INTERPOL arrests 2 in Nigeria as $2.4m investment fraud was laundered through crypto in Operation Serengeti III

INTERPOL has arrested two suspects in Nigeria in separate cybercrime cases, including one tied to an investment fraud scheme that allegedly laundered a substantial portion of more than $2.4 million in proceeds through cryptocurrency. The arrests were announced as part of Operation Serengeti III, a 21-country crackdown that led to 1,462 arrests and the recovery of over $105 million globally.

Operation Serengeti III uncovers phishing and investment fraud

The first Nigerian case centred on a phishing and business email compromise operation that allegedly collected software credentials on a large scale.

Phishing typically involves deceptive messages or websites designed to persuade victims to disclose passwords, account details or other sensitive information. Business email compromise, meanwhile, involves the misuse or impersonation of legitimate business email accounts to facilitate fraud, redirect payments or obtain confidential information.

INTERPOL said the operation under investigation had amassed approximately 2.1 million email addresses while harvesting software credentials. The agency did not specify how many victims had been directly affected by this particular scheme or whether the recovered information had been used in additional offences.

The recovery of a luxury vehicle suspected of being purchased with criminal proceeds also points to investigators’ efforts to identify and recover assets potentially connected to cybercrime.

The second investigation involved an international investment fraud scheme allegedly promoted through messaging applications. Such platforms can enable fraudsters to communicate directly with prospective investors, circulate investment claims and maintain contact with victims across geographical boundaries.

According to INTERPOL, financial investigations linked the scheme to the movement of more than $2.4 million in suspected criminal proceeds, much of which was allegedly laundered through cryptocurrency transactions.

The agency’s statement described the two investigations as separate cases. It did not establish that the phishing operation and the investment fraud scheme were run by the same individuals or formed part of a single criminal network.

The financial findings nevertheless illustrate why Operation Serengeti III included investigations into both cyber-enabled fraud and the movement of suspected illicit funds. Tracing transactions and identifying assets can help investigators build cases beyond the initial online activity and determine where proceeds may have been transferred.

Cryptocurrency transactions can create additional investigative challenges when funds move between wallets, exchanges and jurisdictions. However, blockchain transaction records can also provide investigators with evidence to analyse and follow, depending on the available information and the services involved.

INTERPOL reports more than $105m recovered globally

Beyond the Nigerian arrests, Operation Serengeti III produced enforcement results across participating countries, according to INTERPOL.

The agency reported that law enforcement authorities arrested 1,462 suspects, disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds during the operation.

Investigators also identified 65,929 victims targeted by cybercriminal networks. Financial investigations connected criminal activities under examination to losses exceeding $385 million.

The figures cover the multinational operation as a whole and should not be attributed solely to Nigeria. INTERPOL’s statement did not provide a country-by-country breakdown of arrests, recoveries or financial losses in the information supplied.

The operation targeted several categories of cybercrime, including online fraud, ransomware, business email compromise, digital extortion and other online scams. These offences can affect individuals, businesses and public institutions, while criminal proceeds may be transferred through financial systems spanning multiple countries.

INTERPOL said private-sector partners supported the operation by providing intelligence, technical analysis and operational expertise. This assistance helped investigators identify targets, map criminal networks and support ongoing investigations.

The involvement of private-sector organisations is particularly relevant to cybercrime cases, where information held by technology providers, financial institutions and cybersecurity specialists can help law enforcement agencies identify suspicious activity and connect related incidents.

The participating countries included Nigeria, Ghana, Kenya, South Africa, Uganda, Tanzania, Rwanda, Senegal, Angola, Benin, Cameroon, Congo, Côte d’Ivoire, the Democratic Republic of the Congo, Eswatini, Gabon, The Gambia, Mozambique, the United States, Zambia and Zimbabwe.

The geographic scope of Operation Serengeti III reflects the cross-border nature of cybercrime investigations, in which suspects, victims, digital infrastructure and financial transactions may be located in different jurisdictions.

Operation Serengeti III reinforces international cooperation

INTERPOL’s Director of Cybercrime, Neal Jetton, said coordinated enforcement remained important in responding to criminal networks operating across national borders.

“Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm,” Jetton said.

His remarks underscored the importance of cooperation between national law enforcement agencies in investigating online offences, exchanging intelligence and tracing assets that may have moved beyond the country where a crime was initially reported.

For Nigeria, the two arrests represent part of the country’s contribution to the wider operation. The cases also highlight the different methods allegedly used in cybercrime, including credential harvesting, email compromise, investment fraud and cryptocurrency-based money movements.

INTERPOL said several investigations arising from the operation remained active. Authorities were continuing efforts to identify additional suspects, trace suspected criminal proceeds and analyse seized digital evidence.

The ongoing investigations mean that the full extent of the alleged criminal activity may not yet be established. Further findings could help investigators determine whether other individuals or networks were involved and whether additional assets can be identified or recovered.

While the results announced under Operation Serengeti III demonstrate the scale of the international crackdown, the allegations against the two Nigerian suspects remain subject to the relevant legal processes. INTERPOL’s statement did not disclose their identities or provide information about any charges, court proceedings or final judicial outcomes.

The operation’s broader findings nevertheless point to the continuing challenge posed by cyber-enabled financial crime and the importance of cooperation between law enforcement agencies, technology companies and financial investigators in responding to offences that cross national borders.

As authorities continue examining digital evidence and tracing financial flows, Operation Serengeti III remains a significant multinational effort aimed at disrupting cybercrime networks, identifying suspected offenders and recovering assets linked to illicit activity.