Authorities across Africa arrested more than 1,200 suspects and seized nearly $100 million in a sweeping cybercrime operation that dismantled online fraud networks and illegal crypto mining operations, INTERPOL announced on Aug. 22.

The three-month crackdown, known as Operation Serengeti 2.0, targeted nearly 88,000 victims across 18 African nations in collaboration with the UK.

Investigators uncovered 11,432 malicious infrastructures tied to ransomware, business email compromise schemes, and online investment fraud.

Major seizures and arrests

In Angola, police shut down 25 crypto mining centers operated by 60 Chinese nationals who were illegally validating blockchain transactions. Authorities also confiscated 45 illicit power stations used to fuel the operation, as well as mining and IT equipment valued at more than $37 million.

Officials said the seized power assets will be redirected to bolster the electricity supply in vulnerable areas.

Meanwhile, Zambian authorities dismantled one of the region’s largest online investment fraud schemes, where scammers persuaded more than 65,000 people to invest in crypto platforms with promises of high returns.

Losses were estimated at $300 million. Police arrested 15 suspects, seized forged documents, and shut down bank accounts tied to the scheme.

In a separate raid, officers and immigration officials disrupted a human trafficking ring and confiscated 372 counterfeit passports.

Meanwhile, in Côte d’Ivoire, investigators dismantled a transnational inheritance scam traced back to Germany. Victims were tricked into paying upfront fees to claim fabricated estates. Authorities arrested the lead suspect and seized cash, electronics, vehicles and jewelry, estimating losses at $1.6 million.

Training, prevention and international support

The crackdown followed months of intelligence sharing between INTERPOL and private-sector partners, who provided data on suspicious domains, IP addresses, and command-and-control servers.

Ahead of the operation, officers underwent training workshops on crypto tracking, open-source intelligence, and ransomware analysis. INTERPOL officials said the operation reflects a growing global push to tackle cybercrime through coordinated enforcement and prevention.

A new partnership with the International Cyber Offender Prevention Network, involving 36 countries, aims to identify threats before they escalate into criminal activity.

Funded by the UK’s Foreign, Commonwealth, and Development Office, the effort brought together operational partners including Group-IB, Kaspersky, Trend Micro, TRM Labs, and Fortinet.

Authorities said more investigations are underway, particularly into the international financial and criminal networks behind the fraud schemes.

The US has seized servers, domain names, and around $1 million in crypto assets from the ransomware group BlackSuit.

The Justice Department said on Monday that multiple US and international law enforcement agencies conducted an operation against the BlackSuit ransomware groups in late July.

The operation included the unsealing of a warrant for the seizure of cryptocurrency valued at just over $1 million, at the time of the seizure, it reported. 

“Disrupting ransomware infrastructure is not only about taking down servers, it’s about dismantling the entire ecosystem that enables cybercriminals to operate with impunity,” added Michael Prado, Deputy Assistant Director at the Homeland Security Investigations Cyber Crimes Center.

Blacksuit is a spinoff of the Royal ransomware gang and has operated since at least 2023, with the latest seizure coming amid other actions the US has taken against ransomware groups, such as sanctioning the ransomware hosting provider Aeza Group in July.

The Justice Department said the takedown was led by the US Department of Homeland Security’s Homeland Security Investigations with help from the Secret Service, the IRS and the FBI, along with law enforcement from the UK, Germany, Ireland, France, Canada, Ukraine, and Lithuania.

Coordinated ransomware attacks 

The Justice Department said the ransomware group persistently targeted critical infrastructure across sectors, including healthcare, government facilities, manufacturing, and commercial facilities. Victims are typically forced to pay ransoms in Bitcoin (BTC) through darknet websites.

Since 2022, BlackSuit has compromised over 450 known victims in the US and has received more than $370 million in ransom payments, it added.

The ransomware schemes used double-extortion tactics such as encrypting victims’ systems while threatening to leak stolen data to further coerce payment, the DOJ stated. 

“The BlackSuit ransomware gang’s persistent targeting of US critical infrastructure represents a serious threat to US public safety,” said Assistant Attorney General for National Security John Eisenberg.

Bitcoin ransom seized 

In 2023, a victim paid a ransom of 49.3 BTC, worth around $1.4 million at the time, to decrypt their data. 

A portion of the ransom payment, the seized $1 million, was repeatedly deposited and withdrawn from a crypto exchange account until the funds were frozen by the exchange in early 2024, it reported, though it did not name the exchange. 

