The Digital Bank Heist: Part 2

As the DarkNet Diary podcast explained, $81 million dollar had been stolen from the Bangladesh Bank. But how do you cash out that much money? If you just keep transferring it electronically across banks, it leaves a trail. The thieves had planned that out too.

 

They emptied the accounts in the Philippines almost immediately (almost certainly, someone in Philippines was in on the crime). The money was then taken to casinos in the region, where it was converted into chips. But if you gamble with that much but don’t play for long, it draws attention. The thieves chose a game where one doesn’t lose much, around 10% on average (They were willing to write off the 10% as the cost of doing “business”). Having played long enough to avoid suspicion, they cashed back their chips and walked away. But it’s still a lot of cash. The money trail of subsequent investigations led to Macao, China. But after that, the trail just vanishes.

 

This seemed to be an exceptionally sophisticated heist. Meticulously planned. Patiently executed. With actors in different countries. Every step planned through. How can a gang of hackers have such expertise and so many resources? Hence the question (and answer):

“Who exactly were these hackers? Well, it turns out it was the North Korean government.”

At first this seems crazy. Sure, countries hack each other all the time, but never for financial gain. They hack for spying, stealing secrets, or installing malware for future “detonation” e.g. wartime. But stealing money? That was new.

 

Aha, but North Korea had been under severe sanctions. It doesn’t have access to international money. It doesn’t have much to sell/trade in any case:

“You can see a progression where it’s like oh, uh-uh, we can’t get any money.  How are we going to do that?  Oh, well, let’s just try and hack our way around that.”

If you’re wondering why the money would have gone to Macao (China) on the way, that fits once the final destination is North Korea:

“From Macao, it can then be wired directly into North Korea because North Korea does business with companies in China and so, this transaction could easily be hidden.”

 

I find a silver lining in this story. It made me realize why robbing banks digitally is so hard: while electronic stealing can be done, cashing out is very hard. Banks usually have per day limits on transactions. So too do ATM’s. Emptying out an account with huge amounts in cash sets off red flags – unless you have bribed someone at the bank. Circumventing every step requires far more than just hacking skills. The reason we can sleep easy wrt the money in the bank is not because their system is unhack’able but because there are so many steps involved in truly walking away with all the cash. And they’re all very complicated. Which makes it very hard for any one entity to pull it off.