Inside Equity Bank’s Sh1.5 Billion Heist: A Web of Deception and Cover-Up

The Scheme That Rocked Kenya’s Banking Sector

How rogue bank officials, real estate scammers, and corrupt police officers orchestrated one of Kenya’s biggest financial crimes

On the morning of July 11, 2024, Inspector Bonface Maina Kamau and Sergeant Josiah Gichobi from the Banking Fraud Investigation Unit (BFIU) received what would become one of the most complex financial crime cases in Kenya’s history.

What started as a routine response to a distress call from Equity Bank’s security chief would unravel into a web of deception involving serial fraudsters, rogue bank officials, and alleged attempts to cover up a sophisticated Sh1.5 billion heist.

The case would expose not just the vulnerability of Kenya’s banking systems, but also raise troubling questions about potential interference in high-stakes financial investigations.

The Heist: A Masterclass in Digital Deception

The theft itself was executed with surgical precision on July 10, 2024.

Through 47 carefully orchestrated transactions, cybercriminals managed to siphon Sh1,545,553,374.59 from Equity Bank’s salary suspense general ledger—an internal account used for processing employee payroll.

What made this heist particularly audacious was its method: the transactions were designed to appear as legitimate salary payments from various companies to their employees.

On paper, everything looked normal. In reality, Kenya’s second-largest bank was being systematically drained of funds.

The scheme’s sophistication became apparent when investigators discovered that the money was immediately dispersed across multiple accounts in different banks, some converted to foreign currencies through forex bureaus, and portions moved through Hawala—a traditional Islamic money transfer system that operates outside conventional banking channels.

The Inside Job: A General Manager’s Betrayal

Central to the investigation was David Kimani Machiri, a general manager at Equity Bank who had direct access to the compromised salary suspense account.

When investigators traced the digital fingerprints of the transactions, all signs pointed to an inside job orchestrated using Machiri’s credentials.

The timing was particularly suspicious: Machiri had taken sick leave just before the heist occurred.

Yet somehow, his access credentials were used to authorize the fraudulent transactions.

When confronted, Machiri’s explanations failed to satisfy investigators, making him the prime suspect in what appeared to be a carefully planned betrayal from within.

Following his arrest on July 12, 2024, Machiri was granted bail of Sh500,000 by Magistrate Geoffrey Onsarigo, with strict conditions requiring him to report to the BFIU twice weekly.

However, the investigation would take a sinister turn when Machiri was allegedly abducted on August 11, 2024, and reportedly held in a forest with lions and hyenas—a bizarre twist that raised questions about who might want to silence him.

The Mastermind: Ruth Muthoni Kamau

As investigators followed the money trail, one name emerged repeatedly: Ruth Muthoni Kamau, a businesswoman who allegedly received over Sh800 million from the heist.

Through her companies—Goodmans Fresh Ltd and Blue Kenfresh Ltd—she obtained Sh105 million directly, while additional funds flowed into her personal accounts.

Muthoni claimed to be in the export business, dealing in mutton and goat meat to Middle Eastern markets. However, investigators discovered a more complex financial web.

According to suspect Owen Karanja, who received Sh215 million through his companies, all his funds were converted to bitcoins and deposited into a Binance cryptocurrency wallet registered under Muthoni’s name.

When approached for comment, Muthoni’s responses were evasive and concerning.

She claimed to have been “abducted” rather than arrested, questioned why she was being singled out from “200 suspects,” and even suggested that journalists inquiring about her role might be “abductors.”

Her connection to the case became more intriguing when investigators learned of her relationship with Andrew Kamau Muhiu, a director of the collapsed real estate firm Banda Homes, which had defrauded hundreds of investors of millions of shillings.

The Serial Fraudster: Geoffrey Kiragu’s Double Life

Perhaps the most shocking revelation in the investigation was the identity of a key suspect initially known only as “Geoffrey.”

When fingerprint analysis was conducted, investigators discovered that Gideon Kamau Wangeci—who had led police on a wild goose chase across Nairobi suburbs—was actually Geoffrey Kahungi Kiragu, the notorious founder of Lesedi Developers.

Kiragu’s criminal resume was extensive. Under the Lesedi Developers banner, he had orchestrated a massive real estate fraud that cost over 800 investors at least Sh1 billion.

The scheme involved selling non-existent plots and properties, leaving hundreds of middle-class Kenyans without homes or their life savings.

Since Lesedi’s collapse in 2023, Kiragu had been far from idle. He had established new companies—Bomalink Concepts Ltd and Brickways Properties Ltd—and was allegedly selling the same fraudulent land parcels that had been used in the Lesedi scam.

The Directorate of Criminal Investigations had already issued public warnings about these companies, directly linking them to Kiragu’s fraudulent activities.

The discovery that Kiragu was central to the Equity Bank heist revealed a pattern of escalating financial crimes.

From land fraud to bank heists, he had graduated to increasingly sophisticated and devastating schemes.

The Cover-Up: Allegations of High-Level Interference

What transformed this investigation from a complex financial crime into a potential scandal was the allegation of systematic interference in the probe.

