Original subtitles

Downloaded from YTS.MX

Official YIFY movies site: YTS.MX

It was one of the world's biggest cyber heists.

A bank robbery of the online age

that no amount of armed guards, armored cars,

and heavily protected vaults could prevent.

It was like a terrorist attack into the central bank.

More than $80 million stolen

from Bangladesh's Central Bank

by hackers who authorities say, tricked one

of the world's most trusted financial institutions.

It would've dropped like a bomb, the New York Fed.

Only one official is facing charges

and most of the money is still missing.

There is no way that this could have been done

by just one or two rogue employees.

She is but a pawn in a high stakes game

made by international bankers.

It's a crime which exposed serious failings

in the international banking system,

and it could have been much, much worse.

How in the world could a staggering 81 million,

almost billion be lost in a transfer system?

I'm Andrew Wilson,

and I'm going to follow the trail

of the stolen funds from Dhaka to Manila,

and New York.

To find out how the hackers did it

and ask who was behind the heist and could it happen again?

Dhaka, the capital of Bangladesh.

A teaming chaotic city

and one of the world's poorest.

17 million people live here,

a third of them surviving on less than $2 a day.

Many eeking out a living on the city's polluted waterways

and crowded streets.

Bangladesh has one of the world's fastest growing economies.

It's a country on the up.

But one that could ill afford to lose more than $80 million

of taxpayers money.

Bangladesh Bank, the countries central bank

is at the heart of its economic system.

It overlooks a busy roundabout

in Dhaka's financial district.

High walls and tight security to stop anyone getting in

who shouldn't be there.

But sometimes physical barriers aren't enough.

For this heist, nobody broke in

and nobody took anything away.

The entire crime was perpetrated electronically.

On the evening of Thursday, February the fourth, 2016,

the start of the weekend in Muslim Bangladesh,

most of the central bank's staff had gone home.

The building was secure, but intruders were already inside.

In an interim report,

experts commissioned by Bangladesh Bank said

a malicious program was installed

on the bank's computer systems.

The malware, possibly delivered

via an infected email, collected passwords and usernames

and covered its own tracks.

Investigators say they found considerable evidence

that the hackers used the bank's credentials

to access SWIFT,

the international messaging system

used to send money around the world.

The hackers then generated 35 requests

to transfer funds from Bangladesh Bank's account

with the Federal Reserve Bank of New York.

The orders came close to a billion dollars.

Most of the requests were blocked, but four did get through,

and as a result, almost $81 million was sent

to accounts at a bank called RCBC, thousands of miles away

in the Philippines.

I couldn't believe it, I tell you,

because nothing like that,

even a smaller thing like that never happened.

So I was dumb and actually for a while,

Atiur Rahman was the governor

of the bank when its systems were compromised

and the money was stolen.

You know, I'm not blaming SWIFT, I'm not blaming Fed,

I'm not blaming Bangladesh Bank,

but the entire system was not strong enough

to really withstand the kind of attack that it got.

All institutions touched by the heist

have denied they were at fault for the losses.

They have, however, taken steps to improve security.

According to one senior Bangladesh police investigator

in late 2016, there were serious security lapses,

which made the central bank vulnerable.

Reuters journalists, Sarajul Quadir has spoken

to police sources and insiders at Bangladesh Bank.

Yeah, cybersecurity was quite, I mean, vulnerable.

It was very weak, and it was not up to the mark,

I mean, with the present, with the modern technology.

Police headquarters in downtown Dhaka.

Detectives here are working

with authorities in other countries

in what has become an international investigation.

They've yet to confirm how the hackers got into the system.

We process all the data and FBI is helping us.

Interpol is helping us,

and we are trying to find out

the conclusive evidence we get maybe some.

Investigators are sifting through 10 terabytes

of data in the hunt for a smoking gun

that might identify the culprits.

Though no bank insiders have been charged over the heist,

police say they must fully investigate the possibility.

We are looking into that.

Maybe a bank employee?

Yes, maybe.

Bangladesh Bank denies that anyone on

the inside was involved and also denies negligence.

