Bangladesh central bank considers suing NY Fed over $107m hack

Bangladesh's central bank has hired a lawyer in the US for a potential lawsuit against the New York Federal Reserve after unknown hackers stole US$81 million (A$107 million) from its account. 

In one of the largest cyber heists in history, the hackers breached the computer systems of Bangladesh Bank (BB) in early February and succeeded in issuing instructions to the New York Fed to transfer US$81 million to accounts in the Philippines. 

The hackers also tried to move US$20 million to an obscure non-profit entity based in Sri Lanka, but that transaction was halted because the attackers misspelt the recipient's name.  

The heist has prompted the resignation of Bangladesh's central bank governor, Atiur Rahman, and the US Federal Bureau of Investigation (FBI) is now helping the country to track down the culprits. 

BB said in an incident report that it had been the subject of a sophisticated cyber attack in which 35 payment instructions were issued to the New York Fed. 

Of those instructions, the US bank blocked 30 while allowing the rest to go through. 

"We view this as a major lapse on the part of FRB NY," BB said in the incident report.. 

It said the bank was considering "preparing the ground to make a legitimate claim for the loss of funds against the FRB NY through a legal process". 

A source at the central bank confirmed the authenticity of the report. 

The New York Fed has said it followed normal procedures in allowing the transfer of the funds and that there was no evidence that its own systems had been compromised.  

Bangladesh police are still collecting information from the central bank's computer systems to determine who was behind the heist. In its report, BB said it was pursuing all avenues to recover the money. 

In Sri Lanka, a court has imposed a travel ban on six directors of the Shalika Foundation to which the hackers transferred money, a lawyer said. 

The transfer of US$20 million, ostensibly for a rural electrification project, was held up because the hackers had spelt the entity as Shalika "Fandation".