Spanish police arrest suspected mastermind of $1 billion bank hacks

AMSTERDAM (Reuters) - Spanish police have arrested the suspected leader of a gang of cyber criminals who stole up 1 billion euros ($1.2 billion) from banks by altering account balances and instructing automatic teller machines to issue cash, Europol said on Monday.

The person suspected of being behind malware attacks known as “Carbanak” and “Cobalt” was arrested in Alicante, a port city on the south east coast of Spain, after cooperation between police forces in the United States, Asia and Europe, Europol said.

The Interior Ministry said ‘Denis K.’, who had directed the criminal organization from Spain since 2013, was arrested with three members of his organization, who originally came from Russia and Ukraine, it said.

The Ukrainian police did not provide further details.

Europol said the group had operated since 2013, with members in 40 countries, carrying out attacks on 100 financial institutions. They targeted bank employees with emails infecting their computers and then using them as a base to gain control of bank network and servers.

“With that level of access, the nefarious individuals authorize fraudulent bank transfers, raise the balances of mule accounts or command affected ATMs to spit out the money for them,” Europol said.

Europol, said the U.S. Federal Bureau of Investigation, Romanian, Belarussian and Taiwanese authorities, and private cyber security companies were assisting in the case.


The Interior Ministry said that during the raid in Alicante police seized jewels worth 500,000 euros and two luxury cars. It also blocked bank accounts and two homes valued at about 1 million euros.

The organization needed the support of other criminal groups to coordinate the work of the ‘mules’ they used to extract money from cash points that they attacked, it said. Until 2015 they used the Russian mafia for this, and after 2016 the Moldovan mafia.

Their earnings were converted into bitcoins at exchange houses in Russia and Ukraine. These were later transferred to their accounts and they accumulated about 15,000 bitcoin, Interior Ministry said.

Denis K used financial platforms in Gibraltar and the United Kingdom to load prepaid cards with bitcoin and spend them in Spain on cars, homes, and other goods.

He also set up an “enormous network” to mine bitcoins which he used as a means of laundering money.

($1 = 0.8037 euros)

Reporting by Toby Sterling in Amsterdam, Angus Berwick and Jesús Aguado in Madrid and Jack Stubbs in Moscow; Editing by Richard Balmforth