9 ms·
How Hackers Stole $100M from the New York Fed
- an_account 11y agoIf the funds were sent to casinos, shouldn't the casinos have logs of what the money was used for?
- chatmasta 11y agoHave you ever been to a casino? You buy chips with cash, then you play with the chips, then you cash the (remaining) chips in for cash. There is no tracking of where each chip came from. EDIT: Although maybe you're right, if the "gamblers" deposited funds to the casino via wire, direct from the fed, and then exchanged them for chips. So the casinos should presumably have some record of who came to claim that wire in chips.
- shkkmo 11y ago> There is no tracking of where each chip came from. Do you have evidence for this? I find it rather plausible that casinos have anti-fraud measures built into their chips to allow tracking of where each chip came from. EDIT: A quick google shows this is indeed the case for some casinos at least: http://singularityhub.com/2011/02/12/1-5m-robbery-of-bellagio-casino-foiled-thanks-to-rfid-chips/ http://singularityhub.com/2011/02/12/1-5m-robbery-of-bellagi...
- wlesieutre 11y agoI'm surprised they haven't started putting RFID tags in every chip so they can track exactly how much each player spends at each game. Combined with proper record keeping, if chips were ever stolen, you could flag them and make sure they can't be redeemed for cash. Maybe in Vegas?
- drone 11y agoPlay craps? You'll cycle chips pretty much all of your chips, and chips you throw to one side get replaced with chips from another side when making field bets -- for example. Typical player tracking is done through comp cards, where they account for your buy-ins at the table, and buy out at the cashier.
- jgalt212 11y agoOK, now try doing that with $100MM of chips.
- simcop2387 11y agoI believe they do that in higher value chips in vegas, http://singularityhub.com/2011/02/12/1-5m-robbery-of-bellagio-casino-foiled-thanks-to-rfid-chips/ http://singularityhub.com/2011/02/12/1-5m-robbery-of-bellagi...
- trhway 11y ago>I'm surprised they haven't started putting RFID tags in every chip so they can track exactly how much each player spends at each game. and how would casino be laundering money then? :)
- gozur88 11y agoWhere I live the $5k chips and up are tagged. Or they were, ten years ago when I stopped playing. They may all be tagged now. Casinos have cameras at the cage, and beyond that cash transactions in a casino have the same reportability as cash transactions everywhere. If it's in the US that means IRS paperwork at $10k. I have no idea what the limits are in the Philippines, but I'll bet they have video of the people who collected the money.
- Animats 11y agoCasino chips have had RFID tags for years.[1][2] The tracking is getting quite good. Casinos can know how much players bet, lost, and won.[3] The casino chip RFID vendors have solved the tag collision problem quite well; casinos can inventory big stacks of chips all at once, obtaining the serial number of each chip. Chips can be flagged or invalidated by serial number. [1] http://singularityhub.com/2011/02/12/1-5m-robbery-of-bellagio-casino-foiled-thanks-to-rfid-chips/ http://singularityhub.com/2011/02/12/1-5m-robbery-of-bellagi... [2] http://www.cnbc.com/2014/04/16/cheaters-may-speed-need-for-pricey-data-tracking-poker-chips.html http://www.cnbc.com/2014/04/16/cheaters-may-speed-need-for-p... [3] http://www.gpigaming.com/rfid-technology/rfid-in-casino-chips http://www.gpigaming.com/rfid-technology/rfid-in-casino-chip...
- Retric 11y agoDepends on how much cash your throwing around. Casino's tend to track there high rollers with great precision, but if your tossing out < 1,000$ total it's not an issue. PS: In the US the government requires casino's to track large winnings for the IRS they hand out W9's.
- at-fates-hands 11y agounlikely. The best way to legally launder money is to use a casino. You bring in your dirty money, exchange it for chips. Then sit on your chips for a week, maybe a month, then go back and cash out your chips for clean money. Meanwhile, all the cash you moved through the casino is now scattered to some 50-100 different banks as it gets deposited in their daily drops and then transferred as necessary between the banks. In a few weeks, the dirty money is albeit untraceable.
- 21 11y agoBut I don't understand something. You showed up with lets say $50k at the casino, you departed with the same $50k. If you'll be investigated, you still can't justify the money you walked in with.
- wmf 11y agoCan you claim it as winnings? Do these casinos issue receipts?
- MagnumOpus 11y agoCriminal 1 buys $50k in chips using wired funds. Gives chips to criminal accomplices 2, 3 and 4. CA2, CA3 and CA4 come into the casino a few different times over several months, gamble for while for a net zero gain or loss, and then convert their "winnings" from chips into cash in chunks of $5k or so - flying under the radar. C1 never needs to come back to the casino where the police might catch him - and he is the only one who is linked to the big heist.
