Footage of hacker Sriki using laptop in police custody provided key breakthrough in Bitcoin scam: SIT

The laptop that the hacker was found to be using in police custody has provided the SIT with digital evidence to show that police officers illegally accessed cryptocurrency wallets of the hacker that were located on a cloud server, sources familiar with the probe said.

“There were images in the media of the accused (Sriki) using a laptop when he was in police custody. We tried to locate the laptop since it was not among the property declared in official records of the case. When the laptop turned up it provided leads,” a police officer said.

The SIT arrested a police officer of the rank of inspector, Prashant Babu, who headed the technical support cell of the Bengaluru crime branch police and a private cyber expert, KS Santhosh Kumar, of the Group Cyber ID in the case on January 24.

The SIT has also named three former crime branch police inspectors, Sridhar Poojar, SR Chandradhar and Lakshmikanthaiah, the original investigators of the cases against the hacker in the FIR that was registered in the CID cyber crime police station on January 24.

During a bail hearing on Thursday for the police officer Prashant Babu, a special public prosecutor Jagadeesh B N informed a special court about how the SIT discovered the existence of the suspicious laptop and its usage by Sriki while he was in police custody between November 2020 and January 2021 from looking at CCTV footage.

The SPP told the court that the secretive manner in which the laptop was procured and allowed to be utilised by Sriki with the installation of Linux software indicated that police officers were not forthright in their efforts to recover Bitcoins that the hacker claimed to have in his possession.

The SIT has stated in court filings that around December 8, 2020, the arrested police officer purchased a laptop manufactured by MSI for Rs 60,000 with the help of a cyber expert. The laptop was not initially produced before the SIT by the arrested crime branch officer despite multiple notices but was eventually produced on October 13, 2023.

When the laptop was subjected to forensic analysis, it was found that it had been used while the hacker was in police custody to remotely access crypto wallets on his Amazon Web Service cloud server account from the police technical cell and the office of the Group Cyber ID firm.

The details of the wallet files on the Amazon cloud servers or its presence was not recorded in police files, the SIT has alleged. The SIT has also reported finding the digital trail for the deletion of the “bash history” for the access of the cloud server where the crypto wallets of the hacker were located by using the laptop.

CCTV footage from a guesthouse where Sriki was kept in illegal custody after his arrest in November 2020 had emerged in the media and it showed the hacker working on a laptop.

The SIT has stated that it has found that Bitcoin worth Rs 1.86 lakh was transferred from the official KYC-cleared crypto exchange account of Robin Khandelwal, an associate and accountant to Sriki to the KYC-cleared account of Santhosh Kumar when Khandelwal was in police custody with Sriki at the end of 2020.

The SIT has also found that when Sriki was in custody the cyber expert Santhosh Kumar obtained three nano ledgers or hardware crypto wallets from Surat through his associates. A large quantity of Bitcoin that was in Sriki’s wallets were transferred to these hardware wallets on January 16, 2021, the SIT has alleged.

Sources said that the SIT is yet to find the trail of a large cache of Bitcoins that is alleged to have been transferred from the hacker’s cloud crypto wallets to the nano ledgers (hardware crypto wallets) that were procured on behalf of the police.

The laundering of crypto currency generally involves the conversion of Bitcoins and other crypto money to regular currency through exchanges in places like Dubai and subsequent return of the money through hawala and other routes to the main launderers. At least one of the suspects on the radar of the SIT is known to have been a frequent traveller to Dubai.

The background

Srikrishna and his accountant Khandelwal were initially arrested by the CCB in November 2020 on charges of ordering drugs on the internet using Bitcoins.

The case involving the purchase of drugs on the darknet eventually led to the cracking of several cybercrimes in Karnataka involving the then 26-year-old hacker Srikrishna Ramesh, including a Rs 11.5-crore heist from the Karnataka e-governance cell in July-August 2019.

The handling of the cases involving the hacker by the police under the BJP government in Karnataka after the arrests in November 2020 resulted in allegations of corruption by the Congress when it was in opposition between 2020-2023.

The Congress government constituted the CID SIT on June 30, 2023, soon after it came to power in May 2023.

Sriki himself has said in police statements that are on record in chargesheets filed by the crime branch that he was forced to hand over all crypto currency in his possession to the police.

“I understood the case scenario that even if I do not give them the Bitcoins they can use forensic methods to find the Bitcoins after a talk with the investigating officer. So post consultations, I voluntarily accepted [sic] to give away the Bitcoins which I had kept in various wallets in different cryptocurrencies,” reads a statement attributed to Sriki which is a part of the chargesheet in one of the cases filed against the hacker in 2021.

The Congress has suggested that police and politicians collected bribes through cryptocurrency from the hacker and his associates to water down the cases during the BJP tenure.

At the time of the hacker’s arrest in 2020, the value of one Bitcoin was in the range of $25,000 (around Rs 20 lakh) and soared to as high as $60000 (around Rs 50 lakh by April 2021). The Bitcoin scam has been estimated to be in the range of Rs 80 to Rs 200 crore.

In court hearings since the SIT filed its January 24, 2024, FIR and named four police officers and a cyber expert in the scam, advocates for two of the police officers accused in the case have argued that the SIT probe of police corruption in the handling of the hacker’s cases would weaken the original hacking cases registered against the hacker between 2019 and 2021 by the crime branch for breaking into and stealing from gaming/poker websites as well as cryptocurrency exchanges.