Gujarat CID Crime's Cyber Centre of Excellence has arrested a tenth accused in an alleged international cryptocurrency syndicate, with total transactions across the network estimated at ₹226.54 crore (approximately USD 23,962,383), officials said on Sunday, 25 May 2025. The syndicate is accused of linking dark web narcotics trade, terror financing, money laundering, and cyber fraud through layered cryptocurrency channels.

Who Was Arrested

The latest accused, Ghulamali Qureshi (25), a resident of Mirzapur in Ahmedabad, was reportedly hiding in Rajasthan, primarily in Udaipur, for approximately one-and-a-half to two years, according to officials. Investigators allege he operated illegal cryptocurrency transactions and converted so-called 'dirty crypto' into USDT through peer-to-peer platforms and mule bank accounts. Police said he used a Binance wallet registered in his father's name and allegedly facilitated illegal funding of around ₹42 lakh, carrying out USDT transactions worth between ₹10 crore and ₹15 crore.

Around ₹43 lakh linked to dirty crypto transactions was allegedly transferred into his wallet through intermediary wallets. Two mobile phones were seized from him at the time of arrest.

The Network and Its Alleged Terror Links

The arrest follows the earlier detention of nine accused in the same case. Investigators used blockchain analysis to trace cryptocurrency transactions linked to the alleged illegal online narcotics marketplace 'ARTEMISLAB.CC'. Funds from the platform were reportedly transferred into cryptocurrency wallets operated from Gujarat, including one belonging to Mohsin Molani, whose wallet analysis allegedly revealed financial ties with nine other users across India.

According to officials, the wallet of Dubai-based accused Mohammad Zuber Popatiya was identified in 2025 by Israel's National Bureau for Counter Terror Financing (NBCTF) and allegedly had direct transactions with the 'Dubai Company for Exchange', which investigators linked to Hamas. Officials further stated that wallets in the network reportedly received funds from entities sanctioned by the United States Office of Foreign Assets Control (OFAC), including Yemen-based group Ansar Allah (also known as the Houthis), Iran's IRGC-QF, Russia-based crypto exchange Garantex, and wallets associated with the Ilan Shor network.

Monero, Hawala and the UK Drug Trade

Investigators alleged that the group extensively used Monero, an anonymous cryptocurrency frequently associated with dark web activity and terror financing, to conceal transactions worth nearly ₹2 crore. Officials also alleged that the syndicate had been involved in drug trafficking operations in Britain since 2023.

During interrogation, Molani allegedly disclosed that he received drug orders for Britain through Telegram groups and other online platforms before forwarding details to Popatiya in Dubai, who arranged supplies through a UK-based network. Another accused, Salman Ansari, was sentenced to six years' imprisonment in Britain in October 2024 after being convicted of drug trafficking and money laundering. Investigators claimed evidence recovered from Molani suggested that Ansari continued to operate the network from prison.

Officials described Salman Ansari and Mohammad Zuber Popatiya as the alleged masterminds of the Monero-based terror finance network. Funds were reportedly routed through hawala and angadia channels and later distributed through local operatives, including arrested accused Ghulam Sadiq Ibadulla Ansari, who is Salman's father.

Scale of the Cyber Fraud Trail

Around 60 bank accounts connected to the transactions were frozen during the investigation. Analysis of Binance-linked peer-to-peer bank accounts reportedly revealed links to 935 complaints registered on the National Cyber Crime Reporting Portal involving cyber fraud carried out using fake identities.

The case has been registered under Sections 111(2)(B), 153 and 61 of the Bharatiya Nyaya Sanhita, 2023, and Sections 66(C) and 66(D) of the Information Technology Act, 2008, covering organised crime, criminal conspiracy, cyber fraud, and alleged financial assistance to terrorist activities. Separate investigation teams operated under the supervision of Superintendent of Police Dr Rajdeepsinh Jhala, Sanjay Keshwala, and Vivek Bheda.

With the tenth arrest made and international leads still active, investigators are expected to pursue further action against overseas accused, including Popatiya in Dubai.