An empty bank operations floor at night

Bank heist · February 5, 2016 · 6 min

Bangladesh Bank: $81 million left through SWIFT over a weekend

MedellínSoftware · Medellín, Colombia

February 2016. They tried to move nearly a billion. A spelling error and the New York Fed's closing hours saved the rest. The trail points to Lazarus.

medellinsoftware.com/story/banco-de-bangladesh-81-millones-swift/

Stolen

USD 81M

Attempt

~USD 951M

Channel

SWIFT

Attribution

Lazarus

In February 2016, operators inside Bangladesh Bank's network issued SWIFT orders for nearly $951 million toward accounts in the Philippines and Sri Lanka. The Federal Reserve Bank of New York, the correspondent, processed part of it. $81 million reached casinos in Manila. The rest stuck.

One order said “fandation” instead of “foundation.” An intermediary bank stopped it as suspicious. The weekend and the Fed's hours did the rest: by the time Dhaka understood the hole, Monday had passed.

Investigators and the FBI placed the malware and the method with Lazarus, the same North Korean circle as the exchange thefts. This was not an ATM. It was the system banks use to speak to each other.

The figure that did not leave — nearly a billion — matters as much as the one that did. The margin between a historic theft and an impossible one was a typo.

Source · Reuters / FBI

The desk

The file is public. The briefing is requested.

AI and deep military intelligence. Medellín.