ED Busts ₹400 Crore Crypto Laundering Ring in Chennai

On 30 October 2026, the Enforcement Directorate's Chennai office arrested two men it accuses of running one of the largest online-fraud laundering networks uncovered in India this year. The agency says the network cheated more than 600 victims across the country of over ₹400 crore, then moved the money through a web of mule bank accounts and converted a large part of it into cryptocurrency, mainly USDT. The case is a useful one to understand in detail — not because of the headline number, but because it shows, step by step, how a modern Indian crypto-fraud network actually works: the lure, the collection, the layering, and the exit into digital assets.

> Educational content only. This is not financial advice. Crypto markets are volatile — never invest money you can't afford to lose. This guide explains a reported enforcement case and the fraud techniques the agency alleges; it does not predict prices and does not recommend any coin, trade or investment.

What the ED Says Happened

The Enforcement Directorate (ED), Chennai Zonal Office-II, arrested Roshan Fiaz of Chennai and Ammar of Pudukottai on 30 October 2026 under the Prevention of Money Laundering Act (PMLA), 2002. The arrests were reported publicly on 5–6 November 2026 by The Hindu, The Times of India and other outlets, based on an ED press release.

The investigation began with two first information reports (FIRs): one registered by the State Cyber Crime Command Centre of the Tamil Nadu Police and another by the Cyber Crime Police Station, Cyberabad, in Telangana. The cases were filed under provisions of the Bharatiya Nyaya Sanhita (BNS) 2023, the Indian Penal Code and the Information Technology Act.

Here are the key figures the ED has put on record, all of which the agency presents as allegations at the investigation stage:

Fact (as alleged by the ED)	Detail
Arrests	Roshan Fiaz and Ammar, arrested 30 October 2026 under PMLA
Complaints linked to the network	More than 600 cybercrime complaints across India
Estimated proceeds of crime	Over ₹400 crore
Bank accounts allegedly controlled by Fiaz	31 accounts, in his name, his wife's name and the names of firms and entities he controlled
Transactions through those 31 accounts	Debit and credit entries exceeding ₹300 crore
Cash seized in earlier searches	₹14.5 lakh
Cryptocurrency seized	Worth about ₹3.26 crore
Bank balances frozen	₹88.28 lakh across multiple accounts
Custody	Produced before a Special PMLA Court in Chennai; remanded to 14 days of judicial custody

It is important to be precise about what these numbers mean. The ₹400 crore figure is the ED's estimate of the proceeds of crime — the total the agency believes the network collected from victims. The ₹300 crore-plus figure is the volume of transactions the agency says it found in 31 accounts, which is a measure of money moving through those accounts rather than a separate sum of losses. And the seizures — ₹14.5 lakh in cash, about ₹3.26 crore in cryptocurrency and ₹88.28 lakh frozen — are what investigators say they have actually recovered or frozen so far, which is a small fraction of the alleged total. That gap is normal in laundering cases: most of the money has already been moved on, spent or converted, and recovery is a long process.

How the Scheme Allegedly Worked, Step by Step

According to the ED, the network followed a pattern that will be familiar to anyone who has followed Indian cyber-fraud cases — but with a crypto exit that made the money much harder to follow.

Step 1: The lure. The accused allegedly contacted victims through social media platforms and drew them in with offers of investment schemes, jobs, share-market investments and other online earning opportunities. The Times of India reported that victims were made to pay large sums on the pretext of these schemes. This is the classic entry point: a message or call that promises returns, employment or quick profits, aimed at people who are looking for extra income.

Step 2: The collection. Victims were directed to pay into bank accounts controlled by the network — the mule accounts. These were not the accused's own single account, but a spread of accounts held in different names, which made the inflow harder to spot as one operation.

Step 3: The split. The deposits were then broken down into smaller amounts and moved through a network of further mule accounts. This is called layering: each hop makes the trail longer and the original source harder to prove. The ED says the two men, in connivance with their associates, "orchestrated and devised the modus operandi of diversion and layering" of the proceeds through this web of accounts.

Step 4: The exit. From the mule accounts, the money allegedly went in two directions. Some was withdrawn as cash. A substantial portion, according to the agency, was converted into cryptocurrency — specifically USDT, the dollar-pegged stablecoin — and moved into crypto wallets. That conversion is the point at which the money leaves the banking system, where it can be tracked through account statements, and enters a system where it moves between wallets instead.

