Interpol’s Serengeti III operation led to 1,462 arrests across Africa and the recovery of more than $105 million in illicit funds, the international police organisation said in a press release on 22 October 2026. The sweep ran from 29 June to 31 August in 20 African countries and the United States, and investigators say they disrupted 10,909 malicious networks and identified 65,929 victims.
Crypto appears in the release only in specific cases. In Angola, police shut two illegal cryptocurrency blockchain e riceve una ricompensa, rendendo carissimo riscrivere lo storico.">mining centres and seized more than 2,000 mining machines. In Nigeria, a suspect was arrested over an investment fraud worth more than $2.4 million in suspected proceeds, much of it laundered through crypto, according to Interpol. How much of the $105 million total was held in crypto, Interpol does not say.
That gap matters for anyone trying to read the operation as a crypto story. The headline figures cover all kinds of cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion. Some of that money moved through banks and mobile wallets, some through crypto. The release gives no split.
Interpol Serengeti III in numbers: 1,462 arrests and $385 million in losses traced
Interpol’s figures for the two-month operation are below. All come from its release of 22 October, which security firm Group-IB, one of the private partners, repeated in its own statement the same day.
| Measure | Serengeti III (29 June to 31 August 2026) |
|---|---|
| Countries taking part | 21 (20 in Africa, plus the United States) |
| Arrests | 1,462 |
| Malicious networks disrupted | 10,909 |
| Illicit funds recovered | More than $105 million |
| Victims identified | 65,929 |
| Losses linked by financial investigations | More than $385 million |
The countries were Angola, Benin, Cameroon, the Republic of Congo, Côte d’Ivoire, the Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, Zambia and Zimbabwe, with the United States as the only participant from outside the continent.
Before the arrests began, investigators in those countries received intelligence on suspicious domains, IP addresses and command-and-control servers, the machines that send orders to infected computers or botnets. That is where most of the 10,909 disrupted networks come from: they are pieces of criminal infrastructure taken offline, not 10,909 gangs.
Two of the figures do not line up neatly, and Interpol does not explain how they relate. The $105 million recovered is about 27% of the $385 million in losses the investigations tied to the activity, by our arithmetic. The release does not say whether the recovered money came from those same losses, how much of it was seized outright and how much was only frozen, or how it splits by country.
Where the crypto shows up: Angola’s mining farms and Nigeria’s $2.4 million fraud
Angola: two illegal mining centres and six power stations
The largest crypto case in the release is not a scam. Angolan police dismantled two illegal cryptocurrency mining centres and arrested nine suspects, Interpol said. They seized more than 2,000 mining devices and six illegal power transformation stations, with the electrical equipment alone valued at more than $1 million.
Interpol calls the six power stations illegal but does not say whether electricity was stolen from the grid or who paid for it. It also does not name the coin being mined, the type of machines, the hash rate or the revenue.
Nigeria: an investment fraud laundered through crypto
In Nigeria, investigators worked two separate cases. The first was a phishing and business email compromise operation that harvested software login credentials and about 2.1 million email addresses; one suspect was arrested and a luxury vehicle recovered. The second was an investment fraud promoted through messaging apps. One person was arrested, and the suspected proceeds exceed $2.4 million, "much of it laundered through crypto", according to Interpol.
No exchange, stablecoin or blockchain is named. Interpol lists Uppsala Security, a blockchain analytics firm, among the private partners, but it does not say whether that firm traced wallets in the Nigerian case.
Uganda: 365 foreign nationals arrested in two fraud rings
The single largest arrest count came from Uganda. Police there dismantled two transnational fraud rings and arrested 365 foreign nationals, Interpol said. The groups ran investment and pension scams aimed at victims in Asia, using scripted phone calls, fake trading platforms and fraudulent websites.
The description matches call-centre investment fraud, in which a fake trading dashboard shows gains that do not exist. Interpol’s release does not use the term "pig butchering", does not say whether the fake platforms claimed to trade crypto, and gives no figure for what the Asian victims lost.
Loan apps in Tanzania and car-import fraud in Gabon
The other national results in the release have no crypto link that Interpol states. Tanzanian authorities dismantled a scheme built on malicious mobile loan apps. In Gabon, police disrupted a network that used social media to sell fake vehicle imports. In the Republic of Congo, 30 suspects were arrested.
This is worth keeping in mind for readers who see "cybercrime" and think "crypto". Most of what Serengeti III targeted is ordinary fraud carried out online, from hijacked business email to fake car sellers on social media. Crypto is one payment and laundering channel among several, alongside bank transfers and mobile money.
Who worked on it: police from 21 countries and ten outside partners
Interpol coordinated the operation. Its partners outside the police were Group-IB, Kaspersky, Fortinet, TrendAI, Team Cymru, Uppsala Security, Cybercrime Atlas, Meta, the Global Anti-Scam Alliance and Zimbabwe’s Postal and Telecommunications Regulatory Authority. Part of the funding came from GLACY-e, a programme of the European Union and the Council of Europe.
"Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale," said Neal Jetton, Interpol’s Director of Cybercrime, in the release. He added that international cooperation is one of the most effective ways to disrupt such networks and recover criminal assets.
Group-IB said it supplied intelligence on phishing kits, botnets and the social media accounts of fraud suspects. Its chief executive, Dmitry Volkov, said: "Cybercriminal networks continue to operate across borders, exploiting digital platforms." He called the operation a demonstration of sustained cooperation between police and the private sector. Jacomo Piccolini, a vice president at Team Cymru, told BleepingComputer that seeing attacker infrastructure at internet scale gives defenders "a fundamentally different starting point". BleepingComputer also reported that crypto investment scams were among the targets, without giving figures.
