The $45 Million ATM Heist – When Hackers Made Cash Machines Their Personal Banks
Aug 28, 2026
In 2013, investigators uncovered a bank robbery unlike almost anything they had seen before.
There were no guns, masks or getaway cars. Instead, an international cybercrime organization combined sophisticated hackers with hundreds of people physically visiting ATMs around the world.
In just two coordinated operations, approximately $45 million was withdrawn from cash machines across more than 20 countries. At the time, the operation was described as one of the largest ATM frauds ever discovered.
The Hack Behind the Money
The criminals weren't simply stealing ordinary bank cards.
According to U.S. prosecutors, hackers penetrated companies responsible for processing prepaid MasterCard transactions. Once inside, they compromised prepaid card accounts and manipulated their balances and withdrawal limits.
That was the key to the entire operation.
A normal prepaid card might contain only a few hundred dollars and have strict withdrawal limits. The attackers effectively removed those restrictions, allowing enormous amounts of money to be withdrawn before the compromised accounts were shut down.
The stolen card information and PINs were then distributed to teams known as “cashers.”
Those teams encoded the information onto magnetic-stripe cards and headed for ATMs.
The First Attack: $5 Million
On December 22, 2012, the organization targeted prepaid cards issued by RAKBANK in the United Arab Emirates.
More than 4,500 ATM transactions were carried out across approximately 20 countries, producing around $5 million in losses.
New York was only one part of the operation. There, the local crew conducted roughly 750 withdrawals at more than 140 ATMs in just two hours and 25 minutes, taking nearly $400,000.
But that was essentially the test run.
Two months later, the organization returned with something much bigger.
$40 Million in Ten Hours
On February 19 and 20, 2013, another payment processor was compromised, this time involving prepaid cards issued by Bank Muscat in Oman.
Then the signal went out.
Cashers in 24 countries started visiting ATMs.
Over approximately ten hours, the organization conducted around 36,000 transactions and withdrew roughly $40 million.
The New York team alone made nearly 3,000 withdrawals, collecting approximately $2.4 million.
Imagine the coordination required. While hackers were maintaining control of compromised financial systems, teams thousands of kilometres apart were simultaneously moving from ATM to ATM carrying cards containing the stolen account information.
The longer they continued, the more money they could take.
Until somebody noticed.
What Happened to the Cash?
Getting $45 million out of ATMs created another problem: suddenly the organization possessed mountains of physical currency that needed to be moved and laundered.
Investigators said members bought expensive watches and luxury cars, made large cash deposits and transported huge quantities of money to other members of the organization.
One particularly incredible piece of evidence appeared later in the investigation.
Authorities recovered a photograph showing approximately $800,000 in cash packed inside luggage. Prosecutors said the suitcase was transported by bus from New York to Florida for delivery to one of the organizers.
The New York Crew Falls
In May 2013, U.S. prosecutors announced charges against eight members of the New York cell.
Their suspected leader, Alberto Yusi Lajud-Peña, wasn't among those who would eventually stand trial. He had fled to the Dominican Republic and was found murdered there in April 2013.
Additional arrests followed, while several members of the New York operation eventually pleaded guilty.
But the people withdrawing cash represented only one layer of a much larger international organization. The operation depended on hackers, organizers, compromised financial infrastructure and cashing teams operating across multiple countries.
Why the $45 Million Heist Became Famous
The amount stolen was extraordinary, but the speed was perhaps even more impressive.
The criminals had effectively transformed ATM withdrawal limits from a security feature into something they could manipulate from behind a computer.
Once that happened, the physical cashers simply had to move faster than the banks could react.
It represented a new kind of bank robbery: the hackers didn't need to enter the bank, and the people emptying the ATMs didn't need to understand how the hack worked.
Everyone had a specific role.
Hack the system.
Distribute the card information.
Empty the ATMs.
Move the cash.
By the time investigators announced the case in May 2013, $45 million had disappeared in two operations that together involved tens of thousands of ATM withdrawals around the world.
It was the traditional bank heist rebuilt for the internet age.