Related: US sanctions crypto wallet tied to ransomware, infostealer host

Ransom demands have typically ranged from approximately $1 million to $10 million in BTC, and the largest ransom demanded by BlackSuit actors was $60 million, according to the Cybersecurity and Infrastructure Security Agency.

Crypto ransomware successors crop up

In July, the Dallas, Texas, FBI announced the seizure of 20 BTC valued at around $2.4 million from a cryptocurrency address belonging to a prominent member of the Chaos ransomware group.

Last week, analysts at TRM Labs investigated how a new ransomware group called Embargo may have emerged as a successor operation to BlackCat, which launders proceeds through crypto accounts. Approximately $18.8 million worth remains dormant in unattributed wallets, it revealed. 

Magazine: Scottie Pippen says Michael Saylor warned him about Satoshi chatter

]]> https://earlybirdsinvest.com/us-takes-down-sites-seizes-1m-from-crypto-ransomware-gang-blacksuit/feed/ 0 52931 https://earlybirdsinvest.com/indias-cbi-cracks-crypto-scam-seizes-327000-in-fraud-raid/ https://earlybirdsinvest.com/indias-cbi-cracks-crypto-scam-seizes-327000-in-fraud-raid/#respond Wed, 11 Jun 2025 21:45:34 +0000 https://earlybirdsinvest.com/indias-cbi-cracks-crypto-scam-seizes-327000-in-fraud-raid/

India’s top investigative agency has arrested a man in New Delhi and seized around ₹2.8 crore (about $327,000) in cryptocurrency.

According to a June 11 press release by the Central Bureau of Investigation (CBI), the arrest took place during searches at three locations on June 10, all of which were linked to an online fraud ring targeting individuals in the US and Canada.

The suspect, Rahul Arora, is accused of helping run a scam that tricked people by pretending to be government or tech support workers.

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe – We publish new crypto explainer videos every week!

What is Shiba Inu Coin? (Explained with Animations)

During the raids, officials found tools used to fake caller ID, devices meant for international calls, software for collecting personal information, and recordings of phone conversations. The team also recovered ₹22 lakh (about $26,400) in cash that had not been declared.

The CBI stated in a press note that these searches were based on solid leads and that they had discovered evidence of a group involved in cyber fraud across countries.

The raids were part of a campaign called Chakra-V, which brings together Indian state cyber units, the Indian Cyber Crime Coordination Centre (I4C), and international groups like Interpol and the FBI. The campaign focuses on finding digital clues, blocking illegal use of cryptocurrencies, and monitoring criminal activity on the dark web.

Officials said they have also made arrangements to store and manage the seized crypto in line with Indian laws. The rules require the assets to be handled while the legal process continues.

On June 9, authorities in Queensland, Australia, arrested four suspects linked to a crypto-related laundering scheme. How did the case unfold? Read the full story.

Having completed a Master’s degree in Economics, Politics, and Cultures of the East Asia region, Aaron has written scientific papers analyzing the differences between Western and Collective forms of capitalism in the post-World War II era.
With close to a decade of experience in the FinTech industry, Aaron understands all of the biggest issues and struggles that crypto enthusiasts face. He’s a passionate analyst who is concerned with data-driven and fact-based content, as well as that which speaks to both Web3 natives and industry newcomers.
Aaron is the go-to person for everything and anything related to digital currencies. With a huge passion for blockchain & Web3 education, Aaron strives to transform the space as we know it, and make it more approachable to complete beginners.
Aaron has been quoted by multiple established outlets, and is a published author himself. Even during his free time, he enjoys researching the market trends, and looking for the next supernova.

---

Officials of Thailand’s Central Investigation Bureau (CIB) seized 63 illegal crypto mining machines on Friday, according to a report by The Nation. The illegal crypto mining rigs, worth around 2 million baht ($60,000), were found in three abandoned houses in the Pathum Thani province.

Officials conducted a raid after locals of the region complained about unidentified individuals stealing electricity from the region’s utility poles and transformers. The locals suspected that the stolen electricity was being used for cryptocurrency mining operations hidden in abandoned buildings.

Crypto mining requires massive amounts of electricity. Authorities estimate that the illicit mining rigs caused losses worth over 11 million baht (over $327 million) to the Metropolitan Electricity Authority.

