Bangladesh Bank Heist: A Day-by-Day Case Study of the $81 Million SWIFT Theft

Late on a Thursday night in February 2016, a computer inside Bangladesh's central bank in Dhaka began sending payment orders to New York, and the Bangladesh Bank heist was under way. The staff had gone home for the weekend. By the time anyone looked closely, about $81 million had left the country's account at the Federal Reserve Bank of New York and was moving through the Philippines.

The attackers asked for close to $1 billion. They got far less, partly because of a spelling mistake and partly because a few alert people did their jobs. This case study walks through the incident one day at a time, because the calendar explains this theft better than the malware does. This post covers five things:

• A day-by-day timeline with Dhaka, Pakistan and New York times
• How the attackers reached the SWIFT system, explained for defenders
• Where the $81 million went, and how little came back
• Who was blamed, and what a US criminal complaint does and does not prove
• Eight lessons from the Bangladesh Bank heist that Pakistani banks and businesses can apply this month

What Was the Bangladesh Bank Heist?

Bangladesh Bank is the central bank of Bangladesh. Like many central banks, it keeps part of its foreign reserves in an account at the Federal Reserve Bank of New York. It sends instructions about that money through SWIFT, the secure messaging network that banks use to tell each other where to send funds.

In February 2016, attackers used Bangladesh Bank's own SWIFT access to send 35 fake payment orders. Al Jazeera reported that these orders could have moved about $950 million if all of them had gone through. Five were paid. Four of them, worth $81 million, reached accounts in the Philippines. The fifth, worth $20 million, was headed for Sri Lanka and was stopped.

Nobody broke into the Fed, and SWIFT has said its own network was not compromised. The attackers took control of the sender's computers and made the fake orders look like the real thing. That is why the Bangladesh Bank heist is still taught as a classic SWIFT hack. The network did exactly what it was told.

The Bangladesh Bank Heist Timeline, Day by Day

Three countries and three weekends shaped the Bangladesh Bank heist. Bangladesh takes Friday and Saturday off. The New York Fed closes on Saturday and Sunday. In 2016, Monday 8 February was a Lunar New Year holiday in the Philippines. The Philippine Center for Investigative Journalism (PCIJ) notes that the money arrived in Manila during those celebrations, when nobody was watching the accounts.

Pakistan time is one hour behind Dhaka. New York was 11 hours behind Dhaka in February. The table uses those offsets.

Sources on the Bangladesh Bank heist give two different dates for the transfer. Al Jazeera says the Fed moved the money on 4 February. The South China Morning Post says 5 February. Both can be right. A message sent late on Thursday night in Dhaka lands on Thursday afternoon in New York, which is already Friday morning back in Bangladesh.

How Did the Attackers Get Into the SWIFT System?

The US Department of Justice says the group behind the Bangladesh Bank heist first got into the bank's network with spear-phishing emails. These are targeted messages built to look normal to one person or team. From there, the DOJ complaint summary says, they reached computers connected to SWIFT and sent fraudulently authenticated messages to the New York Fed.

An ISACA Journal review of the case adds that the malware let the attackers watch the network for months before they acted. That patience matters. They learned how the payment team worked, what normal messages looked like and when people would be away.

The researchers at BAE Systems analysed a custom tool from the attack in April 2016. They described it as part of a larger toolkit that interacted with the bank's local SWIFT Alliance Access software. Its job was to hide the attackers' tracks, which delayed detection and bought time to move the money.

In plain terms, the attack had three stages:

1. Get inside. A phishing email gives the attackers a foothold on an ordinary office computer.
2. Move to the money. They work their way to the machines that can send payment messages.
3. Hide the evidence. They tamper with the bank's own record of what was sent, so staff see nothing unusual.

None of these stages needed a flaw in SWIFT. Each one depended on weak separation, weak monitoring or slow human follow-up inside the victim bank. The first stage may sound familiar from our WhatsApp account recovery guide. Most account takeovers still begin with a message that tricks one person.

