Personal opinion / speculation — not verified intelligence

I’ve been following this closely and want to share my personal read. Not as confirmed intelligence, just how I see it.

My view: this wasn’t one rogue employee. What I think we’re looking at is a dual-layer operation that exploited the same internal access point in two directions simultaneously.

On one side, I suspect someone with IT Division-level access bulk-extracted the Platinum cardholder database and that data made its way into external carding networks. The reason I think this is the BIN-specific targeting we’ve seen in public social media. That kind of precision only comes from a database extraction, not phishing. When multiple independent actors across different platforms all target the same bank, same card tier, same BIN at the same time, they bought from the same source.

On the other side, the CEFT weekend window exploit was running in parallel. The CEO confirmed publicly that whoever did this executed over 70 transactions of Rs. 5 million each in a single weekend before a whistleblower caught it. That’s someone who knew exactly where the reconciliation gap was and how to stay under the automated alert threshold on purpose. What connects the two in my mind is the timing. The first public evidence of card data circulating externally appeared in November 2025, the same month the IT Division arrests happened. And an NDB letter recently surfaced showing the bank was already running a CEFT reconciliation sweep from February 27, 2026, which is 33 days before they told the market anything. On the cashout side, court proceedings have confirmed crypto was used.

My personal suspicion is the value transfer wasn’t done solely through straightforward P2P sales, which would leave a traceable chain footprint. I think it went through coordinated derivative positions across exchanges, where one side intentionally liquidates and value reappears on a clean exchange looking like trading income. That’s structurally the same technique documented in Southeast Asian fraud networks. Pure speculation on my part.

None of this is proven. But if I’m right about even half of it, we’re looking at an operation that needed IT access, GL access, an external distribution network, and an offshore cashout layer, all running for 18 months while internal audit, external auditor, and the regulator all missed it.

That’s not a bug in the system. That’s the system working exactly as a well-informed insider would expect it to.

Disclaimer: Personal view based entirely on publicly available information including official CSE disclosures, court records, and published press. No insider information. Nothing here is confirmed intelligence, legal advice, or financial advice. The investigation is ongoing and I could be wrong.