The opening days of May 2026 have brought a fresh wave of cryptocurrency fraud cases across India, spanning multiple states, multiple tactics, and millions in losses.
From a street-level social media con in Gujarat to an organised cybercrime syndicate in Uttar Pradesh, and from the Enforcement Directorate flagging crypto as its new enforcement priority to the Ministry of Home Affairs issuing a formal advisory against Trust Wallet drainer scams, the first seven days of the month have packed in more bad news than most quarters.
Here is a full breakdown of every crypto-related scam and enforcement development that surfaced in India during the first week of May 2026.
Ahmedabad artist cheated of ₹27 lakh in a fake crypto trading scam
According to a report by the Times of India, an artist from Ahmedabad was cheated of ₹27 lakh after being lured into a fake cryptocurrency investment scheme. The victim came across what appeared to be a legitimate crypto trading platform through social media.
The scammers followed a pattern that Indian investigators have now seen hundreds of times: initial contact through a digital platform, followed by trust-building, small fabricated profits shown on a fake dashboard, and then escalating demands for more money.
This case adds to Ahmedabad’s growing track record with crypto-linked fraud. According to data presented in the Gujarat Legislative Assembly earlier this year, the city recorded 694 cyber fraud cases between February 2024 and January 2026, involving a total of ₹134.45 crore. Police managed to recover only ₹49.01 crore across 315 traced cases.
Gujarat’s history with crypto fraud runs deep. The BitConnect scam, orchestrated by Gujarat-native Satish Kumbhani, remains one of the largest crypto Ponzi schemes in Indian history.
The ED seized crypto worth ₹1,646 crore (~$173.96 million) from devices linked to Kumbhani in February 2025, marking the largest single-day crypto seizure by any Indian investigating agency.
Varanasi: ₹56 lakh crypto-forex scam leads to blackmail, suicide
The most disturbing case to surface this week came from Varanasi, Uttar Pradesh. According to a report by The420.in, police arrested the main accused, Suraj Kumar (32), from near Fularia DM Compound in connection with a ₹56 lakh crypto-forex investment fraud that ultimately led to a woman’s death.
The victim, Nutan Yadav, a homemaker from the Cantt police station area of Fularia, was allegedly trapped by a gang that lured her with promises of high returns through forex trading, cryptocurrency investments, and real estate schemes.
The accused introduced themselves as experienced investment advisors and initially built trust by showing small, fake profits. Once confidence was established, the gang systematically induced her to transfer a total of ₹56 lakh into multiple bank accounts.
When Yadav demanded her money back, the situation took a horrifying turn. An obscene video allegedly linked to the victim was created, and she was blackmailed with threats of public circulation unless she paid another ₹11 lakh. Unable to bear the continuous harassment, threats, and financial loss, Nutan Yadav died by suicide on April 9, 2026, at her residence.
A complaint filed by her sister, Neelam Yadav, led to the registration of a case. Suraj Kumar’s associate, Vishnu Jaiswal, had already been arrested earlier and sent to jail. Investigators believe the gang was part of a structured cybercrime syndicate that used social media platforms, fake customer support calling systems, and fraudulent investment websites to target victims. Police are now examining bank accounts, mobile data, and digital transaction trails to trace the full extent of the network.
ED declares crypto fraud a top enforcement priority
On May 1, India’s Enforcement Directorate made its intentions explicit. Speaking at the 70th ED Day Celebration, Director Rahul Navin announced that the agency is now pivoting its focus toward cryptocurrency frauds, terror financing, cyber-enabled crimes, and narcotics trafficking as its key priority areas.
Navin noted that conventional fraud cases involving banks and real estate have declined thanks to stronger regulatory frameworks like the Insolvency and Bankruptcy Code and RERA. With those sectors stabilised, the ED is redirecting enforcement efforts toward technology-driven offences, particularly those involving digital assets and cross-border illicit networks.
The numbers back the pivot. The ED filed 812 charge sheets along with 155 supplementary filings during FY 2025-26, nearly double the count from the previous comparable period. The conviction rate stood at 94%. Around 2,400 money laundering cases remain pending before courts.
ED files second chargesheet in ₹2,200 crore HPZ token scam
Also on May 1, the ED’s Dimapur Sub-Zonal Office filed a second supplementary chargesheet in the HPZ Token cryptocurrency scam under the Prevention of Money Laundering Act (PMLA). The filing is based on FIRs lodged at the Cyber Crime Police Station in Kohima (Nagaland), the CID Police Station in Ulubari (Guwahati, Assam), and the CBI (EO-III) in Delhi.
The HPZ Token was a cryptocurrency investment scheme operated through a smartphone application that launched in June 2021. It promised high profits from investments in Bitcoin mining machines. The operators shut the scheme down in August 2021, leaving thousands of investors across India without access to their funds. The total fraud amount is estimated at ₹2,200 crore (~$231.90 million).
The ED probe has uncovered cross-border links, shell firms, and payment gateways that were allegedly used to route the stolen money, pointing to the growing complexity of crypto-linked financial crime in India.
MHA issues formal advisory on Trust wallet drainer scams
The National Cybercrime Threat Analytics Unit (NCTAU), operating under the Ministry of Home Affairs through the Indian Cyber Crime Coordination Centre (I4C), published Advisory TAU/ADV/013 in late April targeting Trust Wallet users. The timing made it one of the most discussed developments heading into May.
