Bangladesh Bank SWIFT Cyberheist

What happened

Attackers infected the Bangladesh Bank's systems with malware, capturing credentials for the SWIFT messaging system. They then sent 35 fraudulent transfer requests totaling nearly $1 billion to the Federal Reserve Bank of New York. While most were blocked, five requests succeeded, transferring $101 million to accounts in the Philippines and Sri Lanka. Most of the funds routed to the Philippines were laundered through casinos and lost.

Technical mechanism

The attackers used spear-phishing to gain initial access, then deployed custom malware (including a keystroke logger) to compromise the bank's SWIFT terminal, bypass local security checks, and hide the fraudulent transaction records.

Why it matters

The heist exposed critical vulnerabilities in the global financial system's reliance on the SWIFT messaging network, prompting worldwide reassessment of financial cybersecurity.

Impact

Loss of $81 million (unrecovered) from Bangladesh Bank, the resignation of the bank's governor, and a massive loss of confidence in the security of international bank transfers.

Response

The Federal Reserve Bank of New York blocked the majority of the requested transfers. SWIFT subsequently introduced the Customer Security Programme (CSP) to enforce mandatory security controls for all users of its network.

Defensive lessons

• Financial institutions must implement strict segregation of duties and multi-factor authentication for critical transfer systems.
• Continuous monitoring of transaction anomalies and out-of-band verification for large transfers are essential.

Evidence register

1. ISACA Journal — Lessons Learned From the Bangladesh Bank Heist (verified)