- mianos 11y agoThe large value chips have rfid tags in them. You would be investigated. You'd need to play some game with a slight loss to the casino to swap them out.
- imaginenore 11y agoThat part of the story makes the least sense. So casino gets $100M. Then what? If the casino isn't involved in the scheme, how can a thief take that $100M, using chips or not?
- jonknee 11y agoConvert money to chips, cycle chips around, convert chips to cash. It's a really common money laundering technique, though not usually at this scale.
- imaginenore 11y agoSo casino buys chips from itself, gambles with itself, then exchanges the chips to cash where exactly? That makes no sense.
- SeanBoocock 11y agoThe implication in the article is that the casinos weren't directly involved in the money laundering. Those who were perpetrating it brought the money into the casinos (ie bought chips with "dirty" money), engaged in otherwise legitimate looking behavior at the casinos, and then cashed out the chips for cash. Apparently, the loop on this was tight enough not to fool investigators.
- imaginenore 11y agoNo, the article says the money was wired to the casinos.
- jonknee 11y agoThe point of money laundering is to conceal the path of funds. Changing your money into chips and then your chips into money (at different times) accomplishes this. Casinos are remarkably light on the documentation side compared to financial institutions. When you change money into chips you don't get a receipt or have to sign anything, you just get chips. Similarly, you don't need to do anything special to switch chips back into cash. If you're trying to make the funds look really legitimate you can even pay tax on your gambling "winnings".
- gjem97 11y agoMisleading headline, given the first line of the piece is "The story of the theft of $100 million from the Bangladesh central bank"
- wheaties 11y agoThe money was held in the Fed.
- nibs 11y agoThe money was the Fed's money but it was stolen by hacking the Bangladesh CB. It is both true and misleading.
- Someone1234 11y agoYeah the article's title is true but misleading. They hacked the Bangladesh Central Bank, but stole money from the New York Fed. It is even debatable if the NY Fed is even at fault given that the hackers had legitimate credentials to make the transfer (the Bangladeshis are arguing that the NY Fed is still responsible because they should have flagged the Casinos as unusual and stopped it). You'd think that with accounts as large as these they would have a "whitelist" of valid accounts to transfer funds to, and some long convoluted process to add additional whitelist entries.
- CPLX 11y agoIn the context of the New York Fed transactions of tens of millions of dollars, as in this example, are essentially tiny.
- dang 11y ago"... by way of the New York Federal Reserve". That's ambiguous enough to make it not at all obvious what an accurate, neutral title would be. We're happy to have people suggest one, but don't have time to study this case.
- Thriptic 11y agoZH hates the fed so I'm sure they're eager to imply that the fed is somehow at fault, even if doing so is a stretch. Notice all the non-value add editorial jabs at the fed sprinkled throughout the piece.
- at-fates-hands 11y agoThe page this article is on is a exhibit A of how broken the internet has become.
- drvdevd 11y agoAgreed. I had to navigate away quickly. Which is a shame because the article was interesting.
- dfc 11y agoZero hedge has always looked like this. Atleast for as long as i can remember. http://web.archive.org/web/20101230091417/http://www.zerohedge.com/ http://web.archive.org/web/20101230091417/http://www.zerohed...
- subway 11y agoI don't understand why you've been downvotes, but after 3 minutes of fighting my Chrome on my phone, I had to give up.
- mturmon 11y agoComplaints about poor site UX can often be lodged, and don't address the particulars of the content of the article. It's a distraction.
- runeb 11y agoThis is pretty much the only reason I still use Safari. The Read mode gives me a clean article. Sad that its become necessary really.
- fsiefken 11y agoFirefox has a read-mode as well: https://support.mozilla.org/en-US/kb/firefox-reader-view-clutter-free-web-pages https://support.mozilla.org/en-US/kb/firefox-reader-view-clu...
- deleted 11y ago[deleted]
- JumpCrisscross 11y agoI tried corroborating the claim that the hackers were Chinese. Couldn't find a reliable source. Anyone have anything? For future reference, Zero Hedge is a low-quality source.
- dang 11y agoIt's a penalized site on HN, but this article was vouched for by established users. If there's a more substantive article for this particular story, we can change the URL, but so far the only other one we saw was merely about a spelling mistake. Occasionally the low-quality source has the higher-quality article.
