Robbery · Dhaka, New York and Manila · 2016

The Bank Heist That Stumbled Over a Spelling Mistake

The thieves sent convincing payment instructions. One word looked less convincing.

1. A vault without a getaway car

In February 2016, thieves targeted Bangladesh Bank’s account at the Federal Reserve Bank of New York. They did not need to force open a cash vault. By compromising the bank’s systems, they could send payment instructions that appeared to come from authorised staff, turning an international banking network into the route for a robbery.

The money would leave through messages, not through a door.

2. Instructions that looked legitimate

Fraudulent transfer requests sought nearly a billion dollars. The attackers used access to the bank’s environment rather than breaking the central SWIFT network itself. That distinction mattered: receiving institutions saw apparently valid instructions from a trusted participant. The attack depended on making criminal requests look like routine business between banks that already dealt with one another.

The most dangerous part of the message was how ordinary it appeared.

3. A weekend gives the thieves room

The operation exploited differences in working days and time zones across several countries. Staff in Dhaka discovered problems with a printer used for transaction records, adding confusion while the transfers were being processed elsewhere. An interruption that might initially resemble a technical nuisance became part of the difficulty in understanding how much money had already moved.

A quiet office was a useful place for a very noisy crime.

4. One word attracts attention

A transfer of 20 million dollars toward Sri Lanka named a foundation with a misspelling in its payment information. A routing bank sought clarification, and that payment was stopped and recovered. Other suspicious requests were also blocked. The spelling error mattered to one transfer; it would be wrong to claim that a typo single-handedly prevented the entire attempted theft.

A badly spelled word interrupted a remarkably well-prepared attack.

5. Eighty-one million gets through

Four transfers totalling 81 million dollars reached accounts in the Philippines. Money then moved through financial intermediaries and casino-related channels, making recovery difficult. The criminal operation had achieved only part of its intended total, but that smaller fraction still represented an enormous loss. Stopping additional transfers did not automatically reverse the payments that had already cleared.

The failed billion-dollar plan still produced an eighty-one-million-dollar emergency.

6. Following messages after the money

Investigators examined malicious software, payment records and the people and accounts involved in moving the funds. US authorities later alleged that North Korean state-backed hackers were responsible, linking the operation with a wider campaign. Those accusations should be identified as official allegations rather than treated as a substitute for every separate judicial finding in the international case.

The trail crossed more jurisdictions than any single bank could investigate alone.

7. The trusted channel was not enough

The heist prompted scrutiny of banks’ local computer security, payment verification and transaction monitoring. SWIFT introduced a customer security programme while institutions reviewed their own safeguards. The enduring surprise was not that electronic messages could move money quickly. It was how much authority a message could inherit from the system and sender it appeared to come from.

A trusted address turned out to be a very expensive disguise.