Karnataka Bitcoin scam: SIT’s efforts to verify hacker Sriki’s claims draw tepid response from crypto exchanges

The SIT is trying to establish whether funds stolen from these exchanges were used to pay off police officials and others after the hacker was arrested in November 2020 by the Bengaluru crime branch police in a case related to buying illegal drugs from the dark web with Bitcoin.

“There has not been much response to the information sought through the Mutual Legal Assistance Treaty route from cryptocurrency exchanges located in different countries. One online poker site has indicated a data breach but not loss of funds,” a police official said.

“There may be a reluctance to share data sought by the SIT from apprehension of exposure of the vulnerability of security systems at the exchanges,” an SIT source said.

Following his arrest in November 2020, Sriki claimed before the police that he had hacked multiple international exchanges between 2016 and 2020 and used stolen Bitcoins to live the high life with his associates. He also claimed that he had handed over a large cache of the cryptocurrency in his possession to police officials after his arrest. The crime branch kept the hacker and his accountant Robin Khandelwal in their custody for nearly two months between November 2020 and January 2021 over different hacking cases in India but did not report the recovery of any stolen Bitcoin or other cryptocurrency from the hacker.

Following allegations of large-scale corruption involving crime branch policemen and political leaders in the handling of the cases of the hacker during the 2019-2023 tenure of the then BJP government, the Congress government constituted the SIT in June 2023.

Based on statements given by witnesses who helped the police investigate the hacker in 2020, the SIT has stated, during arguments for denial of bail to two police officers accused in the scam, that Sriki was in possession of over 4,000 Bitcoins valued at Rs 850 crore at the time of his arrest.

The SIT has found evidence to show that Sriki hacked the Unocoin cryptocurrency exchange, headquartered at Tumkur in Karnataka, in June 2017 to steal 60.6 Bitcoins valued at Rs 1.14 crore at the time. “There is evidence from the hacker’s laptop to confirm the Unocoin hacking,” an SIT official said.

The SIT has found that the hacker and his associates were dealing in large amounts of money between 2016 and 2020—for travel, purchase of cars, chartering flights and stays at luxury hotels— with the source of funds suspected to be hacking crimes committed by Sriki.

“The evidence of the hacking has to be obtained from exchanges where the hacking is alleged to have occurred to confirm the claims of the hacker and establish that stolen funds were being used for payments in India,” an SIT official said.

Hacking claims made by Srikrishna in 2020

In a voluntary statement given to the police during the course of his custody following his arrest, Sriki claimed involvement in multiple hackings including a hacking at the Bitfinex exchange in the British Virgin Islands while being part of a hacking group in the Netherlands.

“Bitfinex was my first big Bitcoin exchange hack. The exchange was hacked twice and I was the first person to do so. The second instance was a simple spear phishing attack which led to two Israeli hackers working for the army getting access to the computers of one of the employees, which gave them access to the AWS cloud account,” Sriki told the police.

According to his statement to the police Sriki made an “approx profit: 2000 BTC (Bitcoins)” from the Bitfinex hack and blew the entire amount on a “luxurious lifestyle”.

“The price of bitcoin was around $ 100 to $ 200, which was split with my friend Andy from the UK,” the hacker has stated as per the recordings made by the Bengaluru police. The hacker in his statement to the police has also said he managed on a few occasions to sell Bitcoins stolen from the Bitfinex hack by using concealment techniques to avoid detection.

“I also have various private keys in my cloud account and if access to them is given, I would be able to give back all the stolen Bitcoins which I have stolen from various places using my hacking skills,” Sriki said in his 2020 statement.

In an additional statement in a case where he is accused of hacking a poker gaming site, Sriki has claimed that he voluntarily agreed to give away Bitcoins that were in his possession to the police.

“I understood the case scenario that even if I do not give them the Bitcoins they can use forensic methods to find the Bitcoins, after a talk with the investigating officer. So post consultations, I voluntarily accepted [sic] to give away the Bitcoins which I had kept in various wallets in different cryptocurrencies,” reads his statement.

Several police officers who were part of the Bengaluru crime branch in the 2020-2021 period have been investigated by the SIT over the last year and four of them arrested for wrongdoing along with a cyber expert who assisted the police to probe the hacker’s cases.

Most recently on October 7, the SIT arrested Sridhar Pujar, now an officer of the deputy superintendent rank who was the investigation officer when Sriki was arrested and held in custody. A bail plea filed by Pujar is pending adjudication in a special court next week.

Accountant’s statements on Bitcoins given by hacker Sriki

According to statements given to the police by Robin Khandelwal, a Bitcoin trader who doubled up as an accountant for the hacker, Sriki initially claimed to be in possession of around 900 Bitcoins when they met in 2017. According to Khandelwal, he sold 130 Bitcoins that were given to him by Sriki between 2017 and 2020 and a total of Rs 3.48 crore from the sale of the Bitcoins were given to the accounts of persons indicated by the hacker, while Rs 1.5 crore was provided in cash (through hawala routes) to the hacker himself.

Background of Sriki’s arrest and Bitcoin scam

Sriki and his accountant Khandelwal were initially arrested on charges of buying illegal drugs online using Bitcoin. The case involving the purchase of drugs on the darknet eventually led to the cracking of several cybercrimes involving Sriki, who was then 26, including a Rs 11.5-crore fund heist from the Karnataka e-governance cell in 2019.

The handling of the cases involving the hacker by the police under the BJP government after the arrests in November 2020 resulted in allegations of corruption by the Congress when it was in Opposition between 2020 and 2023. There are allegations of police officials grabbing a large cache of Bitcoins that were found in Sriki’s crypto wallets. At the time of the hacker’s arrest in 2020, the value of one Bitcoin was in the range of $25000 (around Rs 20 lakh) and soared to as high as $60,000 (around Rs 50 lakh) by April 2021. The value of one Bitcoin recently hit $70,000.