Bangladesh Bank robbery

The money transferred to the Philippines was deposited in five separate accounts with the Rizal Commercial Banking Corporation (RCBC); the accounts were later found to be under fictitious identities. The funds were then transferred to a foreign exchange broker to be converted to Philippine pesos, returned to the RCBC and consolidated in an account of a Chinese-Filipino businessman;[11][9] the conversion was made from 5 to 13 February 2016.[12] It was also found that the four U.S. dollar accounts involved were opened at the RCBC as early as 15 May 2015, remaining untouched until 4 February 2016, the date the transfer from the Federal Reserve Bank of New York was made.[12]

On 8 February 2016, during the Chinese New Year, Bangladesh Bank informed RCBC through SWIFT to stop the payment, refund the funds, and to "freeze and put the funds on hold" if the funds had already been transferred. Chinese New Year is a non-working holiday in the Philippines and a SWIFT message from Bangladesh Bank containing similar information was received by RCBC only a day later. By this time, a withdrawal amounting to about US$58.15 million had already been processed by RCBC's Jupiter Street (in Makati City) branch.[12]

On 16 February, the Governor of Bangladesh Bank requested Bangko Sentral ng Pilipinas' assistance in the recovery of its US$81 million funds, saying that the SWIFT payment instructions issued in favor of RCBC on 4 February 2016, were fraudulent.[12]

The US$20 million transfer to Sri Lanka was intended by hackers to be sent to the Shalika Foundation, a Sri Lanka-based private limited company. The hackers misspelled "Foundation" in their request to transfer the funds, spelling the word as "Fundation". This spelling error gained suspicion from Deutsche Bank, a routing bank which put a halt to the transaction in question after seeking clarifications from Bangladesh Bank.[8][13][14]

Sri Lanka-based Pan Asia Bank initially took notice of the transaction, with one official noting the transaction as too big for a country like Sri Lanka. Pan Asia Bank was the one which referred the anomalous transaction to Deutsche Bank. The Sri Lankan funds have been recovered by Bangladesh Bank.[8]

Initially, Bangladesh Bank was uncertain if its system had been compromised. The governor of the central bank engaged World Informatix Cyber Security, a US-based firm, to lead the security incident response, vulnerability assessment and remediation. World Informatix Cyber Security brought in the forensic investigation company Mandiant, for the investigation. These investigators found "footprints" and malware of hackers, which suggested that the system had been breached. The investigators also said that the hackers were based outside Bangladesh. An internal investigation has been launched by Bangladesh Bank regarding the case.[8]

The Bangladesh Bank's forensic investigation found out that malware was installed within the bank's system sometime in January 2016, and gathered information on the bank's operational procedures for international payments and fund transfers.[12]

The investigation also looked into an unsolved 2013 hacking incident at the Sonali Bank, wherein US$250,000 was stolen by still unidentified hackers. According to reports, just as in the 2016 central bank hack, the theft also used fraudulent fund transfers using the SWIFT global payment network. The incident was treated by Bangladeshi police authorities as a cold-case until the suspiciously similar 2016 Bangladesh central bank robbery.[15]

The Philippines' National Bureau of Investigation (NBI) launched a probe and looked into a Chinese-Filipino who allegedly played a key role in the money laundering of the illicit funds. The NBI is coordinating with relevant government agencies including the country's Anti-Money Laundering Council (AMLC). The AMLC started its investigation on 19 February 2016, of bank accounts linked to a junket operator.[12] AMLC has filed a money laundering complaint before the Department of Justice against a RCBC branch manager and five unknown persons with fictitious names in connection with the case.[16]

A Philippine Senate hearing was held on 15 March 2016, led by Senator Teofisto Guingona III, head of the Blue Ribbon Committee and Congressional Oversight Committee on the Anti-Money Laundering Act.[17] A closed-door hearing was later held on 17 March.[18] Philippine Amusement and Gaming Corporation (PAGCOR) has also launched its own investigation.[8] On 12 August 2016, RCBC was reported to have paid half of the Ph₱ 1 billion penalty imposed by the Central Bank of the Philippines.[19] Prior to that, the bank reorganized its board of directors by increasing the number of independent directors from four to seven.[20]

On 10 January 2019, Maia Santos Deguito, a former manager at RCBC, was convicted on 8 counts of money laundering and sentenced to 4 to 7 years imprisonment for each count at a Makati City Regional Trial Court.[21] On 12 March 2019, RCBC sued Bangladesh Bank for embarking "on a massive ploy and scheme to extort money from plaintiff RCBC by resorting to public defamation, harassment and threats geared towards destroying RCBC's good name, reputation, and image."[22]

On 6 February 2023, the First Division of the Court of Appeals dismissed Deguito's appeal and upheld the Makati City Regional Trial Court's conviction in 2019.[23]

FireEye's Mandiant forensics division and World Informatix Cyber Security, both US-based companies, investigated the hacking case. According to investigators, the perpetrators' familiarity with the internal procedures of Bangladesh Bank was probably gained by spying on its workers. The US Federal Bureau of Investigation (FBI) reported that agents have found evidence pointing to at least one bank employee acting as an accomplice. The FBI also alleged that there is evidence that points to several more people as possibly assisting hackers in navigating the Bangladesh Bank's computer system.[24] The government of Bangladesh has considered suing the Federal Reserve Bank of New York in order to recover the stolen funds.[8]

Federal prosecutors in the United States have revealed possible links between the government of North Korea and the theft.[25] According to this report, U.S. prosecutors suspected that the theft was perpetrated by criminals backed by the government of North Korea. The report also said that to be included in the charges are "alleged Chinese middlemen", who facilitated the transfer of the funds after it had been diverted to the Philippines.[26]

Some security companies, including Symantec Corp and BAE Systems, claimed that the North Korea-based Lazarus Group, one of the world's most active state-sponsored hacking collectives, were probably behind the attack. They cite similarities between the methods used in the Bangladesh heist and those in other cases, such as the hack of Sony Pictures Entertainment in 2014, which U.S. officials also attributed to North Korea. Cybersecurity experts say Lazarus Group was also behind the WannaCry ransomware attack in May 2017 that infected hundreds of thousands of computers around the world.[27]

The Cybersecurity and Infrastructure Security Agency published an alert "FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks", which attributed the Bank of Bangladesh hack in 2016 to BeagleBoyz. The agency claimed that BeagleBoyz is a threat actor group under the North Korean government's Reconnaissance General Bureau, and have been active since 2014.[28]

US National Security Agency Deputy Director Richard Ledgett was also quoted as saying that, "If that linkage from the Sony actors to the Bangladeshi bank actors is accurate—that means that a nation state is robbing banks."[29]

The U.S. has charged a North Korean computer programmer with hacking the Bangladesh Bank, alleging this was carried out on behalf of the regime in Pyongyang. The same programmer has also been charged in connection with the WannaCry 2.0 virus and the 2014 Sony Pictures attack.[30]

Computer security researchers have linked the theft to as many as eleven other attacks, and alleged that North Korea had a role in the attacks, which, if true, would be the first known incident of a state actor using cyberattacks to steal funds.[31][32]