The police have not charged anyone from Bangladesh Bank

in relation to the heist.

To find out more, I contacted one

of the private sector cybersecurity companies

that have investigated the methods used by the hackers.

What were your thoughts when you heard

that this central bank had been hacked?

Yeah, the early indicators show that this,

they likely got in through

some sort of spearfishing message.

So basically they sent an email to someone,

and then that person basically clicked on that email

and had their computer system infected.

Now, they were going

after what's called the SWIFT terminals.

These are the terminals

or computers that are responsible

for conducting large bank transfers

between organizations or even countries.

It's basically they're modifying the applications

on the computer that has sort of been hijacked.

And remember, those computers are actually inside the bank.

This is a case where this institution

was compromised more so than anything SWIFT specific.

Within weeks,

the central bank governor, Atiur Rahman,

felt he had to resign.

They were blaming the institution,

they're blaming the governor.

And I thought, the central bank is a very sacred place.

It's a very, very, very, I would say, highly esteemed place.

You cannot just put a mud on it the way you are liking.

So I took myself, not only myself away,

I tried to protect the central bank,

the integrity of the central bank.

In Bangladesh, the investigation into

who stole the $81 million continues,

but it's quite possible

that the hackers may actually

have never set foot in the country.

The missing millions were sent overseas,

and I'm following the money trail to the Philippines

where electronic wire transfers became hard cash.

This is the story of one

of the world's biggest cyber heists.

How hackers stole 10s of millions

of dollars from Bangladesh's Central Bank

and appear to have got away with it.

To try to find out how, I've come to Manila.

It's the sprawling capital of the Philippines

and one of the fastest growing cities in Asia.

This is a society that thrives

on its links to the outside world.

One of its biggest exports is workers.

More than 2 million Filipinos work overseas

and send more than $25 billion a year in remittances

to their loved ones back home.

It's a flow of revenue

that helps drive the country's economy.

Manila's business district has expanded substantially

over the last decade, but its banking sector operates under

unusually strict secrecy laws,

and that includes the institution,

which helped turn the transfers from Bangladesh

into hard cash.

It was by sending money here

that the thieves effectively made their getaway.

$81 million of Bangladesh Bank's funds

ended up in this local branch of a bank called RCBC.

And they did it using bank accounts

that had been opened months earlier using fake IDs

and had since lane inactive.

The hackers had sent payment requests from Bangladesh Bank

to the New York Fed on Thursday,

and by Friday, the money had hit accounts at RCBC in Manila.

It was then moved between an array

of other accounts controlled

by a remittance company called PhilRem

and some of it was converted into Philippine pesos.

Over a period of 10 days,

the money was transferred electronically and in cash

and channeled into Manila's casino industry.

The accounts here on Jupiter Street

were a vital clue for investigators.

They were crucial for laundering the money,

and someone had set them up using false names

and fake credentials.

The question is who?

The Philippines Senate held an inquiry into the laundering

of the proceeds of the heist.

It heard that the accounts were opened

by the manager of the RCBC Jupiter Street branch,

a woman called Maia Deguito.

You tell the truth here?

Your honor, I will tell the truth.

She says she opened the accounts for this man,

a Manila casino owner

and agent she'd known for several years, called Kim Wong,

who also gave evidence at the inquiry.

Maia Deguito declined to be interviewed for this program,

but she testified to the inquiry

that she had actually met four people

whose names were on the accounts.

She's been represented by a lawyer

who has an unusual taste in art.

Mr. Wong vouch for their identities, presented documents

which showed their identities

and requested her to open accounts

in her branch on behalf of these five individuals,

and with the promise that a substantial

amount would come into these accounts.

Wong hasn't been formally charged over the heist,

but is subject to civil action.

He denied Deguito's version of events

and denied knowing that the money was stolen.

RCBC bank was fined close to $20 million for failing

to comply with banking regulations

and its chief executive and president resigned.

The bank said it accepted the findings of the regulator

and wants to move on.

The company's lawyer says Maia Deguito was a rogue employee.

The branch manager says that she was naive,

that she was a pawn in a much larger plan,

which she didn't clearly understand at the time.

