China-linked international cybercrime ring busted in Delhi, 8 held

The gang worked for China-based operators, who gained remote control of Indian bank accounts using SMS-forwarding malware.

Eight men were arrested in connection with a cyber fraud syndicate that ran mule bank accounts across Delhi,  Moradabad and Bareilly and routed stolen money to China-based operators through cryptocurrency, officers said. The racket has so far been linked to more than 600 cybercrime complaints across the country and suspicious transactions worth nearly Rs 15 crore, said police on Tuesday.

The probe began with a complaint by a Tamil Nadu resident who reported that Rs 6,000 had been fraudulently transferred from her account in September last year. The trail led investigators to a Yes Bank account in East Delhi’s Mayur Vihar, registered under the name of 25-year-old Wasim, a garment worker from Ghaziabad.Soon, police found he controlled four mule accounts across different banks, with at least 39 complaints already linked to them. A case was registered at Pandav Nagar police station on November 20, 2025.

On the probe, DCP East, Abhishek Dhania said, “Our team analysed the account statements of the mule accounts used in the commission as well as disposal of cybercrime proceeds. The team also analysed the internet banking IP logs of account transactions in question. On the basis of in-depth analysis, the chain of the cybercrime syndicate was identified and eight accused persons were arrested.”

The accused helped in running mule accounts and moved the crime money in cash and USDT (cryptocurrency), he added. “Total 14 mobile devices, 20 SIM cards and seven bank debit cards belonging to Bank of Maharashtra, Indian Bank and Indian Overseas Bank including cash of Rs 4,70,000 used by the syndicate have been recovered,” said DCP Dhania.

According to the police, the gang worked for operators based in China, who gained remote control of Indian bank accounts using SMS-forwarding malware. Once a mule account received fraud proceeds, the China-based handlers used the intercepted OTPs to move the money through layers of accounts and convert it into USDT on cryptocurrency platforms such as Binance and MetaMask. The Indian operatives were paid their commissions in crypto, police said.

Police said the members of the network had distinct roles, from sourcing account holders to distributing banking credentials and converting money into cryptocurrency.According to the police, one of the accused, based in Bareilly, is suspected to have shared details of over 60 accounts, while another was linked to 81 complaints. Most of the arrested men had no prior criminal record, said officers.

Police said that victims are now being traced and further arrests are likely as the probe widens into the international links of the syndicate.Over 800 held in two days under Delhi Police’s Operation Gang Bust 2026.