INTERPOL said law enforcement agencies from 21 countries arrested 1,462 suspects, disrupted 10,909 malicious networks, and recovered more than $105 million in a coordinated crackdown on cyber-enabled crime across Africa. The operation, named Serengeti III, ran from June 29 to August 31, 2026, and was detailed in an INTERPOL statement published on October 22, 2026. CoinMarketCap relayed the figures on October 24.
The detail that separates this sweep from a routine fraud roundup sits in Angola. Police there dismantled two illegal cryptocurrency mining centres, arrested nine people, and seized more than 2,000 mining devices along with six illegal power transformation stations. INTERPOL valued the equipment at over $1 million. Those six transformer stations are the tell. The mining was running on stolen or illicitly rigged power, which is the economic core of any operation that wants to turn a profit.
Stolen power was the business model
Mining is a margin business built on one input: electricity. A rig that has to pay retail rates for its own power barely breaks even, so operators chase the cheapest watt they can find, legal or not. Six illegal power transformation stations feeding more than 2,000 devices describe an operation that had solved the power problem by stealing it.
Pulling out the transformers does more lasting damage than hauling off the rigs. Hardware can be rebought in weeks. A diverted municipal power feed takes infrastructure, money, and local cooperation to rebuild, and it leaves a trail that utilities and investigators can follow. The nine arrests tied to the Angolan sites push the cost past equipment and onto the people running it.
A continent-wide net with one US partner
Twenty of the 21 participating countries were African. The United States was the 21st, a reflection of how often the servers and the cash-out points land in US jurisdiction. The arrests ranged well beyond mining.
In Uganda, authorities broke up two transnational fraud rings and arrested 365 foreign nationals running call centres aimed at pensioners in Asia. Nigerian investigators recovered a luxury vehicle and 2.1 million harvested email addresses from a phishing scheme. Tanzania disrupted a mobile loan-app fraud network. The common thread is organized, cross-border operations rather than lone actors, the pattern enforcement agencies have been describing for two years.
Private firms supplied the forensics
Serengeti III leaned on private-sector intelligence. Group-IB, Kaspersky, Fortinet, Team Cymru, and Meta provided technical analysis and network mapping that helped police identify targets. That division of labour has become standard. Public agencies hold the authority to arrest and seize, while private firms trace the infrastructure and the money across chains and borders.
The approach mirrors a larger action announced days earlier, a 30-country push led by the UAE and INTERPOL that flagged over $39 billion in scam-linked funds with help from 13 private companies. Two coordinated operations in the same week point to a shift in tempo: continuous monitoring and faster asset freezes rather than case-by-case subpoenas months after the fact.
The scam math behind the headline
Financial investigators linked the dismantled networks to losses exceeding $385 million and identified 65,929 victims. The gap between $385 million in losses and $105 million recovered is the part worth holding onto. Identifying stolen funds is not the same as returning them, and cross-border restitution stays slow. A large share of flagged crypto often sits in wallets or jurisdictions beyond any single operation's reach.
Neal Jetton, INTERPOL's Director of Cybercrime, framed the result around coordination: "Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm."
For anyone holding or spending crypto, the operational lesson does not change with the scale. Most of these losses begin with a single voluntary transfer to a counterparty that turns out to be fake. A wallet you control is only as safe as the addresses you send to, so treating unsolicited investment pitches and "support agent" contacts as hostile by default remains the cheapest protection available. Prices were quiet as the news circulated, with Bitcoin near $80,831 (down 0.6% on the day) as of October 24, 2026, per CoinMarketCap, and enforcement news of this type rarely moves markets.
Overview
INTERPOL's Operation Serengeti III arrested 1,462 suspects across 21 countries, disrupted 10,909 malicious networks, and recovered more than $105 million between June 29 and August 31, 2026. The distinctive piece was in Angola, where police shut two illegal crypto mining centres powered by six stolen power transformation stations and seized over 2,000 rigs. Investigators tied the networks to $385 million in losses and 65,929 victims, a reminder that identified funds and recovered funds are different numbers. The operation, backed by five private security firms, fits a wider pattern of continuous, cross-border policing of the on- and off-ramps that criminal proceeds pass through.
