impimpi
Mr. Tumelo Nku.
Tumelo Nku — ‘Philip Plein’ — Cartel Operative in the R286m Aeroton Cocaine Heist
Self-styled ‘ethical hacker’ turned cartel operative — Madlanga Commission witness on the R286m Aeroton cocaine heist; testimony indefinitely postponed (2 July 2026)
Institutional Layer
Private civilian operating as a self-declared ‘ethical hacker’ / ‘cybersecurity analyst’ and unpaid ‘confidential source’; alleged operational asset of a drug-trafficking network run by ‘Eby’ (Iby); intersecting with Gauteng Traffic Police, SAPS Crime Intelligence and Transnet logistics
Record Source
Madlanga Judicial Commission of Inquiry public hearings, Pretoria (25 June – 2 July 2026); commission-entered Threema encrypted-messaging screenshots; SAPS docket on the 9 July 2021 Aeroton (Johannesburg) 715kg cocaine seizure; contemporaneous reporting by Eyewitness News (EWN), Daily Maverick, IOL, SABC News and Facebook/IOL News video record
Integrity Status
contested — Nku admits under oath that his first affidavit was false; concedes typing Threema messages under alias ‘Philip Plane / Philip Plein’ after initially claiming his phone was ‘cloned’ or ‘hacked’; cross-examination indefinitely postponed on security grounds (2 July 2026)
Network Role
alleged ‘ethical hacker’ front / cartel-embedded fixer; tip-off source to Chief Inspector Samuel Mashaba (Gauteng Traffic Police); alleged surveillance and logistics coordinator on Threema under handle ‘Philip Plein’
Correlation Links
linked to Chief Inspector Samuel Mashaba (MADLANGA/MASHABA-021) and W/O Marumo Magane on the 9 July 2021 Aeroton bust; to late Deputy Defence Minister Kebby Maphatsoe (family connection, introduction to ‘Eby’); to Transnet employee Zamo Khuzwayo (container tracking data); to late top cop Philani Mfazi (allegedly poisoned); pause of testimony triggered by attempted assassination of Crime Intelligence officer Feroz Khan (late June 2026)
Theme
A self-branded ‘ethical hacker’ and ‘confidential source’ who tipped off a Gauteng traffic chief and a senior SAPS officer about a 700kg-plus Durban-to-Johannesburg cocaine shipment in July 2021 — and who, under Madlanga Commission cross-examination in June 2026, concedes he was in fact hired by a rival-cartel trafficker (‘Eby’) to weaponise a police bust against a competing network. The field records the shifting affidavits, the ‘Philip Plein’ Threema alias, the R60,000 cash intercepted near the scene, the contaminated crime scene, the political connection through the late Deputy Defence Minister Kebby Maphatsoe, and the indefinite postponement of testimony after the attempted assassination of Crime Intelligence officer Feroz Khan — without verdict.
Archival Testimony
“The bird has landed, move the transport in position.”
— ‘Philip Plane’ / ‘Philip Plein’ (Threema handle attributed to Tumelo Nku)
Encrypted Threema chat log entered into the Madlanga Commission record, June 2026 — cited as real-time coordination of the 2021 Aeroton container heist
“Ensure the path is clear on the south gate, the boys are ready.”
— ‘Philip Plane’ / ‘Philip Plein’ (Threema handle attributed to Tumelo Nku)
Threema tactical instruction on bypassing port security, entered into the Madlanga Commission record, June 2026
“I was hired by Eby to orchestrate a police bust to destroy the business of his rival cartel.”
— Tumelo Nku (paraphrased under cross-examination)
Madlanga Commission, Pretoria, 29 June 2026 — dropping the ‘ethical hacker’ whistleblower persona
Evidence
Madlanga Commission oral testimony and exhibits (25 June – 2 July 2026); extracted Threema encrypted-messaging screenshots linked to Nku’s phone number under alias ‘Philip Plane / Philip Plein’; SAPS Aeroton docket on the 9 July 2021 715kg cocaine seizure; R60,000 cash intercepted on Nku near the Aeroton scene; crime-scene contamination record (cocaine bags handled without gloves); WhatsApp screenshots dated 21 May 2021 shown at hearing; supplementary statement filed by Nku (26 June 2026)
Timeline
July 2021 — Nku tips off Gauteng Traffic Police Chief Inspector Samuel Mashaba and discusses the incoming shipment with the late Philani Mfazi; 9 July 2021 — 715kg cocaine (~R286m street value) intercepted at the Scania warehouse, Aeroton, Johannesburg; Nku found near scene with R60,000 in cash. 2021–2025 — Nku publicly styles himself as an ethical hacker, cybersecurity analyst and unpaid confidential source. 25 June 2026 — testifies at the Madlanga Commission as an ostensible whistleblower. 26 June 2026 — commission adjourns for Nku to file a supplementary statement. 29 June 2026 — under cross-examination admits he was hired by trafficker ‘Eby’ to sabotage a rival cartel via a police bust; concedes political introduction via late Deputy Defence Minister Kebby Maphatsoe; confronted with Threema ‘Philip Plein’ logs and 21 May 2021 WhatsApp screenshots; concedes he typed the messages after ‘cloned phone’ defence collapses under cryptographic-key evidence. 2 July 2026 — Justice Mbuyiseli Madlanga indefinitely postpones cross-examination after the attempted assassination of Crime Intelligence officer Feroz Khan.
