Three men have been arrested in the UK in connection with the €13 million cyber-heist at Bank of Valletta in February last year.
The breakthrough in the investigation into the audacious hacking was announced in a statement by the UK's National Crime Agency.
Hackers were able to access BOV systems and move the money into foreign accounts before some of the cash was spent on high-end goods including Rolex watches and an Audi A5 car.
David Cunningham, the National Crime Agency's Belfast branch commander said the investigation focussed on "a number of individuals we suspect may have been involved in laundering money on behalf of the organised crime group who carried out the cyber-attack."
Three men were arrested earlier this week in Belfast and London after a money-laundering investigation by the UK's NCA and the Malta Police Force's economic crimes unit.
Arrests in Belfast and London
On Wednesday two men aged 22 and 17 were arrested in raids in West Hampstead and Ladbroke Grove in London and a third man was interviewed under caution.
On Thursday the Police Service of Northern Ireland arrested a 39-year-old man in Belfast on suspicion of money laundering offences, fraud and theft. He remains in custody.
The investigation found that a strain of malware was used to access systems and illegally remove the funds into UK accounts.
Around £800,000 (€950,000) was transferred into accounts in London and Belfast and in the following hours a number of card payments and cash withdrawals totalling £340,000 were made before a block could be put on them.
Spending spree on high-end cars, watches
"They included payments to high-end stores such as Harrods and Selfridges in London, around £110,000 spent on Rolex watches at a store in London, and payments for a Jaguar and Audi A5 from a car dealership," the National Crime Agency said in a statement.
Officers are still seeking a number of other suspects in connection with their investigation, the NCA said.
A spokesman for Bank of Valletta confirmed that arrests had been made but said that it had no other details at this stage.
In May, Bank of Valletta said it had recovered €10 million of the €13 million stolen by hackers in February and is expected to recover most of the remainder.
Malta Police: Investigations continuing, people in other countries may also be involved
A spokesman for the Malta police said investigations are still ongoing.
“Since the incident in February, we have collaborated with different agencies in Europe and around the world,” he said.
“Whilst we are pleased with the results of our work with our UK counterparts, there could be more people involved in other countries.”