Still on the trail

The investigation into the Bangladesh Bank heist continues

A YEAR after one of the most spectacular robberies of modern times, the authorities in Bangladesh are still trying to crack the case. Hackers into the country’s central bank sent instructions through SWIFT, a messaging network for cross-border payments, to transfer funds from the bank’s account with the New York Federal Reserve to private accounts in Sri Lanka and the Philippines. Much of the stolen $101m has yet to be retrieved; the masterminds are yet to be identified. But the probe reveals the strikingly sophisticated, and international, nature of the crime.

After sifting 60 hard drives and thousands of pieces of paper, and interviewing dozens of people, investigators, talking anonymously in Dhaka, say they are confident about some details of the heist. They believe foreign hackers acted with inside help. The attackers’ coding style has raised suspicions of involvement by North Korea. This week the New York Times reported that American federal prosecutors were examining this possibility.

Egregious violations of the bank’s security procedures have also been uncovered. On the day of the robbery, its security cameras were disabled. A number of security protocols need to be met before the SWIFT system authorises a payment: one step, a physical key or dongle, was left plugged in for weeks, rather than locked away. Five of the hackers’ 70 messages were accepted as genuine by the New York Fed. But for basic slipups (some payment instructions, for example, were incomplete) the thieves could have made off with $1bn.

SWIFT has not commented on the investigation. Last year Gottfried Leibbrandt, its chief executive, took pains to stress that it was the bank’s security, and not SWIFT’S, that had been compromised. Investigators have been silent in public on the role of Bangladeshi nationals in the crime. Reluctance to expose failings at home may help explain why their findings have yet to be published. The official line is that they do not want to jeopardise ongoing inquiries.

Bangladesh has recovered only $15m of the $81m wired to the Philippines. (Payments made to Sri Lanka were reversed before they could be withdrawn.) The main plotters have yet to be traced. Nor is there evidence that any money reached North Korea. But relations between Bangladesh and North Korea have soured: last August a North Korean diplomat was expelled from Dhaka on suspicion of smuggling.

Whether in connection with the heist or not, SWIFT has in effect cut off North Korea’s formal ties with the global financial system. This month SWIFT was obliged to exclude three North Korean banks that were under United Nations sanctions. On March 17th it suspended services for the four remaining banks on the system, saying they no longer complied with its membership criteria. Reasons for termination include participation in activities that are illegal, endanger security or adversely affect SWIFT’S reputation.

A speedy resolution to the Bangladesh case seems unlikely. Even if it is never cracked, it is clear, as Mr Leibbrandt put it, that it was a “watershed event” for the banking industry: a lesson in the threats posed by well-organised cybercriminals, which bankers neglect at their peril.

Much remains unknown, but the sophistication of the crime is clear.

Reuters/file Commuters pass by the front of the Bangladesh central bank building in Dhaka.