The Rs. 290 Million Binance-Linked Bank Case: What the Public Record Establishes

Evidence cut-off: 28 August 2026

Method and status. This documentary case study is based on public records and reporting. It distinguishes allegations, investigator submissions, reported procedural orders and final judicial findings; it does not determine civil or criminal liability. No original interviews were conducted for this edition. It is independent academic and investigative analysis, not legal, financial, investment or recovery advice. Cardiff Metropolitan University did not review or endorse it. Documentary corrections may be submitted through the corrections channel; material corrections, clarifications and later developments will be identified in the article’s update record.

In March 2026, reports from the Colombo Chief Magistrate’s Court described an investigation into the disappearance of Rs. 290 million from a private bank and alleged that Binance accounts had been used in moving the money. The reports also said that 19 suspects had earlier been remanded and later released on bail. They did not report a charge, conviction, final finding of money laundering or recovered cryptoasset (Hiru News, 2026a, 2026b; Silva, 2026a).

This is a narrow crypto-transfer companion to the broader NDB internal-fraud case study. It does not repeat that article’s governance, audit and financial-impact analysis. Its question is more specific: what does the accessible record establish about the reported path from a bank’s general ledger, through domestic accounts, to alleged Binance transfers—and what remains unproved about tracing and recovery?

The answer matters because this was not reported as a crypto investment sold to customers. Only the later April NDB-linked report places alleged Binance transfers after domestic account movements; the March reports publish no transaction map. Cryptocurrency is therefore examined as an alleged conversion, transfer or cash-out rail, while the relationship among the reports remains unproved (Hiru News, 2026a, 2026b; Silva, 2026a; Sri Lanka Mirror, 2026b).

The answer in brief

Eight conclusions are supported at the evidence cut-off.

1. The possible NDB connection is supported by converging reports, but the public file is incomplete. Sri Lanka Mirror identified NDB in November 2025 and January 2026 reports about a Rs. 290 million general-ledger case. March reports used the same amount, described a private bank, referred to three months of suspect production and added the Binance allegation. No report supplied a common case number, and no signed order or complete B-report was located. The reports are treated as potentially related, not as proof of one continuous file (Sri Lanka Mirror, 2025, 2026a; Hiru News, 2026a, 2026b; Silva, 2026a).

2. Rs. 290 million was a reported case amount, not a final loss finding. Hiru initially reported that Rs. 290 million had been moved from a general-ledger account through 64 accounts and then ten more. It did not provide an audit, calculation or balance remaining after any preservation or recovery (Hiru News, 2025).

3. Only the April NDB-linked report places Binance downstream from bank-account movements. March reports alleged use of Binance accounts but published no route. Sri Lanka Mirror’s 21 April account attributed to CID a path through 64 accounts before a Binance deposit allegation. It does not establish the token, chain, exchange account, wallet address, amount converted, overseas destination or amount ultimately withdrawn (Sri Lanka Mirror, 2026b).

4. The March status was investigation and bail—not charge or trial. Hiru reported an expedition order on 6 March. Daily Mirror’s 13 March report of the 12 March hearing said 19 suspects had previously been remanded, were later on bail and that the matter was next to be called on 15 May (Hiru News, 2026a; Silva, 2026a).

5. A later NDB-linked report used a different amount and route. Sri Lanka Mirror reported on 21 April that CID submissions concerned Rs. 380 million deposited into Binance accounts through 64 allegedly fraudulent accounts, followed by a wider chain. NDB’s public FAQ separately described Rs. 380 million as an initial incident figure that expanded to Rs. 13.2 billion. No official source establishes that those two Rs. 380 million descriptions are the same measurement. This makes it unsafe to treat Rs. 290 million as an audited loss or allocate the broader figure to Binance (Sri Lanka Mirror, 2026b; National Development Bank PLC, 2026).

6. Binance’s position is available only through attributed reporting. The Sunday Times said Binance confirmed that court proceedings existed and that it was cooperating by providing necessary information. The article also attributed a licensing and know-your-customer statement to the company. No primary company statement, exchange response, production schedule or judicial finding against Binance was located (The Sunday Times, 2026).

7. The scheduled 15 May return cannot be reconstructed safely from the public material. A Daily Mirror report dated 14 May described the broader NDB complaint, a reported Rs. 13 billion amount, 900 accounts described by CID as suspicious, directions concerning records and four suspects remanded until 29 May. It did not state that this was the scheduled return of the Rs. 290 million matter or publish a case number. The two accounts should not be silently merged (Silva, 2026b).

