INTERPOL Recovers $105M in Africa Cybercrime Crackdown

By Nathan Brooks

INTERPOL said law-enforcement agencies in 21 countries arrested 1,462 suspects, disrupted 10,909 malicious networks and recovered more than $105 million during Operation Serengeti III, one of Africa’s largest coordinated cybercrime operations.

INTERPOL announced the results on Thursday, Oct. 22, 2026. The operation ran from June 29 to Aug. 31, 2026, and targeted ransomware, online scams, business email compromise, digital extortion and other cyber-enabled fraud. Investigators identified 65,929 victims, while financial investigations linked the networks to losses exceeding $385 million.

The recovery total was not equivalent to the full loss estimate: using the stated figures, $105 million represents roughly 27% of the linked losses. INTERPOL also did not break down how much of the recovery came from cryptocurrency, so the headline should not be read as digital-asset recoveries alone.

Neal Jetton, INTERPOL’s director of cybercrime, said: "Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale."

What does the crackdown change for practitioners?

In Angola, investigators dismantled two illegal crypto-mining centers, arrested nine people and seized more than 2,000 mining devices plus six illegal power transformation stations. INTERPOL valued the electrical equipment alone at more than $1 million. The seizures removed both the mining machines and the power-conversion equipment supporting them, extending the enforcement action beyond bank accounts, wallets and transaction records.

In Nigeria, authorities arrested a suspect over an international investment-fraud scheme promoted through messaging apps. Investigators traced more than $2.4 million in suspected criminal proceeds, much of it laundered through cryptocurrency transactions. That makes crypto a laundering channel within this case, not necessarily the method that sold the fraudulent investment.

Ugandan authorities dismantled two transnational fraud rings and arrested 365 foreign nationals linked to online investment and pension scams aimed at victims in Asia. The rings used rotating call centers, scripts, fake trading platforms and fraudulent websites to persuade pensioners to invest in opportunities that did not exist.

Other arrests included a Nigerian suspect accused of running a phishing and business email compromise operation that collected around 2.1 million email addresses. Authorities also linked 30 suspects to a cybercrime operation in the Republic of Congo.

Private-sector partners Group-IB, Kaspersky, blockchain analytics firm Uppsala Security and Meta supported the operation. INTERPOL said several investigations remain active as authorities seek more suspects and trace additional illicit proceeds.

The action followed Operation Catalyst, a joint INTERPOL and Afripol crackdown on terrorist financing and cybercrime that arrested 83 people across six African countries in 2025. That operation flagged $260 million in illicit crypto and fiat; authorities seized $600,000 and identified high-value crypto wallets that INTERPOL said were "potentially linked" to terrorist financing.

An INTERPOL expert told Decrypt at the time of Catalyst that criminals were "increasingly" using crypto in Africa, but that crypto was not yet the main way most cybercrime proceeds were paid or settled. Serengeti III adds evidence of crypto-enabled laundering and illegal mining without reversing that broader assessment.

For practitioners, the change is operational: cross-border investigators can combine victim and network analysis with seizures of physical mining infrastructure and tracing of crypto-laundered proceeds. The cases also show enforcement spanning mining hardware, investment promotions, phishing data and transnational call centers, rather than focusing only on how illicit payments move.

Serengeti III does not establish that crypto is the primary settlement rail for African cybercrime, consistent with the earlier expert assessment. Because INTERPOL said several investigations remain active and disclosed no deadline, the next measurable enforcement window is further arrests, suspect identifications and asset recoveries tied to the 65,929 victims and the disrupted networks.