The Gujarat Cyber Centre of Excellence has dismantled a massive international financial syndicate operating a Rs 226 crore cryptocurrency network.
The syndicate specialised in routing these illicit funds back into notorious global terror organisations, international drug networks, and smuggling syndicates operating across multiple continents.
The unravelling of this global network began quietly when the Cyber Centre's technical team, specialising in deep blockchain analysis, flagged a highly suspicious Indian IP address. This specific IP address was caught directly receiving digital funds from Artemis Lab, a prominent dark web marketplace infamous for large-scale online narcotics trading.
Tracking the digital breadcrumbs of these crypto transactions, investigators discovered that the recipient wallet belonged to an Ahmedabad resident named Mohsin Sadiq Molani.
A deeper diagnostic look into Molani's transactional footprint cracked open a hornets' nest, leading to the discovery of nine additional linked crypto wallets spread across the country, establishing the baseline framework of an aggressive financial pipeline.
The high-octane operation, executed under the guidance of Director General of Police Dr. K. Lakshmi Narayanan Rao and Deputy Inspector General Bipin Ahire, was spearheaded by Superintendents of Police Dr. Rajdeepsinh Zala, Sanjay Keshwala, and Vivek Bheda.
SP Jhala provided comprehensive details on how his team successfully unmasked the dark underbelly of a highly sophisticated gang specialised in converting "dirty crypto" into USDT and hard cash through deep-rooted hawala channels.
The Shadow Trial: Monero Privacy Wallets, Gaza Terror Links, and US Sanction Violations
The intelligence breakthrough deepened when investigators analysed the cluster of wallets and discovered direct ties to Al-Kahira, a Gaza-based terrorist organisation associated with Hamas.
In 2025, Israel's National Bureau for Counter Terror Financing seized several crypto wallets via strict court orders, alleging they were actively funding Hamas operations through Turkey.
Astoundingly, one of those blacklisted wallets was caught transferring digital payments directly into two wallets owned by another prime accused, Mohammad Zuber Popatia. Popatia then systematically layered these funds out, transferring them directly into wallets operated by the other co-accused.
The US Office of Foreign Assets Control also cluster-marked Popatia's wallets due to explicit links with Yemen's Houthi group, Ansar Allah, exposing a dark channel where terror-linked funds were routed, converted into cold cash, and distributed globally by Popatia.
To ensure their financial operations remained entirely invisible, the syndicate relied heavily on privacy coins, with investigators recovering two specialised Monero wallets. Because Monero masks sender, receiver, and transaction amounts, it was the gang's preferred asset for hiding their trail, moving over Rs 2 crore through these two wallets alone. This multi-layered "Dirty Crypto" laundering machine processed funds arriving from cyber scams, international gold smuggling, and human trafficking.
Investigators estimate that roughly 30 to 40 percent of the Rs 226 crore under scrutiny constitutes pure dirty crypto directly tied to illegal activities, while the remaining balance was generated through heavy peer-to-peer trading, futures trading, and hawala operations.
To convert these digital assets into cash, the accused heavily utilised P2P methods across bank accounts that have since been matched to 935 distinct cybercrime complaints on the National Cyber Crime Reporting Portal, proving the gang actively absorbed the proceeds of widespread digital fraud.
From Post-Pandemic Plotting to UK Jailhouse Drug Rings: Smashed by a Four-Month Siege
The origins of this criminal brotherhood trace back to the aftermath of the Covid-19 pandemic. While spending time in India together, Mohammad Zuber Popatia, Salman Ansari, and Mohsin Mulani pooled their backgrounds in crypto trading and USDT exchange to plot a lucrative, highly illegal drug business primarily targeting the UK market.
Over time, they steadily engineered a robust network of USDT traders, cash converters, and hawala operators to clean their profits. Operating out of Ahmedabad, Mulani secured UK drug orders via encrypted Telegram groups and dark web forums. He passed the order details to Popatia, who is currently hiding abroad, and Salman Ansari, their UK-based partner.
The narcotics were then fulfilled and delivered directly to buyers overseas using Royal Parcel services, with the incoming drug payments immediately converted back into cryptocurrency and routed straight to the gang.
Though a British court sentenced Salman Ansari to six years in prison back in October 2024, investigators uncovered startling indications that he was still actively managing the narcotics ring from behind his UK prison bars as recently as March 2026.
The drug money generated in the UK was wired back to India via Angadia and Hawala networks, where Mulani would collect the physical cash and hand it over to Salman's father, Ghulam Sadiq Ansari, who was arrested for acting as the network's local cash anchor.
The massive investigation has successfully snared nine accused individuals so far, including Mohammad Sadiq Mulani, Mohsin Sadiq Mulani, Ejaz Aslam Khan Pathan, Mohammad Zaid Siddiqui, Naved Ayub Khan Pathan, Faiz Ahmed Chishti, Salman Habib Khan Pathan, and Ghulam Sadiq Ansari from Ahmedabad, alongside Zeeshan Siraj Motiwala from Mumbai and Lovepreet Singh from Karnal.
Dismantling this network required a relentless four-and-a-half-month operation by the Cyber Centre of Excellence, deploying ten dedicated field teams-one for each suspect-and three independent technical intelligence units.
The far-reaching case connects criminal assets across Israel, Yemen, Iran, the UK, the US, Turkey, Palestine's Gaza region, and Russia, with distinct funding lines pointing back to groups associated with Iran's Islamic Revolutionary Guard Corps.
While officials have declined to disclose the exact value of the crypto assets currently frozen until formal court approval is granted, the hunt continues.
Authorities clarified that no involvement of government agencies has emerged regarding the air cargo routes used for the drug shipments, but deep ongoing investigations are actively mapping out the complete money trail, hidden hawala pipelines, and domestic luxury properties purchased using the proceeds of crime.
With Popatia currently abroad, active international efforts are underway to extradite him, while the domestic and international channels remain under heavy surveillance as more arrests loom on the horizon.
