Loading story…
Hackers penetrated Bangladesh Bank’s systems and used stolen payment credentials to send fraudulent transfer requests from the bank’s account at the Federal Reserve Bank of New York, attempting to steal nearly $1 billion. Most of the transfers were halted after a misspelled instruction tied to a $20 million payment to a Sri Lankan entity drew scrutiny, along with concerns over the unusual volume and nature of the requests. Even so, about $81 million was successfully transferred to the Philippines, prompting investigations by Bangladesh Bank, Philippine authorities, and incident responders including FireEye Mandiant.
The theft exposed weaknesses in cross-border banking controls and intensified a dispute over responsibility for the losses. Bangladesh criticized the New York Fed’s handling of the transfer requests, while suspicions grew that stolen funds were funneled through Philippine casinos. The fallout later expanded into litigation, with Philippine bank RCBC suing Bangladesh’s central bank over what it described as damaging allegations tied to the cyber heist.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
In March 2019, Philippine bank RCBC filed a lawsuit against Bangladesh's central bank over what it described as 'vicious' claims tied to the 2016 cyber heist. The suit marked a legal escalation in the dispute over responsibility and handling of the stolen funds.
Following discovery of the fraudulent transfers in February 2016, Bangladesh Bank, Philippine authorities, and incident responders including FireEye Mandiant began investigating the heist and attempting to recover the stolen money. The incident drew attention to weaknesses in international banking controls and prompted criticism of the New York Fed.
During processing of the transfer requests in early February 2016, a misspelling in a $20 million instruction to a Sri Lankan entity and concerns about the unusual volume and nature of the transactions triggered additional scrutiny. As a result, most of the attempted transfers were blocked before completion.
Despite the failed larger theft attempt, roughly $81 million was successfully moved from Bangladesh Bank to accounts in the Philippines. The stolen funds were later suspected of being funneled onward through Philippine casinos.
In early February 2016, attackers compromised Bangladesh Bank's systems and used stolen payment credentials to submit fraudulent transfer requests from the bank's account at the Federal Reserve Bank of New York. The requests sought to move nearly $1 billion to accounts in Sri Lanka and the Philippines.
Hackers reportedly compromised Bangladesh Bank's internal systems and planted malicious software in January 2016, before launching the fraudulent SWIFT transfer requests the following month. This earlier foothold suggests advance preparation for the February bank heist.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
6 references tracked. Mallory keeps watching after this page renders.
nytimes.com
Open sourceinsurancejournal.com
Open sourcenytimes.com
Open sourcenytimes.com
Open sourceindependent.co.uk
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Investigators tied the attempted theft of nearly **$1 billion** from Bangladesh Bank to hackers linked to North Korea, strengthening suspicions that the operation was part of a broader campaign against financial institutions using the **SWIFT** payment network. In the Bangladesh case, fraudulent transfer messages were sent through the bank’s compromised systems; most were blocked, but about **$81 million** reached accounts in the Philippines and was later laundered through casinos. The fraud was reportedly uncovered after a printer malfunction disrupted routine transaction records, helping expose the unauthorized transfers. The inquiry widened to as many as **12 additional banks**, with security firms reporting contacts from institutions in countries including New Zealand and the Philippines that feared similar compromises. Researchers from BAE Systems, Symantec, FireEye, and later Kaspersky said malware and operational overlaps connected the bank theft activity to the same cluster associated with attacks on U.S. and South Korean targets and the **Sony Pictures** breach, which U.S. authorities had attributed to North Korea. The case raised concern that once a bank connected to SWIFT is breached, fraudulent messages can appear legitimate to other institutions, undermining trust in the global payments system.
Jun 29, 2026
Bank of Baroda has confirmed a cybersecurity incident after threat actors claimed to have stolen and published sensitive bank data online. The bank said a compromised employee email account enabled unauthorized access to certain data, but added that its core banking systems were not accessed and that the incident was detected and contained quickly. Public reporting said leaked samples and directory listings appeared to include internal documents, customer onboarding records, audit materials, internal emails, loan documents, and corporate banking files, although the authenticity and full scope of the exposed data have not been independently verified. Researchers tracking darknet activity said the stolen material was advertised for sale on underground forums and a Telegram channel by an actor identified in separate reports as **"leak-king-F"** and publicly linked elsewhere to **Triple X**. One report described the cache as roughly **1 TB** of data spanning retail, corporate, and digital banking operations, while also noting an unverified claim that the breach stemmed from a weak password. Bank of Baroda had not confirmed customer-data exfiltration, and the incident raised concerns over fraud, phishing, and follow-on attacks if internal security and audit documents were exposed.
Jul 30, 2026
Brazilian and German authorities have disrupted a cyber-enabled bank fraud operation that allegedly stole about **€30 million** from German bank accounts by exploiting a vulnerability introduced through a faulty software update at a payment and transaction processing provider. Investigators said the attackers used the flaw over four days in November 2023 to trigger unauthorized direct debits and withdrawals from German online banking customers, with media reports identifying **Commerzbank** as the affected institution. The bank confirmed that clients were impacted but said customers did not ultimately suffer financial losses. The joint investigation, conducted by Brazil’s Federal Police with support from Germany’s **BKA** under **Operation Klonen**, led to arrests in both Brazil and Europe. Authorities said four suspects were arrested in Brazil and three more were identified or detained in Europe for prosecution in **Spain** and **Bulgaria**, while police also carried out 21 search-and-seizure warrants. Investigators said much of the stolen money was withdrawn in Brazil, with additional cash-outs in four European countries, and that the laundering scheme involved cloned payment cards; seized assets were reported at up to **R$106 million** (more than **$20 million**).
Aug 19, 2026