8. The recovery record stops before an asset outcome. No public wallet schedule, exchange-held balance, case-specific freezing or restraint order, forfeiture, realised crypto value, return to the bank or restitution to any claimant was located. This does not prove that no preservation or private recovery occurred; it defines the limit of the accessible record.

Why this companion identifies NDB

The earliest report located, published by Hiru on 21 November 2025, called the institution a private bank in its headline and opening paragraph but called it a state bank in the final paragraph. It also said the CID acted “yesterday (21)”, an internally impossible date formulation. That source cannot safely identify either the bank or the exact event date by itself (Hiru News, 2025).

Later reports add a possible NDB connection. Sri Lanka Mirror named NDB on 27 November while reporting the remand of four suspects in the Rs. 290 million general-ledger investigation. Its 8 January report again named NDB, gave the same Rs. 290 million amount and said the CID had questioned senior bank officials on 7 January. On 21 April, it named NDB while reporting a CID submission about an Rs. 380 million allegation, 64 accounts and Binance (Sri Lanka Mirror, 2025, 2026a, 2026b).

Primary disclosures then confirm the wider institutional context. CBSL named NDB when announcing on 6 April that the bank had reported an internal fraud and had said customer accounts and deposits were unaffected. NDB’s own page says the initial Rs. 380 million figure expanded to Rs. 13.2 billion as its review progressed. CBSL’s later updates continued to identify NDB, address prudential stability and require independent reviews (Central Bank of Sri Lanka, 2026a, 2026b, 2026c; National Development Bank PLC, 2026).

Together, those records provide a reasonable basis to discuss a possible NDB connection. The qualification remains important: the accessible CBSL and NDB disclosures do not publish the Rs. 290 million court case number, identify the March Binance hearing or establish that Sri Lanka Mirror’s reported Rs. 380 million Binance amount and NDB’s initial Rs. 380 million incident figure are the same measurement. The November, March and April descriptions are treated as potentially related reports—not one proved transaction, one continuous procedural file or a mapped subset of the final exposure.

A later NDB-linked report used a different amount and route

The public descriptions come from potentially related reports. No common case number or primary transaction schedule proves that the November, March and April descriptions belong to one continuous file, so they cannot be combined into one verified forensic flow.

Publication	Reported route	What it does not establish
21 November 2025	General-ledger funds to 64 accounts, then ten accounts	Who controlled the accounts; what remained; whether crypto was used
27 November 2025	More than Rs. 100 million reportedly passed through one bank employee’s account	Total loss, ultimate recipient or crypto conversion
6 and 12–13 March 2026	Rs. 290 million disappearance; Binance accounts allegedly used	Token, blockchain, wallet, exchange account, conversion amount or destination
21 April 2026	Rs. 380 million allegedly deposited into Binance through 64 accounts; another description ran from 64 to 100 and then five accounts	Whether each stage carried the same funds; whether Rs. 380 million was acquired as crypto or remained at the exchange
NDB’s public FAQ	Initial Rs. 380 million incident figure expanded to Rs. 13.2 billion after detailed review	Whether its Rs. 380 million measurement is the same as Sri Lanka Mirror’s reported Binance amount; any Binance allocation within Rs. 13.2 billion

The difference between ten destination accounts in November and 100 then five in April may reflect different stages, separate but related allegations or imprecise reporting. Without a common case number and transaction schedule, none can be selected as the final forensic map.

Cryptocurrency was the alleged rail, not the investment product

The Sports Chain, OnmaxDT, MTFE and F3C case studies ask whether cryptocurrency was an investment, a payment rail, an accounting device or marketing language. Here, the public record points to a different category.

There is no reported public solicitation to invest in a token, no promised yield and no participant dashboard. March reporting alleged Binance use but did not publish the preceding account route. Separately, the April NDB-linked report alleged unauthorised general-ledger access, movements through domestic accounts and a Binance deposit. That later account supports the rail analysis but does not prove that the November, March and April reports concern one continuous file (Sri Lanka Mirror, 2026b).

“Binance” alone does not reveal whether an account bought, received, transferred or sold cryptoassets. Testing the alleged leg requires exchange-account control, fiat funding, deposits and withdrawals, tokens, networks, wallet addresses, hashes, valuations and preservation or production records. None was publicly accessible. Nor does the platform’s name establish that Binance owned the funds, knew their alleged origin or was liable for user conduct.

What the court reporting actually records

The procedural sequence is short and must remain attributed because no signed orders were located.

