Key Takeaways
- • Nine individuals arrested across three Indian states (Gujarat, Maharashtra, Haryana) for operating a sophisticated dark web cryptocurrency syndicate with direct links to Hamas and Houthi rebel financing, representing a significant disruption to transnational terror financing infrastructure.
- • Rs 226 crore (~$27 million USD equivalent) cryptocurrency network dismantled by the CID Cyber Centre of Excellence, with Binance wallets connected to the operation traced to 935 fraud cases, demonstrating the scale of illicit financial activity and operational complexity.
- • Charges include criminal conspiracy, aiding terrorist operations through financial channels, and waging war against a foreign state at peace with India, filed under BNS Sections 111(2)(B), 153, and 61, plus IT Act Sections 66(C) and 66(D), indicating prosecution at the highest severity level for terror financing facilitation.
- • Dark web infrastructure used for narcotics distribution, money laundering, and designated terrorist organization financing, with the network identified through sophisticated cryptocurrency wallet and transaction analysis, revealing how criminal syndicates exploit blockchain opacity for illicit fund flows.
- • One of the arrested individuals is the father of a UK-jail inmate (Salman Ansari), suggesting familial networks may play a role in transnational terror financing operations, raising questions about organizational structure and recruitment patterns within these networks.
Summary
Indian law enforcement has dismantled a major international cryptocurrency syndicate operating across three states with demonstrated operational links to designated terrorist organizations Hamas and Houthi rebels. The Cyber Centre of Excellence (CCoE) under CID Crime announced the arrest of nine individuals on May 19, 2026, following a technical investigation that analyzed cryptocurrency wallets and blockchain transactions to identify the illicit network's operational structure.
The syndicate operated on the dark web with a stated operational scope encompassing narcotics distribution, money laundering, and direct financing of designated international terrorist organizations. The network's asset base reached Rs 226 crore, with Binance cryptocurrency wallets associated with the operation traced to approximately 935 fraud cases. This connection to multiple fraud vectors suggests the network leveraged cryptocurrency infrastructure for both terror financing and broader financial crimes, indicating integrated operational capability across multiple illicit domains.
The nine arrested individuals include seven from Ahmedabad (Gujarat), one from Mumbai (Maharashtra), and one from Karnal (Haryana). Named suspects include Mohsin Sadiq Mohamed Molani Chhipa, Ejaz Aslamkhan Pathan, Mohammedzaid Abdulkaderbhai Siddi, Naved Ayubkhan Pathan, Faizahmed Nassaruddin Chishti, Salmankhan Habibkhan Pathan, Gulam Sadiq Ibadullah Ansari, Zeeshan Siraj Motiwala, and Lovepreet Darshansingh Madharu. Notably, Gulam Sadiq Ibadullah Ansari is identified as the father of Salman Ansari, a UK-based inmate, potentially indicating organized familial involvement in transnational terror financing networks.
All nine accused face charges under BNS Sections 111(2)(B) (criminal conspiracy), 153 (waging war against foreign state at peace with India), and 61 (aiding terrorist operations through financial channels), along with IT Act Sections 66(C) and 66(D). The severity of charges reflects law enforcement's assessment that the network constituted a direct threat to national security through formalized financial support for designated terrorist entities. The investigation's reliance on blockchain transaction analysis and cryptocurrency wallet forensics underscores the increasingly sophisticated technical capacity of Indian law enforcement to penetrate dark web financial infrastructure previously considered resistant to state-level investigation.
The syndicate operated on the dark web with a stated operational scope encompassing narcotics distribution, money laundering, and direct financing of designated international terrorist organizations. The network's asset base reached Rs 226 crore, with Binance cryptocurrency wallets associated with the operation traced to approximately 935 fraud cases. This connection to multiple fraud vectors suggests the network leveraged cryptocurrency infrastructure for both terror financing and broader financial crimes, indicating integrated operational capability across multiple illicit domains.
The nine arrested individuals include seven from Ahmedabad (Gujarat), one from Mumbai (Maharashtra), and one from Karnal (Haryana). Named suspects include Mohsin Sadiq Mohamed Molani Chhipa, Ejaz Aslamkhan Pathan, Mohammedzaid Abdulkaderbhai Siddi, Naved Ayubkhan Pathan, Faizahmed Nassaruddin Chishti, Salmankhan Habibkhan Pathan, Gulam Sadiq Ibadullah Ansari, Zeeshan Siraj Motiwala, and Lovepreet Darshansingh Madharu. Notably, Gulam Sadiq Ibadullah Ansari is identified as the father of Salman Ansari, a UK-based inmate, potentially indicating organized familial involvement in transnational terror financing networks.
All nine accused face charges under BNS Sections 111(2)(B) (criminal conspiracy), 153 (waging war against foreign state at peace with India), and 61 (aiding terrorist operations through financial channels), along with IT Act Sections 66(C) and 66(D). The severity of charges reflects law enforcement's assessment that the network constituted a direct threat to national security through formalized financial support for designated terrorist entities. The investigation's reliance on blockchain transaction analysis and cryptocurrency wallet forensics underscores the increasingly sophisticated technical capacity of Indian law enforcement to penetrate dark web financial infrastructure previously considered resistant to state-level investigation.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.