The last time India tried to pass a comprehensive law on virtual digital assets, the year was 2021, the bill was withdrawn before it was introduced, and every crypto exchange operating in the country was left to guess where the line ran. Five years later, the guessing game is over. It just did not end the way anyone in the industry expected. The line was drawn, quietly and consistently, by the Enforcement Directorate, one raid, one FEMA notice, one wallet seizure at a time.
Seven months into what has been the busiest crypto enforcement year in Indian history, the ED has become something the country’s regulatory architecture never formally created. It has become the de facto crypto regulator. And behind almost every headline it generates sits a question nobody has properly answered: where does all that seized crypto actually go, and who takes charge of it once the doors are kicked in?
A 70-Year-Old Agency Learning a New Trade
There is a nice symmetry in the timing. On May 1, 2026, the ED completed exactly 70 years. It was born on May 1, 1956, as a small “Enforcement Unit” inside the Department of Economic Affairs, set up to police foreign exchange violations under the old FERA regime. For most of those seven decades, the assets it chased were physical: cash, gold, benami flats, and farmhouses. Crypto did not exist for 52 of those 70 years.
That makes what has happened since roughly 2018 all the more striking. A 70-year-old agency built for lockers and land records has taught itself to seize, hold, and trace assets that live on a blockchain.
From FERA to Blockchain Forensics
The ED’s first serious brush with crypto came through the BitConnect case, which originated with Surat CID FIRs after the global Ponzi collapsed in 2018. But the real threshold moment was February 2025, when the Ahmedabad office seized cryptocurrency worth ₹1,646 crore, roughly $190 million, from devices linked to BitConnect founder Satish Kumbhani. It remains the largest single-day crypto seizure by any Indian investigating agency.
By January 2026, the ED was still making arrests in that arc, watching Bitcoin get converted into Ethereum and USDT. As The Crypto Times has tracked, crypto probes do not close. They widen.
The Doctrine That Was Never Meant to Be a Policy
On the same 70th anniversary, ED Director Rahul Navin stood up and said something that, read as an internal briefing, sounded routine. Bank frauds, corporate scams, and real estate frauds had shown a “visible decline”, he told officers, thanks to the Insolvency and Bankruptcy Code and RERA.
The new criminal landscape, he said, was defined by cryptocurrency fraud, cyber-enabled financial crimes, terror financing, and narcotics trafficking. Those were now the agency’s priority areas. The Crypto Times captured the shift in India’s ED Moves Beyond Bank Fraud: Crypto Identified as New Enforcement Frontier.
Read as policy, that speech was a declaration. India had, for the first time, put virtual digital assets in the same sentence as terror financing at the level of official doctrine. The RBI still refused to legitimize crypto. The Finance Ministry still had no bespoke law before Parliament. Into that vacuum stepped the one agency that could actually do something. In the six weeks that followed, it did.
Seven Months, Reconstructed
January to April: The Perimeter Shifts
The year opened with FIU-IND bringing 49 crypto exchanges under formal PMLA oversight, a number that rose to 54 by July, followed within days by tighter compliance guidelines and a rewritten KYC framework. None of these were ED actions, but they were the terrain the agency would work on all year.
Then the ED did what it always does. On January 7, the Nagpur office searched three locations tied to the Ether Trade Asia platform, an unregistered scheme that had pulled in retail money through seminars at star-rated hotels across Maharashtra. Cryptocurrency worth ₹43 lakh was frozen. Investor losses were pegged at ₹4.25 crore. It was small, but it set the year’s template: unregistered platform, guaranteed returns, wallets the operators believed no one could touch.
February brought the Ministry of Home Affairs’ PRAHAAR counter-terrorism strategy, the first Indian doctrine to explicitly name crypto wallets and blockchain as tools for terror and narcotics financing. Then came the move almost no one in crypto noticed. On March 30, the Special PMLA Court ordered restitution of 455 properties worth ₹15,582 crore to the Justice R.M. Lodha Committee in the PACL case.
The industry filed PACL under “old Ponzi case.” It should have filed it under “preview,” because the same 2019 amendment to the PMLA introducing non-conviction-based confiscation is the machinery that will eventually return seized USDT to crypto victims.