Why the Weekend Mattered More Than the Malware

Bangladesh Bank printed paper confirmations of its SWIFT messages. According to the SCMP's account of a report filed with police, those printers were faulty, and engineers could not fix them until 6 February. A joint director said in that report that staff assumed it was a common glitch, because it had happened before.

That small assumption cost a full day. When staff did see the problem, the Fed was closed. When the Fed reopened, Manila was on holiday. Every handover between time zones added hours in which the money could be withdrawn and spread out.

The attackers did not need to beat every control. They only needed the people behind those controls to be unavailable at the right moment. This is the main lesson of the Bangladesh Bank heist. Timing can do more damage than any single piece of code.

Where Did the Money Go After It Left New York?

A Reuters report published by The Daily Star sets out what happened at the Federal Reserve Bank of New York. The Fed first rejected all 35 requests because the SWIFT formatting was wrong. The attackers fixed the formatting and sent them again the same day. This time the Fed held 30 for a sanctions review and paid five, worth $101 million.

The $20 million transfer to Sri Lanka was reversed because the word "foundation" was misspelled in the request. Al Jazeera reported that a routing bank noticed the error and asked Bangladesh Bank to confirm. One typo saved $20 million.

The remaining $81 million went to the Philippines. PCIJ's timeline follows the money through accounts at Rizal Commercial Banking Corporation (RCBC) and a remittance firm, Philrem, into the casino industry. It reports that Solaire received $29 million and Midas Hotel and Casino received $21.2 million. Casino chips and cash are hard to trace, which made recovery slow.

The recovery numbers are small. PCIJ reports that only $15 million had been recovered from the Philippines more than four years after the Bangladesh Bank heist. Part of it was handed back by businessman Kam Sin Wong. By our arithmetic, that leaves about $66 million of the $81 million unrecovered at that point.

Who Was Blamed, and How Strong Is the Evidence?

On 6 September 2018, the DOJ unsealed a criminal complaint against Park Jin Hyok, a North Korean citizen. The complaint alleges he belonged to a government-backed team that security researchers call the Lazarus Group. It says he worked for Chosun Expo Joint Venture, which the DOJ describes as a front company for North Korean military intelligence. The same complaint covers the 2014 Sony Pictures attack and the 2017 WannaCry ransomware outbreak.

It helps to be precise about what this means:

• Confirmed: the US government formally accused Park and placed the Bangladesh Bank theft within the conspiracy it describes.
• Not established in court: a criminal complaint is an accusation, not a conviction. The DOJ release lists the Bangladesh Bank heist as part of the group's activities but does not say Park personally sent the payment orders.
• Wider pattern, per the DOJ: the complaint ties the case to a campaign against several banks in which the group tried to steal at least $1 billion between 2015 and 2018.

The pattern did not stop in 2016. North Korea hackers are blamed for some of the largest crypto thefts since the Bangladesh Bank heist. They include the ones we covered in our Bybit hack case study and the Binance hack explainer. The targets changed from bank messaging systems to crypto wallets. The method stayed similar: trick a trusted person, then let the trusted system move the money.

Ten Years On: Fines, a Conviction and a Court Case

The fallout spread across three countries. In Bangladesh, the loss was not reported to the finance minister, Al Jazeera said. It came out only through Philippine news a month later. Governor Atiur Rahman resigned on 15 March 2016.

In the Philippines, PCIJ records that the central bank, Bangko Sentral ng Pilipinas, fined RCBC a record 1 billion pesos on 5 August 2016. On 10 January 2019, a Makati court convicted former RCBC branch manager Maia Santos-Deguito on eight counts of money laundering. Each count carries four to seven years in prison, and she was ordered to pay about $109 million in fines. She appealed.