I disagree with that.

She knows the banking system.

She's trained of all the policies of the bank,

so I don't agree with that one.

Just because she's trained in the policies of the bank,

is that enough for RCBC to conclude that she is a single

or a rogue employee within one branch?

It was actually the, all the circumstances taken together.

Number one is that she knew about these accounts.

She set it up.

Second is when she was obviously waiting for the funds

to be credited, and when it was she credited

she acted with lighting speed in getting these accounts out

of the beneficiary accounts into other accounts.

The Senate report documented the timing of the payments.

Many were made within minutes of each other.

Maia Deguito's lawyers say

that when funds were received on February the fifth,

she confirmed the legitimacy of the remittances

with RCBC head office

and received emails confirming they were from valid sources.

Her legal team say she didn't have authority

to unilaterally prevent transfers,

and their client was told there was no reason

to hold the funds.

Following an investigation

by anti-money laundering authorities,

the Philippine Department of Justice has recommended

that Maia Deguito be charged

with eight counts of money laundering.

Her legal team is trying to quash the charges against her,

but if the case goes ahead, she will plead not guilty.

Sergio Osmena, a former Philippines senator

who sat on the committee looking into the heist,

says he doesn't believe seven days

of testimony uncovered the whole story.

We couldn't quite get her to explain everything

because we did not give her witness protection program.

So I left it up to the AMLA.

I said, okay, AMLA you take care of Maia Deguito.

They filed a case against her already,

so she had to stop talking in the senate

because anything she'd said would be used against her

in the case.

At the Senate inquiry,

one of Deguito's former colleagues

said that at the time of the heist,

she talked about being threatened.

I would rather do this than me being killed,

or my family.

Deguito's lawyer denies the threat was made.

He says she's determined to prove her innocence

and didn't know she was being used

to bring fraudulent money into the country.

He also says she's been offered a deal to speak to the FBI,

which has been leading an international

investigation into the heist.

The FBI has declined to comment.

Yes, there was an offer, it was a standard offer for her.

It came under nomenclature of "Queen for a Day"

for a day, wherein as she would say everything

and she would be given limited impunity.

We came to the conclusion

that it would not offer enough protection for my client.

So we had to politely decline the offer of the FBI.

When the money left RCBC, it was paid

to accounts at the PhilRem Remittance company.

PhilRim was run by Michael and Salud Bautista.

They, along with Kim Wong,

and the company that owns a casino called Solaire,

are the subject of pending legal action

by money laundering authorities

to try to recover some of the stolen money.

Kim Wong and Solaire say they are complying

with the authorities.

The Bautistas have not responded to our request for comment.

We account the $81 million

and we filed several civil for future cases against Solaire,

against the company of Kim Wong,

against Kim Wong himself and PhilRem.

And the total of our claim is around more

or less $81 million.

The ALMC also filed criminal complaints

against Maia Deguito, Kim Wong,

and PhilRem executives, including Salud

and Michael Bautista.

They were considered by the Philippines Department

of Justice, but the only case the Justice Department

is pursuing is that against Maia Deguito.

The AMLC has asked them

to reconsider the complaint against Wong and the Bautistas,

and is waiting for a decision.

Wong has declined to comment

and the Bautistas have not responded to our inquiries.

We ask the Department of Justice

why it wasn't taking the other cases forward,

but it declined to comment.

One stumbling block for the Senate's inquiry was

the unusually high level of privacy afforded

to bank accounts.

The Philippines, along with Switzerland

and Lebanon has one

of the most secretive banking sectors in the world.

These secrecy laws are almost unique

to the Philippines banking system,

although it has to be said widely supported by the majority

of lawmakers here.

But that privacy for all accounts held in this country made

life extremely difficult for the Senate investigators trying

to trace the missing millions, keeping doors firmly closed

that many of them would gladly have seen opened.

Kim Wong's bank account. We couldn't get it.

PhlRem's bank account. We couldn't get it.

Why?

Bank Secrecy Act.

It stopped us from getting the whole picture.

