KULIYAPITIYA, Sri Lanka — On the afternoon of April 30, the daughter of Abeysinghe Mudiyanselage Ranga Nishantha Rajapaksa noticed her father walking toward the back of their house. He carried a knife. His wife, a schoolteacher, was at work. Sometime between that moment and 2:00 p.m., she found him near a banana tree, bleeding from severed veins in both legs and his left hand. A blood-stained knife lay nearby.
By nightfall, Sri Lanka was confronting a new and deeply disturbing chapter in an already escalating national scandal: Ranga Nishantha Rajapaksa, a 49-year-old Assistant Director of the Finance Ministry’s External Resources Department — born on June 26, 1976, and suspended days earlier over his alleged links to the country’s humiliating $2.5 million cyber fraud scandal — was found dead at his residence. Following a post-mortem examination conducted by a special Judicial Medical Officer panel, police officially concluded the death was a suicide, a finding that closed one line of inquiry even as it intensified public scrutiny over the broader financial scandal engulfing the state.
THE HEIST
The fraud had its roots in what investigators describe as a sophisticated, if methodical, act of digital deception. Between late December 2025 and late January 2026, Sri Lanka’s External Resources Department processed a series of debt-repayment installments totaling approximately $2.5 million — funds earmarked under a larger $22.9 million bilateral loan facility from the Australian government for development projects in Sri Lanka.
The money never arrived. According to the Criminal Investigation Department (CID), hackers had infiltrated the email systems of the ERD and its Australian counterpart, Export Finance Australia, and replaced the legitimate payment domain — exportfinance.gov.au — with a near-identical fraudulent one: exportfinance.av.com. Fake invoices and payment instructions followed. Treasury officials processed the transactions.
The fraud was reportedly discovered when a similar attempt to divert funds destined for India was made. That second attempt triggered verification, which revealed the earlier diversion. By the time investigators confirmed what had happened, the money had vanished into overseas accounts.
What makes the heist particularly damaging is not only the sum stolen — significant for a country still under IMF supervision — but the timeline of its disclosure. Treasury Secretary Harshana Suriyapperuma confirmed publicly that the breach had been detected in January 2026. The government chose not to inform Parliament. It was only in late April, when the case came before the Colombo Fort Magistrate’s Court, that Sri Lanka’s legislators and the public learned the full extent of what had occurred.
Suriyapperuma defended the delayed disclosure as necessary to protect an ongoing criminal investigation. The explanation did not satisfy critics.
The most explosive detail, however, concerns what happened before the money moved at all. HSBC Bank had flagged the transaction as suspicious on at least two separate occasions before the payment was processed. On both occasions, the bank's warnings were overridden. Opposition MP Harsha de Silva, chairman of the parliamentary Committee on Public Finance, raised the question that has since haunted the case: how does a $2.5 million sovereign debt payment — roughly Rs. 798 million, or nearly 79.9 crore rupees — clear the system after a major correspondent bank has twice raised a red flag? De Silva also questioned whether such a disbursement could lawfully have been authorised without Treasury Secretary-level sign-off.
The government’s characterization of the breach has shifted in ways that have only deepened public confusion. Deputy Minister of Digital Economy Eranga Weeraratne rejected descriptions of the incident as a direct systems hack, instead suggesting that the failure stemmed primarily from human procedural lapses. Deputy Finance Minister Anil Jayantha Fernando, meanwhile, warned against what he described as misleading opposition narratives, while simultaneously confirming that the breach had affected multiple transactions. This oscillation between framing the scandal as a sophisticated cyberattack and attributing it to human error has left accountability dangerously suspended somewhere in between.
The CID has since charged individuals under the Computer Crimes Act, the Public Property Act, and the Penal Code. Investigators have engaged INTERPOL and the Australian Federal Police. A technical committee drawn from Sri Lanka's Computer Emergency Readiness Team, the Government Analyst's Department, and the University of Colombo's Faculty of Computer Studies has been constituted. The next court date is June 3, 2026.
THE MAN AT THE CENTRE
Ranga Nishantha Rajapaksa grew up in Kuliyapitiya, in Sri Lanka's North Western Province — a market town that produces civil servants, teachers, and, occasionally, leftist student politicians. He studied at Kuliyapitiya Central College and later at the University of Sri Jayewardenepura, building the credentials for a career in public finance. By the time of his death, he had risen to Assistant Director at the ERD, the Ministry of Finance unit that manages Sri Lanka's external borrowing and debt-servicing obligations. He was 50 years old. His wife teaches at a local school. They have two children.
Investigators say he was among the ERD officials who responded to the fraudulent emails during the period of the fraud. He subsequently gave statements to the CID on three occasions — once while still in service, twice after his suspension. He failed to appear on two further CID summonses. Police sources indicate that preliminary findings did not characterise him as a corrupt actor, and that he had cooperated fully in the initial stages of the inquiry. His personal computer was seized.
A Facebook check-in on his personal profile, verified by Jaffna Monitor, places him at the University of Queensland's St. Lucia campus in Brisbane on December 17, 2025 — less than two weeks before the first fraudulent transactions were processed through the ERD. The nature and purpose of that visit have not been established.