Inspector Bonface Maina Kamau, the lead investigator, found himself at the center of what he claims was an orchestrated campaign to derail the investigation.

According to internal police correspondence, Kamau’s troubles began when he criticized inconsistencies in Ruth Muthoni’s statement, including a curiously incorrect date (July 22, 2023 instead of 2024) and the recording officer’s failure to include proper initials.

When Kamau pressed for a corrected statement, Muthoni allegedly stalled and eventually filed a complaint against him.

The complaint, filed with the police’s Directorate of Public Complaints, accused Kamau of demanding a Sh10 million surety (which he denied) and orchestrating her “abduction” (which he maintained was a lawful arrest).

More significantly, the complaint triggered Kamau’s sudden transfer to Baragoi, Samburu County—a remote posting that effectively removed him from the investigation.

In his protest letters to senior police officials, Kamau made explosive allegations: that two senior DCI officers from the Transnational Organised Crime Unit had “incessantly tried to help Ms Muthoni wriggle out of the investigation,” and that bureaucrats from the Office of the Director of Public Prosecutions had made similar attempts.

Perhaps most damaging to the investigation’s credibility was Kamau’s claim that Muthoni had made “several WhatsApp calls to senior officers in the DCI and the National Police Service” while being processed, and that she had met “an officer she was acquainted with” who allegedly provided her with a BFIU contact for “furtherance in assistance she needed.”

The Wider Network: Hawala and Cryptocurrency Connections

The investigation revealed the sophisticated methods used to launder the stolen funds.

Five individuals—Sahal Mohamed Sahal, Mohamed Hashi Adan, Kariye Salah Ali, Hassan Abdirashid Mohamed, and Mohamud Mohamed Arab—had received Sh463 million and attempted to access additional funds when they were detained at Equity Bank’s headquarters.

These suspects revealed how the money was moved through both traditional and modern channels. Some funds were transferred through Hawala networks, while others were converted to foreign currencies at forex bureaus.

The most technologically advanced aspect involved converting substantial amounts to bitcoins through the Binance cryptocurrency platform.

The use of cryptocurrency represented a new frontier in Kenyan financial crimes, making it extremely difficult for authorities to trace and recover stolen funds. Equity Bank’s attempts to reverse these transactions highlighted the challenges banks face when dealing with digital currencies.

The case has spawned multiple legal proceedings across different courts. David Machiri faces charges related to the fraudulent transactions, while Geoffrey Kiragu battles charges in the Lesedi Developers case alongside his alleged involvement in the bank heist.

Most recently, in May 2025, lawyer Esther Bitutu Kadiki was arrested and charged in connection with the heist.

Court papers suggest she may have played a central role in orchestrating the scheme, with investigators alleging she was instrumental in the fraudulent siphoning of funds between May 1 and July 31, 2024.

Ruth Muthoni has obtained a court order blocking police from investigating or arresting her, claiming the investigation is tainted and that she was illegally implicated due to her connection to other suspects.

This legal maneuver has effectively stalled efforts to compel her to provide the additional statement that investigators have been seeking since October 2024.

The Equity Bank heist has exposed critical vulnerabilities in Kenya’s banking system.

The fact that such a massive theft could be executed using internal credentials raises questions about banks’ internal controls and monitoring systems.

Industry experts note that while the stolen money came from the bank’s payroll account rather than customer deposits, such a significant loss could still impact the institution’s financial stability and customer confidence.

The case has prompted calls for enhanced cybersecurity measures and more robust internal audit systems across the banking sector.

Unanswered Questions and Ongoing Investigations

Despite the arrests and ongoing legal proceedings, several critical questions remain unanswered:

• How did the perpetrators gain access to David Machiri’s credentials?
• What was the extent of internal collusion within Equity Bank?
• How much of the Sh1.5 billion has been recovered?
• Are there other financial institutions at risk from similar schemes?
• What measures are being taken to prevent future heists?

The investigation has been escalated to the DCI headquarters, suggesting the complexity and sensitivity of the case. However, allegations of interference continue to cast a shadow over the probe’s integrity.

Beyond the staggering financial figures lies a human story of betrayal and loss.

The case connects to the broader pattern of financial fraud that has devastated ordinary Kenyans, from the Banda Homes investors who lost their savings to the Lesedi Developers victims who never received their promised properties.

The involvement of serial fraudsters like Geoffrey Kiragu highlights how financial criminals often operate with impunity, moving from one scheme to another while their victims struggle to recover their losses.

The sophisticated nature of the Equity Bank heist suggests that these criminal networks are becoming increasingly organized and technologically advanced.

The Equity Bank heist serves as a wake-up call for Kenya’s financial sector.

The case has exposed weaknesses in banking security, regulatory oversight, and law enforcement capabilities.

It has also raised troubling questions about potential corruption and interference in high-stakes financial investigations.

The question now is whether the justice system can overcome the alleged interference and complications to hold all perpetrators accountable—and whether the lessons learned will be sufficient to prevent similar heists in the future.

This investigation is based on court documents, police correspondence, and interviews with sources familiar with the case. The investigation remains ongoing, and all suspects are presumed innocent until proven guilty in a court of law.