How ex-staff stole Sh1.49b from Equity Bank

Equity Bank lost Sh1.49 billion in 277 transactions, some of which ended up being laundered in the crypto world, then vanished into thin air, the High Court has been told.

The bank, in its new bid to recover the money, has sued its former employee, David Machiri, claiming that his credentials were used while the money was being siphoned.

The lender, in documents seen by The Standard, filed a case against Machiri, Axteron Technologies Limited, KT Owen Group Limited, Mac and Gray Trading Limited, Owen Karanja, Blue Kenfresh Limited, Goodmans Fresh Limited, Ruth Muthoni and Muda Ventures Limited.

In its case before the Commercial Court, Equity said the first tranche of Sh1.4 billion was allegedly stolen between November 2, 2023 and June 14, 2024 and wired to the six companies, Muthoni and Karanja.

Court documents indicate the second tranche of Sh156 million was wired from Equity to Axteron’s accounts held in Absa Bank Kenya and UBA Kenya Bank Limited.

According to Equity’s legal director Waweru Mathenge, Axterton’s Absa account received Sh27 million between May 13 and May 15. He claimed that on the first day, Sh9.4 million was transferred, then, on May 15, three transactions of Sh4.3 million, Sh6.2 million and Sh7.4 million were conducted using Machiri’s account and computer.

Mathenge said Sh128 million was wired to Axerton’s account in UBA between May 9 and May 28, 2024.

The transfers to Axerton were allegedly happening as much as six times in a day with the highest amount being Sh11.2 million. “I believe David Kimani in his capacity as an employee of the plaintiff with access to the plaintiff’s ledger account, and by the virtue of his position of trust and authority in accessing the plaintiff’s banking system and processing payments stood the fudiciary capacity towards the plaintiff under contract and common law and that he acted in breach of his duty as particularized below,” argued Mathenge.

Equity’s senior manager alleged that on May 9 alone, the bank lost Sh50.4 million. Further, he said, on May 14, some Sh12.1 was wired to Axerton while two days later, Sh26.4 million was wired out. On May 17, he said, Equity also lost at least Sh20.9 million and on May 24 and 28, Sh18.7 million was again wired to the company. He stated that Machiri then illegally wired to KT’s Owen’s account at NCBA Bank at least Sh30.8 million between May 13 and 15. Mathenge said this happened in five tranches.

Kennedy Njue, a fraud investigator, explained that they singled out Machiri since the theft happened on his computer, which could only access the account if he keyed in his unique user ID and password.

He said Machiri was employed as a manager on May 25, 2021. Machiri’s role, according to Njue, was to among others process payroll transactions on behalf of Equity’s clients.

He said Karanja is the sole director and shareholder of Axerton and Mac and Gray. At the same time, the investigator stated that Karanja also holds 50 percent share of KT Ownen.

Further, the investigator said that Ms. Kamau is the sole director and shareholder of Blue Kenfresh and Goodmans. According to him, Machiri wired Sh24.2 million to Goodmans’ account on May 9 ( Sh5.1 million), May 15 ( Sh9.1 million and May 28 (Sh9.9 million). He then allegedly sent Sh36.1 million from Equity to her directly on May 8 and May 13. “Ruth Kamau is the sole director and shareholder of Blue Kenfersh and Goodmans and she exercises total control over these entities,” argued Njue.

According to the investigator, a further trace of the money indicated that they ended in cryptocurrency. He singled out Binance Holding Limited as the destination.

He said Equity hired A&D, a firm specialising in tracing, and investigating blockchain technology and cryptocurrency related fraud. “The plaintiff has continued to trace the funds fraudulently transferred from its general ledger account and has established that part of these funds were converted to United States Dollars and thereafter to cryptocurrency with the digital currency code USDT on the Binance Holding Limited cryptocurrency exchange,” he said.

The investigator claimed that Axerton transferred Sh47.5 million from its UBA account to Quicknode Technologies Limited on May 13, 2024.

On the same day, he said, Quicknode transferred USDT 359,912 to Binance wallet which is allegedly owned by Karanja. He said the binance ID is 40883625.

Similarly, he told the court that four days later, the same company transferred Sh38 million to Muda ventures. Muda on its end wired USDT 490,937.46 again to Karanja’s wallet. Njue further said that Karanja’s Binance account separately received USDT 429,734.54 between May 21 and May 22 from AO Markets, a money remittance company.  Her Binance ID, according to the investigator is 895931158.

He said part of the crypto money ended up with Machiri as he allegedly received USDT 371,270 between May 14 and May 19 from Kamau’s account.

At the same time, Fednant Ojiambo Oddury is claimed to have received USDT 1.056 from Ms Kamau’s Binance account. Njue said the amount allegedly sent to Ojiambo vanished.

Fednant Ojiambo Oddury transferred USDT 1.056 to unknown persons and the bank is still in the process of tracing these funds. The above transactions show that the funds were fraudulently transferred by David Kimani were concerted to cryptocurrency and were thereafter transferred to Owen Kuguru, then to Ruth Kamau and then back to David Kimani. He said Machiri’s Binance account is still holding USDT 371,2070. “The dishonesty of the defendants is apparent or can be inferred from the fact they knew they were not entitled to the funds that were transferred from the plaintiff’s account to their accounts and there was no legitimate reasons for these transfers,” he said.

He said if the court does not intervene, Equity will lose the amount held in digital currencies. “The plaintiff will suffer irreparable loss because it will not be able to recover the loss caused by the defendants’ fraud and dishonesty,” he said adding that they allegedly made sure that it would not be able to recover the amount.

A blockchain forensic report on the movement of the alleged siphoned money indicated that a total Sh186 million was moved to crypto.

According to the report, Karanja distributed the crypto money to multiple recipients. It indicated that Kamau allegedly received the largest share of USDT 1.44 million, followed by Joyce Mburu (USDT 30,510), David Makuku Nandwa (USDT 9,500), Raphael Pereira Mendes (USDT 220), Lilian Wangui Ondwoma ( USD 10).

Karanja further allegedly made five smaller transfers (USDT 2,700, USDT 5701, USDT 6500, USDY 750, USDT 45) to different Ethereum wallets addresses without IDs. The report prepared by Wycliff Sewe also indicated that Nandwa allegedly transferred the same amount sent to him by Karanja to Kamau, increasing her total amount to USDT 40,010, which she then sent back to Karanja.

Equity wants the court to freeze all the bank accounts where the money was wired to. It is also seeking an order barring the persons who got crypto money from either transferring, trading or withdrawing the amount.

It is also seeking an order allowing it to trace all the money to any bank or crypto account that got the heist for recovery. “Pending the hearing and determination of this application, there be a tracing order directing that the sum of Sh 1.49 billion be traced into any bank account,” it prayed.

It stated that it serves at least 16.9 million customers and it is the largest bank in terms of customer base in Africa. The first tier lender also claimed that nearly half of all bank accounts are domiciled in its different branches across the country.

Justice Wayua Mong’are ordered the bank to serve the court papers to all persons and companies it sued. She directed that they respond within five days after which the bank will do a rejoinder within the same time.

In the meantime, she froze all bank accounts linked to the heist and directed they should not trade, transfer or withdraw the cryptocurrency.