Bangladesh Bank also went to court in New York. A first federal suit, filed in January 2019, was dismissed in March 2020. A new case followed in New York state court in 2020. That Bangladesh Bank heist lawsuit was still at the pre-trial stage in early 2026. On 4 February 2026, Justice Andrea Masley ruled on several discovery disputes, sanctioned RCBC and its lawyers over conduct at a deposition, and appointed a special discovery master. No ruling on liability had been made.

The payments industry changed too. According to ISACA, SWIFT launched its Customer Security Programme (CSP) in 2016 in response to this attack. Member banks now check themselves against mandatory security controls every year. Since 2021, an independent assessor must do those checks.

Why Does a 2016 Bank Cyber Attack Matter in Pakistan?

Pakistani banks use SWIFT for international payments, and many Pakistani companies move money through online banking portals every day. The weak points behind the Bangladesh Bank heist exist in most offices here. Staff inboxes can be phished. Payment computers often share a network with everything else. And there are quiet periods when nobody is watching.

Think about the long holidays in Pakistan's calendar, such as Eid, when banks and offices close for several days. Think about the gap between Pakistan's working week and that of partner banks in the Gulf, Europe or the US. A bank cyber attack timed for those gaps works the same way it did in 2016.

The lesson also applies outside banking. A small exporter in Sialkot or a software house in Islamabad can lose money through a fake payment instruction sent from a hijacked email account. The amounts are smaller, but the pattern of phishing, access, then a well-timed transfer is the same.

Eight Defensive Lessons From the SWIFT Hack

These lessons are written for security teams, IT staff and finance managers. Most of them cost more in discipline than in money.

1. Separate payment systems. Computers that can send payments should not be used for email or web browsing, and they should sit in their own network zone.
2. Watch for changes to payment software. Alert on any change to the files, settings or database of the system that sends payments.
3. Reconcile from two sources. Compare what your system says it sent with a separate record, such as the statement from the receiving bank.
4. Treat odd glitches as possible incidents. A broken printer on a payment system deserves a phone call, not a shrug.
5. Cover weekends and holidays. Name an on-call person with the authority to stop payments, and test that they can be reached.
6. Agree on a stop route in advance. Know exactly whom to call at each partner bank, and keep those numbers outside the systems that might be compromised.
7. Train against targeted phishing. Teach staff in payment teams that they are high-value targets and how to report a suspicious email quickly.
8. Report losses early and honestly. Hiding a loss for a month, as happened in Dhaka, only gives attackers more time to clean the money.

To practise the network side of these lessons, try our guide to Wireshark for beginners, which shows how to read traffic and spot something that does not belong. Our ethical hacking lab setup checklist explains how to build a safe space to test ideas without touching real systems.

Rebuilding Incidents Like This in a Cyber Security Course in Pakistan

Reading about a breach is useful. Rebuilding it as a defender is better. The Cyber Security and Ethical Hacking Course at PSTA runs for 12 weeks at beginner level. Its course page lists core ideas such as the CIA triad and risk first. Then come common attacks, basic ethical hacking, network security, malware and threat detection, cyber law and digital forensics.

One of its labs asks you to investigate a security incident, preserve evidence and document a timeline. That is the exact skill this case study uses. The course ends with a case-study project and a written security report. You can join live online classes from any city in Pakistan or attend on campus in Abbottabad, and a new batch starts every month.

Already know the basics? If you want to test systems the way an attacker would, with permission, our intermediate Advanced Ethical Hacking and Penetration Testing track adds 12 more weeks of practice. Not sure which credential to aim for after that? Our guide to cyber security certifications for beginners compares the common first exams. For batch dates and timings, you can send a message on WhatsApp to +92 314 5424399.

Map Your Own Weekend Gap

Before the next long holiday, sit down with whoever approves payments in your organization. Ask one question: if a fake transfer left our account at 11 PM on the last working day, who would notice, and when? Write the answer down with names and phone numbers. If the answer is "nobody until Monday", you have found the same gap that turned the Bangladesh Bank heist into an $81 million loss.