Unlike most regulatory advisories that stay vague on technique, this one laid out the attack chain step by step. Scammers establish initial contact via social media or messaging platforms, then direct users to counterfeit websites that brand themselves as official BNB Chain verification platforms. The fake sites display fabricated trust signals and prompt users to connect their wallets.
The critical kill switch: a third permission request flagged in red that grants the ability to move funds without further authorisation. Once signed, a drainer script executes, and the financial loss is direct and irreversible.
NCTAU named three specific counterfeit domains used in the campaign. The advisory is significant because it crosses into territory where Indian regulators have historically been quiet, the non-custodial, self-sovereign end of the wallet stack, where there is no exchange to subpoena and no chargeback mechanism.
Elderly victims continue to bear the brunt
In the days leading up to May, two cases from Hyderabad and Lucknow exposed how cybercriminals are systematically targeting older Indians. A retired professor from the University of Hyderabad lost ₹3.2 crore (~$337,800) to a fake crypto platform run through a Telegram group by a person identified as Aman Kumar, who posed as a professional stock trader.
The victim paid an initial fee of ₹8,500 to register, after which a fake trading dashboard showed fabricated profits, leading to multiple transactions totaling over ₹2.58 crore (~$272,300).
In Lucknow, a businessman lost ₹1.15 crore (~$121,410) to an associate who had been building trust over the years before directing him to a fraudulent SIP and crypto investment scheme. When the victim started demanding his money back, the accused stalled him until April 2026 and then began issuing threats.
Both cases follow the same playbook: social engineering through messaging platforms, fake dashboards showing inflated balances, a steady drip of small demands that escalate into massive transfers, and an exit strategy built on intimidation or silence.
Hyderabad realtor accused in ₹2.3 crore blockchain scam
On April 29, Hyderabad police identified a man posing as a real estate businessman who allegedly cheated several investors of nearly ₹2.3 crore (~$242,744) through a fake blockchain investment scheme. The accused, S. Satish Rao, operated from an office in Tarnaka under the name Jana Jyothi Real Estate.
The primary complainant, K. Harikumar, a medical shop owner from Khammam, reportedly invested around ₹55 lakh in different schemes after being convinced by Rao to put money into a blockchain-based investment. Investigators found that the accused had collected more than ₹1.78 crore (~$187,800) from other victims, bringing total losses to nearly ₹2.3 crore.
Mumbai cyber cell nabs suspect in ₹60 lakh crypto fraud
The North Cyber Cell of Mumbai Police arrested Arbaaz Wasim Mansuri in connection with a cryptocurrency investment fraud involving over ₹60 lakh. The complaint was filed by a private company executive and technical manager based in Kandivali, who had been added to a WhatsApp group in February that claimed to offer cryptocurrency trading advice.
According to investigators, Mansuri acted as a conduit, routing victim funds to the main operators behind the WhatsApp-based scam. His bank account was linked to multiple suspected cases, indicating a broader network. Police have remanded him to custody and are working to identify and apprehend the remaining members of the operation.
The broader picture: India’s crypto fraud epidemic by the numbers
The scale of the problem extends far beyond these individual cases. According to official data presented in Parliament, over 24 lakh cybercrime complaints were filed on the National Cyber Crime Reporting Portal in 2025, with reported fraud losses amounting to ₹22,495 crore (~$2.37 billion).
The recovery rate remains devastating. Of the ₹36,448 crore (~$3.84 billion) in cumulative losses reported since the portal’s inception, only ₹60.52 crore (~$6.38 million) has actually been returned to victims, a recovery rate below 0.2%.
A government report released in January 2026 revealed that reported crypto scam cases jumped from just over 1,300 in previous fiscal years to more than 11,700 in the first eight months of the current fiscal year alone, an increase of over 700%.
Government figures indicate that 82% of victims fall between the ages of 20 and 40, and an estimated 41% of Indian crypto users trade on offshore platforms that fall outside domestic regulatory oversight.
The government’s PRAHAAR counter-terrorism strategy, released in February 2026, specifically flagged the growing use of crypto wallets by criminal and terrorist networks. A dedicated darknet and cryptocurrency task force has been set up under the Multi-Agency Centre.
The Union Budget 2025-2026 allocated ₹782 crore (~$82.48 million) for cybersecurity projects. And from April 1, 2026, new powers under the Income Tax Bill now allow authorities to access crypto wallets, emails, and social media during authorised searches.
What investors need to know
The first week of May 2026 has reinforced what every recent case has already demonstrated. The playbook being used by crypto scammers in India is remarkably consistent: initial contact through social media, WhatsApp, or Telegram; trust-building through fake profiles and fabricated credentials; a fake platform or mobile application that displays manufactured profits; escalating demands for deposits; and withdrawal blocks disguised as processing fees, taxes, or security deposits.
No legitimate law enforcement agency or government body in India asks citizens to transfer money over phone calls or online platforms. No legitimate investment platform demands upfront payments before allowing withdrawals. Any unsolicited offer promising guaranteed returns in crypto should be treated as a scam until independently verified through SEBI.
Victims of cryptocurrency-related cybercrime should file complaints immediately at cybercrime.gov.in or call the national cybercrime helpline at 1930.
The infrastructure to fight crypto fraud in India is catching up. The scammers, as the first week of May has shown once again, are still getting there first.
Also Read: India Crypto TDS Deadline: What Traders Must Know