April brought a quiet structural change: from April 1, Indian exchanges had to share transaction data directly with the Income Tax Department. Every registered exchange now had a live pipe to the tax authorities, and by extension to the ED.
May: The Numbers Behind the Doctrine
On May 1, the ED released FY26 figures that gave the speech teeth. Attachments hit ₹81,422 crore, the highest single-year total in its 70-year history and a 170% jump. Cumulative attachments across all PMLA cases crossed ₹2.36 lakh crore. Roughly 1,080 ECIRs were registered.
But the number that mattered most was restitution: ₹32,678 crore returned to victims in FY26, more than double both the previous year and the ₹15,000 crore internal target. Since the 2019 amendment, the ED said, it had restituted ₹63,142 crore to victims and rightful owners. Arrests, meanwhile, fell 27%. For an agency that once measured itself by who it locked up, this was a real reframing. The ED now grades itself on the money it returns.
June: The Blitz
On June 4, India hosted the inaugural BRICS asset recovery expert network meeting, where Navin disclosed the aggregate: roughly $25 billion frozen through attachment, about $6.6 billion restituted.
Then, in a single 48-hour window, the sector saw the sharpest concentration of enforcement it has ever seen. On June 15, the Shimla office arrested Masoom Juneja in the ₹500 crore Korvio Coin case, an MLM scheme with more than 2,48,000 investors and transactions above $219 million; the alleged kingpin had reportedly fled to Dubai. The same day, the ED filed a prosecution complaint in the Coinbase phishing case, naming Chirag Tomar and tracing ₹64.55 crore through the MLAT framework.
Two days later, the Bengaluru office searched six premises tied to five crypto payment companies, not under the PMLA but under Section 37 of FEMA. The named firms were Transak, Carretx, Mokshagna Technologies (formerly Xpat and Remit2Any), Buyhatke Internet (Onramp.money), and Abhibha Technologies (Onmeta). The allegation: they had run on-ramp and off-ramp services, converting rupees into USDT and routing the proceeds abroad without RBI authorization.
The ₹6 crore restrained was almost beside the point. As The Crypto Times argued in ED’s ₹2,500 Cr FEMA Probe Opens Regulatory Minefield for India’s VDA Industry, by choosing FEMA the ED asserted a premise never formally tested in India: that unlicensed on-ramp and off-ramp activity is itself an unauthorised cross-border remittance service. If that holds, every VDASP moving fiat-to-crypto value across borders will have to restructure. The market priced it before the courts did. By late June, the local USDT premium jumped from a typical 3-6% band to 8.5%.
July: The Aftershock
The month opened with the RBI telling the Parliamentary Standing Committee on Finance on July 2 that crypto should not be legalized. Its report is due in the monsoon session. The industry has waited five years for it. The ED has not.
On July 7, the ED filed a 3,500-page prosecution complaint against alleged Bengaluru hacker Srikrishna Ramesh, aka Sriki. On July 13, the Mumbai office attached ₹55.50 crore in the ATC Coin fraud, a 2017 case in which roughly ₹84 crore had been collected in the name of a self-created token.
The Chennai raid of July 10 and 11 may be the year’s most operationally significant, even though the headline number, ₹3.35 crore in seized crypto, looked modest. As The Crypto Times noted, the real story was the recovery of seed phrases. A seized hardware wallet without its seed phrase is a locked box. With phrases in hand, the ED can actually move the assets, trace every on-chain hop, and eventually restrain them.
Then came the ₹303 crore Dubai-linked syndicate: 10 arrests, more than 1.6 lakh Tether and 563 Ethereum frozen, and ₹641 crore traced through PYYPL, a UAE fintech platform, with conversions on Binance, GetBit, and Carretx before the money landed in Dubai wallets.
On July 18 and 19, the Bengaluru office turned to a dormant April FIR filed by a Dutch entity. A $10 million complaint became, on the ED’s own reckoning, a $35 million case, roughly ₹337 crore. The accused presented themselves as “Key Opinion Leaders” on Telegram, WhatsApp and Instagram, promising foreign investors discounted early-allocation tokens including MultiversX, Kava, BEAM, GRASS, SUI, VANA, and AGLD.
