1. Operation Serengeti III: what the numbers show
Law enforcement agencies from 21 African countries arrested 1,462 suspects, took down 10,909 malicious networks and recovered more than $105 million during Operation Serengeti III, an Interpol-coordinated campaign against cybercrime on the continent. Interpol announced the results on Thursday, October 22, 2026. The operation ran from June 29 to August 31 and also shut down illegal cryptocurrency mining sites in Angola.
The headline totals describe a crackdown that was broad in geography and in the kinds of offences covered. Officers across the participating countries worked on cases involving ransomware, online scams, business email compromise, digital extortion and other forms of cyber-enabled fraud. Investigators identified 65,929 victims, and the financial inquiries tied the targeted networks to losses of more than $385 million.
Those two figures, $385 million in losses traced and $105 million recovered, put the outcome in perspective. Recovery in cybercrime cases is difficult because stolen funds are usually moved quickly through multiple accounts and, increasingly, across borders. Getting back roughly a quarter of the losses linked to these networks is a meaningful result for an operation that lasted about two months.
2. How the operation worked
Serengeti III is the third operation in a series that Interpol coordinates for African law enforcement. Its structure follows a familiar pattern for international policing: the organization acts as a hub, national police forces carry out arrests and seizures on their own territory, and information moves between countries and with outside technical partners while the work is under way.
That coordination matters because the networks involved rarely respect national boundaries. A fraud call center can sit in one country, target victims in another, route payments through a third and rely on infrastructure rented elsewhere. A single national agency sees only a fragment of such a scheme. A shared operation lets investigators match leads, compare indicators and act in several places within the same window.
Neal Jetton, Interpol's director of cybercrime, said that cybercrime networks operate without regard for borders and use technology to reach victims at a scale not seen before. His remark reflects the rationale for pooling resources across 21 countries rather than leaving each country to pursue the same groups separately.
The timeline also shows how long such work takes. Field activity ended on August 31, and the results were made public on October 22, about seven weeks later. That gap is typical, since agencies must tally arrests, verify recovered amounts, match victims to losses and confirm which cases can be described publicly without harming ongoing inquiries. Figures released at the end of this process tend to be more reliable than early estimates, though open investigations can still change them.
3. Why did police shut down crypto mines in Angola?
In Angola, authorities dismantled two illegal cryptocurrency mining centers, arrested nine people and seized more than 2,000 mining devices. They also took apart six illegal power transformation stations that supplied the sites. Interpol said the seized electrical equipment alone was worth more than $1 million.
The power equipment is central to the case. Cryptocurrency mining consumes large amounts of electricity, and electricity is usually the biggest running cost for a mining operation. Operators who connect to the grid illegally or build unauthorized transformer capacity avoid paying for that power, and the cost is carried by utilities and other customers. Equipment of this kind can also create safety and reliability risks for the local network.
Mining itself is not a crime in most places. The Angolan case concerned operations that were unlicensed and powered through unlawful infrastructure, which is why police treated them as part of a cybercrime-focused sweep rather than as ordinary commercial activity. The seizure of more than 2,000 devices indicates the scale: these were industrial setups, not hobby rigs.
4. Investment fraud and money laundering through crypto in Nigeria
In Nigeria, police arrested one suspect in connection with an international investment fraud that was run through messaging applications. Investigators traced more than $2.4 million in suspected proceeds, and a large share of that money was laundered through cryptocurrency transactions.
The case illustrates a pattern that investigators have described for years. Fraudsters approach victims through chat applications, present a seemingly profitable investment and collect payments. They then convert the proceeds to digital assets and move them through several wallets to make the trail harder to follow. Because public blockchains keep a permanent record of transfers, analysts can often reconstruct that movement later, which is one reason blockchain analytics firms were among the operation's partners.
A second Nigerian case involved a suspect accused of running a phishing and business email compromise operation that collected roughly 2.1 million email addresses. Such lists are the raw material for mass phishing campaigns, in which messages impersonating suppliers, executives or banks are sent to large numbers of recipients in the hope that a few will respond.
