ATM, card, and digital transaction services across 30 banks in the country were shut down from Sunday night.
After three days, all Q-Cash services were restored late Tuesday.
Information Technology Consultants PLC (ITCL), the local payment processor operating the Q-Cash network, revealed that the crisis stemmed from a dispute over software migration between ITCL and Compass Plus, a sanctioned Russian technology firm.
ITCL stated that upon learning their platform was being replaced by "Way4"—an enterprise payment platform developed by Brussels-based OpenWay—the Russian firm injected a malicious script into ITCL's servers.
This malicious script automatically restarted ITCL's servers every eight hours.
As a result, routing tables were cleared, halting data processing capabilities across the entire network.
Kazi Saifuddin Munir, managing director and CEO of ITCL, told the media: "As soon as the issue was identified, we alerted all our partner banks, including bKash."
The dispute escalated in August when ITCL announced its decision to phase out Compass Plus's platform over a 12-to-18-month transition period.
In response, Compass Plus allegedly threatened to terminate technical support and immediately demanded a $1.5 million migration fee.
Additionally, they demanded an advance payment guarantee backed by Bangladesh Bank.
The central bank later intervened on Monday, attempting to resolve the deadlock through discussions with both the vendor firm and ITCL.
However, Bangladesh Bank officials expressed dissatisfaction with ITCL's decision to shut down the system without prior notice.
Arief Hossain Khan, executive director and spokesperson of Bangladesh Bank, stated: "This is clearly a technical issue, but the failure to manage it immediately caused severe suffering for cardholders."
Khan confirmed that the central bank will issue official show-cause notices to member banks regarding the sudden suspension of services.
Under central bank guidelines, institutions are required to notify the public well in advance through national media, television, and direct text messages before conducting any scheduled maintenance.
According to Bangladesh Bank's Payment Systems Department, ITCL's system migration was originally scheduled for late October.
The central bank on Tuesday summoned the management of ITCL, the operator of the Q-Cash network, and directed them to restore all card-related services, including switching, at the earliest possible time.
The central bank clarified that transactions for banks, Mobile Financial Services (MFS) providers, and other Payment Service Providers (PSPs) directly connected to the NPSB platform remain entirely unaffected and are functioning normally.
