The $1 Billion Bank Heist That Was Partly Stopped by a Spelling Mistake
Sep 02, 2026
In February 2016, hackers attempted one of the most ambitious bank robberies ever seen. Their target wasn't an ordinary commercial bank but Bangladesh Bank, the central bank of Bangladesh, which held billions of dollars in an account at the Federal Reserve Bank of New York.
The criminals didn't walk into a building or threaten a cashier. They compromised computers at Bangladesh Bank and obtained credentials used to send legitimate international payment instructions. Then they attempted to make $951 million disappear.
35 Fraudulent Transfers
The attackers submitted 35 fraudulent payment instructions through the international banking system, directing money from Bangladesh Bank's account at the New York Fed toward accounts elsewhere.
At first, many of the requests failed because of formatting problems. The criminals corrected them and tried again.
Several payments succeeded.
Around $81 million reached accounts in the Philippines, while another $20 million was transferred toward Sri Lanka.
Had the remaining instructions succeeded, the losses could have approached $1 billion.
Then something remarkably simple went wrong.
The $20 Million Typo
One fraudulent transfer attempted to send $20 million to an organization in Sri Lanka called the Shalika Foundation.
But somebody reportedly typed:
“fandation”
instead of:
“foundation.”
The spelling mistake caused Deutsche Bank, which was involved in routing the payment, to request clarification. The suspicious transaction was stopped and the $20 million was eventually recovered.
Other unusual details in the payment requests also triggered scrutiny. The New York Fed ultimately blocked 30 of the 35 instructions, preventing hundreds of millions of additional dollars from leaving Bangladesh Bank's account.
The attackers still had $81 million.
The Money Reaches the Philippines
The stolen $81 million was transferred into accounts in the Philippines and then moved into the country's casino industry.
That made recovering the money considerably more difficult. Funds could be converted, transferred and mixed through gambling operations before investigators had time to react.
Bangladesh Bank discovered the scale of the attack during a weekend, creating another problem: urgently contacting institutions on the other side of the world wasn't as simple as it sounds. Reuters later reported that officials sent emails, attempted phone calls and even used fax while desperately trying to stop the payments.
By the time everyone understood what had happened, much of the money was already gone.
Was the Federal Reserve Hacked? No.
This became an important misconception surrounding the case.
The Federal Reserve Bank of New York said there was no evidence its systems had been penetrated.
The fraudulent instructions appeared legitimate because they had been authenticated using the banking credentials compromised at Bangladesh Bank.
Similarly, SWIFT later stressed that its central network itself had not been hacked. The attackers had compromised systems used by the bank to communicate through the network.
In other words, instead of trying to break into one of the world's most heavily protected financial institutions, the attackers found a weaker point elsewhere in the chain and used legitimate banking mechanisms against the banks themselves.
From $951 Million to $81 Million
The Bangladesh Bank robbery became one of the most famous cyber-heists in history because of how close the criminals came to something much larger.
They attempted to move approximately: $951,000,000.
They successfully stole: $81,000,000.
And hundreds of millions more were prevented from disappearing because banks eventually recognized something wasn't right.
Among the warning signs was one tiny spelling mistake.
Fandation.
For the hackers behind one of history's most ambitious digital bank robberies, it may have been one of the most expensive typos ever made.
Discussion:
What is more incredible: that hackers nearly managed to move $1 billion from a central bank, or that something as simple as a spelling mistake helped expose the operation?
The criminals didn't walk into a building or threaten a cashier. They compromised computers at Bangladesh Bank and obtained credentials used to send legitimate international payment instructions. Then they attempted to make $951 million disappear.
35 Fraudulent Transfers
The attackers submitted 35 fraudulent payment instructions through the international banking system, directing money from Bangladesh Bank's account at the New York Fed toward accounts elsewhere.
At first, many of the requests failed because of formatting problems. The criminals corrected them and tried again.
Several payments succeeded.
Around $81 million reached accounts in the Philippines, while another $20 million was transferred toward Sri Lanka.
Had the remaining instructions succeeded, the losses could have approached $1 billion.
Then something remarkably simple went wrong.
The $20 Million Typo
One fraudulent transfer attempted to send $20 million to an organization in Sri Lanka called the Shalika Foundation.
But somebody reportedly typed:
“fandation”
instead of:
“foundation.”
The spelling mistake caused Deutsche Bank, which was involved in routing the payment, to request clarification. The suspicious transaction was stopped and the $20 million was eventually recovered.
Other unusual details in the payment requests also triggered scrutiny. The New York Fed ultimately blocked 30 of the 35 instructions, preventing hundreds of millions of additional dollars from leaving Bangladesh Bank's account.
The attackers still had $81 million.
The Money Reaches the Philippines
The stolen $81 million was transferred into accounts in the Philippines and then moved into the country's casino industry.
That made recovering the money considerably more difficult. Funds could be converted, transferred and mixed through gambling operations before investigators had time to react.
Bangladesh Bank discovered the scale of the attack during a weekend, creating another problem: urgently contacting institutions on the other side of the world wasn't as simple as it sounds. Reuters later reported that officials sent emails, attempted phone calls and even used fax while desperately trying to stop the payments.
By the time everyone understood what had happened, much of the money was already gone.
Was the Federal Reserve Hacked? No.
This became an important misconception surrounding the case.
The Federal Reserve Bank of New York said there was no evidence its systems had been penetrated.
The fraudulent instructions appeared legitimate because they had been authenticated using the banking credentials compromised at Bangladesh Bank.
Similarly, SWIFT later stressed that its central network itself had not been hacked. The attackers had compromised systems used by the bank to communicate through the network.
In other words, instead of trying to break into one of the world's most heavily protected financial institutions, the attackers found a weaker point elsewhere in the chain and used legitimate banking mechanisms against the banks themselves.
From $951 Million to $81 Million
The Bangladesh Bank robbery became one of the most famous cyber-heists in history because of how close the criminals came to something much larger.
They attempted to move approximately: $951,000,000.
They successfully stole: $81,000,000.
And hundreds of millions more were prevented from disappearing because banks eventually recognized something wasn't right.
Among the warning signs was one tiny spelling mistake.
Fandation.
For the hackers behind one of history's most ambitious digital bank robberies, it may have been one of the most expensive typos ever made.
Discussion:
What is more incredible: that hackers nearly managed to move $1 billion from a central bank, or that something as simple as a spelling mistake helped expose the operation?