In India, cryptocurrency exchange Binance has publicly confirmed its role in an ongoing investigation by the Gujarat CID Crime’s Cyber Centre of Excellence (CCoE) in Gandhinagar, saying it supported authorities probing alleged illicit crypto transactions worth roughly ₹226.54 crore, or about $23.96 million.
In a statement shared with The Crypto Times, the exchange said it assisted investigators with transaction retracing, blockchain analysis, and restricted certain accounts “where appropriate” in response to lawful requests. The statement puts the total arrests in the case at 14 to date, following more than four months of field operations and technical review by the state agency.
The disclosure adds a fresh operational update to a case that has been unfolding in public since May 2026, when the CCoE first announced the network’s dismantling. The Crypto Times has previously reported on the arrests as the count moved from nine in mid-May to 12 by early June and 13 by mid-June.
What Binance Says It Provided
According to the exchange, its assistance was limited to what is permissible under “applicable laws and valid legal process.” The statement said Binance’s contribution involved:
- Assisting with transaction retracing across wallets linked to the case.
- Providing blockchain analytics support.
- Taking “appropriate measures” on relevant accounts, “where warranted.”
SB Seker, Head of APAC at Binance, said in the statement that public blockchains “can provide an auditable record of transactions that may support financial-crime investigations.” He added that when investigators can trace on-chain activity and link it to real-world behavior, “it becomes harder for bad actors to operate at scale.”
Binance said the investigation involved leads spanning India and multiple other jurisdictions.
How the Case Unfolded
The CCoE first disclosed the syndicate’s existence on May 19, when it arrested nine people across Ahmedabad, Mumbai, and Karnal in Haryana. Investigators said the trail began with an Ahmedabad-based accused, Mohsin Sadiq Molani, whose crypto wallet was allegedly linked to a dark web narcotics marketplace called ARTEMISLAB.CC.
Combined transaction volume traced across the accused accounts stood at $23,962,383, or roughly ₹226.54 crore in present value terms, according to police. Officials estimated that 30-40% of the volume involved what they termed “dirty crypto” linked to terror financing, cyber fraud, and organized crime, while the remainder was attributed to trading, hawala, gold dealings, and futures activity.
A 10th arrest followed on May 24, when police detained Ghulamali Qureshi, 25, of Ahmedabad’s Mirzapur area. Investigators alleged Qureshi had carried out USDT transactions worth ₹10 crore to ₹15 crore through a Binance wallet ID registered in his father’s name.
Two more arrests, of Bhavnagar residents Hadiraja Sarani and Mohmand Zamin Abbasali Jigar, were confirmed in early June. According to a Times of India report at the time, that pair allegedly used stolen KYC credentials to route 5,000 USDT of “dirty crypto” through a wallet set up in another person’s name.
A 13th accused, Shabbarhusen Padele of Sarkhej in Ahmedabad, was arrested on June 16, with Superintendent of Police Rajdeepsinh Jhala saying the accused was part of a broader network converting “dirty crypto” into USDT and cash through multiple operators.
Alleged International Links
Investigators have publicly attributed a range of international connections to the network. According to statements from the CCoE reproduced in multiple outlets, the wallet of a Dubai-based accused, Mohammed Zuber Popatiya, was frozen in 2025 by Israel’s National Bureau for Counter Terror Financing over alleged links to a front organisation of Hamas.
The state agency also alleged that funds moved into syndicate wallets from entities blacklisted by the U.S. Office of Foreign Assets Control (OFAC), including Yemen’s Ansar Allah (Houthi) group, Iran’s IRGC-QF, the sanctioned Russian exchange Garantex, and wallets associated with the Ilan Shor cluster. Another accused, Isam Salman Ghulam Ali Ansari, is reported to be lodged in a UK prison following a 2024 conviction in a drug trafficking and money laundering case.
Police said the group made extensive use of Monero, a privacy-focused cryptocurrency, alongside USDT. Officers reported recovering two Monero wallets and tracing Monero transactions worth about ₹2 crore. Layered routing through multiple wallets before conversion to USDT and eventual cash-out was described as a standard modus operandi.
Cross-referencing with India’s National Cyber Crime Reporting Portal (NCCRP) revealed that Binance P2P-linked bank accounts tied to the accused figured in 935 cybercrime complaints filed across the country, involving digital fraud and identity theft.
The accused have been booked under Sections 111(2)(B), 153, and 61 of the Bharatiya Nyaya Sanhita, 2023, along with Sections 66(C) and 66(D) of the Information Technology Act, 2000. The charges cover criminal conspiracy, organized crime, identity-related cyber offences, and alleged facilitation of illegal financial channels.
Wider Pattern of Exchange Cooperation in India
The Gujarat case sits within a broader pattern of Indian law enforcement engaging offshore crypto exchanges through formal channels. On July 22, Binance said it had worked with India’s Narcotics Control Bureau (NCB) and the Data Security Council of India (DSCI) to dismantle the alleged “Team Kalki” darknet drug network, providing wallet tracking and blockchain analytics that helped authorities freeze crypto assets tied to the group.
Binance registered as a “reporting entity” with India’s Financial Intelligence Unit (FIU-IND) in August 2024 after paying a $2.25 million penalty for earlier non-compliance with anti-money-laundering rules. The registration allowed the exchange to resume operations for Indian users after a seven-month ban.
In parallel, Binance has been under scrutiny on the tax side, with Indian authorities in 2024 alleging the exchange group owed roughly ₹722 crore in Goods and Services Tax (GST), and separate reporting in October 2025 indicating the Central Board of Direct Taxes was examining more than 400 high-net-worth Binance traders for suspected crypto tax evasion.
The exchange’s broader law enforcement posture has also drawn attention this year. A New York Times investigation published in late July reported that a policy change instituted by Binance in April 2025 now requires certain law enforcement requests to be routed through mutual legal assistance treaty (MLAT) processes rather than handled directly, a shift the report said had slowed some investigations in Europe. Binance has said the change was designed to align data handling with local privacy laws and disputed claims that overall cooperation had reduced.
What Remains
The Gujarat CID has said the investigation continues, with teams still probing the network’s international financial channels, foreign handlers, and possible ties to wider criminal and extremist ecosystems. Further arrests and seizures have been indicated as possible as leads are pursued across states and international jurisdictions.
Neither Binance nor the CCoE has published the identities of the two additional arrests that take the count from 12 (as of June 6) or 13 (as of June 16) to the 14 figure cited in Binance’s latest statement. The exchange’s disclosure noted only that authorities have “publicly reported” 14 arrests to date.
Also Read: Binance APAC Head Says India Needs Rupee Stablecoins to Cut Dollar Reliance
