Gujarat intelligence busts Rs 226-crore crypto network linked to drugs, terrorism
The Gujarat Cyber Centre of Excellence said it had uncovered an Ahmedabad-based crypto network allegedly tied to drug trafficking, money laundering and terror financing. Investigators traced cross-border links through Monero, hawala channels and wallets.
by Brijesh Doshi · India TodayIn Short
- Investigators traced suspicious payments from dark web platform ARTEMISLAB.CC to Indians
- Police said Monero helped conceal nearly Rs 193 crore in transfers
- One accused's wallet was earlier frozen by Israel's terror financing bureau
The Gujarat Cyber Center of Excellence has uncovered a massive cryptocurrency-based network from Ahmedabad allegedly linked to drug trafficking, money laundering and terror financing. The operation has lead to the arrest of nine individuals from different parts of the country. Investigators said transactions worth nearly Rs 226.54 crore were traced through crypto wallets connected to the accused.
According to officials, the probe exposed a sophisticated network operating across several Indian cities, including Ahmedabad, Mumbai and Karnal, with alleged links to international criminal syndicates, dark web drug markets and organisations accused of terror financing.
The Superintendent of Police of the Cyber Center of Excellence said investigators traced suspicious transactions originating from ARTEMISLAB.CC, an alleged illegal online drug-selling platform operating on the dark web. The transactions reportedly led investigators to crypto wallets linked to Ahmedabad resident Mohsin Sadiq Molani and several other Indian users associated with him.
Officials said the accused extensively used privacy-focused cryptocurrency Monero to hide the movement of funds. Transactions worth nearly USD 20 million (Rs 193 crore) through Monero were allegedly identified during the investigation. Authorities said Monero is widely used on the dark web because of its anonymity features and has frequently surfaced in investigations related to illegal trade and terror financing.
The investigation further revealed that one of the accused, Mohammad Zubair Mohammad Hussain Popatia, allegedly operated a crypto wallet that had earlier been frozen by Israel’s National Bureau for Counter Terror Financing (NBCTF) in 2025. Investigators claimed the wallet had links to entities allegedly associated with Hamas and Dubai-based crypto exchanges.
Officials also alleged that transactions from the network were connected to crypto wallets sanctioned by the US Office of Foreign Assets Control (OFAC), including entities allegedly linked to Yemen’s Ansar Allah (Houthis), Iran’s IRGC-QF and the sanctioned Russian crypto exchange Garantex.
According to investigators, Mohsin Molani allegedly accepted drug orders for customers in the United Kingdom through Telegram groups and online platforms. The orders were then allegedly routed to Mohammad Zubair Popatia, who reportedly operated the supply chain from Dubai.
Another accused, Isam Salman Ghulam Ali Ansari, is currently lodged in a UK prison after being sentenced in 2024 for drug trafficking and money laundering. Investigators suspect the network continued operations even while he was incarcerated.
Police said hawala channels and “dirty crypto” converted into USDT were allegedly used to move money across borders and fund criminal operations.
Authorities have so far registered multiple charges under the Bharatiya Nyaya Sanhita (BNS) and sections of the Information Technology Act related to organised crime, terror financing, conspiracy and cyber fraud.
Officials also revealed that 935 complaints had earlier been filed on the NCCRP portal against Binance P2P-linked bank accounts allegedly connected to the accused. Further investigation into the international links of the network is underway.
- Ends