Investigators examining the theft of $81 million from Bangladesh's central bank have uncovered evidence of three hacking groups — including two nation states — inside the bank's network but say it was the third, unidentified group that pulled off the heist, according to two people briefed on the progress of the bank's internal investigation.

FireEye Inc., the company hired by the bank to conduct the forensics investigation, identified digital fingerprints of hacking groups from Pakistan and North Korea, the two people said. It hasn't found enough data to determine whether the third group, the actual culprit, was a criminal network or the agent of another nation.

The twists and turns add to the mystery of who pulled off one of the largest cyberheists in history. The hackers, pairing theft with havoc within the global financial system, used the Swift interbank messaging system to move cash into fake accounts in the Philippines but were discovered before they could complete an attempted transfer totaling $951 million.