- jackgavigan 11y agoReuters: http://www.reuters.com/article/us-usa-fed-bangladesh-typo-insight-idUSKCN0WC0TC http://www.reuters.com/article/us-usa-fed-bangladesh-typo-in... Bloomberg: http://www.bloomberg.com/news/articles/2016-03-09/the-1-billion-plot-to-rob-fed-accounts-leads-to-manila-casinos http://www.bloomberg.com/news/articles/2016-03-09/the-1-bill...
- tristanj 11y agoThe zerohedge article has more information than either of those articles. It uses those two as sources, plus some Philippine newspapers. Right now it gives a fairly effective summary of the situation. Switching to either of those would be a downgrade, in my opinion.
- jackgavigan 11y agoThe zerohedge article is misleading (e.g. "And yes, it does appear that hackers managed to bypass the Fed's firewall") and lacks any semblance of objectivity.
- tristanj 11y agoAgence France-Presse/SCMP: Suspected Chinese hackers stole the money from Bangladesh’s foreign exchange account on February 5, according to a Dhaka central bank official and media reports. http://www.scmp.com/news/asia/south-asia/article/1922556/bangladesh-sue-us-reserve-bank-after-suspected-chinese-hackers http://www.scmp.com/news/asia/south-asia/article/1922556/ban... VICE: "The Fed had the responsibility to keep the money safe," Shamim Ahamad, press minister at the Bangladesh Embassy in Washington, told VICE News. "We are suspecting that Chinese hackers have done it." https://news.vice.com/article/bangladeshs-central-bank-accuses-ny-federal-reserve-of-losing-100-million https://news.vice.com/article/bangladeshs-central-bank-accus...
- imaginenore 11y agoI don't get how any of this could have happened. So many WTFs. Fraudulent bank wires are reversible, even months after. And how in the world do they not check who they send the money to?
- SilasX 11y agoOnly reversible if they consider you important enough. Source: got defrauded.
- eli 11y agoHow does that work if the money is no longer at the destination account?
- imaginenore 11y agoThat becomes the destination bank's problem.
- ianpurton 11y agoSwift payments are reversible if the destination bank agrees. If the money has already moved on they are unlikely to honour that reversal.
- karmacondon 11y agoI would be all for banning submissions from zerohedge.com outright. It's just noise that makes it harder for me to skim headlines for actual content.
- jackgavigan 11y agoSeconded.
- laxatives 11y agoThis is probably an unpopular opinion, but I feel the same way about Vice. Its not news, its entertainment. And when you can't disambiguate the two, its fucking dangerous.
- jorgecurio 11y agoYes VICE makes 100% of everything up. This is why even big news media outlets own a stake in it. Bush did 911 too.
- awakeasleep 11y agoBBC.com is FAR worse than Vice.
- fiatmoney 11y ago"The News" exists as a genre because it is entertaining, and this has been true literally since the inception of mass media with the printing press.
- wdr1 11y ago> Its not news, its entertainment. And when you can't disambiguate the two, its fucking dangerous. I consider the Daily Show both, as do many others.
- johnnyb9 11y agoI kinda like the articles on Zero Hedge. Is there a reason people on HN don't seem to like it?
- gotchange 11y agoFrom the Filipino source here: http://business.inquirer.net/207742/100-m-laundering-via-ph-banks-casinos-probed http://business.inquirer.net/207742/100-m-laundering-via-ph-... > a total of $100 million that was brought into the country’s banking system, sold to a black market foreign exchange broker, transferred to at least three large local casinos, sold back to the money broker and moved out to overseas accounts. Here's how I think that this heist went and I am just speculating here based solely on the info in the report: - They first wired the money to multiple accounts of a secondary financial institution (Remittance or FX business) which is characterized by heavy and frequent transactions so as not to raise suspicions. - They collected the money with the help of the facilitator in that organization. - They exchanged the dollars into pesos and likely in counterfeit bills at very lucrative rates just to account for the risks hoping for more rewards from the operation. - They took the money and deposited them in the casinos for ships settling debts and laundering the money in the process. - They traded the chips for authentic cash from the casinos and then went back to their FX broker to exchange it back in USD. - Finally, they reached out to their man at the FX/remittance business to have the funds wired overseas to the final recipients and probably masked with other legitimate transactions for better security for them.
- 21 11y agoWhy would you mix a money stealing operation with a money counterfitting one? It doesn't make sense. And we are talking huge sums here, the fake money would quickly show up everywhere in that area.