It stopped us from tracing the money

because we couldn't get the bank accounts of anybody.

Almost $15 million has been recovered according

to the official Philippine Senate report.

Some of it handed over by Kim Wong

who denied knowing it was stolen.

The AMLC says, PhilRem still holds $17 million

of the stolen money and is suing for its return.

The company denies it has the money.

Almost $50 million has been traced to casinos

and gambling junket operators according

to the AMLC investigation,

but none of that 67 million has been recovered.

Gambling junkets are paid for trips

that attract high spending visitors,

many from China.

According to the Senate report,

most of the $81 million was channeled to casinos

and junkets, which were effectively being used

by the criminals to complete the getaway.

It said 10s of millions of dollars from the heist were used

to buy chips that were gambled

by junket groups on Manila's tables.

According to the inquiry, one group had known winnings

of more than $5 million,

but the junket operators could have made

much more than that.

The casinos denied knowing where the money came from,

and it's not known whether the gamblers knew the money

they'd borrowed to play was stolen.

Wong who had years of experience

with junkets in Manila told the Senate inquiry,

the men who got the funds into the casinos

were Chinese nationals.

Gao Shuhua, who he'd known for eight years,

and Ding Zhize, who was based in Macau.

The inquiry said much of the money was transferred

to casino accounts in Ding's name.

The men are of high interest to investigators.

They were gone.

They left the country.

Well, I don't know because there's no record

of their having left the country, but they were gone.

We couldn't get hold of them.

How do you think it was so easy for them to disappear?

Oh, it's easy in this country.

We have a very porous border

and you bribe anybody and you'll get out.

The casinos were used

for turning the electronic money transfers into hard cash.

Though there's been no inference,

they knew the funds were stolen.

They weren't covered by money laundering laws at the time

and weren't required to record large transactions.

For Sergio Osmena's committee,

the heist exposed serious flaws

and they were flaws that were predictable.

I was concerned, especially in 2010

when they were going to develop the four big casinos here.

When they did that, I said it's time that we

updated our money laundering law

because this is gonna be very bad for us.

The senators knew,

and the congressmen knew

that money laundering would happen,

except that they're probably gonna wait for the first big,

big thing to explode.

And so it so happened that in 2016 this thing exploded,

so we were able to get them to plug the loophole

on the money laundering and casinos.

The Senate's inquiry

made more than a dozen recommendations,

which included extending money laundering laws to casinos

and making it easier to access information

about bank accounts.

New laws covering the casinos were passed in July, 2017

and earlier that year,

the Philippines appointed a new central bank governor

who vowed to make it harder for dirty money

to enter the financial system.

But Osmena says he found it hard to get politicians to act.

We have the strictest bank secrecy law in the world,

and I can't get any of my congressmen

or senators to amend that law.

That's another reason why it still would be tempting

for somebody to come and launder money in the country.

There are strong links between the casino industry

in the Philippines

and the Chinese gambling haven of Macau.

And it's there I'm heading next.

I've come to Macau, a former Portuguese colony now part

of China that many called the Las Vegas of the East.

Macau was the home of the junket,

organized gambling holidays where Chinese high rollers

could get round domestic currency restrictions

by borrowing millions of dollars from the operators

to pour onto the Baccarat tables,

and pay it back when they got home.

According to Kim Wong, it was in Macau that Ding Zhize,

one of the Chinese men

who operated the junkets in the Philippines was based.

And a crackdown in Macau

and weak money laundering laws in the Philippines

made Manila's gambling tables increasingly attractive

to Chinese high rollers.

Restrictions on cash moving from the Chinese mainland

to Macau had been introduced

because of concern that corrupt officials were betting

embezzled money there,

in casinos where according

to one supervisor, "Few questions were asked."

Tell us about how people enjoy the gambling.

Why is it addictive?

And according to Benny Sio,

no one pays too much attention to the source of the money.

This whole junket model in Macau

is now under serious pressure.

The Chinese government has tightened outgoing capital flows

and beefed up its anti-corruption operations

and the authorities here are cooperating with that.

The downside of such crackdowns

for countries like the Philippines is

that the money launderers simply move on.

