A joint operation by the Cyber Centre of Excellence (CCoE) and CID Crime teams of Gujarat Police has uncovered an international cryptocurrency and terror funding network worth nearly ₹226 crore. According to investigators, the group was not only involved in financial crimes but was also connected to drug trafficking, human trafficking, gold smuggling and funding activities linked to global terror groups, including networks affecting India.
The operation began during continuous monitoring of the dark web by the technical team of the Cyber Centre of Excellence. During blockchain analysis, investigators noticed an Indian IP address receiving digital funds directly from “artemislabs.cc” (Artemis Lab), which agencies identified as a major illegal drug marketplace operating on the dark web.
After tracing the transactions and crypto links, investigators reached Ahmedabad’s Danilimda area. The suspicious crypto wallet was found to belong to Mohsin Sadiq Mulani, a resident of Ahmedabad. Further checking of his digital activities and transaction history exposed nine more linked wallets spread across different parts of India.
The operation lasted nearly four-and-a-half months and was carried out under the supervision of Gujarat DGP Dr. K. Lakshmi Narayana Rao and DIG Bipin Ahir. Gujarat Police formed 10 field teams and three technical intelligence units, led by Cyber Centre SP Dr. Rajdeepsinh Jhala along with officers Sanjay Keshwala and Vivek Bheda, to track the network and arrest those involved.
The investigation reveals Hamas connection
One of the biggest findings during the investigation was the link between the crypto wallets and Hamas, the Gaza-based militant group.
Police said the seized crypto accounts were connected to financial channels linked with Hamas and an organisation identified as “Al-Qahira.” Investigators found that some of the crypto accounts under the scanner had already been blacklisted by Israel in 2025 through court orders. Those accounts were suspected of sending funds to Hamas through Turkey.
The investigation found that money from the same banned accounts was reaching wallets connected to the main accused, Mohammad Zubair Popatia, who is currently believed to be staying in Dubai.
As investigators followed the money trail further, they found that Zubair’s wallets had transactions linked to other globally blacklisted networks as well. These included Yemen’s Houthi militants (Ansar Allah), Iran’s Islamic Revolutionary Guard Corps Quds Force (IRGC-QF) and Garantex, a banned Russian cryptocurrency exchange.
Police said Zubair allegedly moved these funds into India, layered the transactions across several wallets and later converted them into cash through local hawala channels.
Use of Monero and hidden crypto transactions
Investigators said the syndicate avoided using common cryptocurrencies and instead relied heavily on Monero, a privacy-focused cryptocurrency known for hiding transaction details. Unlike many regular cryptocurrencies, where transfers can often be tracked, Monero hides information related to senders, receivers and transaction amounts.
Police seized two special Monero privacy wallets during the operation. Initial examination reportedly showed suspicious transactions worth more than ₹193 crore, which investigators believe may have been misused. Officials said this made tracking the money trail more difficult and helped the network stay hidden for a long time.
Nearly 40% money came from ‘Dirty Crypto’
Senior cybercrime officials said around 30-40% of the total ₹226 crore turnover came from what investigators called “dirty crypto” money linked to drug trade, smuggling activities and terror funding.
The remaining money was moved into the system through peer-to-peer (P2P) trading, futures trading and traditional cash movement channels such as hawala and Gujarat’s angadiya network. Police also found that the group was involved in online fraud and cyber scams targeting ordinary people.
Investigators discovered that bank accounts used by the accused to convert cryptocurrency into cash were linked to 935 cyber fraud FIRs registered on the National Cyber Crime Reporting Portal (NCCRP). Officials said this indicated that money stolen through cyber frauds was also being mixed into the larger international network linked with drugs and terror financing.
The entire network started after covid
According to the investigation, the foundation of this network was laid during the period after Covid-19 pandemic. Police said Mohammad Zubair Popatia, Salman Ansari and Mohsin Mulani came together while they were in India and planned to enter the UK drug market using cryptocurrency payments and the USDT stablecoin.
Over time, the trio reportedly built a network stretching from Ahmedabad and Mumbai to Dubai and London.
Investigators said Mohsin Mulani handled drug orders from British customers through encrypted Telegram channels and dark web forums while operating from Ahmedabad. The order details were then passed to Dubai-based kingpin Zubair Popatia and Salman Ansari, who managed logistics in the UK.
Drugs were reportedly delivered to customers through courier systems and Royal Parcel Services in the UK, while payments were collected through crypto wallets.
Salman Ansari continued running a network from UK jail
Another major revelation was linked to Salman Ansari. According to investigators, a British court sentenced him to six years in prison in October 2024 in a drug smuggling and money laundering case. However, Gujarat Police said digital evidence and intelligence reports show that Ansari continued running the international network from inside a high-security prison in the UK until March 2026.
Investigators claim he remained active through Telegram and other communication methods while coordinating operations. Police also found that money earned from the UK drug market was brought to India through international hawala channels and Gujarat’s traditional angadiya network.
This cash was reportedly received by Mohsin Mulani in Ahmedabad and later handed over to Ghulam Sadiq Ansari, Salman’s father. Investigators described Ghulam Sadiq as the local “cash anchor” for the syndicate. Police said he invested the money into properties and legitimate businesses to hide its source.
Older foreign funding routes also under investigation
The Cyber Centre of Excellence also found that before the rise of cryptocurrency use, the accused were allegedly receiving money from abroad through Money Transfer Service Scheme (MTSS) platforms such as Western Union. Police are now examining transactions from 2016 to 2021.
Investigators have identified transfers worth more than ₹80 lakh coming from nearly nine countries, and this financial trail is still under investigation.
A total of 9 accused arrested, main kingpin in Dubai
So far, Gujarat Police have arrested nine accused in the operation. Those arrested include Ahmedabad residents Mohammad Sadiq Mulani, Aijaz Aslam Khan Pathan, Mohammad Zaid Siddiqui, Naved Ayub Khan Pathan, Faiz Ahmed Chishti, Salman Habib Khan Pathan and Ghulam Sadiq Ansari.
Apart from them, Zeeshan Siraj Motiwala from Mumbai and Lovepreet Singh from Karnal, Haryana, have also been arrested. Police have registered cases under Sections 111 (Organised Crime), 153 and 61 of the IPC, along with serious provisions of the Information Technology Act, 2008, citing threats to national security and links to terror conspiracy activities.
Meanwhile, authorities have started the extradition process to bring the main accused Mohammad Zubair Popatia back to India from Dubai. Police and central agencies are also moving ahead with legal steps to seize luxury properties, benami assets and bank accounts linked to the network. Investigators believe more arrests may happen in the coming days as the probe expands further.