Step 5: The supply chain. The ED alleges that Ammar's role was to supply the raw material of the operation: mule accounts belonging to various individuals and entities, along with "account kits" containing net-banking credentials, SIM cards, mobile phones and email IDs. These kits were used, the agency says, to receive rupees from crypto buyers — in other words, to complete the loop in which crypto was sold and the proceeds came back as rupees into accounts the network controlled.

Mule Accounts, Explained

The mule account is the single most important concept in this case, and the one most worth understanding. A mule account is a bank account used to receive and pass along money from crime. The account holder may be a knowing participant, or may have been recruited with a promise of easy money for "renting" their account, or may not fully understand what the account is being used for.

Mule accounts matter to fraud networks for a simple reason: they create distance. If victims pay directly into the fraudster's own account, the trail is short and the account is quickly frozen. If the money passes through dozens of accounts held in other people's names, each hop adds time, paperwork and jurisdictional complexity for investigators. The ED's allegation that Fiaz controlled 31 accounts — in his own name, his wife's name and the names of firms and entities — shows the scale at which this distancing operates.

For ordinary Indians, the lesson is direct and serious. Lending your bank account to someone else, or handing over your net-banking credentials, SIM card, phone or email access, can put you inside a money-laundering investigation even if you never spoke to a victim and never saw the fraud itself. Your name is on the account, your credentials moved the money, and that is what investigators will see first. Enforcement agencies have repeatedly warned against this, and this case is a concrete illustration of why: the people who supplied the accounts are now accused alongside the people who ran the scheme.

There is also a practical banking consequence. Accounts used in this way are routinely frozen, and getting them unfrozen can take months or years while the investigation runs. For someone who lent an account for a small payment, the cost can be far larger than the payment itself.

Why USDT? The Crypto Part of the Story

A natural question is why a laundering network would choose USDT, a stablecoin designed to track the US dollar, rather than cash or another asset. The answer is a mix of properties that make stablecoins useful for moving value — and the same properties are why they are also used legitimately by millions of people.

USDT is fast to move, works across borders without a bank, and holds a roughly stable value, so a sum converted into USDT does not swing wildly in price while it is being moved. For someone trying to move illicit funds, that combination is attractive: the money can leave the banking system, cross borders, and be converted back into rupees elsewhere, all without a single bank transfer.

But it is a mistake to think crypto makes money invisible. Every USDT transfer is recorded on a public blockchain, and exchanges that convert crypto into rupees keep records of who they dealt with. That is why investigators in this case were able to describe the flow at all, and why the ED's seizures included cryptocurrency worth about ₹3.26 crore. The blockchain is a permanent record; it is the identity layer — which wallet belongs to whom — that investigators have to establish through exchanges, devices and bank records.

This is also why the ED's description of the network matters: the crypto conversion was only one stage. The money entered through bank accounts, was layered through bank accounts, and came back as rupees through bank accounts. The crypto stage was the middle of the chain, not the whole chain, and it depended on the mule-account infrastructure at both ends.

What PMLA and the ED Actually Do

The Prevention of Money Laundering Act, 2002, is the law under which the two men were arrested. PMLA is aimed at the laundering of criminal proceeds — not at the underlying fraud itself, which is dealt with under the BNS, the IPC and the IT Act through the original FIRs. The ED investigates the money trail: how proceeds of crime were generated, layered and used.

A few distinctions are worth keeping straight. An arrest under PMLA is not a conviction. The accused were produced before a Special PMLA Court in Chennai and remanded to 14 days of judicial custody, which means the court has allowed the agency to keep them in custody while the investigation continues. Whether charges are ultimately framed, and whether a court finds them guilty, will be decided later, on the basis of evidence. Until then, everything the ED has said about the network is an allegation — serious, detailed and backed by the seizures the agency reports, but still an allegation.

The ED's search powers under Section 17 of PMLA are what produced the seizures in this case: ₹14.5 lakh in cash and cryptocurrency worth about ₹3.26 crore seized, and ₹88.28 lakh frozen in bank accounts. Freezing is a precautionary step — it stops the money moving while the investigation establishes whether it is proceeds of crime.

How This Case Differs From the Other Recent ED Cases

This is not the first ED crypto case covered on this site, and the differences are worth noting, because each case illustrates a different part of the same enforcement picture.

