Sri Lanka just lost 2.5 million dollars to a hacker, and the two institutions responsible for guarding the country’s money are spending more energy dodging blame than explaining how it happened. That is the real story here, not the hack itself. A breach is embarrassing. A cover-up dressed up as bureaucratic process is something worse.
The money disappeared while the Public Debt Management Office was still operating as a joint venture between the Treasury and the Central Bank, before it became a fully independent agency under the Finance Ministry. Both institutions had their hands on the machinery when the funds vanished. Both now want to be the one standing furthest from the wreckage. The Treasury’s report reportedly assigns the lion’s share of blame to the Central Bank. The Central Bank, predictably, says it needs more time to study that claim before agreeing to anything. This is not an investigation. It is a negotiation over who gets to avoid the headline.
Meanwhile, the public has been told almost nothing. Two reports have been submitted to the Committee on Public Finance. Neither has been released. The committee chairman has said a final, merged report will eventually go to Parliament, which is a reasonable step but an insufficient one. If state money disappeared because of a security failure inside state institutions, the original reports identifying who failed and how should not be optional reading reserved for a parliamentary committee. They should be public documents, tabled and published, because it was public money that vanished.
And here is the part nobody wants to say plainly: even a flawless investigation will not bring that money back. Sri Lanka has decades of experience with this exact pattern. Commission after commission gets appointed, hearings run for months or years, final reports get written, and at the end of it the stolen or lost money is gone, while the cost of the investigation itself — staff time, legal fees, endless committee sessions — gets quietly absorbed into the general ledger of public expenditure. The country pays twice: once for the original loss, and once for the paperwork generated while pretending to fix it. There is no indication this case will be different. Nobody investigating this has shown a plan to actually recover the 2.5 million dollars rather than simply produce a report explaining how it was lost.
This isn’t a uniquely domestic embarrassment, either. The IMF noticed. The misdirected payment — money meant for an Australian counterparty that ended up somewhere else — technically triggered a default under the terms of Sri Lanka’s program, because it breached the commitment not to accumulate new external arrears. The Fund chose to grant a waiver rather than blow up the review, citing the small size of the loss relative to GDP and the fact that Colombo moved quickly to investigate. Generous of them. But a waiver is not a vote of confidence; it is the IMF deciding that derailing a multi-billion-dollar program over a few million dollars would be disproportionate. The Fund’s own language afterward — calling for stronger cybersecurity and tighter financial controls at the debt office and the external resources department — is a polite way of saying the existing safeguards were not good enough. A government running an IMF program that requires constant proof of institutional credibility just had a very public demonstration of the opposite.
Then there’s the bribery case, which on the surface looks unrelated but isn’t. A criminal network allegedly paid roughly 120 million rupees to keep an organized crime figure out of the hands of both the police and the justice system — first trying to prevent an extrajudicial killing, then working to get him moved out of a high-security prison and clear of ongoing investigations. Two men, including the son of a former justice minister, are now in custody over it. Set aside, for a moment, whether the specific charges hold up in court. The structural point stands regardless of the verdict: organized crime in Sri Lanka can apparently raise nine figures in rupees on short notice to buy outcomes from the justice system, and use middlemen with direct political connections to do it.
That is not a policing problem. It is an economic one. Money like that doesn’t sit quietly. It moves into property, into vehicles, into the kind of luxury consumption that creates artificial demand and pushes up prices for everyone else, particularly in housing and land markets, where ordinary buyers are now competing against capital that was never taxed and never earned through anything resembling productive work. None of it touches GDP in any way that benefits the country; all of it touches GDP in ways that distort it. And every rupee diverted into protecting criminals from prosecution is a rupee added to the cost of running police, prisons and courts — institutions funded by the same ordinary taxpayers who had no part in any of this and will never see a cent of the money that flowed the other way.
Put the two stories side by side and the pattern is the same. A breakdown in financial accountability at the top of the state. A justice system that can apparently be rented by the highest bidder when the stakes are high enough. And in both cases, the bill — whether it’s a multi-million-dollar hacking loss or the slow corrosion of institutional credibility that comes from letting organized crime buy its way out of consequences — lands on people who had nothing to do with either.
The standard response to scandals like this is more commissions, more committees, more reports that take years to produce findings nobody acts on. That cycle hasn’t recovered stolen money in the past and there’s no reason to expect it will now. What would actually matter is uncomfortable for the people currently running these institutions: real enforcement of anti-money-laundering law, genuine independence for anti-corruption bodies instead of nominal independence, and an honest public accounting — published, not buried in committee — of exactly who was responsible for losing 2.5 million dollars of the country’s money. Until that happens, every word from Colombo about institutional reform is just more paper to add to the pile, paid for, like everything else here, by the public.
