A court case has been filed over allegations that the website of the government’s Public Procurement Monitoring Office (PPMO) was hacked and bid prices manipulated in public contracts.
After the Central Investigation Bureau (CIB) of Nepal Police submitted its investigation report naming 22 defendants, including Rastriya Prajatantra Party leader and former minister Bikram Pandey, the District Government Attorney’s Office, Kathmandu, registered the case on Friday. The case will now proceed to detention hearings at the Kathmandu District Court.
We reviewed the investigation report to understand how government contract bids were manipulated by hacking an official government website.
According to the report, two separate groups were involved in the act. One group specialized in gaining unauthorized access to the website, while the other consisted of contractors. Police believe both groups worked together in an organized manner to profit from manipulating government procurement contracts.
Police identified one Diwakar Deuja as the key technical operator behind the hacking. He is also a government employee.
Deuja, who works at the Dense Urban and Building Construction Project in Dhankuta, reportedly possesses expertise in programming, cloud servers, project testing, and software systems. He denied involvement in hacking activities and claimed he had no knowledge of the operation.
However, the CIB presented internet activity records as evidence, identifying Deuja as the main accused who allegedly gained unauthorized access to the website.
Another accused, Bharat Dhami, allegedly used his WhatsApp number to communicate with contractors.
Police also charged Bhaskar Raj Aryal as the financial facilitator. Aryal, a computer engineer, is accused of facilitating cryptocurrency transactions through contacts in the United States and arranging corresponding cash settlements in Nepal.
Investigators say the group hacked the PPMO server and created a parallel server resembling the official procurement website. An email account was then created under the name “Jeevan Limbu,” which was used to negotiate with contractors.
The investigation report states that in August 2025, Sanjay Bhatta, owner of Soli Thumka Construction Service, received an email from “Jeevan Limbu,” who claimed to be a PPMO employee.
“Are you the director of Soli Thumka? Congratulations. Your contract bid has been selected. We can help you. The difference between your bid and the second-lowest bidder is Rs 21 million. If you want, we can even adjust the rate to more than Rs 20 million,” the email reportedly stated.
Bhatta replied two days later, asking, “Who are you? How can you do this?”
Limbu then allegedly demonstrated a fake PPMO login dashboard showing the Rs 21 million difference, on the condition that it be kept a secret. He later provided Bhatta with a link, username, and password to access the parallel website.
“The link looked exactly like the PPMO’s official website. We discussed the matter through its dashboard. He said that the job could be done for Rs 5.6 million and that payment had to be made in Bitcoin. Later we agreed on payment of Rs 4.5 million through Bitcoin,” Bhatta said in his statement to police.
Based on that arrangement, Bhatta reportedly paid an initial installment of Rs 1.3 million and a second installment of Rs 1 million in Bitcoin after communicating with Aryal.
Despite the payments, Bhatta did not receive the contract. However, he chose not to file a complaint, fearing he could get into trouble later.
A similar incident allegedly occurred with Sagar Katwal of Katwal Construction, who also received emails under the same name.
“We are employees of the Public Procurement Monitoring Office. If you want to participate in this contract, we can provide details of all participants and ensure your success. For this, an advance payment of Rs 500,000 to Rs 1 million must be deposited in Bitcoin,” the email reportedly said.
Katwal stated that he was also provided with a Bitcoin QR code for payment but was unable to transfer the money.
Other contractors, however, told investigators that they had never received emails from anyone named Jeevan Limbu.
In another aspect of the case, investigators found that bid amounts linked to contractors including Bikram Pandey were altered even after the tender submission deadline had passed.
Pandey, who is also the operator of Kalika Construction, had submitted a tender for the construction of the Bakaiya River bridge along the Mahendra Highway.
He admitted that he initially submitted a confidential bid worth Rs 670 million. Later, however, the bid amount appeared as Rs 605.4 million.
The CIB alleges that Pandey manipulated the contract price through the hacked system. However, Pandey denied any knowledge of the changes.
“Bikram Pandey appears to have gained unauthorized access to the parallel server of the Public Procurement Monitoring Office and, after obtaining information about updated confidential bid documents, reduced his quoted amount from Rs 670 million to Rs 600 million after the submission deadline had expired,” the CIB report stated.
Investigators allege that several other contractors also manipulated bid amounts in a similar manner.
In this case, the CIB has filed charges against Diwakar Deuja, Bharat Dhami, Sanjay Bhatt (owner of Soli Thumka), Sagar Katwal (owner of Katwal Construction and Shiva Om Suppliers), Bhaskar Raj Aryal, and Jeevan Kumar Das (owner of Gitanjali Construction, Duhabi).
Furthermore, charges have been filed against Anil Shrestha of Shivansh Nirman, Tanka Kumar Shrestha of Bhisan Construction, Amrit Bohora of Chapur Nirman, Bikram Pandey of Kalika Construction, Swadesh Pokharel of Incon Pvt Ltd, Prakash Dhungana of Kalpavriksha Builders, and Rishikesh Gauli of Ashish Nirman.
According to the police, Rahul Jung Karki of KBA Construction, Narayan Prasad Sitikhu of Man Construction, Indra Bahadur Bohara of Ramita Infrastructure, Shanta Kumar Shrestha of SK Construction, Niranjan Khanal of Dakshinkali Allover Contact, Krishna Bahadur Khatri of Nandi Construction, Jyoti Subedi (procurement officer at Ashish Nirman), Saroj Dahal of Chapur Sewa, and Sujan Adhikari of Rising Peak Construction are absconding.
Police submitted the case after investigating them for violations of the Electronic Transactions Act, cryptocurrency trading, and organized crime.
