India’s Gujarat Police Cyber Centre of Excellence has arrested two more individuals in connection with the expanding investigation into a cryptocurrency network allegedly tied to terror financing, international narcotics trafficking, and dark web financial operations, officers confirmed on Friday.
The accused have been identified as Hadiraja Sarani, 23, and Mohmand Zamin Abbasali Jigar, 36, both residents of Bhavnagar. Their arrests bring the total number of people held in the case to 12.
According to investigators, blockchain analysis by the CCoE’s technical unit flagged a Binance wallet that had been set up using the KYC credentials of one Sabbir Ali Sarani. Police allege that Hadiraja, who is Sabbir’s son, along with Jigar, gained access to those credentials and created the wallet in Sabbir’s name without his authorization. Through this wallet, the two allegedly received 5,000 USDT, which investigators described as “dirty crypto,” routed through layered transactions from wallets allegedly linked to sanctioned entities.
According to the Times of India report, the funds, police said, were subsequently converted and moved to enable what officials termed unlawful financial activity.
Both accused have been booked under Sections 111(2)(B), 153 and 61 of the Bharatiya Nyaya Sanhita, 2023, and Sections 66(C) and 66(D) of the Information Technology Act, 2000. The charges cover criminal conspiracy, organised crime, identity-related cyber offences, and alleged facilitation of illegal financial channels.
How the probe unfolded
The investigation first came to public attention in May when nine individuals were arrested across Ahmedabad, Mumbai, and Haryana after the CCoE traced suspicious cryptocurrency activity back to a dark web narcotics marketplace identified as ARTEMISLAB.CC.
Investigators said the initial trail led to an Ahmedabad resident, Mohsin Sadiq Molani, whose crypto wallet showed links to the platform. From there, technical analysis revealed a wider network of wallets and users spread across multiple Indian cities.
The total transaction volume traced during the probe stood at approximately $23.96 million, or around Rs 226.54 crore. Police estimated that 30 to 40 percent of the transactions involved what they called dirty crypto linked to terror financing, cyber fraud, and organised crime. The rest, they said, was tied to trading, hawala, gold dealings, and futures activity.
Among the more serious allegations to emerge from the case: investigators claimed that a wallet linked to one of the accused, Mohammad Zubair Mohammad Hussain Popatia, had been previously frozen by Israel’s National Bureau for Counter Terror Financing in 2025. That wallet, police alleged, had transaction links to a Dubai-based entity reportedly associated with Hamas.
The probe also allegedly uncovered connections to Yemen’s Houthi group, Iran’s IRGC-QF, the Russia-based exchange Garantex, and wallets tied to the Ilan Shor network.
The syndicate, according to investigators, relied heavily on the privacy-focused cryptocurrency Monero to obscure fund movements. Officers said they recovered two Monero wallets and traced Monero transactions worth roughly Rs 2 crore. The accused allegedly used complex layering techniques, rotating funds through multiple wallets before converting assets into USDT stablecoins and then into cash.
A tenth arrest followed on May 24, when Ghulamali Qureshi, 25, of Ahmedabad’s Mirzapur area, was picked up. Police alleged that Qureshi had learned USDT trading during a trip to Dubai and subsequently carried out transactions worth Rs 10 crore to Rs 15 crore through a Binance wallet registered in his father’s name. He had reportedly been hiding in Rajasthan for nearly two years before his arrest.
Cross-referencing with the National Cyber Crime Reporting Portal revealed that bank accounts linked to the accused were connected to 935 cybercrime complaints filed across the country, involving digital fraud and identity theft.
A growing pattern across Gujarat
The case sits within a broader pattern of crypto-linked financial crimes being traced back to Gujarat. Gujarat Deputy Chief Minister Harsh Sanghavi publicly confirmed the initial round of arrests, calling the operation a strong message against cybercrime and anti-national networks operating within Indian borders.
The CCoE, headquartered in Gandhinagar and staffed with around 50 technical experts, has in recent years become one of the state’s key agencies in tackling digital financial crime. It has been involved in busting major scams related to investment fraud, digital arrest rackets, and mule account networks.
Meanwhile, the scale of crypto-related fraud across India continues to climb. Over 24 lakh cybercrime complaints were filed on the national portal in 2025 alone, with reported losses totalling Rs 22,495 crore. The government’s PRAHAAR counter-terrorism strategy, released in February 2026, specifically flagged the growing use of crypto wallets by criminal and terrorist networks.
Police said the investigation remains ongoing, with teams continuing to probe the network’s international financial channels, foreign handlers, and possible links to wider criminal ecosystems. Further arrests, officials indicated, are likely.
Also Read: RBI Denies Gold Sale Amid Oil Crisis: Could It Speed Up India’s Digital Rupee Push?
