate segment - a security architecture failure. SWIFT subsequently issued mandatory security requirements for member banks specifically addressing network isolation and access controls for SWIFT-connected systems.

The Timing and the Spelling Error

The timing of the attack was carefully chosen. The transfers were initiated on a Thursday evening (Bangladesh time), which was Friday morning in New York. The Federal Reserve processed them on a Friday before a US holiday weekend - Presidents' Day was Monday, February 15. Bangladesh Bank was closed for its weekend (Friday-Saturday in Bangladesh). The Philippines banking system was closed Monday for Lunar New Year. The layered holiday windows gave the attackers four days before anyone could begin recovery efforts.

The $20 million Sri Lanka transfer was recovered due to a spelling error: the beneficiary was intended to be "Shalika Foundation" but was typed as "Fandation" (for "Foundation"). Deutsche Bank, acting as an intermediary, flagged the misspelling and requested clarification from Bangladesh Bank. The delay allowed Bangladesh Bank to notify Sri Lankan authorities, who froze the funds before they could be withdrawn.

The $81 million that reached the Philippines was laundered through RCBC (Rizal Commercial Banking Corporation) accounts opened with fraudulent documents. The accounts were controlled by casino operators who converted the funds to casino chips and then to cash through transactions that were not subject to Philippines anti-money laundering reporting requirements (casinos were explicitly exempted). By the time Filipino authorities became involved, the cash had been distributed to multiple individuals and partially exported. Approximately $15 million was eventually recovered through civil proceedings. The Philippines subsequently removed the casino exemption from its anti-money laundering law.

[WARNING]
The Bangladesh Bank heist demonstrated that SWIFT - the messaging system underlying global interbank transfers and trusted as inherently secure because of its encryption and authentication - was vulnerable to attacks that didn't break the cryptography but instead compromised the systems at the bank that sent and received SWIFT messages. SWIFT authentication proves that a message came from a legitimate SWIFT terminal; it cannot prove that the legitimate terminal wasn't under adversary control. Subsequent analysis found that Lazarus Group had used similar attack techniques against other banks in Asia, with partial or complete success in some cases. The Bangladesh case became the most visible because of the scale of the attempted theft. SWIFT responded with its Customer Security Programme (CSP), which mandated minimum security controls for institutions connected to SWIFT, including network segmentation, multi-factor authentication, and audit logging. Compliance became mandatory; non-compliant banks risked suspension. The lesson - that critical financial infrastructure is only as secure as the weakest participating institution - drove significant security investment across the global banking system.

North Korea's Financial Hacking Program

The Bangladesh Bank attack was part of a broader North Korean state program to generate hard currency through cyber theft. UN Panel of Experts reports have estimated North Korea's total cyber theft at over $3 billion between 2017 and 2023, primarily from cryptocurrency exchanges but also from banks. The SWIFT heists - Bangladesh, plus operations against banks in Vietnam, Taiwan, Ecuador, and elsewhere - predated the cryptocurrency focus. As cryptocurrency grew and SWIFT defenses improved, Lazarus Group shifted emphasis to targeting exchanges and DeFi protocols.

The program serves North Korea's sanctions-evasion objectives. Under UN and unilateral sanctions, North Korea cannot conduct normal international financial transactions. Cyber theft circumvents this constraint by generating cryptocurrency or cash that can be laundered through jurisdictions with limited compliance. The connection between North Korean state strategy and specific cyber operations is direct: the hacking units are part of the Reconnaissance General Bureau, which reports directly to North Korean leadership, and the proceeds fund sanctioned programs including weapons development.

[IOC]
Bangladesh Bank / Lazarus Group indicators: the custom malware deployed against Bangladesh Bank used module names that varied by installation but shared common code structures with other Lazarus Group tools. Key malware components: evtdiag.exe (event log cleaner), msoutc.exe (SWIFT message injector), nroff_b.exe (delete/cover tracks tool). The malware was specifically compiled for and configured against Bangladesh Bank's specific SWIFT Alliance Access installation. The Philippines accounts at RCBC where the $81M landed: accounts in the names of Alfred Vergara, Jessie Christopher Lagrosas, Michael Francisco Cruz, Enrico Teodoro Vasquez - all fictional identities supported by fraudulent identification. RCBC branch manager Maia Deguito was convicted of money laundering by Philippines courts in 2019. The $81M remains largely unrecovered. Lazarus Group SWIFT attack tools shared code with WannaCry and other North Korean malware, including specific cryptographic implementations (custom Blowfish implementation), string obfuscation techniques, and PE structure patterns identified by BAE Systems research in 2016.