Sources who studied, worked, and lived alongside him told Jaffna Monitor that he was widely regarded as a man of genuine simplicity — modest in his habits, honest in his dealings, the kind of civil servant whose lifestyle bore no trace of unexplained wealth. After his death, television cameras entered his home in Madakumburumulla, Pahala Weerambua. What Sri Lanka saw surprised many: a partially unfinished house, spare and ordinary, the residence of a man allegedly entangled in a scandal worth nearly 80 crore rupees yet seemingly untouched by any of it.
That image — the unfinished walls, the modest furniture — lodged itself in public memory. On social media, it circulated alongside a question that no official statement has yet answered: if Ranga Nishantha was corrupt, where was the money?
Those who knew him noted that he had roots in the leftist student politics of the Janatha Vimukthi Peramuna — the Marxist party now in government under President Anura Kumara Dissanayake. Whether that history shaped his conduct within the ERD or his relationship with investigators after the fraud remains unclear.
What is clear is that by the time the Colombo Fort Magistrate's Court heard the CID's submissions on April 28, the pressure on him had become acute. Two days later, he was dead.
THE DEATH
The sequence of events on April 30 has been reconstructed from police reports and media accounts. His wife was at school. His daughter observed him walking toward the rear of the house with a knife. She did not immediately follow. When she found him near a banana tree, he was bleeding severely from wounds to both legs and his left hand. Police recovered a blood-stained knife at the scene.
Following a post-mortem examination by a special Judicial Medical Officer panel, police officially ruled the death a suicide.
Several sources told Jaffna Monitor that Ranga Nishantha was reportedly among the earliest officials to formally alert the Criminal Investigation Department (CID) to the Treasury fraud. If accurate, that detail would fundamentally reframe his position in the case. Rather than simply being a suspect who succumbed to mounting pressure, he may instead have been a complainant who, after helping expose the crime, ultimately found himself treated as one of its alleged perpetrators.
Those who knew him have since raised a deeply troubling question: if he was among the first to sound the alarm, why was he later summoned as a suspect — and was he ever provided adequate protection after doing so?
Individuals close to him have called for a comprehensive forensic examination of his digital devices, official correspondence, and personal records. Forensic analysis of his computer and mobile devices, seized by the CID, remains ongoing.
TWO INVESTIGATIONS
Sri Lanka now faces two parallel inquiries whose intersection is impossible to ignore. The CID is pursuing the cyber-fraud case with international assistance. The Kuliyapitiya Police are investigating the death of a man who was simultaneously a suspect, a witness, and — by some accounts — a complainant in that same fraud.
The political and institutional pressures are profound. Sri Lanka is still recovering from the catastrophic 2022 sovereign default under an International Monetary Fund program that imposed stringent fiscal discipline and sweeping economic reforms. President Anura Kumara Dissanayake’s government came to power pledging a decisive break from the corruption, opacity, and misgovernance that defined previous administrations. The Treasury heist — and the troubling conduct surrounding it — now poses a direct challenge to that reformist political project, threatening both public trust and the credibility of the government’s anti-corruption mandate.
The Treasury Secretary initially failed to appear before the Committee on Public Finance as scheduled, citing an impending Presidential statement to Parliament as justification. Opposition legislator Harsha de Silva condemned the absence as an unprecedented breach of constitutional accountability. Although the Treasury Secretary later appeared before the committee, no official transcript or detailed public record of that appearance has since been released, further intensifying concerns over transparency and institutional responsibility.
Opposition leader Sajith Premadasa, of the Samagi Jana Balawegaya, described the diversion as a serious breach of financial security and called for an independent, transparent investigation into whether safeguards at the Treasury and Central Bank had been bypassed.
Australia, whose export finance agency was the intended recipient of the diverted funds, acknowledged the breach and stated its commitment to continued cooperation with Sri Lanka’s debt restructuring programme. The Australian Federal Police have been engaged in the investigation.
THE UNANSWERED QUESTIONS
The questions that remain are both highly specific and deeply systemic. How were HSBC's two explicit warnings overridden before a sovereign debt payment of this magnitude was processed? What chain of authorisation permitted $2.5 million to be disbursed on the basis of instructions pointing to a forged email domain? Were the officials who first flagged the fraud given adequate protection once the investigation commenced? And was Ranga Nishantha, as sources allege, among the original complainants — a possibility that, if true, would render his subsequent treatment as a co-suspect not merely troubling, but a potential institutional failure of the first order?
Sri Lanka has a documented history of key witnesses dying before they can testify. Against that backdrop, the timing of Ranga Nishantha's death has produced a level of public suspicion that police statements alone cannot easily dispel. Investigations of this gravity demand more than an official ruling; they demand a transparent accounting of how a man who may have raised the alarm came, within months, to be treated as a criminal.
For now, the broader investigation remains active. Parliamentary scrutiny is expected to continue, with key hearings scheduled for June 3. Authorities have officially ruled the death a suicide. Forensic analysis of Ranga Nishantha's seized devices continues.
His wife, a schoolteacher in Kuliyapitiya, has not made any public statement.
