A third defendant has pleaded guilty to taking part in a global $45 million ATM fraud scheme, prosecutors said.
Evan Jose Peña was part of a cybercrime ring that allegedly stole debit card data, then hacked bank systems and ultimately emptied the accounts.
Peña and two other men, who pleaded guilty last month, allegedly formed the worldwide group's New York cell, which by itself fraudulently withdrew nearly $3 million in just hours.
"These three defendants participated in a criminal flash mob, using data stolen through the most sophisticated hacking techniques to withdraw millions of dollars in mere hours in an unprecedented cyber heist," said Loretta Lynch, U.S. Attorney for the Eastern District of New York.
Related: 8 charged in $45 million cybertheft bank heist
Prosecutors said hackers targeted MasterCard-connected accounts at banks in the United Arab Emirates and Oman. They stole card data and changed withdrawal limits, then sent the card information to associates worldwide who withdrew nearly unlimited sums from ATMs.
The three defendants who pleaded guilty were allegedly involved in two such thefts, one in 2012 and another last spring. The first heist brought in $400,000 in under three hours, according to the U.S. Attorney's office.
Related: Cyberattacks are the bank robberies of the future
They said the ringleader, Alberto Yusi Lajud-Peña, was murdered in the Dominican Republic in April. Four other defendants who initially pleaded not guilty are pending trial, said spokesman Robert Nardoza of the U.S. attorney's office.
The theft is one of the largest bank heists in history. The only larger theft in New York was the 1978 robbery of cash and jewelry at John F. Kennedy International Airport, which was depicted in the movie "Goodfellas."
Peña's attorney could not be reached for comment.
--CNNMoney's Chris Isidore contributed to this report
