More than €814,000 belonging to the Bank of the Republic of Burundi (BRB) was stolen in a cybercrime operation in June 2024 and transferred to Poland, the central bank has confirmed, but more than two years later the money has not been recovered and the perpetrators have not been publicly identified.
Bellarmin Bacinoni, the BRB’s communications officer, said the attackers infiltrated the computer system of a partner bank in Poland before initiating the transfer.
The incident was detected after the funds had been moved, prompting the central bank to alert law enforcement and judicial authorities.
“As soon as the breach was detected, the relevant authorities, including the judicial bodies and the police, were alerted,” Bacinoni said.
He said the authorities immediately took steps to prevent the perpetrators from accessing all of the transferred funds.
“Measures were taken to prevent the withdrawal of a portion of the transferred funds,” Bacinoni said.
The BRB has not publicly disclosed how much of the €814,957.821 was blocked or whether any of the money was subsequently recovered.
A payment linked to REGIDESO
According to Bacinoni’s account, the attackers presented themselves as individuals seeking to make a payment for equipment intended for REGIDESO, Burundi’s state-owned water and electricity utility.
That element of the case has raised questions about how the transaction was processed and why REGIDESO became associated with the payment.
REGIDESO has denied being the source of the funds.
The utility’s director general, Jean Albert Manigomba, has said no money was withdrawn from REGIDESO’s accounts and that the company did not purchase equipment in Poland.
The distinction is important: the BRB says the stolen funds belonged to the central bank, while the transaction was allegedly presented as a payment connected to REGIDESO.
Burundi’s anti-corruption watchdog OLUCOME has called for the circumstances to be investigated, including the documents allegedly used in connection with the transaction.
OLUCOME President Gabriel Rufyiri has questioned who prepared the documents, how they were used to support the transfer and who ultimately received the money in Poland.
Those claims have not been independently established, and the underlying documents have not been publicly released in full.
The Polish connection
The money trail led investigators to Poland, where the funds were transferred through the country’s banking system.
Reports from sources indicate that a prosecutor in Poland’s Gdańsk region sought cooperation from Burundian authorities in connection with the investigation.
OLUCOME has said correspondence from the Polish Embassy in Dar es Salaam was sent to Burundi’s Foreign Affairs Ministry in May 2025 concerning the case.
The organization has further alleged that the request was only forwarded to Burundi’s Justice Ministry in July 2026.
If the dates and correspondence cited by OLUCOME are confirmed, the timeline would raise questions about the handling of an international request concerning almost €815,000 in stolen funds.
Burundi Times has not independently verified the original diplomatic correspondence.
No public Polish statement
The Polish side of the investigation has not been publicly detailed in an official statement that could be independently reviewed.
Publicly available reports refer to a prosecutor in Gdańsk investigating the transfer and seeking cooperation from Burundi, but it remains unclear whether Polish authorities have identified the holder of the receiving account, recovered any of the funds or identified suspects.
There is also no publicly available Polish statement establishing what happened to the money after it reached the receiving bank.
That leaves a significant part of the financial trail unresolved.
BRB promises stronger controls
Bacinoni said the central bank was taking steps to strengthen its security systems following the incident.
He said the BRB would reinforce its “security and prevention mechanisms” to prevent similar incidents from occurring again.
The central bank spokesperson also said investigations were continuing to establish the circumstances of the breach and identify those responsible.
“The competent services are pursuing their efforts to identify the perpetrators so that they can be apprehended and brought to justice,” Bacinoni said.
The BRB has not publicly identified any suspects. Nor has it disclosed the identity of the Polish bank involved, the recipient of the funds or the precise amount that investigators were able to block.
Where did the money go?
More than two years after the transfer, the central question remains unanswered: where did the €814,957.821 ultimately go?
The BRB says its funds were stolen after a cyberattack involving a partner bank in Poland. REGIDESO says it did not make the purchase or lose money from its accounts. OLUCOME says documents bearing the utility’s name may have been used in the transaction.
Polish authorities are reported to have investigated the transfer and sought cooperation from Burundi, but details of their findings have not been made public.
For the BRB, the case is now both a criminal investigation and a cybersecurity lesson.
For the public, however, the unresolved money trail leaves several questions open, including who received the funds, whether any of the money remains recoverable and why more than two years after the theft no suspect has been publicly identified.
