Gujarat CID Busts Alleged International Crypto-Terror Network Linked to Dark Web Drug Trade and Hawala Operations
In a major cybercrime crackdown, the Cyber Centre of Excellence (CCoE) of the Gujarat CID Crime claimed to have uncovered a sprawling international financial network allegedly involved in terror financing, narcotics trafficking and cryptocurrency-based money laundering.
Officials said the operation led to the arrest of nine accused persons believed to be part of a sophisticated syndicate operating across India and abroad.
According to investigators, the network functioned through encrypted digital channels and dark web platforms, using cryptocurrency transactions to hide the movement of illegal funds.
The CCoE said its technical team tracked suspicious crypto wallets and analyzed complex transaction trails before exposing what it described as a highly organized financial structure connected to global criminal operations.
Police alleged that the syndicate was engaged in multiple illegal activities, including facilitating narcotics distribution on the dark web, laundering proceeds generated through cyber fraud, and routing funds to entities linked with international terror organizations.
Officials added that the accused used advanced digital methods and anonymous cryptocurrencies to avoid detection by law enforcement agencies.
The nine accused arrested in the case have been booked under serious provisions of the Bharatiya Nyaya Sanhita (BNS) related to criminal conspiracy, terror financing and offences against national security, along with sections of the Information Technology Act dealing with cyber fraud and identity theft.
The accused have been identified as Mohsin Sadiq Mohamed Molani Chhipa, Ejaz Aslamkhan Pathan, Mohammedzaid Abdulkaderbhai Siddi, Naved Ayubkhan Pathan, Faizahmed Nassaruddin Chishti, Salmankhan Habibkhan Pathan and Gulam Sadiq Ibadullah Ansari from Ahmedabad, Gujarat, along with Zeeshan Siraj Motiwala from Mumbai and Lovepreet Darshansingh Madharu from Haryana’s Karnal district.
The investigation reportedly began after authorities traced illegal transactions linked to a dark web narcotics marketplace to a cryptocurrency wallet allegedly owned by Mohsin Molani, a resident of Ahmedabad.
Once investigators began examining his digital financial activity, they uncovered a web of interconnected transactions involving several other suspicious crypto users spread across different states.
Officials said the accused heavily relied on privacy-focused cryptocurrencies such as Monero, which is often difficult to trace and is widely known for being used in dark web transactions and illegal financial networks.
Investigators estimate that cryptocurrency transactions worth nearly Rs 2 crore were routed through these anonymous channels.
One of the biggest breakthroughs in the investigation came when officials allegedly discovered links between one of the accused and cryptocurrency wallets previously flagged by Israel’s National Bureau for Counter Terror Financing (NBCTF).
According to the CCoE, a wallet linked to accused Mohammed Zuber Mohammedhussein Popatiya had earlier been frozen by Israeli authorities in 2025 over suspected terror financing activities.
Investigators further claimed that this wallet maintained direct transactional links with the “Dubai Company for Exchange,” which authorities alleged was being used as a front by the Palestinian militant group Hamas.
The probe also uncovered alleged financial transactions involving entities sanctioned by the United States Office of Foreign Assets Control (OFAC).
Officials claimed funds were transferred into the syndicate’s wallets from groups and networks associated with Yemen’s Houthi rebels, Iran’s IRGC-QF,
Russia-based sanctioned crypto exchange Garantex and financial clusters allegedly linked to Moldovan oligarch Ilan Shor.
According to investigators, the accused allegedly converted illegally obtained digital assets into stable cryptocurrencies such as USDT after layering transactions across multiple wallets to hide their origin.
Officials said these funds were then moved through international criminal channels operating across different countries.
The CCoE also alleged that interrogations and digital evidence pointed towards a large-scale narcotics trafficking network operating in the United Kingdom since 2023.
Investigators claimed that Mohsin Molani used Telegram groups and encrypted communication channels to receive drug orders, which were then allegedly routed to Dubai-based accused Mohammed Zuber Popatiya for supply through a UK-based distribution network.
Another key accused in the investigation is said to be Salman Gulamali Ansari, who was sentenced to six years in prison in the United Kingdom in October 2024.
Despite being lodged in a UK jail, investigators alleged that Salman continued to oversee portions of the drug and financial network remotely from prison.
Officials further claimed that the proceeds generated through narcotics trafficking and cybercrime were funnelled back into India using traditional Angadia and Hawala channels.
According to the investigation, Mohsin Molani allegedly collected the money in India and handed it over to Gulam Sadiq Ibadullah Ansari, the father of Salman Ansari.
In another significant revelation, investigators cross-checked the accused persons’ cryptocurrency-linked bank accounts with records available on the National Cyber Crime Reporting Portal (NCCRP).
Authorities claimed these accounts were connected to as many as 935 cyber fraud complaints across the country, involving money allegedly stolen from unsuspecting victims through digital scams, phishing operations and identity theft.
