BENGALURU: Despite multiple FIRs registered since 2017 onwards and chargesheets filed, notorious hacker Srikrishna aka Sriki continued to indulge in criminal activities associated with offences such as hacking of websites, stealing of virtual digital assets (VDAs), cheating, extortion and routing of proceeds of crime, with his associates Robin Khandelwal, a crypto trader, and others, the Directorate of Enforcement (ED) investigations revealed.
The latest WhatsApp chat between Srikrishna and Khandelwal disclosed the purchase of e-SIMs from foreign entities and subscriptions for software tools such as the Proton VPN network. It was substantiated with the recovery of WhatsApp chats from the phone seized from Srikrishna after his arrest recently by the ED, which also disclosed that Khandelwal purchased them for Srikrishna.
However, contradictory details were provided by Khandelwal and Srikrishna before the ED as to how the payments were made to the foreign entities and the purpose, during their statements recorded in May 2026. No plausible method of making payments to foreign entities has been provided for obtaining e-SIMs, software subscriptions, etc.
The examination of WhatsApp chats reveals that Srikrishna is operating cloud servers on Amazon Web Services and hidden proceeds of crime, especially in the form of VDAs, which are being sold through foreign-based crypto trading platforms.
Evidence gathered during investigation under PMLA, 2002, disclosed that the proceeds of crime or stolen bitcoins by hacking crypto websites were used by Srikrishna for personal benefits, including online betting. This was admitted by him. He used the same to book flight tickets for his associates through websites located in the Netherlands.
The investigation also revealed that the stolen data has been used for extortion, and in the case of money, the same has been routed or layered and laundered through multiple bank accounts.
The proceeds of crime were used for the personal benefit of Srikrishna, Khandelwal and other associates.
While narrating the modus operandi for money laundering, the ED took note of the fact that the sale proceeds of VDAs stolen by Srikrishna were paid to accounts given by Srikrishna, or for his personal expenses such as luxury hotel stays, travel expenses, casino payments, and hiring a private jet for him and his associates.
Details of routing of stolen VDAs through Khandelwal, and use of sale proceeds of stolen VDAs in a crime registered in Tumakuru New Extension police station in 2017, amounting to Rs 3.34 crore for personal benefits of Srikrishna and his associates, have also been brought out in the forensic audit report undertaken by the CID, which was obtained by the ED.
The forensic audit report revealed that Khandelwal received an approximate quantum of 76.044BTC, equivalent to Rs 3.35 crore, along with 100 Ethereum equivalent to Rs 50.34 lakh. Over a period of slightly more than three years, Khandelwal had transferred Rs 3.85 crore to various accounts shared by Srikrishna.
Investigation revealed that the website of the Pokerbaazi online gaming site was hacked, over which an FIR was registered in 2018 by the city cyber crime police and an amount of Rs 70lakh was siphoned off. This crime was used to extort Rs 2 crore from the then owners of Pokerbaazi, as stated by Khandelwal during the course of the statement recorded by the ED. This was also admitted by Srikrishna.