Ebin B Paul, a design graduate from Puthencruz, Ernakulam, was arrested in connection with the arson attack on the Kadavumbhagam Synagogue in Kochi on October 13, 2026. Police found eight types of synthetic narcotics at his residence and filed a separate NDPS case. The investigation now covers a suspected dark web connection for drug procurement, an unidentified online handler called “Boss” who allegedly directed him through Telegram, cryptocurrency transfers, and possible foreign network links. He has also confessed to an earlier arson at a car showroom in Muvattupuzha in March 2026.
What Happened at the Synagogue
The Kadavumbhagam Synagogue in Ernakulam is part of Kerala’s centuries-old Jewish heritage , one of the oldest active Jewish institutions in India, with roots tracing back to communities that have lived along the Malabar coast for over a thousand years.
The attack on its outer premises in the early hours of Monday morning was not the first incident Ebin is now linked to. Police say he has confessed to a separate arson incident at a car showroom in Muvattupuzha in March 2026 , seven months earlier. That confession is being treated as significant because it suggests a pattern of directed activity rather than a one-off incident.
CCTV footage and vehicle tracking helped police identify Ebin. He was arrested after investigators pieced together the sequence.
The “Boss” on Telegram
The part of the investigation that has drawn the most attention from central intelligence agencies is not the arson itself. It is the online handler.
Police say Ebin was allegedly in contact with an individual he referred to only as “Boss”, an unidentified contact operating through Telegram and other encrypted communication platforms. Investigators are now examining Ebin’s Telegram chats, WhatsApp conversations with foreign contacts, digital communications, and financial transactions to understand who “Boss” is, where they are operating from, and what instructions were given.
The possibility of a foreign network giving directions to someone inside Kerala has brought national-level agencies into the investigation. Central intelligence agencies are probing potential terror links and the nature of the communications between Ebin and his online contacts.
This pattern, a vulnerable individual identified online, given instructions via Telegram, paid or directed through cryptocurrency, and used as a proxy for an attack while the actual organiser remains remote and anonymous, has shown up in cases across Europe and South Asia. As we covered in looking at how online operators directed arson and violence through dark web platforms in the Rotterdam hitman case, the structure of remote direction through anonymous channels puts the physical risk on the recruited person while the organiser stays invisible. Police are now determining whether “Boss” is in that category.
The Narcotics and the Dark Web
The drugs found at Ebin’s home — eight types of synthetic narcotic and psychotropic substances, introduced the dark web dimension into what began as an arson case.
Synthetic narcotics of the kind allegedly found in Ebin’s residence are commonly procured through dark web marketplaces. Kerala police have specifically flagged a dark web link as part of the probe, suggesting investigators believe at least some of the substances may have been acquired through encrypted online markets accessible only through software like Tor , the same infrastructure we’ve covered repeatedly this year in the context of drug trafficking networks operating through dark web platforms.
The dark web link here potentially runs in two directions. First, as a procurement channel for the drugs found at his home. Second, as possibly the same network through which the “Boss” contact operated , criminal and potentially terror-adjacent networks increasingly use the same encrypted communication infrastructure that the dark web relies on, from Telegram channels to cryptocurrency payment systems.
Investigators are examining cryptocurrency transactions linked to Ebin to determine whether payments were made through the dark web or received from foreign contacts in crypto.
Who Ebin Is: The Profile Behind the Case
OnManorama’s reporting describes Ebin B Paul as a design graduate who was described by people in his community as a “loaded, introvert” struggling with depression. His family, from the Vadayampady area, reacted with shock to the arrest. A local ward member in the area confirmed the family’s disbelief.
He is described as having no obvious prior criminal history visible to the community , no publicly known affiliations or activities that would have signalled the trajectory his case now reveals. The design background, the reported mental health struggles, and the alleged online contact who gave direction are now the central threads investigators are pulling on.
Depression and isolation have been identified in multiple radicalisation and directed-crime cases as vulnerability factors that online recruiters specifically target. Whether that framing applies here is part of what the Special Investigation Team is working to determine.
The Cryptocurrency and Foreign Network Investigation
Both the arson probe and the narcotics case are now running alongside a financial investigation. Cryptocurrency transfers linked to Ebin are being examined in detail.
This part of the investigation sits within a well-documented framework. As we’ve covered in looking at how cryptocurrency is used to fund and conceal criminal activity in the dark web economy, cryptocurrency is the standard payment mechanism for both dark web drug purchases and payments made by remote operators to individuals they’ve recruited. Blockchain analysis can trace these flows even when the original payments were made through mixing services, given time and forensic resources.
The involvement of central intelligence agencies in Ebin’s case suggests the cryptocurrency and foreign communication angles have been escalated beyond routine police investigation.
What This Means Beyond Kerala
This case sits at an intersection that law enforcement across India is increasingly encountering: the convergence of dark web drug procurement, anonymous online radicalization through encrypted platforms, and directed criminal activity paid for through cryptocurrency.
None of these elements is new individually. What’s significant is how they appear together in a single case involving someone who, from the outside, seemed to have no obvious criminal profile. The drugs from the dark web, the handler on Telegram, the cryptocurrency payment chain, the history of an earlier attack, all of it assembled around a person his community describes as an isolated, struggling young man.
Understanding how the dark web functions as infrastructure for both drug markets and criminal communications is increasingly relevant not just to cybersecurity professionals but to anyone following how crimes are organised in 2026.
Kerala Police and central agencies are continuing the investigation. Key unanswered questions include: who is “Boss,” what instructions were given and through what platforms, whether the synagogue attack was ideologically motivated or transactional, and whether the dark web narcotics network is connected to the same foreign contact network.
Frequently Asked Questions
Who is Ebin B Paul?
A design graduate from Puthencruz, Ernakulam, Kerala, arrested in connection with the arson attack on the Kadavumbhagam Synagogue in Kochi in the early hours of October 13, 2026.
What were the drugs found at his home?
Police found eight types of suspected narcotic and psychotropic substances at his residence in Ginger County Villa, Puthencruz. A separate case was registered against him under the NDPS Act.
What is the dark web link being probed?
Investigators believe the synthetic narcotics found at his home may have been procured through dark web marketplaces. The same encrypted network infrastructure may also be linked to his communication with an anonymous online contact called “Boss.”
Who is “Boss”?
An unidentified online handler who allegedly communicated with Ebin through Telegram and gave him directions Central intelligence agencies are working to identify who this person is and whether they are operating from outside India.
Is this a terror case?
No terror links have been officially confirmed. Central intelligence agencies are probing potential connections to foreign networks, cryptocurrency transfers, and the nature of communications between Ebin and his contacts. The investigation is ongoing.
Was this his first offence?
No. Police say he confessed to an earlier arson at a car showroom in Muvattupuzha in March 2026 — seven months before the synagogue attack.
