In 2015 and 2016, attackers compromised member banks’ internal systems and obtained legitimate SWIFT credentials, allowing them to send fraudulent transfer instructions that recipient banks initially treated as authentic. The Bangladesh central bank theft, publicly reported in 2016, involved attempted transfers totaling $101 million through its account at the Federal Reserve Bank of New York. A related attack targeted a commercial bank in Vietnam, while Reuters reported on May 20, 2016, that Banco del Austro in Ecuador had suffered a similar 2015 loss involving transfers to Hong Kong accounts.
The malware did more than issue unauthorized messages: it deleted transfer records and manipulated paper or PDF reports so bank staff would not see the transactions or confirmation messages. Security researchers linked the tools to the Lazarus Group, and Symantec associated that group with North Korea, though the state attribution remained an assessment rather than a proven court finding. SWIFT CEO Gottfried Leibbrandt warned that compromised banks could be put out of business. SWIFT subsequently imposed mandatory security controls, began compliance inspections, and reported three further attacks in September 2016; in two cases receiving banks detected suspicious orders, while a software patch stopped the third before fraudulent messages were sent.