Event date	Publication date	Reported procedural status
Unclear, no later than 21 November 2025	21 November 2025	CID reportedly presented facts; the Chief Magistrate ordered an immediate investigation and the arrest and production of suspects
26 November 2025	27 November 2025	Four suspects were reported remanded in the NDB general-ledger matter
7 January 2026	8 January 2026	CID reportedly described questioning senior NDB officials; four suspects were reported remanded and a sixteenth suspect was reported remanded until 16 January
6 March 2026	6 March 2026	The Chief Magistrate reportedly ordered CID to expedite the Rs. 290 million investigation and report findings; 19 suspects were reported previously remanded and later bailed
12 March 2026	12 and 13 March 2026	Reports agreed on observations about public awareness, the Foreign Exchange Act and alleged Binance use, but differed on whether CBSL was ordered to act and report or was to be informed; next call was reported as 15 May
20 April 2026	21 April 2026	Court reportedly allowed CID to record statements from four remanded suspects; CID submissions described Rs. 380 million, 64 accounts and Binance
14 May 2026	14 May 2026	In the broader NDB matter, court reportedly ordered further investigation of senior officials, audit records and suspicious accounts; four suspects were remanded until 29 May

The March accounts also differ on the form of the court’s action concerning CBSL. Hiru said the Magistrate ordered CBSL to act and submit a report on closing Foreign Exchange Act gaps. Daily Mirror said the Magistrate directed that CBSL be informed. Without the signed order, this article preserves both versions and does not convert either into a verified formal direction (Hiru News, 2026b; Silva, 2026a).

Arrest, remand and bail are procedural events. They are not charges, proof of the alleged transaction path or findings of guilt. An order to expedite an investigation is not an indictment or judgment. Court observations about regulatory gaps are not a finding that every Binance transaction, or every cryptocurrency transaction in Sri Lanka, is criminal.

The article does not name the suspects. No public adjudication was located, and individual names add little to the explanation of the alleged transfer method.

The amounts measure different things

Amount	Public description	Controlled interpretation
Rs. 290 million	Reported disappearance, fraud or amount diverted from the general ledger	Early case allegation; not an audited net loss, crypto balance or recoverable value
More than Rs. 100 million	Amount reportedly transferred through one employee-linked account	Transaction flow through one account; not total proceeds or loss
Rs. 380 million — Sri Lanka Mirror	CID’s reported Binance deposit allegation	Secondary court reporting; not an official or adjudicated crypto value
Rs. 380 million — NDB	NDB’s initial incident figure before detailed review	First-party incident measure; no official source equates it with the reported Binance amount
Rs. 600 million	Amount suspects were reported to have attempted to misappropriate	Attempt allegation; not completed transfer or loss
Rs. 310 million	Amount Sri Lanka Mirror said the bank safeguarded after suspending accounts	Reported prevention or preservation; not a realised recovery from Binance and not restitution
Rs. 13.2 billion	NDB’s stated broader figure after detailed review	Wider financial-impact figure; no public Binance allocation
Rs. 13 billion	Amount used in Daily Mirror’s report of CID submissions on 14 May	Rounded reported broader case amount; not a judgment or audited crypto total
64, ten, 100, five and 900 accounts	Different stages or categories in reports	Counts cannot be treated as unique recipients or crypto wallets without the underlying schedule

“Missing”, “fraudulently misappropriated”, “transferred”, “laundered”, “safeguarded”, “restrained”, “recovered” and “returned” describe different propositions. The public record does not permit those terms to be used interchangeably.

Binance’s reported position does not close the evidence gap

On 22 March, The Sunday Times reported that Binance said proceedings existed in the Colombo Chief Magistrate’s Court and that it was cooperating with authorities by providing necessary information. The same passage attributed to Binance a statement that its users were licensed and know-your-customer compliant (The Sunday Times, 2026).

That position is relevant because centralised exchanges can hold identity and transaction records unavailable from the public blockchain alone. It is not proof of what was supplied, which users were covered, whether property remained available or whether a preservation request became a restraint order. The phrase “fully licensed” is also too imprecise to establish the legal status of every user or activity in Sri Lanka.

No accessible source accused Binance itself of stealing the bank’s money. No court finding against the exchange was located. The case concerns alleged user activity through Binance accounts and reported cooperation by the company.

The legal framework supplies powers, not case findings

CBSL’s 2021 warning stated its position that buying virtual currencies abroad was not a permitted investment category under the Foreign Exchange Act and that electronic fund transfer cards were not permitted for foreign-currency virtual-currency payments. It also said CBSL had not authorised virtual-currency exchanges in Sri Lanka (Central Bank of Sri Lanka, 2021).

