Gujarat's Cyber Centre of Excellence (CCoE) under CID Crime has arrested nine individuals and dismantled an international cryptocurrency syndicate allegedly involved in terror financing, dark web narcotics trafficking, hawala transactions, cyber fraud, and money laundering. Blockchain analysis traced financial transactions worth more than ₹226 crore (approximately 23.96 million US dollars) across the network, with links to organisations flagged by Israeli, American, and international counter-terror authorities.

How the Investigation Began

According to officials, the probe was initiated after the technical unit of the CCoE detected a suspicious Indian IP address while analysing cryptocurrency flows. The address was receiving payments from ARTEMISLAB.CC, a dark web platform allegedly involved in international online drug trafficking. Subsequent blockchain analysis traced the transactions to a crypto wallet belonging to Ahmedabad resident Mohsin Sadiq Molani, from which investigators identified nine additional interconnected wallets operating within the same network.

Terror Financing Links: Hamas, Houthis, and IRGC

A detailed examination of the wallets revealed alleged links with Al-Kahira, a Gaza-based organisation that Israeli authorities have associated with Hamas financing operations. Investigators said Israel's National Bureau for Counter Terror Financing (NBCTF) had frozen certain crypto wallets in 2025 through court orders, alleging they were used to route funds to Hamas through Turkey.

'One of those wallets was directly transferring payments into two wallets belonging to Mohammed Zuber Popatiya. From Popatiya's wallets, the money was transferred into the wallets operated by members of this group,' a senior official said. Investigators further alleged that Popatiya's wallet had been cluster-marked by the United States Office of Foreign Assets Control (OFAC) in connection with Yemen-based Ansar Allah, also known as the Houthi group.

Wallets associated with Iran's Islamic Revolutionary Guard Corps-Quds Force (IRGC-QF), Russia-based crypto exchange Garantex, and the Ilan Shor network were also reportedly linked to the syndicate's transaction chain, according to police.

UK Drug Network and the Prison Connection

SP Rajdeepsinh Zala, addressing a press conference on Tuesday, said the investigation uncovered an international narcotics network operating between India, Dubai, and the United Kingdom since 2023. According to investigators, Mohsin Molani allegedly sourced drug orders through Telegram groups and dark web channels while operating from Ahmedabad, passing orders to Dubai-based Mohammed Zuber Popatiya and UK-based Salman Gulamali Ansari, who arranged deliveries in Britain.

'The drugs were supplied in the UK, and the payments were converted into cryptocurrency and routed back to the group,' Zala said. Notably, officials said Salman Ansari had been sentenced to six years' imprisonment by a British court in 2024 in connection with a narcotics case — yet investigators claimed evidence suggested he continued operating the network from prison during 2026.

Proceeds were allegedly routed back to India through angadia and hawala channels. Police alleged that Molani collected the cash and handed it to Gulam Sadiq Ibadullah Ansari, father of Salman Ansari, who has also been arrested.

Scale of Transactions and Cyber Fraud Links

The accused allegedly used complex layering techniques — rotating cryptocurrency through multiple wallets before converting assets into USDT stablecoins and cash — to disguise the origin of funds. Police also recovered two Monero wallets; Monero, a privacy-focused cryptocurrency widely associated with illegal online transactions, was allegedly used for transactions worth more than ₹2 crore.

Analysis of linked bank accounts revealed connections with 935 cyber fraud complaints registered on the National Cyber Crime Reporting Portal. Officials estimated that approximately 30 to 40 per cent of the total transactions are suspected to involve 'dirty crypto' linked to terror financing, cyber fraud, and organised crime, while the remainder related to trading, hawala, gold dealings, and futures trading.

Among the accused, Mohammedzaid Siddi allegedly handled transactions worth more than 7.52 million US dollars, followed by Mohammed Zuber Popatiya with 4.87 million US dollars and Naved Pathan with 3.83 million US dollars.

The Nine Accused and What Comes Next

The nine individuals arrested have been identified as Mohsin Sadiq Chhipa, Ejaz Pathan, Mohammedzaid Siddi, Naved Pathan, Faizahmed Chishti, Salmankhan Pathan, and Gulam Sadiq Ansari from Ahmedabad; Zeeshan Motiwala from Mumbai; and Lovepreet Madharu from Karnal in Haryana. Popatiya remains abroad, with efforts underway to secure his return to India, while Salman Ansari remains lodged in a UK prison.

A case has been registered under Sections 111(2)(B), 153, and 61 of the Bharatiya Nyaya Sanhita, 2023, along with Sections 66(C) and 66(D) of the Information Technology Act, 2008. The operation involved ten field teams and separate technical units handling blockchain analysis over more than four-and-a-half months. Investigators are also examining whether narcotics were transported from India through air cargo routes before distribution in Britain. The investigation into the wider terror financing and cybercrime network is ongoing.