New York City, one of the world's biggest financial centers

and home to one of

its most important financial institutions,

the Federal Reserve Bank of New York or the Fed.

Its Manhattan headquarters, sit on top of 508,000 gold bars

and it handles around $800 billion of payments every day.

Jonathan Spicer reports on its activity

which moves markets around the world.

Well, no one thinks as the Federal Reserve in terms

of cyber heist, usually you think of, you know, economics,

you think of labor markets, you think

of macro models at the US Central Bank

and its economists are pouring over to try to decide what

to do about interest rates.

It turns out, of course, that there's about three

and a half trillion dollars

of foreign funds being held at the New York Fed,

and the Fed is basically account custodian

for 250 foreign entities around the world.

And its customers included Bangladesh's Central Bank,

and it was to the New York Fed

that the hackers sent 35 messages requesting payments

from the Bangladesh Bank account.

Things could have been a lot worse,

but for an extraordinary coincidence.

Millions of dollars, hundreds of millions

were never transferred

because the name Jupiter in the address

for the bank happened to match that of an oil tanker.

Nothing to do with the heist,

but on the list of US sanctions against Iran.

As a result, most of the transfer orders were flagged

as suspicious and blocked by the Fed.

And there were other reasons the transfer requests could

have aroused suspicion.

They were different to most payments made

by Bangladesh Bank.

They weren't formatted properly

and these were large payments

to individuals rather than organizations.

But largely because the requests appear

to be authenticated by SWIFT, $81 million was sent.

When I use my card in a foreign country, for example,

or for a sudden large purchase,

it can trigger a simple fraud inquiry from my bank.

Real-time monitoring,

the technology is quite straightforward,

but in the case of the heist,

nothing like that happened at the Fed.

The vast majority of these payment requests

that arrive on the doorstep

of the New York Fed are automatically executed.

You know, they come to the SWIFT network,

they have all the boxes ticked, they're SWIFT authenticated,

and so they automatically go out the door.

But Fed staff were concerned enough about some

of the payments to try to contact Bangladesh Bank.

At the end of Thursday,

they sent a message using SWIFT and two more on Friday,

but hackers had compromised Bangladesh Bank's SWIFT system

and sabotaged a crucial printer in the Dhaka office.

It wasn't until Saturday that Bangladesh Bank staff realized

what had happened and tried to contact the Fed urgently,

but could only use numbers they found on the internet,

lines that weren't answered at the weekend.

On Monday, Bangladesh Bank finally got messages through

to New York saying they'd been hacked.

They would've been seen as staff arrived

for work in New York at 7:30 in the morning.

Former fed employees familiar

with the bank's workings told Reuters

that the news would have been devastating.

People said it would've dropped like a bomb.

Someone said everyone would've freaked out.

Every lawyer within the US Central Bank

would've been contacted.

And this explains in part why when this, when the gravity

of the situation did occur to the New York Fed,

there was a very odd

and very troubling from Bangladesh's perspective, a period

of silence that lasted almost a day.

One former insider at the Fed said

they would've been concerned that its payment system

had been exploited by the hackers.

It was definitely a surprise

because I know that they take security

so seriously there at the Fed

and they put so much energy towards making sure

that only the right people have the right access

to the right information at the right time.

Were you surprised when you found that the,

that such a large amount of money had passed

through the Fed and out the other side as it were?

Well, the Fed certainly manages a lot

of money every single day,

and I think the people that work there are aware

that it's a very high stakes game,

whatever work that they're doing there.

So the dollar amounts didn't phase me.

It was more about the idea of that there was any kind

of security breach and that anything had gone wrong

in the procedures or the communication

between different central banks.

And the implications of what had happened

were sinking in beyond the banks.

Once it became clear that an internationally recognized

and respected institution like the Federal Reserve

had been caught up in the heist,

questions started being asked here in Washington.

Alarm bells were ringing about security and reputation

and US lawmakers wanted answers.

US congresswoman Carolyn Maloney was one

of the first public officials in America to ask questions.

How could this happen?

This is the Fed, the Federal Reserve.