The ED searches of 27 October 2026 in Bengaluru and Madhya Pradesh, covered in our guide to the ED crypto searches and FEMA rules, concerned alleged unauthorised foreign-platform balances and FEMA contraventions — a regulatory and cross-border question involving exchanges and payment firms. The Chennai case is different: it is about an alleged domestic fraud network that used crypto as an exit for the proceeds of online scams.

The Korvio Coin case, covered in our guide to the ED's Korvio raids, involved an alleged Ponzi-style MLM coin operation in Punjab, with an estimated ₹500 crore in losses and an arrest in Chandigarh, Mohali and Zirakpur. The Chennai case is a different network, a different region and a different method — investment and job lures rather than a promoted coin.

The Andhra Pradesh CID case from Tenali, covered in our guide to the ₹15 crore fraud, involved a single victim, 27 traced transactions and a court order returning frozen assets to the victim. The Chennai case is far larger in scale, involves hundreds of victims, and is an ED/PMLA investigation rather than a state CID case.

The common thread is that Indian enforcement agencies are now routinely following crypto trails in fraud cases — and that the trail almost always runs through ordinary bank accounts first.

Warning Signs: How to Spot This Kind of Fraud

The Chennai case is a catalogue of red flags. Any one of these, on its own, should make you stop and check before sending money:

• Guaranteed or unusually high returns. No genuine investment guarantees profits, and no legitimate scheme pays far above market rates without risk. A promise of fixed, high returns is the oldest fraud signal there is.
• Pressure and urgency. "Offer ends today", "only a few slots left", "send now or lose the opportunity" — pressure is a tool to stop you thinking and checking.
• Job offers that ask you to pay. A genuine employer does not ask you to pay a fee, deposit money, or buy equipment before you start. If a "job" involves receiving money and forwarding it, you are being recruited as a money mule.
• Payment to a stranger's personal account. If an investment platform asks you to pay into a personal bank account, a UPI ID belonging to an individual, or a crypto wallet — rather than a verifiable company account — that is a strong warning sign.
• Communication only through social media or chat apps. Genuine businesses have verifiable addresses, websites, registration details and customer support. A scheme that exists only in a Telegram or WhatsApp chat is easy to abandon overnight.
• Requests to lend your account or credentials. Anyone who asks to use your bank account, UPI, net-banking login, SIM card or phone for their transactions is asking you to take on their legal risk. The answer should always be no.
• Returns paid from new investors. If "profits" arrive only when new people join, or when you recruit others, the structure depends on fresh money rather than any real business.

What To Do If You Are Targeted

If you think you have been contacted by a scheme like the one alleged in Chennai, the steps are simple and worth following in order:

1. Stop sending money. Do not send a further payment to "unlock" a withdrawal, pay a fee, or recover what you have already lost. That is how losses grow.
2. Save everything. Keep screenshots of messages, profiles, payment receipts, UPI transaction IDs, bank statements and wallet addresses. These are the evidence investigators will need.
3. Report it. Call the National Cyber Crime helpline on 1930 or file a complaint at cybercrime.gov.in. Early reporting matters: the faster a complaint is filed, the better the chance that a receiving account can be frozen before the money moves on.
4. Tell your bank. If you have sent money, inform your bank immediately and ask what can be done. If someone has used your account, tell the bank that too — it is far better that the bank hears it from you than discovers it in an investigation.
5. Do not try to recover it yourself. Anyone who contacts you offering to recover lost funds for a fee is very likely running a second fraud on top of the first.

The Bottom Line

The ED's Chennai case, as alleged, is a complete picture of a modern Indian crypto-fraud network: social-media lures promising investments and jobs, hundreds of victims, more than ₹400 crore collected, 31 mule accounts carrying over ₹300 crore in transactions, and a USDT exit that moved the money out of the banking system. The arrests on 30 October 2026 and the seizures that followed are the visible end of an investigation that began with two FIRs from state cybercrime police.

For Indian users, the practical lesson is not about crypto at all. It is about bank accounts. The network could not have worked without mule accounts and banking kits, and the people who supplied them are now accused alongside the people who ran the scheme. Never lend your account, never hand over your credentials, and treat any offer of guaranteed returns or paid "forwarding" work as a fraud until proven otherwise. The technology changes; the pattern does not.

Keep Learning

• 7 Common Crypto Scams Targeting Indians
• ED Crypto Searches in India: FEMA Rules Explained Simply
• AP CID Busts ₹15 Crore Crypto Fraud: Tenali Case Explained