"Engines are normally changed at Vridhachalam station. It could have happened here or after (the train left) Salem or Virudhachalam. We are investigating all angles," RPF Salem Railway Divisional Security Commissioner P Rajmohan told reporters here.
He was replying to a question whether the theft could have happened in Salem Junction itself as the train was reported to have halted for five hours (after the loading of the cash) or at Vridhachalam Junction where too some delay was reported.
The theft came to light yesterday as four of the more than 200 wooden boxes stuffed with the cash was found ripped open when the train arrived in Chennai.
"We are yet to receive the forensic report. As per the photographs received, we believe the roof of the train was opened by using large sized scissors and not a drilling machine as stated earlier," he said.
"As of now we have received a formal complaint from the bank officials that the money has been stolen. We are taking their statements," he said.