Every other crypto case this year targeted retail investors through MLM structures. This one targeted foreign investors sophisticated enough to move millions in OTC deals. The con was not technical. It was social, built on the credibility of being a “KOL” in a Telegram group. That is a category of scam the sector has not been forced to reckon with at this scale before.
August: PRAHAAR’s Prediction Turns Into a Case
The most consequential update since we last surveyed the field arrived on August 4, when The Crypto Times reported that Binance had assisted Indian authorities in dismantling a ₹226.54 crore crypto network linked to terror financing. Fourteen individuals have been arrested. Combined traced transaction volume across the accused accounts stood at $23,962,383, and officials estimated that 30% to 40% of the volume involved what they termed “dirty crypto” linked to terror financing, cyber fraud, and organised crime.
The investigation, first announced by the Central Coordination for Excellence in May 2026, has escalated through the year: 9 arrests by mid-May, 12 by early June, 13 by mid-June, and now 14. On May 24, police detained 25-year-old Ghulamali Qureshi of Ahmedabad’s Mirzapur area, who allegedly moved ₹10 crore to ₹15 crore in USDT through a Binance wallet registered in his father’s name.
Two Bhavnagar arrests followed. Binance’s own statement said its assistance was limited to what is permissible under “applicable laws and valid legal process,” and involved transaction retracing across wallets linked to the case.
The importance of this update is not the arrest count. It is the case category. When PRAHAAR was released in February, it warned in the abstract that crypto wallets could become terror-financing infrastructure. Six months later, the ED and state police have a concrete ₹226.54 crore case that fits that prediction almost exactly, with a private-sector exchange helping trace the flow. The doctrine of May 1 has closed its loop.
The Question Nobody Answers: Where Does the Seized Crypto Actually Go?
Every raid headline leaves the same gap. The ED freezes 1.6 lakh USDT here, 8,700 USDT there, ₹3.35 crore in tokens somewhere else. Then what? Who controls the private keys? This is the part almost nobody writes about, and it is where the ED’s operation is most quietly sophisticated.
Step One: Getting the Tokens Off the Suspect’s Wallet
You cannot pick up a crypto wallet and carry it out. You need the key. This is why the Chennai seed-phrase recovery mattered, and why the ED’s release language has become so precise.
In the earlier ₹90 crore E-Nugget case, the agency stated plainly that funds identified in wallets held with Binance, ZebPay and WazirX were “taken into possession and transferred into the crypto wallet of the ED.” That sentence is the whole game. Once tokens move into an ED-controlled address, they stop being an abstraction and become custodied value the agency can eventually liquidate.
Step Two: Who Takes Charge of the Custody
Here is the detail that surprises even people in the industry. The ED does not necessarily hold everything itself. In a first for India’s digital asset sector, the agency appointed a domestic exchange, CoinDCX, to provide secure custody infrastructure for seized crypto, storing and managing confiscated assets under advanced security protocols.
That arrangement is doing a lot of quiet work. It solves the cold-storage and key-management problem the ED is not natively built to handle, it keeps the assets inside a regulated Indian entity, and it gives the agency a professional counterparty when the time comes to liquidate. It also creates an unusual dynamic worth naming: the same industry the ED is policing is now helping the ED safeguard what it seizes.
Step Three: Storage, Then Liquidation, Then Restitution
Until a court finally decides a case, confiscated crypto stays in wallets under government supervision. Liquidation generally requires a court order, and that order can take years. Once assets are sold, the proceeds go back to the victims or into the government’s recovery pipeline. This is where the 2019 PMLA amendment becomes decisive, because it allows interim restitution during trial rather than only after a conviction that might be a decade away.
The PACL order of ₹15,582 crore, the SRS Group return of ₹281.85 crore to 12 homebuyers in June, and the Udaipur homebuyer releases that drew Supreme Court praise are all proof that this pipeline works for property. The open question, and the one the industry should be watching, is when it starts working at scale for tokens.
How Much Crypto Does the ED Actually Hold, and In What?
