INTERPOL Cybercrime Operation Leads to 1,462 Arrests and $105 Million Recovered
An international cybercrime operation coordinated by INTERPOL has resulted in 1,462 arrests, the disruption of 10,909 malicious networks and the recovery of more than $105 million in suspected criminal proceeds. The operation highlights how digital evidence and financial investigations can help authorities dismantle cybercrime networks operating across national borders.
Announced on 22 October 2026, Operation Serengeti III involved law enforcement agencies from 21 countries. Conducted between 29 June and 31 August, the operation targeted cyber-enabled fraud, ransomware, business email compromise, online scams and digital extortion. INTERPOL reported that investigators identified 65,929 victims targeted by criminal networks, with financial losses linked to the investigated activity exceeding $385 million.
Investigations uncovered different forms of criminal activity across the participating countries. In Uganda, authorities dismantled fraud operations that used fake investment platforms and scripted calls to target victims. In Nigeria, investigators pursued phishing and business email compromise activity involving the harvesting of software credentials and approximately 2.1 million email addresses. Authorities also investigated schemes involving cryptocurrency transactions and suspected laundering of criminal proceeds.
Forensic examination is essential to connecting these seemingly separate activities. Investigators may need to correlate seized-device data, email headers, authentication records, domain-registration information, server logs and financial transactions to reconstruct how a criminal operation functioned. Cryptocurrency investigations add another layer, requiring transaction tracing to identify movement between wallets and, where possible, connect blockchain activity to real-world individuals or services.
INTERPOL said intelligence shared before the operation included suspicious domains, IP addresses and command-and-control infrastructure. Such indicators can help investigators identify related activity across jurisdictions, but a shared IP address or domain alone does not prove that a particular person participated in a crime. Investigators must corroborate technical indicators with device artefacts, account records, communications and financial evidence.
The operation also illustrates the challenge of preserving evidence across borders. Differences in data-retention periods, collection procedures and legal authorities can complicate the reconstruction of events. Accurate timestamps, documented acquisition methods and a defensible chain of custody are essential when evidence collected in one country may be used in proceedings elsewhere.
Although the arrests and financial recoveries represent significant operational results, investigations remain active. INTERPOL said authorities continue to identify suspects, trace proceeds and analyse seized digital evidence.
The forensic significance extends beyond the number of arrests. Dismantling transnational cybercrime networks depends on turning fragmented technical and financial records into evidence that can reliably establish individual actions, relationships and responsibility.