Interpol arrests nearly 1,000 cyber criminals in months-long anti-fraud operation
Operation HAECHI-III sees the seizure of more than $130 million in virtual assets


A months-long operation led by Interpol, and supported by the UK and 29 other countries, to crack down on cyber crime has led to the arrest of 975 people.
The result of Operation HAECHI-III has resolved more than 1,600 cases and the seizure of $129,975,440 (£107 million) worth of virtual assets.
RELATED RESOURCE
The financial services survival guide
How uncertainty and disruption is forcing financial services to innovate
In addition, almost 2,800 bank and virtual asset accounts linked to online financial crime were blocked. Interpol said that investigations during Operation HAECHI-III led to the publication of 95 Interpol notices and the detection of 156 new crime trends.
Interpol also provided some details on the breakdown of each operation and how much they contributed to the total £100m + virtual asset seizure.
Two criminals that each earned Interpol Red Notices - a worldwide arrest order - were tracked to and brought into custody in Greece and Italy respectively after embezzling €28 million (£24 million) from 2,000 Korean victims.
The pair were wanted by Korean authorities under suspicion of being involved in a global Ponzi scheme.
In another case, law enforcement agencies in Austria and India discovered a cyber criminal gang impersonating Interpol officers. These suspected criminals persuaded victims to transfer around $159,000 (£131,491) through financial institutions, cryptocurrency exchanges, and online gift cards. Indian authorities stormed the call centre, confiscating four cryptocurrency wallets and other crime evidence.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
The operation saw the arrival of Interpol’s new Anti-Money Laundering Rapid Response Protocol (ARRP). The organisation’s new worldwide stop-payment mechanism aims to facilitate easier cross-border collaboration between European law enforcement agencies for the purposes of restraining criminal proceeds.
ARRP enabled police in Manchester and Dublin to jointly track and confiscate around €1.2 million (£1 million) lost to business email scams in Ireland.
Since January, the protocol has also helped numerous countries recoup more than $120 million (£99 million) in illicit proceeds from cyber-enabled fraud, Interpol said.
Jürgen Stock, Interpol Secretary General, said that the success of this operation was based on two key elements for law enforcement, “follow the money and cooperation via Interpol”.
“We have highlighted the need for greater efforts to deprive criminals of their illegal gains and this operation has seen member countries doing just that,” he added.
Operation HAECHI-III is the third in a series of operations designed to crack down on cyber criminals. In May 2021, Interpol’s operation HAECHI-I brought together more than 40 specialised law enforcement officers across the Asia Pacific region to intercept a total of $83 million (£68 million) in illicit funds transferred from victims to the perpetrators of cyber-enabled financial crime.
In September 2021, Ireland’s Garda National Cyber Crime Bureau “seized several domains” used in the ransomware attack on the Irish Health Service Executive earlier that year and worked with Interpol to ensure that other states are aware of the systems targeted by Conti ransomware.
In November of the same year, HAECHI-II saw police arrest more than 1,000 individuals and intercept a total of nearly $27 million (£22 million) in illicit funds from cyber criminals, targeting specific types of online fraud, such as romance scams, investment fraud and money laundering associated with illegal online gambling.
Rene Millman is a freelance writer and broadcaster who covers cybersecurity, AI, IoT, and the cloud. He also works as a contributing analyst at GigaOm and has previously worked as an analyst for Gartner covering the infrastructure market. He has made numerous television appearances to give his views and expertise on technology trends and companies that affect and shape our lives. You can follow Rene Millman on Twitter.
-
Geekom Mini IT13 Review
Reviews It may only be a mild update for the Mini IT13, but a more potent CPU has made a good mini PC just that little bit better
By Alun Taylor
-
Why AI researchers are turning to nature for inspiration
In-depth From ant colonies to neural networks, researchers are looking to nature to build more efficient, adaptable, and resilient systems
By David Howell
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the last
News Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
By Ross Kelly
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackers
News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
By Emma Woollacott
-
Healthcare systems are rife with exploits — and ransomware gangs have noticed
News Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
By Nicole Kobie
-
Alleged LockBit developer extradited to the US
News A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
By Emma Woollacott
-
February was the worst month on record for ransomware attacks – and one threat group had a field day
News February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
By Emma Woollacott
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impacted
News The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
By Solomon Klappholz
-
Warning issued over prolific 'Ghost' ransomware group
News The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
By Solomon Klappholz
-
The Zservers takedown is another big win for law enforcement
News LockBit has been dealt another blow by law enforcement after Dutch police took 127 of its servers offline
By Solomon Klappholz