There is no single official published figure for the total value of cryptocurrency the ED currently holds in custody, and that itself is telling. The agency reports aggregate attachment numbers (₹81,422 crore in FY26, ₹2.36 lakh crore cumulative), but crypto is folded into that total rather than broken out as its own line.
What we can reconstruct from case-by-case disclosures is a portfolio that is large and growing, and that is not denominated in one asset. The BitConnect haul alone was ₹1,646 crore. The OctaFX case saw the ED freeze crypto assets worth around ₹2,385 crore in a single October 2025 action, taking total seizures in that case past ₹2,681 crore.
The ₹303 crore Dubai ring added over 1.6 lakh Tether and 563 Ethereum. The KOL case added 8,700 USDT. The Chennai raid added ₹3.35 crore in mixed tokens. Older cases hold Bitcoin, Litecoin and BCC. In other words, the ED’s crypto custody is spread across Bitcoin, Ethereum, USDT (Tether), Litecoin and a long tail of scam-linked tokens, seized in tranches since roughly 2018 and accelerating sharply through 2025 and 2026.
The absence of a clean, published “total crypto held” number is not an oversight so much as a reflection of how new this is. An agency that has published attachment figures for decades has not yet built a public reporting category for an asset class it only started seizing seven years into a seventy-year life. That gap is itself a story, and one Parliament may eventually force the agency to close.
What It All Adds Up To
Step back, and a shape emerges. India has, without ever passing a comprehensive crypto law, ended up with a working regulatory framework. It came from FIU-IND expanding the registered entity list, from the CBDT wiring exchange data directly into the tax system, from the ED choosing FEMA over PMLA to reset the rules for cross-border stablecoin flows, and from special courts translating attached property and custodied tokens into restitution orders. Ask any compliance officer at an Indian VDASP what the operative rulebook is, and the answer will not be a single statute. It will be that combined ecosystem, with the ED at its centre.
The most under-appreciated shift is that the ED has stopped treating arrests as its primary scorecard. Arrests fell 27% while attachments and chargesheets nearly doubled and restitution more than doubled the target. For the sector, this rewrites the incentives. The fastest way for a platform to see a case against it wind down is not to litigate for a decade. It is to help identify the proceeds so they can be liquidated and returned to burned investors. Cooperation, not attrition, is now the rational strategy.
The second thing to name is the Dubai corridor. Of the ED’s 353 pending MLAT requests as of March 31, 2026, the largest single share, 69, went to the UAE. Every major crypto case this year ended with a wallet or a promoter in the Emirates. If India ever writes a bespoke crypto law, its extradition and asset-recovery provisions toward Dubai will matter more than its tax rates.
What Comes Next
Two things will decide the next stretch. The first is the Parliamentary Standing Committee report on VDAs, due in the monsoon session. If it recommends a bespoke law, the ED’s improvised authority folds back into a formal framework. If it does not, 2027 looks like 2026, with the ED as the effective regulator and FEMA as the effective rulebook.
The second is the Supreme Court’s pending review of the Vijay Madanlal Choudhary judgment, which underpins the ED’s PMLA authority. A 2026 ruling already requires pre-cognisance hearings under the BNSS, another has stopped confiscation while attachment appeals are pending, and Article 22 protections around 24-hour magistrate production have been reinforced. Whatever the Court says will decide how aggressive future crypto attachments can be.
For now, on the last working day of July 2026, the picture is unambiguous. A 70-year-old agency built for cash and gold has taught itself to seize seed phrases, hold Tether and Ethereum through a private exchange custodian, and return the proceeds to victims under a 2019 legal tweak almost nobody in crypto had read.
India has more crypto users than any country on earth, roughly 119 million by the Chainalysis measure, and still no comprehensive law governing them. Into that gap, the ED has stepped, month by month, raid by raid, order by order.
It did not set out to become India’s crypto regulator. It just turned out to be the only institution in the country actually doing regulation. Until Parliament decides otherwise, the industry might as well plan for it.
Also Read: India’s UPI Fees on ₹2,000+ Payments? RBI’s Digital Rupee Stays Free