- Tloewald 11y agohttps://en.m.wikipedia.org/wiki/Money_laundering https://en.m.wikipedia.org/wiki/Money_laundering Having money in an account is useless as long as it can be traced to the fraudulent transfer. So you move the money through a casino or any other large scale cash flow, such as counterfeiting (buy fake money for cents in the fake dollar and then sell it at a loss somewhere else)
- tromp 11y agoChoice quote: "In other words, the Fed was funding gamblers, only these were located in Philippine casinos, not in the financial district. Ironically, that's precisely what the Fed does, only it normally operates with gamblers operating out of Manhattan's financial district."
- conductr 11y agoFirst job out of college was at JP Morgan treasury division. Was surprised when working on SWIFT system I had read so much about, it was literally just a fax to TIFF system. Basically just an image viewer. At the time, 10 years ago, we didn't even have ability to parse or OCR the images. I was really disappointed in how low tech this was, and how easy it would have been to make it better. Perhaps I only saw a piece of it, and it did have more going on. But I always thought "what's preventing someone from faxing in a false trade?" We would execute any trade that got faxed in if the letter head and account numbers looked normal.
- markbnine 11y agoI find ZH amusing.. In some ways I think it's the anti hackers news.. Hyper negative about the future.. Constant hate for new tech.. (Fear of skynet).. The system is always rigged and the little guy will never succeed... Posts by Right coast angry ex-traders.. The comments are inane...the cherry picked stories out of left field but plausible. Etc. The one place the two sites do often intersect is the fear and loathing of government surveillance.. I vote to give ZH stories a fair shake...
- jahmed 11y agoI read it every day. If only to contextualize the other news sources I read. FWIW I throw in some infowars when something big happens so I can see how certain segments will try to spin something.
- kchoudhu 11y agoOh my. Treasury ops at banks live in fear of clients getting ripped off like this. The liability is probably not the Fed's, but the reputation hit from large value transfer fraud is enough that loss of client business is a very real possibility. Consider also that the Fed is also facing competition in the intra-government "hold my cash" business from the Chinese, and this could be the first reputational domino in a real geopolitical shift in how funds are held and managed internationally.
- ilostmykeys 11y agoCould it be Chinese hackers then?
- kchoudhu 11y agoGiven that most of the funds ended up in Hong Kong... There's more at play here than Bangladesh getting ripped off.
- deleted 11y ago[deleted]
- JackFr 11y agoDoes the Fed make good on the lost money? As they can create it ex nihilo, it literally costs them nothing to make Bangledesh whole.
- zhte415 11y agoWorked at a bank. Usually stayed late/came early/irregular hours. Therefore had access code to the key safe, for confirming everyone put their keys in the key safe. But this was for front office and back office. Access to all keys. Small team, 10 people. That's important. Knew how much we had in the petty cash bank account. Usually around USD 40MM. Liquidity usage, etc. Also had access to the cheque book (via key locked cabinet), where via sealed internal mail, cash payment requests (cheque) were sent to the banking department. Speaking to a friend in the banking department, he remarked that whitelists of authorised payment receivers where being introduced. Being introduced? "Sure, if a payment request comes in, and it is authorised correctly (signature, in case of cheques), we send it ASAP." "Do you telephone the signer to verify? No." "Any transaction limits?" "No." This was 2005. Could have walked away with USD 40MM - then fled rapidly to another country. But didn't. Well, did go to another country. 2 factor authentication is essential, and whitelists too - a central bank doesn't change their account number. The FED seems to have had neither.
- downandout 11y agoSo SWIFT, the backbone of international monetary transfers, doesn't have some sort of automated way to verify that requests are legitimate? It would seem to me that once a request is received, the only secure thing to do would be to send a hash of the request back to a known system belonging to the originator to verify that the request was authorized. If SWIFT security is really as bad as this incident seems to suggest, I'm shocked that more fraudulent transfers don't occur.
- trumpd 11y agoAt least in consumer usage, SWIFT transfers are "push", not pull as you may be used to with American ACH. So the concept of verifying a request doesn't make sense. It sort of sounds (from the public information) like the Bangladeshi bank's credentials were compromised and used to make fraudulent transfer requests to the NY Fed. That's not really a problem with SWIFT. Arguably the NY Fed should have flagged the requests as suspicious, but that's probably a best-effort kinda thing.
- patrickk 11y agoReminds me somewhat of this story, where a German guy suspects the New York Fed is missing some of Germany's gold and won't come clean: http://www.bloomberg.com/news/features/2015-02-05/germany-s-gold-repatriation-activist-peter-boehringer-gets-results http://www.bloomberg.com/news/features/2015-02-05/germany-s-...