And instead of breaking into one vault, the criminals effectively turned thousands of ATMs into vault doors that opened simultaneously.
There were no guns, masks or getaway cars. Instead, an international cybercrime organization combined sophisticated hackers with hundreds of people physically visiting ATMs around the world.
In just two coordinated operations, approximately $45 million was withdrawn from cash machines across more than 20 countries. At the time, the operation was described as one of the largest ATM frauds ever discovered.
The Hack Behind the Money
The criminals weren't simply stealing ordinary bank cards.
According to U.S. prosecutors, hackers penetrated companies responsible for processing prepaid MasterCard transactions. Once inside, they compromised prepaid card accounts and manipulated their balances and withdrawal limits.
That was the key to the entire operation.
A normal prepaid card might contain only a few hundred dollars and have strict withdrawal limits. The attackers effectively removed those restrictions, allowing enormous amounts of money to be withdrawn before the compromised accounts were shut down.
The stolen card information and PINs were then distributed to teams known as “cashers.”
Those teams encoded the information onto magnetic-stripe cards and headed for ATMs.
The First Attack: $5 Million
On December 22, 2012, the organization targeted prepaid cards issued by RAKBANK in the United Arab Emirates.
More than 4,500 ATM transactions were carried out across approximately 20 countries, producing around $5 million in losses.
New York was only one part of the operation. There, the local crew conducted roughly 750 withdrawals at more than 140 ATMs in just two hours and 25 minutes, taking nearly $400,000.
But that was essentially the test run.
Two months later, the organization returned with something much bigger.
$40 Million in Ten Hours
On February 19 and 20, 2013, another payment processor was compromised, this time involving prepaid cards issued by Bank Muscat in Oman.
Then the signal went out.
Cashers in 24 countries started visiting ATMs.
Over approximately ten hours, the organization conducted around 36,000 transactions and withdrew roughly $40 million.
The New York team alone made nearly 3,000 withdrawals, collecting approximately $2.4 million.
Imagine the coordination required. While hackers were maintaining control of compromised financial systems, teams thousands of kilometres apart were simultaneously moving from ATM to ATM carrying cards containing the stolen account information.
The longer they continued, the more money they could take.
Until somebody noticed.
What Happened to the Cash?
Getting $45 million out of ATMs created another problem: suddenly the organization possessed mountains of physical currency that needed to be moved and laundered.
Investigators said members bought expensive watches and luxury cars, made large cash deposits and transported huge quantities of money to other members of the organization.
One particularly incredible piece of evidence appeared later in the investigation.
Authorities recovered a photograph showing approximately $800,000 in cash packed inside luggage. Prosecutors said the suitcase was transported by bus from New York to Florida for delivery to one of the organizers.
The New York Crew Falls
In May 2013, U.S. prosecutors announced charges against eight members of the New York cell.
Their suspected leader, Alberto Yusi Lajud-Peña, wasn't among those who would eventually stand trial. He had fled to the Dominican Republic and was found murdered there in April 2013.
Additional arrests followed, while several members of the New York operation eventually pleaded guilty.
But the people withdrawing cash represented only one layer of a much larger international organization. The operation depended on hackers, organizers, compromised financial infrastructure and cashing teams operating across multiple countries.
Why the $45 Million Heist Became Famous
The amount stolen was extraordinary, but the speed was perhaps even more impressive.
The criminals had effectively transformed ATM withdrawal limits from a security feature into something they could manipulate from behind a computer.
Once that happened, the physical cashers simply had to move faster than the banks could react.
It represented a new kind of bank robbery: the hackers didn't need to enter the bank, and the people emptying the ATMs didn't need to understand how the hack worked.
Everyone had a specific role.
Hack the system.
Distribute the card information.
Empty the ATMs.
Move the cash.
By the time investigators announced the case in May 2013, $45 million had disappeared in two operations that together involved tens of thousands of ATM withdrawals around the world.
It was the traditional bank heist rebuilt for the internet age.
And instead of breaking into one vault, the criminals effectively turned thousands of ATMs into vault doors that opened simultaneously.