Three Bank 9 Jambi Hackers Who Stole IDR 144 Billion Arrested, Bulgarian Hacker Network Involved

The Cyber Sub-Directorate of the Special Criminal Investigation Directorate (Ditreskrimsus) of the Jambi Regional Police has uncovered a major hacking case affecting customers of Bank 9 Jambi (PT Bank Pembangunan Daerah). In the operation, police arrested three suspects involved in the theft of IDR 144.82 billion. The three suspects, identified by the initials DD, TF, and AG, are Indonesian citizens and are currently detained at the Jambi Regional Police headquarters. The Head of Public Relations of the Jambi Police, Commissioner Erlan Munaji, alongside the Director of Special Criminal Investigation, Commissioner Taufik Nurmandia, announced the arrests in Jambi on Tuesday (14/7/2026). Commissioner Munaji explained that in addition to apprehending the suspects, the police also seized approximately IDR 18.9 billion of the criminal proceeds. The intensive investigation has been ongoing since early April 2026 after the bank, through its legal counsel Aprizul Ihsan Hasibuan, filed an official report on 2 April 2026. According to the cyber team’s investigation, the heist was controlled by a Bulgarian hacking network involving a figure named Alcaz and his associate, Tsevetanov Radoslan Ivanov, also known as Superman. Both are currently still at large. Director of Special Criminal Investigation Taufik Nurmandia detailed the chronology of the incident, which took place on Sunday, 22 February 2026. Within hours, the perpetrators drained funds from 6,609 Bank 9 Jambi customer accounts. The stolen money was then converted into cryptocurrency assets and withdrawn to digital wallets abroad. The pursuit of the perpetrators led to West Java, where police arrested suspect DD (32), a resident of Lima Puluh Kota Regency, West Sumatra. DD is known to have acted as the coordinator and liaison with the Bulgarian hackers. ‘Suspect DD is a repeat offender in similar cases and was previously detained with Alcaz at Grobokan Prison in Bali. His role was to coordinate the recruitment, creation of accounts, and handover of crypto accounts in Jakarta,’ said Taufik. In carrying out the operation, DD was assisted by TF (33) and AG (36), both residents of Bandung Regency, West Java. Their task was to recruit individuals to create cryptocurrency accounts on various platforms such as Tokocrypto, Reku, and BukuWarung, as well as bank accounts, offering a reward of IDR 5 million per account. The modus operandi was well-planned. The perpetrators prepared a financial infrastructure consisting of 90 crypto accounts and 45 bank accounts integrated into mobile phones. These phones were then handed over to Alcaz in Jakarta between December 2025 and January 2026. On the day of the execution, these accounts were used to receive and launder the stolen funds. Although the total loss reached IDR 144.82 billion, the Jambi Regional Police managed to freeze and seize IDR 18.9 billion as evidence. Taufik Nurmandia reminded the banking industry in Indonesia to increase its vigilance. Based on preliminary investigations, suspect Alcaz is suspected of planning similar crimes against other banking institutions in the country.