The Foreign Exchange Act regulates dealings in foreign exchange and foreign assets. Section 7 addresses authorised capital transactions; section 10 permits CBSL investigations into foreign-exchange transactions and foreign assets (Sri Lanka, 2017). These provisions help explain the Magistrate’s reported concern about outward flows. They do not establish which provision, if any, a suspect was alleged or charged to have breached.

Money-laundering and proceeds legislation addresses a different question: whether property derives from unlawful activity and what investigative, preservation, management and confiscation steps may follow. Sri Lanka Police states that the Proceeds of Crime Act came into operation on 1 June 2025. The PMLA and FTRA amendments became law only when certified on 4 August 2026—after the November to May hearings. They may inform later procedural steps, but were unavailable to support the earlier reported orders. Among other changes, the amendments strengthened freezing and asset-management provisions and brought virtual-asset service providers within the Financial Transactions Reporting Act’s definition of financial business subject to other applicable written law (Sri Lanka Police, 2025; Sri Lanka, 2025, 2026a, 2026b; Parliament of Sri Lanka, 2026).

Those August amendments apply only as later-law context in this article. They do not retrospectively prove the Rs. 290 million allegation, validate an earlier order, identify Binance-held property or show that a case-specific later order was made.

Asset tracing, recovery and restitution remain unproved

The April report supplies the nearest thing to preservation in the accessible record: Sri Lanka Mirror said NDB’s monitoring system detected irregular activity, the bank suspended relevant accounts and Rs. 310 million was safeguarded. It also reported that money already credited to suspect-linked accounts had been misappropriated (Sri Lanka Mirror, 2026b).

That account is ambiguous in three respects. First, it does not say whether Rs. 310 million was part of an attempted Rs. 600 million transfer, the Rs. 380 million allegation or another exposure measure. Second, “safeguarded” may mean a transfer was prevented rather than proceeds were recovered. Third, it does not describe property returned from Binance.

At the evidence cut-off, the public record reviewed does not establish:

• the cryptoasset or fiat amount that reached any Binance account;
• an exchange-held balance preserved for Sri Lankan authorities;
• a wallet or account freezing order;
• property seized or restrained under money-laundering or proceeds law;
• a final confiscation or forfeiture order;
• conversion of a recovered cryptoasset into rupees;
• money returned by Binance or another intermediary to NDB; or
• restitution or compensation paid to any affected person.

CBSL and NDB stated that customer accounts and deposits were unaffected by the wider internal fraud. That means this is not presently documented as a customer-restitution case. It does not answer whether the bank recovered corporate funds, an insurer paid, property was privately preserved or later proceedings produced an asset order (Central Bank of Sri Lanka, 2026a, 2026b; National Development Bank PLC, 2026).

The latest public position

Daily Mirror’s 14 May report is the last detailed procedural account located for the broader NDB investigation. It described a complaint concerning alleged withdrawals between 2024 and March 2026, a reported Rs. 13 billion amount, orders concerning audit and bank records, and four suspects remanded until 29 May (Silva, 2026b). It did not independently identify the Rs. 290 million/380 million Binance sub-case.

Searches through 28 August 2026 located no later authoritative or reputable public record that did all of the following: identified this narrow Binance-linked allegation, supplied a reliable case number and reported a new charge, indictment, judgment, appeal, exchange production, asset order, forfeiture, recovery or restitution event. The wider NDB matter may continue through investigation, regulatory supervision and forensic review; those developments are maintained in the broader case study.

The current defensible conclusion is therefore limited: reporting separately links an Rs. 290 million NDB general-ledger allegation and a later Rs. 380 million NDB/Binance allegation; NDB independently states that an initial Rs. 380 million incident figure expanded to Rs. 13.2 billion, without identifying a Binance allocation or mapping the three public descriptions to one case file. The accessible record does not establish a criminal charge, adjudicated laundering route, case-specific crypto restraint, forfeiture, recovery or restitution.

What this case adds to the series

This matter shows why “crypto crime” should describe a mechanism, not replace the underlying offence analysis. The reported diversion may precede cryptocurrency: internal access, ledger manipulation and domestic intermediary accounts remain central. A known exchange can improve traceability through identity, funding and withdrawal records, but only if preservation and lawful production lead to a documented court process.

Public reporting must also follow the money in stages. Account suspension, exchange identification, wallet freezing, forfeiture and return are different outcomes. Different amounts across potentially related reports may reflect discovery, different measures or separate events; each still needs a date and definition. Prevention must connect privileged-access controls and general-ledger monitoring with rapid suspicious-transaction escalation and exchange preservation.

