INTERPOL Arrests 1,462 in Africa Cybercrime Crackdown
Authorities recovered more than $105 million in illicit funds, while investigated criminal activity was linked to losses exceeding $385 million.
Table Of Content
In brief:
- INTERPOL coordinated Operation Serengeti III, a two-month operation involving law enforcement agencies from 21 countries.
- The investigation resulted in 1,462 arrests, the disruption of 10,909 malicious networks, and the identification of 65,929 victims.
- Authorities recovered more than $105 million in illicit funds, while investigated criminal activity was linked to losses exceeding $385 million.
- Angola authorities dismantled two illegal cryptocurrency mining facilities. A separate Nigerian investment-fraud investigation traced more than $2.4 million in suspected criminal proceeds, much of it reportedly laundered through cryptocurrency.
- This operation comes after a separate operation by US-UK authorities and private individuals targeting scam networks in West Africa broader which led to the identification of at least $11 million in freezable illicit assets.
On October 22, INTERPOL announced the preliminary results of Operation Serengeti III, one of the largest coordinated law enforcement actions on the African continent. Operation Serengeti III ran from June 29 to August 31, 2026. The two-month operation brought together law enforcement agencies across 21 countries to dismantle cross-border cybercriminal infrastructure.
The international crackdown resulted in 1,462 arrests and the disruption of 10,909 malicious networks. Investigators identified 65,929 victims, and financial investigations linked the activity to losses of more than $385 million. Authorities successfully recovered over $105 million in illicit funds.
Highlighting the importance of public-private cooperation, Neal Jetton, INTERPOL’s Director of Cybercrime, said, “Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm.”
The operation received critical intelligence and threat-analysis support from cybersecurity firms, including Kaspersky and Group-IB.
Uganda, Angola, and Nigeria Feature in Key Investigations
Operation Serengeti III targeted a wide spectrum of digital threats, including ransomware, business email compromise (BEC), and malicious mobile loan apps. Investigations in Uganda, Angola, and Nigeria highlighted distinct regional threat models.
In Uganda, authorities dismantled two transnational fraud rings operating out of localised call centres. This led to the arrest of 365 foreign nationals. The syndicates utilised scripted sales pitches, fake trading platforms, and spoofed websites to target victims across Asia, deceiving pensioners into non-existent investment opportunities
In Angola, law enforcement raided two unauthorised cryptocurrency mining facilities. Nine suspects were arrested, and officers seized more than 2,000 crypto mining rigs along with six illegal power transformation stations. INTERPOL valued the confiscated electrical infrastructure alone at over $1 million.
Nigerian authorities arrested a key suspect linked to a large-scale phishing and BEC campaign. The campaign harvested corporate software credentials and compiled about 2.1 million email addresses. In a separate messaging-app investment fraud investigation, financial tracing revealed the movement of over $2.4 million in criminal proceeds, much of it reportedly laundered through cryptocurrency transactions.
Crypto’s Role: Laundering Tool and Infrastructure Exploitation
Crypto and digital assets entered this investigation via two routes. In Nigeria, it reportedly helped move proceeds from suspected fraud. The offence involved operating illegal crypto mining centres, including through unlicensed power infrastructure. However, neither case suggests crypto itself caused the crimes or that a crypto exchange was found culpable in criminal activity.
Interpol also referenced INTERPOL’s African Cyber Threat Assessment Report 2026, published in August 2026. That report found that cryptojacking accounted for roughly 4% of total reported cybercrime cases in 2025. Cryptojacking is the unauthorised use of someone else’s computing power, memory, and electricity to mine digital assets.
What the Figures Mean for Fraud Victims
The headline metric of $105 million in recovered funds represents a major victory for law enforcement agencies. However, it is important to differentiate between recovered assets and identified financial losses. The $385 million figure reflects the total losses resulting from the fraudulent activity.
INTERPOL’s official announcement does not state how much of the $105 million in seized bank accounts, physical luxury assets, or cryptocurrencies has been returned to victims, or the timeline for judicial asset forfeiture and repatriation.
Seized assets often undergo lengthy legal reviews across multiple jurisdictions before victim compensation funds can be distributed. So far, the 1,462 people arrested remain suspects and have not been convicted.
Investigations Continue
Operation Serengeti III’s active enforcement window closed in late August 2026. However, Interpol reports that several investigations remain active. Authorities are working to identify more suspects, trace illicit funds and analyse digital evidence.
Yuliya Shlychkova, Vice President of Global Public Affairs at Kaspersky, commented on the company’s participation in Operation Serengeti III: “The borderless nature of cybercrime makes it impossible for a single organisation or country to confront it on its own.”
Operation Serengeti is a recent addition to public-private coordination against cybercrime. The recently concluded London Joint Disruption Week, which targeted scam networks in West Africa, saw coordination between US and UK task forces, private players like Coinbase, and local authorities.
Group-IB CEO Dmitry Volkov spoke about the importance of coordination between private intelligence and law enforcement. “By combining investigative expertise, actionable threat intelligence, and coordinated international efforts, we can help identify criminal networks, disrupt their operations, and prevent further harm.”
