ED Explains How Mule Accounts And Crypto Networks Enabled ₹12,000 Crore Cyber Fraud

The Enforcement Directorate has exposed an extensive web of mule accounts, shell companies and cryptocurrency routes used to funnel money generated from cyber-enabled financial frauds, with assets worth ₹12,229 crore attached so far. The findings were shared by ED Joint Director Robin Gupta while addressing a national conference on tackling cyber frauds organised by the CBI and the Indian Cyber Crime Coordination Centre.

Describing cyber fraud as a highly organised criminal operation, Gupta said such networks function like corporate structures, with separate units managing SIM cards, mule accounts, human trafficking and crypto conversions to avoid detection by authorities.

The agency is currently investigating a large transnational cyber investment scam operating from compounds located in the Thailand–Laos–Myanmar Golden Triangle region. Based on multiple FIRs registered across India, the probe has resulted in eight arrests and the filing of a prosecution complaint. Victims were duped through fake IPO allotments and fraudulent stock trading applications promising unusually high returns, a scam model globally referred to as “pig-butchering.” Investigators also uncovered evidence suggesting that Indian youths were trafficked and coerced into participating in these cybercrime operations.

According to Gupta, the laundering process followed three stages. Initially, defrauded funds were deposited into mule and shell company accounts, with ₹159 crore traced through such channels. In the second phase, the money was layered by breaking it into smaller transactions ranging between ₹1 lakh and ₹5 lakh and transferring it into hundreds of accounts within a single day. In the final stage, the funds were converted into cryptocurrency using peer-to-peer platforms like Binance and moved overseas, while cash withdrawals were handled locally.

The ED has identified more than 1,000 mule accounts and shell entities linked to the network and frozen ₹2.81 crore. These accounts were often sourced via Telegram or obtained from students, low-income individuals and inactive businesses, and were remotely controlled by handlers.

Gupta also highlighted major enforcement successes, including the seizure of cryptocurrency worth ₹2,057 crore in the Bitconnect Ponzi case and the attachment of crypto assets valued at ₹2,385 crore along with 21 overseas properties in the OctaFX forex fraud investigation, which won the 2025 Best Egmont Case Award.

He pointed out challenges faced by investigators, such as the sheer volume of bank accounts, inconsistent data formats, delays in accessing KYC information and rapid fund movements that outpace traditional investigative methods. To address these issues, the ED is increasingly relying on technology-driven solutions, including an IIT-Kanpur-developed crypto analysis tool, bulk data standardisation and real-time coordination among agencies.

Gupta also outlined warning signs associated with mule accounts, including dormant accounts suddenly receiving large sums, immediate withdrawals, frequent changes in contact details, multiple accounts operated from a single IP address and the use of OTP-forwarding applications.

Calling for a comprehensive crackdown, he urged agencies to dismantle the entire ecosystem behind cybercrime by targeting mule account suppliers, SIM providers, traffickers, shell company operators and crypto facilitators, and treating cyber fraud cases on par with organised crime.

Addressing the same conference, Union Home Minister Amit Shah said multiple agencies, including the I4C, state police, CBI, NIA, ED, RBI, MeitY, the telecom department, banks and the judiciary, are working together to combat cybercrime, stressing that tighter coordination is crucial to counter the growing threat.