This isn't any bank.

This is the backbone of the financial system,

not only in America but in the world.

And how in the world could a staggering 81 million,

almost billion be lost in a transfer system?

And if the transfer system doesn't work

and it's not accurate,

then it puts the whole banking system,

the international banking system at risk.

I was like, horrified.

If this transfer wasn't secure, then no transfer is secure.

So it's a very, very serious issue and cybersecurity,

I would say is one of the most pressing issues of our time.

The Fed declined our invitation

to provide someone for interview, but said this,

"While the event in February, 2016

did not result in a breach

or compromise of the New York Fed systems,

we did view this as an opportunity to further strengthen

the safety of global payments.

The New York Fed performs certain screening of

and diligence on funds transfers sent both to

and from the accounts of foreign central banks on our books.

The robustness of cybersecurity

around the global payment system must continue

to be a priority for each participant in the chain."

Finger pointing was happening both privately and publicly

as it turned out between

the Federal Reserve, Bangladesh, SWIFT,

and then increasingly officials in the Philippines,

where much of the money ended up disappearing

into the casino system there.

So you had the squabble that became louder and louder

and more and more public.

And then also the New York Fed took some steps

as we reported, based on conversations with those familiar

with the moves to bring in a 24-hour hotline

for all clients.

Something that for your everyday observer

seems like kind of an obvious move,

especially when you're sitting atop nearly three

and a half trillion dollars.

You want to allow for your clients to quickly get in touch

with you and not just rely on this SWIFT system

and an archaic,

an archaic convention of communicating that way.

Brussels, Belgian capital

and home to European institutions

as well as the headquarters of SWIFT,

a cooperative organization owned by the banks that use it.

Well in 1973 you have to go back to then,

banks were sending messages to each other using the telex.

Imagine getting 10,000 faxes a day.

Not very secure, not very automated.

So 239 banks from 15 countries said,

hey, let's use computers 1973,

let's use global telecommunications

and try to get it to work.

And they formed the Society

for Worldwide Interbank Financial Telecommunication, SWIFT.

And today, fast forward it's thousands of banks,

hundreds of, 200 countries,

and trillions of dollars a day flow

through the SWIFT network, over 10 trillion a day now.

And it was SWIFT's messaging system

that the hackers access to send messages to the Fed.

We always realized

that SWIFT's weak spot were at the user's terminal,

at the end points.

'Cause we're not responsible for the physical security

and for them keeping their own passwords safe and secure

and other credentials.

And over time you can imagine as cyber crime

became much more sophisticated,

SWIFT should have been doing more

or could have been doing more as we all know today.

SWIFT declined to be interviewed but said,

"There is no indication that SWIFT's network

or core messaging services have been compromised

in the recent attacks on banks.

While our customers are individually responsible

for the security of their own environments,

we fully recognize that the security of the industry

as a whole is a shared responsibility.

In mid 2016, we launched a Customer Security program

to reinforce the local security

of their SWIFT-related infrastructure."

And the organization has introduced changes.

Users like Bangladesh Bank now require

more than just a username and a password to log in.

SWIFT has done tremendous things

to strengthen its interfaces with two-factor authentication,

you know what that is,

and other things to strengthen the software.

They've had audit requirements for controls,

they're certifying third-party providers.

They have daily reconciliation reports.

So you see what SWIFT has sent,

whether or not you've sent it.

If it's fraudulent you'll see it.

And anomaly detection.

You know you've never sent a message

on Friday night to a casino.

Maybe we should hold that until we talk about it.

They've done a lot.

But back in Washington,

there are still doubts about depending on a single system.

My question is why in the world were you relying

so much on one system

when you're moving billions and billions of dollars

and you're relying on the SWIFT system?

Now if the SWIFT system doesn't work right

then the whole thing falls.

Under pressure over the heist,

changes have been made at some of the big institutions,

but will they be enough to stay ahead of the hackers?

And who was behind this audacious theft?

This is the story of one

of the world's biggest cyber heists.

How hackers stole $81 million from Bangladesh Central Bank

and appear to have got away with it, or have they?

