The Hackers Who Stole $81 Million From a Central Bank

TL;DR

Cyber thieves stole $81 million from the Bangladesh Bank in 2016 using an advanced hacking scheme.

Transcript

cyber thieves stole $81 million from the Bangladesh Bank Bangladesh bon in 2016 during a seemingly ordinary weekend in Bangladesh where the work week ends on Saturday employees at the Central Bank of Bangladesh made a chilling Discovery their standard printer which handles International transfer receipts began printing documents confirming a stagge... Read More

Key Insights

• 👊 The Bangladesh Bank heist was characterized by an intricate cyber-attack exploiting human error through social engineering.
• 🛩️ Only a small fraction of the transactions were successfully executed due to irregularities noticed by the Federal Reserve, underscoring the importance of monitoring banking activities.
• 🖤 The lack of adequate cybersecurity investments in underprivileged countries can serve as an enticing target for skilled hackers.
• 💄 The heist exemplified how hackers can leverage timing and communication breakdowns to complicate detection efforts, making effective response challenging.
• 🏦 The involvement of a complicit bank employee demonstrates the potential for insider threats in financial institutions and highlights vulnerabilities from within.
• 🛀 Despite extensive investigations into the incident, the true identities of the hackers remain elusive, showing the difficulties in tracing organized cyber-crime.
• 😒 The use of casinos for laundering not only highlights weaknesses in financial regulations but also the necessity for enhanced monitoring to combat illicit activities.

Questions & Answers

Q: How did the hackers first gain access to the Central Bank of Bangladesh?

The hackers employed social engineering tactics, sending fake emails that appeared to contain job inquiries. Bank employees, believing them to be legitimate, opened these attachments, which contained malware, allowing the hackers to infiltrate the bank's network and monitor it for a year leading up to the heist.

Q: Why wasn't the heist larger than $81 million?

Out of 35 transfer requests amounting nearly $951 million, only four transactions totaling $81 million were processed due to unusual activity that raised flags at the Federal Reserve. The remaining requests were put under review, preventing the hackers from exploiting the full potential of their operation and losing an estimated $870 million.

Q: What role did the branch manager play in the heist?

The branch manager, Maya Diido, facilitated cash withdrawals from the accounts into which the stolen funds were transferred. She cooperated with the thieves to arrange large cash amounts and was later convicted for money laundering, receiving a 59-year prison sentence.

Q: How did the hackers manage to launder the stolen money?

The stolen funds were withdrawn in large sums and converted to cash using local casinos where the thieves exchanged the cash for casino chips. The cash was then exchanged back to different bills, making it untraceable, a common practice in the Philippines due to the lack of financial oversight in gambling venues.

Q: What were the consequences of the heist for the Central Bank of Bangladesh?

The immediate fallout included the resignation of the bank's governor and several officials, overshadowing the severe financial implications of losing $81 million. The event highlighted vulnerabilities in banking cybersecurity measures and led to worldwide media coverage of the breach.

Q: What similarities were found between this heist and the 2014 Sony hack?

Security experts identified that the malware used in the Bangladesh Bank heist bore strong similarities to that used in the Sony hack, suggesting the involvement of the Lazarus Group, a notorious hacking organization believed to have ties to North Korea.

Q: Why was the timing of the heist crucial for the hackers?

The hack was strategically executed just before weekends in Bangladesh, the U.S., and the Philippines. This timing created delays in communication between banks, providing the hackers with a larger window to carry out their scheme without immediate detection or intervention.

Summary & Key Takeaways

• In February 2016, hackers exploited vulnerabilities at the Central Bank of Bangladesh, initiating a heist that resulted in the unauthorized transfer of $81 million to accounts in the Philippines.

• The sophisticated attack involved social engineering tactics to infiltrate the bank, taking advantage of timing and inadequate security measures during weekends when communication was stalled.

• The laundering of the stolen money was facilitated through local casinos, and despite a long investigation, only the bank's branch manager was prosecuted while the hackers remained unidentified.