Former Finance Minister and NDF MP Ravi Karunanayake has called for a Parliamentary Select Committee to investigate the US$ 2.5 million Treasury cyber heist, arguing that the probe has now reached its “final phase” with fresh discoveries pointing to Central Bank involvement in the failed Australian debt repayment.
The siphoning of funds intended for the Australian Export Finance Agency was “not a localised Treasury error but a systemic failure involving the CBSL,” Karunanayake said in remarks reported by Daily FT. He argued that the Central Bank “cannot wash its hands by pointing at the Treasury’s new Public Debt Management Office (PDMO).”
The detail that has reframed the Karunanayake intervention is the timeline. “Out of the ten fraudulent transactions identified, seven occurred while the Central Bank still held the reins,” he said. “Those seven were executed under the CBSL’s Public Debt Department in late 2025, while only three occurred after the 1 January 2026 handover to the Treasury.” The accusation places the bulk of the fraud during the period when the CBSL was the technical custodian of the LankaSecure and Scripless Securities Settlement System (SSSS), and was actively training PDMO staff and overseeing the IT transition.
The heist itself was executed via a Business Email Compromise scheme, with hackers using a fake domain (exportfinance.av.com) to impersonate Australian officials and reroute five tranches of payments over nearly four months without detection. An interdicted Assistant Director from the External Resources Department was later found dead in Kuliyapitiya in what police have ruled a likely suicide following CID questioning.
Karunanayake said the proposed PSC should have the power to summon senior CBSL officials, Treasury leadership and digital forensic experts to determine why multi-factor authentication and secondary verification failed during what he called “the most critical financial transition in Sri Lanka’s history.” He framed the call in terms of international creditor confidence: “To maintain the trust of our creditors, we must prove that our institutions are not beyond reproach.”
The PSC demand is the third distinct opposition accountability track on the heist, alongside Sajith Premadasa’s earlier PSC call, Faiszer Musthapha’s Presidential Special Investigation Committee call, and the Free Lawyers Association’s 22 questions to the President. The government has so far argued the matter will not be treated as a debt default.