Bigger than Serengeti 2.0: 21% more arrests, 8% more money recovered
Serengeti is now a yearly exercise, and each edition has reported more arrests. The earlier figures below are not from Interpol’s new release; they come from secondary sources, named in the table, and we have not checked them against Interpol’s own pages for those years.
| Edition | Period | Arrests | Networks or infrastructure taken down | Money recovered | Source for the figures |
|---|---|---|---|---|---|
| Serengeti (2024) | September to October 2024, 19 African countries | 1,006 | 134,089 | About $44 million | BleepingComputer, 22 October 2026 |
| Serengeti 2.0 (2025) | June to August 2025, 18 African countries and the UK | 1,209 | 11,432 | $97.4 million | Group-IB, 22 October 2026; Help Net Security, 22 August 2025 |
| Serengeti III (2026) | 29 June to 31 August 2026, 21 countries | 1,462 | 10,909 | More than $105 million | Interpol, 22 October 2026 |
Against Serengeti 2.0, arrests rose by about 21% (1,462 against 1,209) and recoveries by about 8% ($105 million against $97.4 million), by our calculation. The number of disrupted networks fell slightly, from 11,432 to 10,909. The 2024 count of 134,089 is much higher, but the sources describe it as malicious infrastructure taken down, which may be counted differently, so the three years are not strictly comparable on that line.
Earlier sweeps: what share was crypto?
Serengeti III publishes no crypto figure. Two earlier Interpol operations did, and in both the crypto slice was small next to cash and bank money.
Operation First Light 2024 covered 61 countries, with a final phase from March to May 2024. Interpol said on 27 June 2024 that it led to 3,950 arrests and the seizure of $257 million in assets: about $135 million in fiat currency, $2 million in cryptocurrency and more than $120 million in other assets such as property, cars and jewellery, according to its release at the time. Crypto was under 1% of the total, and about 1.5% of the cash-like part.
Operation HAECHI VI ran from April to August 2025 in 40 countries and territories. Help Net Security reported on 25 September 2025 that it recovered $439 million, blocked more than 68,000 bank accounts and froze nearly 400 crypto wallets, The article splits the total into about $342 million from bank accounts and government-issued currency and $97 million in physical and virtual assets, and separately cites roughly $16 million recovered in crypto, about 3.6% of the headline. It does not say whether that $16 million sits inside the $97 million.
The pattern from those two operations is that Interpol’s large fraud sweeps mostly recover bank balances and physical assets, and crypto makes up a low single-digit share where it is itemised. It would be a guess to apply that ratio to Serengeti III, and Interpol has not published the number that would settle it.
A second announcement this week: the UAE-led Operation Confrontation Ghost
A separate operation was announced the same week, and the two should not be confused. Operation Confrontation Ghost was led by the United Arab Emirates Ministry of Interior, not by Interpol. It ran from 1 July to 30 September 2026 across 30 countries, including France and Italy, according to Gulf News. Interpol and the Global Anti-Scam Alliance took part, alongside 13 private partners, among them the crypto exchange Crypto.com, Mastercard, Meta, TikTok and Group-IB.
The results were presented at a UAE side event during the UN conference on transnational organised crime in Vienna, Gulf News reported. According to the same report, participants identified more than $39 billion in funds and digital assets that countries are now working to recover, thwarted 123.71 million online fraud attempts, made more than 960 arrests, blocked 4,126 bank accounts and raided 29 fraud centres. The operation targeted AI-enabled fraud, digital financial fraud and online sextortion.
The $39 billion is an amount identified, not recovered or seized, and it should not be set beside Serengeti III’s $105 million. No crypto share was given. Monica Juma, Executive Director of the UN Office on Drugs and Crime, described the operation as an example of international cooperation against new forms of crime, and said criminals use digital platforms, bank accounts and cryptocurrencies to move funds and hide where they came from, Gulf News reported. There is no sign the two operations shared cases, and their totals should not be added.
What it means for crypto users
For readers, the Ugandan and Nigerian cases describe a scheme that keeps coming back: a contact on a messaging app, a trading platform that shows growing gains, and a request to send more money before any withdrawal. Our guide to spotting and reporting crypto scams lists the warning signs and where to file a complaint in the US, the UK, France and Italy.
In France, the AMF publishes a blacklist of unauthorised crypto and forex investment sites. In Italy, Consob can order internet providers to block sites offering investment services without authorisation: by its count of 6 August 2026, it had blacked out 1,805 sites since July 2019, 233 of them tied to crypto-assets. UK readers can check the FCA’s warning list before sending money to any platform.
The cases also show why regulators keep tightening rules on how crypto moves between accounts. This week’s US figures are in our report on the White House’s crypto scam crackdown, and a recent sentencing in a dollar-stablecoin laundering case is covered in our story on Colombia’s ‘Rey’. In the EU, the anti-money-laundering regulation that bans anonymous crypto accounts applies from 10 July 2027.
What Interpol has not published
Several numbers that would make Serengeti III easier to judge are missing from the release:
- The share of the $105 million held in crypto, and in which assets.
- How much was seized and how much was frozen pending court decisions.
- The split of arrests and recoveries by country, apart from the cases named above.
- Whether any exchange or stablecoin issuer froze funds, and whether the blockchain analytics partner traced wallets.
- How much the victims in Asia lost to the two Ugandan rings.
The Nigerian and Angolan suspects now face national courts, and charging decisions there could bring out more detail on the crypto side. Interpol has not announced dates for a fourth edition.