Gandhinagar, May 19 (IANS) The Cyber Centre of Excellence (CCoE) of Gujarat CID Crime has arrested nine individuals and uncovered an international cryptocurrency syndicate allegedly involved in terror financing, dark web narcotics trafficking, cyber fraud, hawala transactions, and money laundering, with financial transactions worth more than Rs 226 crore traced during the investigation.

Addressing a press conference on Tuesday, SP Rajdeepsinh Zala said the investigation exposed a network handling “dirty crypto” linked to international terror organisations, dark web marketplaces, drug syndicates, gold smuggling, human trafficking, and other illegal activities.

“The dirty crypto was converted into USDT and then into cash through hawala channels before being routed to terror organisations, drug networks and criminal syndicates operating in different countries,” he said.

According to officials, the investigation began when the technical unit of the CCoE detected a suspicious Indian IP address while analysing cryptocurrency transactions.

Investigators found that the IP address was receiving payments from “ARTEMISLAB.CC”, a dark web narcotics platform allegedly involved in international online drug trafficking.

Further blockchain analysis traced the transactions to a crypto wallet belonging to Ahmedabad resident Mohsin Sadiq Molani. Investigators then identified nine additional interconnected crypto wallets operating within the same network.

Police said a detailed examination of the wallets revealed links with Al-Kahira, a Gaza-based organisation which Israeli authorities have associated with Hamas financing operations.

Investigators said Israel’s National Bureau for Counter Terror Financing (NBCTF) had frozen certain crypto wallets in 2025 through court orders after alleging that they were being used to route funds to Hamas through Turkey.

“One of those wallets was directly transferring payments into two wallets belonging to Mohammed Zuber Popatiya. From Popatiya’s wallets, the money was transferred into the wallets operated by members of this group,” a senior official told IANS.

Investigators also alleged that Popatiya’s crypto wallet had been cluster-marked by the United States Office of Foreign Assets Control (OFAC) in connection with Yemen-based Ansar Allah, also known as the Houthi group.

Police further stated that wallets associated with Iran’s Islamic Revolutionary Guard Corps-Quds Force (IRGC-QF), Russia-based crypto exchange Garantex, and the Ilan Shor network were also linked to the syndicate’s transaction chain.

“The accused used complex layering techniques to disguise the origin of funds by rotating cryptocurrency through multiple wallets before converting the assets into USDT stablecoins and cash,” officials said.

Police also recovered two Monero wallets from the accused. Monero, a privacy-focused cryptocurrency widely associated with illegal online transactions, was allegedly used for transactions worth more than Rs two crore.

Zala said the investigation uncovered an international narcotics network operating between India, Dubai, and the United Kingdom since 2023.

According to investigators, Mohsin Molani allegedly sourced drug orders through Telegram groups and dark web channels while operating from Ahmedabad.

Police alleged that Molani passed the orders to Dubai-based Mohammed Zuber Popatiya and UK-based Salman Gulamali Ansari, who arranged deliveries in Britain through their network.

“The drugs were supplied in the UK, and the payments were converted into cryptocurrency and routed back to the group,” Zala said.

Officials said Salman Ansari had been sentenced to six years’ imprisonment by a British court in 2024 in connection with a narcotics case.

However, investigators claimed evidence suggested he continued operating the network from prison during 2026.

The investigation further revealed that proceeds generated through the alleged drug trade were routed back to India through angadia and hawala channels.

Police alleged that Mohsin Molani collected the cash and handed it over to Gulam Sadiq Ibadullah Ansari, father of Salman Ansari, who has also been arrested.

Investigators said the accused used peer-to-peer crypto trading accounts to convert USDT into cash.

Analysis of the linked bank accounts revealed connections with 935 cyber fraud complaints registered on the National Cyber Crime Reporting Portal.

Police said approximately 30 to 40 per cent of the transactions are suspected to involve “dirty crypto” linked to terror financing, cyber fraud, and organised crime, while the remaining transactions were related to trading operations, hawala activities, gold dealings, and futures trading.

The total cryptocurrency transaction volume traced in the case was estimated at 23.96 million US dollars, equivalent to around Rs 226.54 crore.

Among the accused, Mohammedzaid Siddi allegedly handled transactions worth more than 7.52 million US dollars, followed by Mohammed Zuber Popatiya with 4.87 million US dollars and Naved Pathan with 3.83 million US dollars.

The nine accused arrested have been identified as Mohsin Sadiq Chhipa, Ejaz Pathan, Mohammedzaid Siddi, Naved Pathan, Faizahmed Chishti, Salmankhan Pathan, and Gulam Sadiq Ansari from Ahmedabad; Zeeshan Motiwala from Mumbai; and Lovepreet Madharu from Karnal in Haryana.

“Popatiya is currently abroad, and efforts are underway to bring him back to India. Salman Ansari remains lodged in a UK prison,” officials said.

Investigators are also examining whether narcotics were transported from India through air cargo routes before being distributed in Britain through dark web channels. Zala said the operation had been underway for more than four-and-a-half months.

Ten field teams were deployed during the crackdown, with separate technical teams handling blockchain analysis and intelligence gathering.

He added that the investigation had revealed links with several countries, including Israel, Iran, Yemen, Turkey, the United Kingdom, the United States, Russia, and the Gaza region.

Police said no involvement of any government agency had emerged during the investigation so far regarding the alleged transportation routes used for narcotics trafficking.

A case has been registered under Sections 111(2)(B), 153, and 61 of the Bharatiya Nyaya Sanhita, 2023, along with Sections 66(C) and 66(D) of the Information Technology Act, 2008.

Officials said further investigation into the wider terror financing, narcotics trafficking, and cybercrime network is continuing.

–IANS

mys/dan