The funds were part of a bilateral debt repayment to Australia - with a settlement due in September 2025, News.Az reports, citing foreign media.

Authorities believe the diversion took place sometime in January, though details are only now emerging.

Harshana Suriyapperuma, the finance ministry secretary, told media on Thursday: "Even though Sri Lanka had made the due payments, the cyber criminals had intervened and diverted it to other bank accounts, instead of the intended recipient."

He said four senior officers at the Public Debt Management Office had been suspended and that they were seeking assistance from foreign law enforcement agencies.

Details of how the hackers managed to steal the money are not clear, but investigators believed hackers tampered with email-based payment instructions in the sovereign debt payment process.

Sri Lankan officials detected the missing $2.5m only after the Australian creditor complained that the debt payment had not been received.

Deputy finance minister Anil Jayantha Fernando said the extent of the cyber heist became clearer after the cyber criminals attempted to make another payment due to India, raising suspicions over altered bank account details.

The cyber attack is a fresh blow for Sri Lanka, which is recovering from a crippling economic crisis four years ago, when it ran out of foreign exchange.

Colombo defaulted then on its $46bn (£34bn) external debt.

The government was unable to pay for the import of food, fuel and medicine, resulting in short supply and triggering widespread anti-government protests that eventually toppled the then President Gotabaya Rajapaksa in July 2022.

The Australian High Commissioner in Colombo, Matthew Duckworth, said Canberra was aware of irregularities in payments owed to it.

"Sri Lankan authorities are investigating the matter and are coordinating with Australian officials, who are assisting the investigation," Duckworth said on X.

The cyber-attack came as Sri Lanka's central bank and finance ministry launched an advertising campaign in local newspapers earlier this year, warning Sri Lankans not to fall prey to cyber scams, AFP reports.