The Billion-Dollar Bank Heist That Was Nearly Undone by a Typo

Here is a fact that ought to keep bankers up at night: the largest bank robbery ever attempted was stopped, in large part, by a spelling mistake.

In February 2016, a group of attackers tried to steal $951 million from Bangladesh Bank, the central bank of Bangladesh. They did it without masks, without guns, without setting foot in a building. And they very nearly got away with all of it. What blunted the theft was not a firewall, not a vigilant security team, not any of the elaborate and expensive defenses the world's financial institutions are supposed to run. It was a typo — one of the fraudulent transfer orders misspelled the word "Foundation" as "Fandation," a clerk at a bank in the routing chain noticed, and a thread came loose that helped freeze roughly $850 million.

I've spent my career as an engineer building banking and enterprise systems — the kind of financial plumbing that the messages in this story actually travel on. And what strikes me about the Bangladesh Bank heist, every time I return to it, is that the typo is the part everyone remembers and the least important part of the story. The typo is the punchline. The real story is the setup: how it became possible, in the modern world, to rob a central bank of nearly a billion dollars by sending a few messages. To understand that, you have to understand the machine.

How You Rob a Bank Without a Vault

Start with a question that sounds simple and isn't: where was Bangladesh's money?

Not in a vault in Dhaka. A country's foreign-currency reserves — the national savings it uses to pay for imports and meet its obligations in the world's dominant currencies — don't sit in a basement as stacks of cash. They exist as a balance in an account at a trusted institution. A great deal of global trade is settled in U.S. dollars, and for many of the world's central banks, the place they keep their dollars is the Federal Reserve Bank of New York. So Bangladesh's reserves lived, in a very real sense, as a number in a ledger in lower Manhattan.

To move that money, the New York Fed needed an instruction from Bangladesh Bank. And the way banks send each other instructions is a system called SWIFT — the Society for Worldwide Interbank Financial Telecommunication, a member-owned cooperative that runs a secure messaging network connecting roughly eleven thousand institutions in more than two hundred countries. Here's the crucial thing to understand, the thing that unlocks the whole heist: SWIFT does not move money. It moves messages. It's the instruction layer, not the cash layer. When one bank wants another to make a payment, it sends a SWIFT message, and the receiving institution carries it out by adjusting the actual balances in the accounts the banks hold with one another.

And the entire system runs on a single load-bearing assumption: when a properly authenticated SWIFT message arrives from a member institution, the receiver treats it as genuine. It has to. The whole value of the network is that a bank in Manila can act on an instruction from a bank in Dhaka without a phone call, without a meeting, without any verification beyond the message itself. Multiply that across eleven thousand institutions and millions of messages a day, and you have the nervous system of the global economy. It works because everyone agrees that an authenticated message is as good as the word of the bank that sent it.

Now you can see the shape of the crime, and it's almost the opposite of what people assume. The attackers did not break SWIFT. They didn't crack its cryptography or defeat its core network — that would have been extraordinarily hard, and there's no evidence they even tried. Instead, they attacked the weak edge of the system: the individual member bank, where messages are created and sent. They got inside Bangladesh Bank, spent roughly a year quietly learning its systems and its payment workflow, and then sent genuine, authenticated messages that happened to be fraudulent. They didn't forge the bank's signature. They took control of the bank's own pen. From the network's point of view — from the New York Fed's point of view — nothing was wrong at all. The messages were valid. The sender was real. The money should move.

That is the real vulnerability, and it is not, at bottom, a technical one. It's trust. The global financial system is a machine for moving trust around, and a machine built to trust authenticated messages will faithfully execute a fraud, as long as the fraud arrives as an authenticated message.

The Printer That Told the Truth by Going Silent

My favorite detail in the whole heist — the one that best captures how clever the operation was — involves a printer.

When Bangladesh Bank sent and received SWIFT transfers, its software automatically printed out confirmation records on a physical printer in the SWIFT room. Staff would review those printouts. It was a simple, almost old-fashioned control: a paper trail that would reveal unauthorized transfers almost immediately. So the attackers' custom malware, tailored specifically to Bangladesh Bank's environment, did something beautiful and sinister. Among other things, it interfered with those confirmations and the printing of them. The printer went quiet. And when the staff noticed, on the morning of Friday, February 5, that the printer wasn't working, they did what anyone in any office would do: they assumed it was a glitch, tried to fix it, and moved on.

It was not a glitch. It was the robbery. For a crucial window, the malware had blinded the bank to its own theft — corrupted the institution's ability to perceive what was happening inside it. This is worth sitting with, because it's a genuinely new category of danger. We assume that a large institution will notice when something enormous happens inside it, that a billion-dollar event can't simply fail to register. But an institution perceives only what its instruments tell it, and if you control the instruments, you control what the institution can know. Bangladesh Bank was, for a long weekend, literally unable to see that it was being robbed — not because its people were careless, but because the tools they would have used to see the crime had been turned against them.

The attackers stacked one more layer of cleverness on top: timing. They launched the transfers on a Thursday evening, exploiting the way weekends and a holiday fell across three countries. Bangladesh's weekend is Friday–Saturday. New York's is Saturday–Sunday. And Manila, where the money was headed, had a public holiday that Monday. The result was a multi-day window in which the fraudulent transfers could be sent, received, and — critically — the stolen money could be pulled out in Manila before Bangladesh Bank was even back at work to notice. They didn't just exploit a software weakness. They exploited the fact that the "global" banking system is really a patchwork of institutions that never share a clock, and there is no single moment when the whole system is awake and watching itself.

Why the Story Still Matters

The heist ultimately failed to reach its full billion — saved, as we've said, by a typo and by a second stroke of luck, an unrelated sanctions filter that flagged a transfer because it was headed to a bank on Jupiter Street and "Jupiter" matched the name of a watchlisted ship. But $81 million still got away, disappeared into Manila's casinos (which were then legally exempt from anti-money-laundering rules), and was mostly never recovered. And when investigators finally traced the crime, following fingerprints in the malware and the infrastructure, it led somewhere that changed how governments think about cybercrime: to North Korea. The attackers were the Lazarus Group, an arm of a sanctioned state, robbing the global financial system to fund itself. In 2018 the U.S. Department of Justice filed a complaint naming a North Korean programmer and laying out the evidence in public.

That's why this story outlasts its headlines. It's the moment the world learned that a nation could rob the global financial system at scale from a keyboard — and it became a template. As banks hardened their SWIFT endpoints, Lazarus pivoted to softer, faster targets, above all cryptocurrency, going on to steal billions. The specific hole at Bangladesh Bank got patched. The deeper condition did not: a trust network is only as strong as its weakest member, and there are thousands of members of wildly varying capability, connected across every time zone and legal regime on earth.

The enduring lesson is the one I keep coming back to as an engineer who helped build these kinds of systems. For all of human history, a robbery was limited by how much the thieves could physically carry. When money became information, that limit vanished, and something new took its place. The vault is now a message. And a message can lie. The full story — the year inside the bank, the casino laundromat, the forensic manhunt, and what the banking world did and didn't fix — is in the book.