How Hackers Stole $81 Million via the SWIFT System
In early 2016, the world witnessed one of the boldest cybercrimes in modern history — a meticulously planned attack that targeted the Bangladesh Bank, the central bank of Bangladesh. Through a combination of malware, deception, and exploitation of the SWIFT international banking system, hackers attempted to steal almost $1 billion USD.
Although most of the transactions were blocked in time, the criminals succeeded in transferring $81 million, much of which vanished into the labyrinth of the Philippine casino industry.
This event reshaped global banking cybersecurity and exposed the vulnerabilities of a system many had considered untouchable.
💻 What Was the Bangladesh Bank Heist?
The Bangladesh Bank Cyber Heist, also known as the SWIFT hack, occurred in February 2016. Cybercriminals infiltrated the bank’s computer systems and issued fraudulent money transfer orders through the SWIFT (Society for Worldwide Interbank Financial Telecommunication) network — a trusted messaging system used by thousands of financial institutions worldwide.
Their goal: steal nearly $1 billion from the bank’s account held at the Federal Reserve Bank of New York.
In total, 35 transfer requests were sent. Most were blocked, but five went through before anyone noticed.
- $81 million reached accounts in the Philippines.
- $20 million was sent to Sri Lanka — later recovered thanks to a spelling error that raised suspicion.
The rest, almost $850 million, was halted before payment.
🕵️ How the Attack Unfolded
Step 1: Initial Infiltration (2015)
Investigations revealed that hackers had gained access months before the heist.
They used phishing emails — disguised as job offers or routine correspondence — to trick employees into opening malicious attachments.
These emails installed malware that gave attackers remote access to internal systems.
For nearly a year, the criminals observed and mapped the bank’s network, learning how its SWIFT terminals and transaction processes worked. They gathered credentials, identified key personnel, and monitored communication habits to mimic real operations.
Step 2: Compromising the SWIFT System
Once inside, the attackers installed custom malware on the SWIFT Alliance Access server — the local software that connects the bank to the SWIFT network.
This malware allowed them to:
- Send genuine-looking SWIFT messages with stolen credentials.
- Hide or delete evidence of those messages in the system.
- Disable the printer that normally produced hard copies of outgoing transactions, preventing staff from seeing suspicious activity.
This combination of stealth and authenticity gave the hackers a temporary but crucial advantage.
Step 3: The Transfers
Between February 4 and 5, 2016, while Bangladesh was on its weekend break, the hackers sent 35 fraudulent SWIFT instructions to the New York Federal Reserve, requesting nearly $951 million USD in total.
These transfers were directed to accounts in:
- The Philippines (RCBC Bank)
- Sri Lanka (Pan Asia Banking Corporation)
However, many requests were flagged automatically due to spelling errors and irregularities — for example, one message mentioned a “Shalika Foundation,” which did not exist.
Still, five transactions slipped through, sending $81 million to the Philippines and $20 million to Sri Lanka.
Step 4: The Discovery
The attack might have gone unnoticed for days if not for a technical glitch.
On Saturday, February 6, Bangladesh Bank employees discovered that the SWIFT printer wasn’t working. When it was finally restarted, dozens of unauthorized transactions suddenly appeared on paper.
Panic ensued. Officials immediately tried to contact the New York Fed to stop the payments — but due to time-zone differences and weekend closures, it was too late for the first batch.
Step 5: Laundering the Money
The stolen $81 million landed in four accounts at Rizal Commercial Banking Corporation (RCBC) in Manila. These accounts had been opened a year earlier using fake names.
From there, the funds were rapidly moved through a series of currency exchanges and casinos, converted into Philippine pesos, and laundered through gambling operations — a sector then exempt from the country’s anti-money-laundering laws.
By the time investigators traced the trail, most of the funds had disappeared.
The $20 million sent to Sri Lanka, however, was recovered almost immediately — the receiving bank spotted a spelling error (“Fundation” instead of “Foundation”) and contacted the sender for verification.
🔍 Investigation and Attribution
Early Response
Bangladesh Bank hired international cybersecurity firms, including FireEye’s Mandiant and World Informatix, to analyze the breach.
Their findings pointed to an advanced persistent threat (APT) — a long-term, highly sophisticated operation consistent with state-sponsored hacking groups.
The Lazarus Group Connection
By mid-2017, multiple intelligence agencies and cybersecurity analysts identified strong links between the Bangladesh Bank attack and the Lazarus Group, a North Korean state-backed hacking organization also blamed for:
- The 2014 Sony Pictures hack.
- The 2017 WannaCry ransomware outbreak.
The U.S. Department of Justice later charged Park Jin Hyok, a North Korean programmer, for his alleged involvement in both incidents.
While direct proof remains classified or circumstantial, the consensus among cybersecurity experts is that Lazarus (or its subgroup APT 38) was responsible for orchestrating the heist.
