In a major crackdown on cyber-enabled organised crime, the Gujarat Cyber Center of Excellence has uncovered a massive cryptocurrency network allegedly linked to drug trafficking, money laundering, hawala operations, and terror financing. The probe, centred in Ahmedabad, has so far led to the arrest of nine individuals from different parts of India, with investigators tracing suspicious crypto transactions worth nearly Rs 226.54 crore.
Officials said the network operated across multiple cities including Ahmedabad, Mumbai, and Karnal, while maintaining alleged international links with dark web drug marketplaces, foreign crypto exchanges, and organisations accused of terror financing.
According to investigators, the operation came to light after authorities tracked suspicious cryptocurrency transactions originating from ARTEMISLAB.CC, an alleged dark web drug marketplace. The money trail reportedly led investigators to crypto wallets connected to Ahmedabad resident Mohsin Sadiq Molani and several associates spread across India.
Police said the accused extensively used Monero, a privacy-focused cryptocurrency known for its anonymity features and frequently linked to dark web transactions, illegal trade, and global cybercrime investigations. Authorities traced transactions worth nearly USD 20 million, approximately Rs 193 crore, involving Monero wallets allegedly connected to the network.
Gujarat Police Busts ₹226-Crore Crypto Syndicate; 9 Held Over Terror Funding, Dark Web Linkshttps://t.co/e3YCzlr7VH pic.twitter.com/F8jkv7q40H
— DeshGujarat (@DeshGujarat) May 19, 2026
Officials revealed that the accused allegedly used encrypted communication platforms, Telegram channels, and crypto conversion methods to conceal transactions and move funds across borders without detection.
The investigation further uncovered alleged international terror financing links. According to officials, one of the accused, Mohammad Zubair Mohammad Hussain Popatia, allegedly operated a crypto wallet that had previously been frozen by Israel’s National Bureau for Counter Terror Financing (NBCTF) in 2025.
Investigators claimed the wallet had suspected links to entities allegedly associated with Hamas and certain Dubai-based cryptocurrency exchanges. Authorities also alleged that some transactions were connected to crypto wallets sanctioned by the United States Office of Foreign Assets Control (OFAC).
These allegedly included wallets linked to Yemen’s Ansar Allah (Houthis), Iran’s Islamic Revolutionary Guard Corps-Quds Force (IRGC-QF), and the sanctioned Russian cryptocurrency exchange Garantex.
According to police officials, Mohsin Molani allegedly accepted drug orders from customers based in the United Kingdom through Telegram groups and online channels. Investigators claim these orders were then forwarded to Mohammad Zubair Popatia, who allegedly managed the supply chain and coordination from Dubai.
Another accused, identified as Isam Salman Ghulam Ali Ansari, is currently lodged in a United Kingdom prison after being convicted in a drug trafficking and money laundering case in 2024. Investigators suspect that despite his incarceration, the network continued to function through associates and digital communication channels.
Officials alleged that hawala channels and “dirty crypto” converted into USDT were used to transfer money internationally and support criminal operations. Authorities believe the syndicate exploited gaps in crypto regulation and peer-to-peer trading systems to move illicit funds discreetly.
Police have registered multiple cases under various sections of the Bharatiya Nyaya Sanhita (BNS) and the Information Technology Act. Charges invoked include organised crime, terror financing, criminal conspiracy, cyber fraud, and illegal financial operations.
Investigators further disclosed that at least 935 complaints had previously been registered on the National Cyber Crime Reporting Portal (NCCRP) against Binance P2P-linked bank accounts allegedly connected to the accused persons.
Officials said the investigation is still ongoing and agencies are now probing the network’s international financial channels, foreign handlers, and possible links with wider organised criminal and extremist ecosystems.
More arrests and seizures are likely as the probe expands across states and international jurisdictions.
