The Lazarus Heist (Bangladesh Bank Robbery)
The Story
In one of the most audacious cyberheists in history, hackers infiltrated the Bangladesh Bank's systems and gained access to its SWIFT credentials. They issued 35 fraudulent orders to transfer nearly $1 billion from its account at the New York Fed. Most transactions were blocked, but $81 million was successfully routed to casinos and junket operators in the Philippines, where it was laundered and vanished. The attack was linked to the North Korean Lazarus Group.
🚩 Red Flags
- Use of sophisticated, custom malware to infiltrate bank systems
- Transactions to high-risk jurisdictions (Philippines casinos)
- Attempted transfers on a Friday to exploit weekend delays
- Typos in transfer instructions used to avoid keyword filters
- Known state-sponsored hacker TTPs (Tactics, Techniques, Procedures)
⚖️ The Fallout
The governor of Bangladesh Bank resigned. The New York Fed faced scrutiny over its security procedures. The incident exposed critical vulnerabilities in the global SWIFT messaging system. A significant portion of the stolen funds remains missing.
📚 Lessons Learned
No financial institution is immune to state-level cyber attacks. The global banking system's security is only as strong as its weakest link. Highlighted the use of casinos for rapid, large-scale money laundering.
Related Scams