Hackers Failed to Withdraw $1 Billion From a Bank?

Yes—but the claim refers to an attempted cyber theft, not a successful withdrawal: in 2016, attackers tried to move about $1 billion from Bangladesh Bank’s account at the Federal Reserve Bank of New York. Most of the attempted transfers were stopped, but $81 million was sent to accounts in the Philippines and was not recovered in full.

The Bangladesh Bank heist in brief

The incident is often described as hackers trying to steal $1 billion from a bank. More precisely, the target was Bangladesh Bank, the country’s central bank, and the money was held in its account at the Federal Reserve Bank of New York. Attackers used fraudulent payment instructions on the international banking network to request transfers from that account.

In early February 2016, the attackers sent 35 transfer requests totaling close to $1 billion. The New York Fed rejected or blocked most of them. Five requests, totaling about $101 million, initially went through. One transfer of $20 million to Sri Lanka was later recovered after a spelling error prompted questions about the payment. The remaining $81 million reached accounts in the Philippines.

So the short answer depends on what “failed” means: the attempt to take nearly $1 billion did not succeed, but the operation was not entirely unsuccessful. A substantial amount was stolen, and its recovery was incomplete.

How the fraudulent transfers worked

The payments were not ordinary cash withdrawals made at a branch or through an ATM. They were international wire-transfer instructions. Banks use systems such as SWIFT to exchange authenticated financial messages, including payment orders. SWIFT carries messages; it does not itself hold the funds or settle every transfer.

Investigators and public reports described malware on Bangladesh Bank’s computer systems that helped attackers interfere with the bank’s payment operations and conceal evidence of their instructions. The attackers used compromised access to prepare messages that appeared to request legitimate transfers. Those instructions were directed to the New York Fed, which held Bangladesh Bank’s account.

The distinction matters: a message asking for a transfer is not the same thing as a completed payment. A receiving institution can reject, delay, question, or process an instruction, depending on its controls and the information available. In this case, a combination of automated screening, review, and circumstances around the requests prevented most of the attempted payments from being completed.

Why most of the money was stopped

Several features of the requests drew attention. The unusually large number of instructions, the amounts, and the destinations raised concerns. Some payment requests were blocked or held for review. One request involving a transfer to Sri Lanka contained a misspelling of “foundation,” which helped trigger scrutiny and ultimately contributed to the recovery of the $20 million payment.

Another factor was the destination of the funds. The attackers sought to route payments through accounts in the Philippines, where the funds could be moved through the local financial system and into casinos. The payment trail and the use of intermediaries made recovery difficult once money had left the original account and been dispersed.

It would be misleading to say one typo alone saved a billion dollars. The result came from several interventions and complications, including payment reviews and questions about the instructions. The exact sequence and responsibility of different institutions have been examined in investigations and legal proceedings, and public accounts do not reduce the event to a single safeguard.

What happened to the $81 million

The $81 million that reached the Philippines was routed through several accounts. Philippine authorities traced part of the flow through money changers and casinos. Because gambling establishments can involve rapid movement of funds and complicated records, investigators faced major obstacles in following and recovering the money.

Bangladesh recovered a significant portion of the stolen funds through later efforts, including a settlement with a Philippine casino operator. However, not all of the $81 million was recovered. Public reports have described tens of millions of dollars as still missing; the precise status can depend on the date and the accounting used. The important point is that the losses were far below the nearly $1 billion the attackers sought, but they were still substantial.

The case also led to criminal investigations and prosecutions in the Philippines. Investigators and authorities examined people and businesses connected with the transfer and movement of the money. Allegations and findings should be distinguished: being mentioned in reporting or an investigation does not, by itself, establish that a person committed a crime.

What the incident revealed about banking security

The heist showed that cyber risk can arise at the point where a financial institution creates and approves payment instructions, not only at the bank that ultimately holds the funds. A compromise of internal systems can threaten the integrity of messages, records, and approval workflows even when the broader payment network remains operational.

Separate duties: Preparing a payment and approving it should not depend on one compromised account or workstation.
Independent confirmation: Unusual or high-value instructions can be checked through a separate, trusted channel.
Monitoring and response: Banks need ways to spot anomalous requests and act quickly when a transfer looks wrong.
Resilient records: Backups and logs help institutions identify tampering and reconstruct what happened.
Coordination: Fast communication between the sending bank, correspondent institutions, and receiving banks can improve the chance of stopping suspicious payments.

These are general security principles, not a claim that any single measure would have prevented this particular attack. Effective defenses combine technical controls, staff procedures, monitoring, and cooperation between institutions.

Was SWIFT itself hacked?

Not in the simple sense suggested by headlines. The attackers exploited weaknesses in Bangladesh Bank’s environment and used access to generate fraudulent payment messages. SWIFT reported that its core network was not compromised in the incident. The case nevertheless raised concerns across the industry because a legitimate messaging channel can be abused if a participant’s systems or credentials are compromised.

This is a useful distinction for readers: a payment network can securely transmit a message that was fraudulently created at a member institution. Protecting the network and protecting each bank’s local systems are related but separate responsibilities.

Frequently Asked Questions

Did hackers actually steal $1 billion?
No. They attempted transfers totaling close to $1 billion, but most were blocked. About $81 million reached accounts in the Philippines, and a separate $20 million transfer to Sri Lanka was recovered.

Which bank was targeted?
Bangladesh Bank, the central bank of Bangladesh, was targeted. The funds were held in its account at the Federal Reserve Bank of New York.

How did the attackers get the money?
They used compromised systems to send fraudulent international payment instructions. The money moved through receiving accounts and intermediaries rather than being withdrawn as cash from a teller.

Was the money recovered?
The $20 million sent to Sri Lanka was recovered. Bangladesh also recovered part of the $81 million sent to the Philippines, but not all of it.

Was SWIFT hacked?
Public accounts say the core SWIFT network was not compromised. The attackers abused access and systems at Bangladesh Bank to create fraudulent messages that used the legitimate payment-messaging process.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →