Loading story…
Investigators tied the attempted theft of nearly $1 billion from Bangladesh Bank to hackers linked to North Korea, strengthening suspicions that the operation was part of a broader campaign against financial institutions using the SWIFT payment network. In the Bangladesh case, fraudulent transfer messages were sent through the bank’s compromised systems; most were blocked, but about $81 million reached accounts in the Philippines and was later laundered through casinos. The fraud was reportedly uncovered after a printer malfunction disrupted routine transaction records, helping expose the unauthorized transfers.
The inquiry widened to as many as 12 additional banks, with security firms reporting contacts from institutions in countries including New Zealand and the Philippines that feared similar compromises. Researchers from BAE Systems, Symantec, FireEye, and later Kaspersky said malware and operational overlaps connected the bank theft activity to the same cluster associated with attacks on U.S. and South Korean targets and the Sony Pictures breach, which U.S. authorities had attributed to North Korea. The case raised concern that once a bank connected to SWIFT is breached, fraudulent messages can appear legitimate to other institutions, undermining trust in the global payments system.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
Kaspersky Lab said it had found a direct connection between the hackers behind the banking theft campaign and North Korea. The finding represented a further attribution development tying the SWIFT-related bank attacks to North Korean operators.
The New York Times reported that investigators had linked digital theft attempts against global banks to North Korea. The report marked a broader public framing of the Bangladesh Bank incident as part of a wider North Korean campaign targeting financial institutions.
Security researchers said malware and tactics in the Bangladesh Bank case resembled those used by the group behind attacks on U.S. and South Korean targets since 2009 and the 2014 Sony Pictures breach. This strengthened early technical attribution connecting the bank heists to the Lazarus threat cluster.
By May 2016, investigators were examining possible compromises at up to 12 more banks connected to the SWIFT network, including institutions in New Zealand and the Philippines. FireEye said multiple banks had contacted it, while SWIFT warned some reports might be false positives and urged banks to inspect their systems.
Reporting said RCBC branch manager Maia Santos Deguito approved withdrawals totaling $81 million even after Bangladesh Bank asked for the transfers to be stopped. Her lawyer said she acted under instructions from higher-level officials, suggesting broader involvement.
Bangladesh Bank discovered the unauthorized transfers after a printer error disrupted normal printing of transaction records, helping alert staff to the fraud. The discovery triggered urgent efforts to stop the transfers, though tens of millions had already been sent.
Fraudulent SWIFT transfer orders were sent from Bangladesh Bank to the Federal Reserve Bank of New York in an attempt to steal nearly $1 billion. Most transfers were blocked, but about $81 million was successfully routed to the Philippines and later laundered through casinos.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
bbc.com
Open sourcenytimes.com
Open sourcearstechnica.com
Open sourcesmh.com.au
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean authorities reportedly arrested members of an insider cybercrime ring accused of breaching the internal networks of **Chosun Central Bank** and **Foreign Trade Bank** and siphoning off state trade funds and foreign currency. According to reporting cited in a related social media post, the group included former North Korean cyber operations personnel and younger IT specialists, making the case notable because the suspects were allegedly state-trained insiders tied to elite military cyber and technical institutions. Investigators reportedly uncovered discrepancies in foreign payment approvals and suspicious overseas IP access before launching a covert probe that culminated in raids and arrests in Pyongyang. The suspects allegedly moved stolen funds through shell accounts, converted proceeds into cryptocurrency, and relied on brokers and border-area contacts to launder the money back into **U.S. dollars** and **Chinese yuan**, exposing a breach that struck core parts of North Korea’s financial system.
Jul 24, 2026
Crypto exchange **Bybit** lost about **$1.5 billion** in Ethereum-linked assets after attackers compromised the platform in what has been described as the largest cryptocurrency theft on record. Blockchain investigators at TRM Labs and a subsequent **FBI/IC3** public attribution linked the operation to North Korean threat actors, citing wallet overlaps and tradecraft consistent with earlier DPRK-backed campaigns. Reporting tied the theft to a broader pattern of financially motivated North Korean operations that have previously targeted major crypto platforms and financial institutions. After the theft, the stolen funds were moved at high speed through intermediary wallets, decentralized exchanges, and cross-chain bridges, with a large share ultimately converted into **Bitcoin**. Analysts said the laundering operation showed an evolution in DPRK tactics away from reliance on traditional mixers and toward rapid, high-volume cross-chain obfuscation; later reporting said more than **$1 billion** had been laundered within months. The heist also triggered recovery efforts, including Bybit's **10% bounty** program for frozen or recovered assets, and intensified debate over cryptocurrency oversight and the implications for future U.S. regulation.
Jun 29, 2026
The U.S. Department of Justice unsealed charges against three alleged North Korean military hackers tied to the Reconnaissance General Bureau, identifying them as members of the **Lazarus Group/APT38** behind a years-long campaign of cyberattacks and financial crime. Prosecutors linked the defendants to the 2014 **Sony Pictures** intrusion, SWIFT-enabled bank theft attempts including the Bangladesh Bank case, **FASTCash** ATM cash-out operations, the **WannaCry 2.0** ransomware outbreak, spear-phishing, and the **AppleJeus** cryptocurrency malware scheme. Authorities said the operations targeted banks, cryptocurrency businesses, and other organizations worldwide, with attempted thefts and losses totaling roughly **$1.3 billion**. Security and law-enforcement reporting described a broad Lazarus toolkit used across those operations, including malware such as **Trojan.Banswift**, **Backdoor.Contopee**, **Downloader.Ratankba**, **Trojan.Fastcash**, and AppleJeus variants, while WannaCry was noted to have spread via **EternalBlue** against Windows flaws including `CVE-2017-0144` and `CVE-2017-0145`. The case also connected North Korean operators to laundering networks and later cryptocurrency theft activity, including the FBI’s attribution of the **$100 million Harmony Horizon Bridge** theft to Lazarus and its **TraderTraitor** campaign. U.S. authorities said they seized about **$1.9 million** in stolen cryptocurrency, issued victim notifications and joint guidance, and continued efforts to trace and freeze assets used to fund Pyongyang’s weapons programs.
Aug 15, 2026