5. Uganda and the Republic of Congo
Uganda produced the largest single group of arrests described in the announcement. Authorities there dismantled two transnational fraud rings and arrested 365 foreign nationals. The rings ran investment and pension scams aimed at victims in Asia.
According to the details Interpol released, the groups used a rotating call-center arrangement, prepared scripts, fake trading platforms and fraudulent websites. Pensioners were lured with promises of returns from investments that did not exist. The rotating setup is a common tactic, because moving staff and locations makes it harder for investigators to pin down any single site.
In the Republic of Congo, 30 suspects were linked to a cybercrime operation. The announcement gave fewer details of that case, but its inclusion shows that the operation reached beyond the countries most often associated with online fraud.
6. Which companies helped Interpol?
Interpol said private-sector organizations supported the operation. They were the cybersecurity companies Group-IB and Kaspersky, the blockchain analytics firm Uppsala Security and the technology company Meta.
Such partnerships are now standard in large cybercrime operations. Private firms hold telemetry, threat intelligence and tracing tools that public agencies often lack, while police have the legal authority to make arrests and seize assets. Blockchain analytics in particular helps connect wallet addresses to criminal activity, and platform operators can help identify scam accounts and the networks behind them.
7. Crypto crime in Africa: the earlier Operation Catalyst
The latest results follow Operation Catalyst, a joint effort by Interpol and Afripol aimed at terrorist financing and cybercrime. In 2025, that operation led to 83 arrests across six African countries. It flagged $260 million in illicit cryptocurrency and fiat currency, of which about $600,000 was seized, and it identified several high-value crypto wallets described as potentially linked to terrorist financing.
An Interpol expert said at the time that criminals were using cryptocurrency increasingly in Africa, although it had not yet become the main way most cybercrime proceeds were paid or settled. The Serengeti III cases are consistent with that assessment: crypto features in the laundering of the Nigerian fraud proceeds and in the mining case, but it is one tool among several in the wider fraud economy.
8. What do the main offence types mean?
Several of the crimes named in the announcement are easy to confuse. Ransomware is malicious software that locks or encrypts a victim's files and demands payment, often in cryptocurrency, in return for access. Digital extortion is broader and covers threats to leak data, expose private material or disrupt services unless the victim pays.
Business email compromise relies on deception rather than malware. An attacker poses as an executive, a supplier or a business partner, often from a spoofed or hijacked email account, and persuades an employee to send a payment or reveal sensitive information. Because the transfers look routine, these frauds can go unnoticed until the real counterparty asks where its money is. Online investment and pension scams work on a similar principle, replacing a corporate pretext with the promise of a safe, high return.
All of these offences scale easily. A single operator with a list of email addresses or a script for a call center can contact thousands of people, and only a small share of them needs to respond for the scheme to pay. That economics explains why the operation counted nearly 66,000 victims across a period of only two months.
9. Why do operations like this matter for victims and for the industry?
For victims, the most important figure may be the $105 million recovered, since money returned or frozen can in some cases be traced back to the people who lost it. Pensioners targeted by fake investment schemes are especially exposed, because losses of savings are rarely replaced.
For the crypto industry, the case shows how digital assets appear on both sides of a criminal investigation. They are a convenient way to move value quickly, but their transparent ledgers also give investigators evidence that cash seldom provides. Exchanges, mining companies and analytics providers that cooperate with authorities help shape how regulators view the sector, while operators who allow illegal activity on their platforms invite closer scrutiny for everyone.
10. What happens next?
Interpol said several investigations remain open. Authorities are trying to identify additional suspects and to trace more of the illicit proceeds, so the arrest and recovery figures announced on October 22 may not be final. Asset tracing in particular can take months, especially where funds have crossed several jurisdictions.
No date has been given for a further phase of the series. For the crypto industry, the practical takeaway is that enforcement attention is widening from exchanges and token projects to the physical and financial infrastructure around digital assets, including electricity supply, call centers and laundering routes. Mining operators, platforms and payment providers working in Africa can expect continued cooperation between police and private analytics firms.