Status
active — Madlanga Commission testimony indefinitely postponed on security grounds (2 July 2026); SAPS / Hawks investigation into the R286m Aeroton heist and the associated cartel network ongoing
Outcome
unresolved — no criminal charges finalised against Nku at time of cataloguing; admitted operational role and false first affidavit on record; cross-examination pending secure hearing environment or witness-protection protocols
Sources
- Eyewitness News — Nku positions himself as cybersecurity expert, not paid informant (25 June 2026)
- Daily Maverick — Nku’s interactions with top police officials before 2021 Aeroton bust (25 June 2026)
- SABC News — Tumelo Nku submits supplementary statement (26 June 2026)
- SABC News — Nku denies involvement in drug shipment planning (29 June 2026)
- IOL News (Facebook video) — Nku confronted over WhatsApp screenshots, 21 May 2021 (29 June 2026)
- IOL National News — Nku confesses cartel plot to sabotage rival drug networks (29 June 2026)
- Daily Maverick — Political ties: late Kebby Maphatsoe linked to cartel introduction (29 June 2026)
- Eyewitness News — Nku’s testimony indefinitely postponed on security grounds (2 July 2026)
- Daily Maverick — Nku security pullout connected to shooting of witness Feroz Khan (2 July 2026)
Archive Notes
Catalogued on the IMPIMPI side as a structural-power case file on the ‘ethical hacker’ whistleblower persona as cover for cartel operations. Facts on file: (1) initially self-presented as an ethical hacker, cybersecurity analyst and unpaid confidential source who tracked a 700kg+ Durban–Johannesburg cocaine shipment in July 2021 and tipped off Gauteng Traffic Police Chief Inspector Samuel Mashaba, having also discussed the shipment with the late top cop Philani Mfazi; (2) under Madlanga Commission cross-examination on 29 June 2026, admits he was hired by drug trafficker ‘Eby’ (Iby) with an explicit mandate to orchestrate a police bust that would destroy a rival cartel — not to stop drug trafficking; (3) introduction to ‘Eby’ — under the cover of a coal-mining businessman — via Nku’s distant relative, the late former Deputy Defence Minister Kebby Maphatsoe; (4) collaboration with Transnet employee Zamo Khuzwayo to harvest tracking data for the target container; (5) Threema encrypted-messaging screenshots linked to Nku’s phone number, operating under handle ‘Philip Plane / Philip Plein’, show real-time container-movement coordination, driver direction and surveillance (‘The bird has landed, move the transport in position’; ‘Ensure the path is clear on the south gate, the boys are ready’); (6) ‘cloned phone / hacked’ defence collapses when evidence leaders show unique Threema cryptographic keys match Nku’s physical handset; Nku admits he typed the messages under the direct command of ‘Eby’; (7) R60,000 in cash intercepted on Nku near the Aeroton scene, pressed by the commission as suspected bribery of compromised police officers; (8) broader inquiry finds Nku and compromised officers contaminated the Aeroton crime scene, handling bags of cocaine without gloves, consistent with diversion of a portion of the consignment; (9) Nku concedes his first affidavit was false, claiming he lied ‘out of fear’ and that a ‘spiritual leader’ later persuaded him to come clean; (10) 2 July 2026 — Justice Mbuyiseli Madlanga indefinitely postpones cross-examination after the attempted assassination of Crime Intelligence officer Feroz Khan, ambushed in his vehicle by heavily armed gunmen just days before his own scheduled appearance; state can no longer guarantee witness safety in open session. Audio reading autoplays on entry to this page.