'IT security lacking led to BB hacking'

Expressing disappointment over Bangladesh Bank's activity after the fund hacking, Bank and Financial Institutions Division Secretary M Aslam Alam has said the central bank's lacking in IT security led to the incident.

He made the statement after a closed-door meeting with the Bangladesh Bank officials on Sunday afternoon.

"We are disappointed that Bangladesh Bank did not inform the finance ministry officially about the hacking even after a month into the incident. The ministry also disappointed on the central bank's activities to resolve the problem," Aslam Alam said.

He said: "Of the hacked money, $68,000 could be recovered as the money was in the account.

"We will decide about recovering the rest amount after discussing it with the finance minister."

He also said it is taking too much time to resolve the problem due to the lack of coordination between finance ministry and the Bangladesh Bank. 

Around $100m was taken away by hackers from of Bangladesh Bank's overseas account with a US bank.

Related stories: 

Anatomy of a bank robbery

FireEye to help probe Bangladesh Bank heist

Portion of money hacked from BB’s US account recovered

Another attempt to steal $870m from BB foiled

On February 4, $81m from the account of Bangladesh Bank at the New York Fed was ordered to be transferred to the four RCBC accounts – $30m was transferred to Lagrosas, $19.99m to Vergara, $25m to Vasquez and $6m to Cruz.

The funds were credited to the accounts via straight-through process after the transactions passed internal validation criteria. The funds were cleared through US-based correspondent banks Citibank, The Bank of New York Mellon and Wells Fargo.

The same day, Lagrosas withdrew $22.73m and deposited it in the US dollar account of William Go DBA Centurytex Trading, an account which was opened that day, PDI reports.

Between February 5 and 13, remittance company Philrem remitted the funds, now converted into Philippine pesos, to the bank accounts of Chinese national Weikang Xu, Eastern Hawaii Leisure Co and Bloomberry Hotels Inc (Solaire Resorts).

By the time Dhaka sent off frantic messages to halt the transaction, there was nobody in the office in Manila to respond.

On February 9, RCBC received a Swift message from BB requesting payment to be stopped and the accounts to be frozen for investigation. But withdrawals from the accounts totalling $58.15m had already been processed by RCBC.

Some $15.2m was deposited in the account of Philrem, $42.93m in Go’s dollar account and another $20m in Philrem, PDI reports.

On February 16, BB Governor Atiur Rahman sought the assistance of Philippine counterpart, Governor Amando Tetangco Jr of Bangko Sentral ng Pilipinas, PDI reports.

Three days later, the Philippines’ Anti-Money Laundering Council (AMLC) began a probe of bank accounts relating to Weikang Xu (believed to be a junket operator), Eastern Hawaii Leisure Co and Solaire Resorts.

The Philippine Daily Inquirer broke the story of a possible $100m digital bank robbery of BB funds on February 29.