Update triggers

This article should receive a dated review if any of the following becomes public:

• a complete B-report, reliable case number or signed March order;
• a charge sheet, High Court indictment, trial judgment or appeal;
• an authenticated bank transaction schedule resolving the 64, ten, 100, five and 900-account descriptions;
• Binance account identifiers, a platform production return or a primary company statement;
• wallet addresses, transaction hashes, token and network details or an official valuation;
• a preservation, freezing, restraint, management, release or forfeiture order;
• a realised recovery by NDB or an insurer and its accounting treatment;
• any victim or claimant restitution process;
• a primary record formally mapping the early Rs. 290 million hearing to the wider NDB proceeding; or
• an official correction changing the bank, amount or procedural status.

References

Central Bank of Sri Lanka (2021) ‘Public awareness on risks in investing in virtual currencies in Sri Lanka’, 9 April. Available at: Original (Accessed: 28 August 2026).

Central Bank of Sri Lanka (2026a) ‘National Development Bank PLC — Internal Fraud’, 6 April. Available at: Original (Accessed: 28 August 2026).

Central Bank of Sri Lanka (2026b) ‘National Development Bank PLC — Subsequent Update on Internal Fraud’, 10 April. Available at: Original (Accessed: 28 August 2026).

Central Bank of Sri Lanka (2026c) ‘Update on National Development Bank PLC’, 17 April. Available at: Original (Accessed: 28 August 2026).

Hiru News (2025) ‘Millions defrauded from a private bank’s ledger account’, 21 November. Available at: Original (Accessed: 28 August 2026).

Hiru News (2026a) ‘Court orders swift conclusion to bank fraud case’, 6 March. Available at: Original (Accessed: 28 August 2026).

Hiru News (2026b) ‘Court orders Central Bank to address cryptocurrency outflows’, 12 March. Available at: Original (Accessed: 28 August 2026).

National Development Bank PLC (2026) ‘Official statement and update on independent forensic review’, statements and FAQ updated through 23 April. Available at: Original (Accessed: 28 August 2026).

Parliament of Sri Lanka (2026) ‘Speaker certifies three financial reform Bills passed by Parliament’, 4 August. Available at: Original (Accessed: 28 August 2026).

Silva, B. (2026a) ‘Rs. 290M crypto scam: Court warns funds leaving Sri Lanka through cryptocurrency’, Daily Mirror, published 13 March, reporting the 12 March hearing. Available at: Original (Accessed: 28 August 2026).

Silva, B. (2026b) ‘Arrest if any senior NDB officials if found to have aided Rs. 13 billion fraud: Court told’, Daily Mirror, 14 May. Available at: Original (Accessed: 28 August 2026).

Sri Lanka (2006) Prevention of Money Laundering Act, No. 5 of 2006. Available at: Original (Accessed: 28 August 2026).

Sri Lanka (2017) Foreign Exchange Act, No. 12 of 2017. Certified 28 July. Available at: Original (Accessed: 28 August 2026).

Sri Lanka (2025) Proceeds of Crime Act, No. 5 of 2025. Available at: Original (Accessed: 28 August 2026).

Sri Lanka (2026a) Prevention of Money Laundering (Amendment) Act, No. 16 of 2026. Certified 4 August. Available at: Original (Accessed: 28 August 2026).

Sri Lanka (2026b) Financial Transactions Reporting (Amendment) Act, No. 17 of 2026. Certified 4 August. Available at: Original (Accessed: 28 August 2026).

Sri Lanka Mirror (2025) ‘NDB Bank IT executive remanded over large-scale fraud’, 27 November. Available at: Original (Accessed: 28 August 2026).

Sri Lanka Mirror (2026a) ‘CID quizzes NDB bigwigs over Rs. 290 mn. fraud’, 8 January, reporting the 7 January hearing. Available at: Original (Accessed: 28 August 2026).

Sri Lanka Mirror (2026b) ‘CID to probe bank accounts of certain NDB officials and their family members’, 21 April, reporting the 20 April hearing. Available at: Original (Accessed: 28 August 2026).

Sri Lanka Police (2025) ‘Opening of the Proceeds Of Crime Investigation Division — PCID’, reporting that the Act came into force on 1 June, page concerning the 20 October opening. Available at: Original (Accessed: 28 August 2026).

The Sunday Times (2026) ‘Crypto fraud storm faces regulatory overdrive’, 22 March. Available at: Original (Accessed: 28 August 2026).