The 2016 Bangladesh Bank Heist and the Typo That Saved Millions

In February 2016, attackers sent a series of fraudulent payment instructions that would have moved close to a billion US dollars out of the account held by Bangladesh's central bank at the Federal Reserve Bank of New York. Most of the transfers were blocked, in part because of a spelling mistake. Even so, about 81 million dollars was successfully taken, making it one of the largest bank thefts ever carried out through a computer network.

What happened

On 4 February 2016, a Thursday evening in Bangladesh, the attackers used credentials and access on the bank's systems to send payment orders through SWIFT, the messaging network that banks use to instruct each other to move money. The orders asked the New York Fed to transfer a total of about 951 million dollars from Bangladesh Bank's account to accounts in the Philippines and Sri Lanka.

The timing was deliberate. The following days were weekend days in Bangladesh, where the working week runs differently from the one in the United States, and Bangladesh Bank's staff were away. Reports also said the printer that normally produced confirmations of SWIFT messages had stopped working, which delayed the discovery.

The typo

Thirty-five payment orders were sent. Five were processed, totalling 101 million dollars. Of those, about 20 million dollars sent to a Sri Lankan non-profit organisation was recovered after a bank flagged a spelling error: the name of the recipient, a foundation, had been misspelled. The additional questions raised by the intermediary bank led to the transfer being halted. The remaining 30 orders, worth about 850 million dollars, were held back by the New York Fed for further checks.

The roughly 81 million dollars that went to the Philippines was moved through accounts at a local bank and then through casinos, which are not subject to the same anti-money-laundering rules there at the time. Only a small portion has been recovered.

How it was done

Investigators found that the attackers had been inside Bangladesh Bank's network for weeks. They installed malware that manipulated the bank's SWIFT software, made it possible to send messages and later hid evidence of the transfers by tampering with the records and the printed confirmations. The attackers needed to understand the bank's procedures in detail. Reports described a lack of basic network controls, including inexpensive switches and no firewall separating the SWIFT systems from the rest of the network.

Who was blamed

US authorities and several security companies linked the attack to the Lazarus Group, associated with North Korea. In 2018 the US Department of Justice charged a North Korean programmer, Park Jin Hyok, in connection with this attack and other incidents, including the Sony Pictures hack and the WannaCry outbreak. North Korea denied involvement. Similar attacks affected banks in other countries in the same period, which led SWIFT to introduce a customer security programme.

Security lessons from the heist

• Separate critical systems. The payment environment should not sit on the same flat network as everyday machines.
• Do not rely on one person or one control. Payments should require independent approval, and unusual ones should be flagged automatically.
• Monitor outside business hours. Attackers choose weekends and holidays on purpose.
• Verify the details. A simple, human check on the recipient's name stopped part of the theft.

The response from the banking world

The heist forced the banking industry to look again at how it protected the endpoints that connect to SWIFT. SWIFT itself stressed that its core network had not been compromised and that the attacks exploited weaknesses in the banks' own local security. It nevertheless launched the Customer Security Programme in 2016, which set out mandatory and advisory security controls for members, and it began sharing indicators of compromise so banks could look for the same malware.

Similar cases came to light in other countries, including earlier incidents at banks in Vietnam and Ecuador, which confirmed that Bangladesh was not a one-off. The lesson that attackers go after the weakest connected organisation, not the strongest, became a central idea in financial security.

That principle applies directly to small websites. Attackers do not need to defeat your hosting provider's infrastructure if they can instead take over your admin login, your domain registrar account or your email. The security of the whole depends on the weakest login you have.

The practical lesson for site owners

Treat the accounts that control money or domains as critical systems. Use unique passwords and two-factor authentication on your domain registrar, payment provider and hosting account, and enable alerts for logins and changes. Make sure no single person has unchecked power over everything. Look at access logs regularly, because attackers often strike when nobody is watching.

Our security page lists protective features available with our hosting, and our knowledge base shows how to review and tighten the access list on your Plesk account.