The FBI is on the case

and inquiries are continuing around the world.

Efforts are being made to trace the missing money.

But will a bank ever get it back?

Could it happen again and who was behind it?

I've come to London to talk to the lawyer who,

on behalf of Bangladesh Bank,

is working with authorities in the Philippines

to recover the stolen funds.

Obviously they're doing everything

that they can to freeze the assets,

and I'm happy to say that they have taken effective steps

to freeze all the money.

The sad part is like in many parts of the world,

the system is slow

because it's very formal,

has to go through the steps that need to be taken.

And it may be a very long time

before we know what the results going

to be from the justice delivery system in the Philippines.

And if the stolen money can't be recovered,

he says Bangladesh Bank

will then consider seeking recompense in other ways.

We are doing everything possible to recover the funds.

If we are not able to do it within a particular time limit,

then we will look at other options, litigation and so on.

You've mentioned RCBC in the Philippines,

but you haven't mentioned the casinos.

Are they of concern to your inquiry at all?

For my purposes, from a strictly legal point of view,

I'm just following the money up to the banks

because I think using the phrase,

the buck stops with RCBC as far as we are concerned.

Bangladesh Bank says it's planning

to file a civil lawsuit against RCBC,

but RCBC says it has been a victim

of Bangladesh Bank's negligence and denies liability.

Liability would probably attach if number one, RCBC

was the one who stole from Bangladesh, which we did not.

We had nothing to do with the exiting

of funds from Bangladesh Bank.

And second is if RCBC has possession of those funds,

which we do not have.

So on the basis of those, yes we cannot subscribe

to any hypothesis that the bank is liable.

The RCBC bank manager, Maia Deguito,

is likely to be tried for money laundering offenses.

Bangladesh police have requested information from Chinese

authorities about the junket operators, GAO and Ding,

and say they want to know if the men are under arrest

in China and if they've been interviewed about the heist.

So a prosecution is now being prepared thousands

of miles away in Manila,

but it's broadly accepted that it's the FBI

that's best placed to move the investigation forward.

How much progress it's making is less clear.

And of course there's still the question of who was actually

behind the heist.

What happened to much of the money

that was played at casino tables

in the Philippines isn't known,

but analysis by US authorities

and cybersecurity experts contacted by Reuters

says the digital fingerprint found at the scene

of the crime, Bangladesh Bank's computer systems, points

to North Korea.

In the UK The defense company BAE systems

is subject to frequent attacks by hackers

and helps other organizations defend themselves

from cyber crime.

According to its experts,

the Bangladesh Bank heist bears

the hallmark of other attacks.

A distinctive code used to erase the tracks of hackers

that also featured in an attack on Sony pictures in 2014.

The US government has blamed that on North Korea,

a claim that North Korea denies.

So we got a few clues from the tools

that these attackers used in Bangladesh Bank

and other attacks that we've seen.

And the tools are very specific to a group called Lazarus.

And this is a name that's been given

by the security community,

and it's a group that has been involved

in attacks from South Korea.

They've been involved in attacks in the US.

We've seen them in attacks in Europe as well.

And they're almost certainly behind

this Bangladesh Bank heist as well.

A lot of people said North Korea

is involved in this.

I mean do you think that's a possibility?

We can't say for certain.

What we can say is that there are links back

in terms of infrastructure.

So we see hops from the IP addresses

that go all the way back to Pyongyang.

Ultimately, we don't know who's behind it though.

The Russian cybersecurity firm,

Kaspersky Lab has also said it found digital evidence

that Lazarus hackers made a direct connection from

an IP address in North Korea to a server in Europe

used to control systems infected by the group.

Kaspersky said that was the first time they've seen

a direct connection between Lazarus and North Korea.

And while it's possible the Bangladesh hackers

were trying to frame Pyongyang,

North Korean involvement was the likely explanation.

The FBI declined to comment for this program,

but a US official briefed on its investigation

has told Reuters the FBI believes

that North Korea was responsible.

And in 2017, the then deputy director

of the National Security Agency said private sector research

linking North Korea to the heist was strong.