The illegal mining rigs were controlled remotely

Police officials said that along with the mining rigs, they also confiscated three crypto mining controllers, three routers, three internet signal boosters, three modified electricity metres, a desktop computer, a laptop computer, and two bank passbooks. No arrests were made as the mining operations were being controlled remotely.

Officials found evidence, however, that the illicit operation had ties to a luxury house in Ram-Indra Soi 65 in Bangkok’s Khan Na Yao district. The CIB officials have requested a search warrant to raid the linked residence and locate the ring leader and other accomplices.

Authorities noted that besides causing damages to the electricity department, the illegal mining rigs also posed a major fire hazard. This is because the operations utilized high amounts of power but had no human monitoring.

Thailand has been plagued with illegal mining operations

Bitcoin miners are treated as manufacturers in Thailand and are subject to associated taxes. However, illegal crypto mining has been a rampant problem across Thailand and Southeast Asia for years.

In a raid conducted in January, authorities seized 996 illegal Bitcoin (BTC) mining rigs from the Phanat Nikhom district in Thailand.

In November 2024, authorities shut down nine illegal Bitcoin mining farms in the Surat Thani province. The farms were estimated to have stolen electricity worth nearly $300,000.

Similarly, in August, authorities raided a town west of Bangkok and found evidence of illegal crypto mining after locals complained about power outages.

U.S. authorities have seized over $23 million in cryptocurrency linked to the theft of $150 million from a Ripple crypto wallet in January 2024. Investigators believe hackers who breached LastPass in 2022 were behind the attack.

Despite the threat actors’ efforts, law enforcement agents traced $23,604,815.09 of the stolen digital assets between June 2024 and February 2025 to the following cryptocurrency exchanges: OKX, Payward Interactive, Inc. (dba Kraken), WhiteBIT, AscendEX Technology SRL, Ftrader Ltd (dba FixedFloat), SwapSpace LLC, and Rabbit Finance LLC (dba CoinRabbit).

A forfeiture complaint unsealed by the U.S. Justice Department yesterday and first spotted by crypto fraud investigator ZachXBT reveals that U.S. Secret Service agents who interviewed the victim believe the attackers could have only stolen the cryptocurrency using private keys extracted by cracking the victim’s password vault stolen in a 2022 breach of an online password manager.

They found that the stolen data and passwords stored in several victims’ password manager accounts were used by attackers to access “their electronic accounts and steal information, cryptocurrency, and other data.”

They also discovered no evidence that the victim’s devices were hacked, which points to the decryption of the stolen online password manager data as the only way the attackers could have obtained the keys needed to compromise the victim’s crypto wallet.

“The scale of a theft and rapid dissipation of funds would have required the efforts of multiple malicious actors, and was consistent with the online password manager breaches and attack on other victims whose cryptocurrency was stolen,” the complaint reads.

“For these reasons, law enforcement agents believe the cryptocurrency stolen from Victim was committed by the same attackers who conducted the attack on the online password manager, and cryptocurrency thefts from other similarly situated victims.”

Crypto theft linked to LastPass hacks

While the investigators didn’t name the online password manager, the complaint says that the platform was hit by “two major data breaches” in August 2022 and November 2022.

This timeline aligns with security breaches disclosed by LastPass three years ago when the company said that attackers stole source code and proprietary technical information, as well as customer vault data, after breaching its cloud storage.

Since then, multiple security experts have shared that they believe the LastPass hackers have cracked some of the stolen vault data and used the extracted private keys and credentials in major cryptocurrency heists.

Even though the investigators didn’t identify the victim, the details match the hack and the theft of $150 million in cryptocurrency from Ripple co-founder and executive chairman Chris Larsen, which was disclosed on January 31, 2024.

ZachXBT first linked the $23 million in cryptocurrency seized this week and the hack of Larsen’s XRP wallet.

“A forfeiture complaint filed yesterday by US law enforcement revealed the cause for the ~$150M (283M XRP) hack of Ripple co-founder, Chris Larsen’s wallet in Jan 2024 was the result of storing private keys in LastPass (password manager which was hacked in 2022),” he said today in a Telegram message.

A Ripple spokesperson was not immediately available when BleepingComputer reached out for comment earlier today.

Update March 07, 14:40 EST: LastPass sent the following statement after publishing time:

Since we initially disclosed this incident back in 2022, LastPass has worked in close cooperation with multiple representatives from law enforcement. To date, our law enforcement partners have not made us aware of any conclusive evidence that connects any crypto thefts to our incident.