New Delhi: When officers of the Enforcement Directorate (ED) began probing a fraudster who had tricked hundreds through a gaming app in 2021, they had little to no idea that the case would bring a big change in how they investigate such cases in the future.
The case, linked to a gaming app called E-Nuggets, had originated from a complaint filed by Federal Bank which was being used as a depository bank by fraudsters who lured their victims by promising huge sums of prize money.
The ED’s investigation found that the money taken from users was routed to approximately 2,500 “mule accounts” and used to purchase cryptocurrencies.
ED officials were able to trace the money transfer routes and attach the cryptocurrencies lying in several separate wallets. That part was relatively simple.
But, the concerns the ED officials faced in the following stages, marked a first in how enforcement agencies in India investigate cryptocurrency fraud.
Here, ThePrint has pieced together how officials stumbled upon the idea of opening a cryptocurrency account for the ED, and transferred the attached cryptocurrencies held in, both, domestic and international exchanges to it.
Origins of an idea
ED officials, on condition of anonymity, told ThePrint that during their investigations, a thorough analysis of bank accounts linked to E-Nuggets showed that money had been routed to companies that owned cryptocurrency exchanges, which confirmed the purchase of digital assets by an Aamir Khan, whom, the agency believed to be the mastermind, of the scam and his aides to circumvent the law.
Investigators said that all exchanges in India, including WazirX and CoinDCX, were asked to help locate the source accounts, which led to the discovery of the Virtual Payment Address (VPA). The process led the officials back to bank accounts used to purchase cryptocurrencies that the ED had attached.
In total, the ED froze approximately Rs 90 crore in 70 crypto accounts maintained with major exchanges, including India’s ZebPay and WazirX, and Dubai-based Binance.
Officials, however, were worried that crypto exchanges, especially those based outside of India, could stop cooperating with them in the future, citing the lack of jurisdiction.
“The crypto accounts were frozen and, both, the money and currencies were of no use to fraudsters but it was of no use to us either. What if the exchanges such as Binance, which is based out of Dubai, refuse to cooperate with us in future,” an ED official told ThePrint.
“Crypto assets are prone to evaporation and hence we needed it in our own custody albeit in a virtual form,” the official added.
Transferring crypto coins to ED’s wallet
This led investigators working on the case creating their own crypto account.
Once their request was approved by the agency’s headquarters in Delhi, the eastern region of the federal probe agency initiated the process of opening the crypto wallet account with WazirX. It was chosen taking into consideration that it had the highest user base and liquidity of currencies among all cryptocurrency exchanges in India.
The fact that WazirX is based in India also played a key role in the decision, a second ED official said.
WazirX recently garnered headlines after a massive breach in its multi-signature wallets leading to evaporation of nearly Rs 2,000 crore worth of crypto currencies in various accounts.
The wallet was opened at the beginning of 2024 under an assistant director, since officers at that level are generally in charge in cases of money laundering, while the power to authenticate the account was given to a deputy director-level officer of the agency.
Once ED had its own wallet, the next task was to transfer the coins it attached from Binance accounts. Investigators used a platform named Kodex, which was designed to facilitate communication between law enforcement agencies and business platforms like Binance.
According to its ‘about’ page, Kodex was founded in 2021 by Matt Donahue who worked in the counterterrorism intelligence wing at the Federal Bureau of Investigation (FBI). The platform offers Software as a Service (SaaS) to private enterprises, law enforcement and government agencies for engagement in legal processes.
“The confirmation of the provisional attachment order by the Adjudicating Authority formed the basis on which Binance agreed to transfer crypto coins to our own wallet,” said the first ED official.
The ED’s Adjudicating Authority, which is the competent authority to validate attachments of properties believed to be generated from proceeds of crime, has to determine the validity of any provisional attachment made by the ED within 180 days. After confirmation from the authority, the attached properties come under the agency’s ownership.
“Once there was an order by Adjudicating Authority. We initiated the transfer of assets which was a gradual process and was done incrementally over a period of time,” the first ED official told ThePrint.
This is a game-changer for the ED since it no longer has to worry about non-cooperation in crypto cases.
However, the complexities do not end here for ED officials. They will have to seek approval from their parent ministry — Ministry of Finance — if they need to sell the coins and free up the money.
According to government rules, a Permanent Account Number (PAN) is mandatory to sell cryptocurrency because the Tax Collected at Source (TCS) to carry out crypto transactions has to be submitted and the ED as a government agency does not have a PAN number of its own.
The ED has about 300 crypto coins in its wallet, which add up to approximately Rs 93 crore.
Now, the ED is contemplating ways to free up the money held in the form of cryptocurrencies and sources in the agency said there are only two ways to solve this riddle. First, seeking an exception from the Ministry of Finance to sell crypto without presenting a PAN number; and second, which also involves the finance ministry, is acquiring a nil TDS certificate from the Income Tax Department.
However, the agency is yet to take a call on which of the two paths it could take if and when it decides to free up its crypto wallet, ThePrint has learnt.
(Edited by Sanya Mathur)
Also read: WazirX, Liminal Custody trade blame after crypto platform loses Rs 2,000 crore in cyber attack