With that linkage from Sony actors

to the Bangladeshi Bank actors is accurate.

That means a nation state is robbing banks.

That's a big deal in my view. That's different.

And do you believe

that there are nation states now robbing banks?

Is that your assessment?

I do.

Allegations of hacking, whether from security firms

or officials in the United States

and South Korea are all denied

by the North Korean government.

But no matter who is behind the Bangladesh Bank job,

North Korea or an unknown crime syndicate,

could there be another cyber heist?

Well, there have already been more attempts.

In 2017 Taiwan's Far Eastern International Bank

was attacked by hackers trying to steal millions

of dollars using the SWIFT payment system.

The banks declined to comment.

Russia's Central Bank has said hackers took control

of computers at an unnamed Russian bank in 2017

and used the SWIFT system to steal $6 million.

And in February, 2018, hackers tried

to steal nearly $2 million from India's City Union Bank.

The bank said there were similarities

with the Bangladesh case.

SWIFT won't comment on individual cases,

but the head of its customer security program has confirmed

that there have been more attacks.

I spoke to the security executive at SWIFT

and he told me that these attacks,

the attempts keep happening.

He wouldn't say how often or how successful they were,

but he said that these attackers are relentless

and one of the reasons that they're relentless

and they haven't stopped is because,

I'm pretty sure it must still be working.

If they weren't making money,

they would move on to something else.

James Lewis is a cybersecurity expert who's advised

the UN and American government on information security.

I think the issue is the people who connect to SWIFT,

and this is a larger pattern we've seen in cybersecurity

as the primary target becomes harder,

takes measures to defend itself,

the attackers move upstream.

In a statement, SWIFT told us,

"Attacks will continue to focus on the entry points

to payment systems at financial institutions,

which is why SWIFT is dedicating significant efforts

and resources to our Customer Security Program.

This is an ongoing challenge

and it is important that both SWIFT

and our customers adapt our approaches over time

as the threat evolves."

It's certainly improved a lot since Bangladesh Bank.

They've accelerated some of the previous plans that they had

to make security improvements.

They're now rolling out a program

of what's called "27 Controls"

to make sure that all banks using SWIFT

are actually following out good best practice security.

SWIFT has to take the bull by the horns

and raise a level of competence.

Anybody using the SWIFT system

has to be good enough and alert enough.

So I'd say it's SWIFT's problem.

I'm not saying it's SWIFT's responsibility.

The user-end is still the responsibility

of the financial institution, but SWIFT has to do more.

I mean, personally it's SWIFT's problem

and I think SWIFT is rising to the challenge.

On the trail of the missing millions

I've visited many places.

From the heart of the global financial system

to developing countries,

all with different levels of technological sophistication.

But their banks all share one thing,

the messaging system SWIFT.

And hackers have realized its users

can make themselves vulnerable.

Maybe Bangladesh is a victim,

but it is at the cost of Bangladesh

that the global payment system is improving.

From the biggest central banks

and from SWIFT, the largest global banks

to the smaller banks, we're all part of the same problem.

And trust in international

financial institutions is vital.

If you can't trust the Fed or the SWIFT system

or the transfer system,

then you don't even have a banking system.

Because what happens when people don't trust

financial institutions, they pull their money out of them.

They don't hire people,

they don't invest in businesses. They don't go forward.

They all know this is a wake up call

and they're not gonna get a second chance.

But enforcing the highest standards

internationally is a challenge.

Where I think the vulnerability is,

is that there isn't a global,

a more global coordinated response to these threats.

And the hackers have not gone away.

It may not be the same exact same type of hack

'cause they have cleaned up some of those vulnerabilities,

but there's gonna be other places where they can get in

and potentially steal large amounts of money.

Defenders come up with a little better defense

and the attackers figure out a way around it.

So until the day comes when countries agree

to prosecute cyber criminals,

we'll just continue to see this kind of back and forth.

This will continue.

The Bangladesh heist was a wake up call

for the international banking system.

Changes have been made,

but the threat from hackers is constantly evolving

and many institutions regard cybersecurity

as the biggest risk they face today.