⚙️ Why the Attack Succeeded
The heist revealed a dangerous mix of technical, procedural, and human weaknesses.
1. Poor Cybersecurity Infrastructure
- The SWIFT terminal was connected to the general bank network — not isolated.
- There was no firewall separating sensitive systems.
- Malware detection and logging were minimal.
- Physical security protocols (like monitoring access to terminals) were weak.
2. Lack of Monitoring and Redundancy
Because the printer responsible for SWIFT logs was offline, no one noticed abnormal transactions in real time.
Had there been redundant reporting or automated alerts, the transfers could have been blocked earlier.
3. Timing Exploitation
The hackers executed their plan during:
- Bangladesh’s weekend (Friday–Saturday),
- The U.S. business hours, and
- The Chinese New Year holidays, which affected intermediary institutions.
This timing ensured delays in communication and oversight.
4. Weak Anti-Money Laundering Controls
In 2016, Philippine casinos were exempt from anti-money-laundering regulations.
This loophole made it easy for criminals to convert and dissipate stolen funds without immediate scrutiny.
⚖️ Legal and Institutional Consequences
In Bangladesh
The heist caused enormous political and reputational damage.
The Governor of Bangladesh Bank, Atiur Rahman, resigned amid criticism of security failures.
Bangladesh later sued RCBC in a New York court for negligence and complicity in money laundering. The case is still ongoing in parts, though some funds have since been recovered.
In the Philippines
The Bangko Sentral ng Pilipinas (Philippine Central Bank) imposed a record fine of roughly $52 million on RCBC for violating anti-money-laundering protocols.
The RCBC branch manager involved in opening the fake accounts was convicted and imprisoned for money laundering.
However, most of the stolen $81 million has never been found.
Globally
The incident forced the SWIFT organization and central banks worldwide to reassess their cybersecurity policies.
SWIFT introduced the Customer Security Programme (CSP) — a mandatory set of security standards for all member banks, emphasizing:
- Network segmentation
- Multi-factor authentication
- Strict access controls
- Continuous anomaly detection
🧠 Key Lessons from the Heist
1. Cybersecurity Is a Banking Core Function
Banks can no longer treat cybersecurity as an IT expense — it is a fundamental pillar of financial integrity.
The Bangladesh case proved that digital vulnerabilities can cause losses comparable to — or greater than — physical robberies.
2. Insider Awareness Matters
Phishing and social engineering remain the easiest entry points.
Regular staff training, simulated attacks, and strict access policies are vital to prevent credential theft.
3. Global Coordination Is Essential
Because the heist spanned multiple countries and jurisdictions, investigators faced enormous challenges tracing and freezing funds.
This case highlighted the need for real-time international cooperation among financial regulators, law enforcement, and cybersecurity agencies.
4. Technology Alone Is Not Enough
Even the most advanced systems fail if basic operational discipline is lacking — such as monitoring printers, logs, or responding quickly to alerts.
🌍 The Legacy of the Bangladesh Bank Heist
Almost a decade later, the 2016 cyber-robbery continues to influence cybersecurity and financial governance.
Its impact includes:
- Stronger global banking regulations regarding SWIFT connectivity.
- The rise of cyber threat intelligence sharing among financial institutions.
- Heightened scrutiny of North Korea’s alleged state-sponsored cybercrime to fund its regime.
- A lasting reminder that even trusted systems can be exploited from within.
The Bangladesh Bank heist is now studied in universities, cybersecurity programs, and financial compliance training as one of the defining cybercrimes of the 21st century.
It demonstrated that hackers don’t need to attack the blockchain, cryptocurrency, or high-tech startups to steal millions — they can simply exploit human error and outdated banking infrastructure.
🔒 Conclusion
The 2016 Bangladesh Bank Cyber Heist was not just a theft — it was a wake-up call for the entire global financial system.
It proved that:
- Even central banks can be vulnerable.
- Cyberattacks can cross borders faster than legal frameworks can respond.
- Trust-based systems like SWIFT are only as strong as their weakest link.
While Bangladesh Bank has since reinforced its defenses and international standards have improved, the fundamental lesson endures:
In a hyperconnected world, cybersecurity is not optional — it is the foundation of financial stability. 💡
📚 Sources & References
- Bangladesh Bank Robbery (2016) – Wikipedia
- ISACA Journal (2023): Lessons Learned from the Bangladesh Bank Heist
- KPMG Report: Bangladesh Hack Illustrates Rising Sophistication of Attacks (2016)
- The Hedge Fund Journal – The Bangladesh Cyberheist
- Wired – The $81 Million Bangladesh Bank Heist: What We Know (2016)
- Darknet Diaries, Episode 72 – The Bangladesh Bank Heist
- U.S. Department of Justice, Criminal Complaint (2018): United States v. Park Jin Hyok
- SWIFT Customer Security Programme (CSP) official documentation
