Law enforcement agencies from 21 countries arrested 1,462 suspects, disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds in an Interpol-coordinated crackdown on cybercrime across Africa, the international police organization announced on Thursday.

The sweep, known as Operation Serengeti III and described by Interpol as one of the largest cybercrime enforcement operations ever carried out on the continent, ran from June 29 to August 31, 2026. It targeted ransomware, online scams, business email compromise, digital extortion and other forms of cyber-enabled fraud, according to Interpol's official announcement.

Authorities identified 65,929 victims during the operation, and financial investigations linked the criminal networks to losses of more than $385 million, Interpol said.

Interpol announced the results in a post on X on October 22:

🚨 Operation Serengeti III dismantles thousands of malicious cyber networks

One of Africa's largest cybercrime enforcement operations has seen agencies from 21 countries: 🔵 Arrest 1,462 suspects 🔵 Disrupt 10,909 malicious networks 🔵 Recover USD 105 million in illicit funds… pic.twitter.com/qtkofnnPEA

— INTERPOL (@INTERPOL_HQ) October 22, 2026

Illegal Crypto Mines Dismantled in Angola

In Angola, investigators shut down two illegal cryptocurrency mining centers, arresting nine people and seizing more than 2,000 mining devices along with six illegal power transformation stations. Interpol said the seized electrical equipment alone was valued at more than $1 million.

$2.4 Million in Fraud Proceeds Traced in Nigeria

In Nigeria, one suspect was arrested in connection with an international investment fraud scheme promoted through messaging apps. Investigators traced more than $2.4 million in suspected criminal proceeds, much of which was laundered through cryptocurrency transactions.

Ugandan Call-Center Rings Targeted Pension Scams

Ugandan authorities dismantled two transnational fraud rings and arrested 365 foreign nationals linked to online investment and pension scams aimed at victims in Asia, according to Interpol. The rings ran a rotating call-center operation, using scripts, fake trading platforms and fraudulent websites to persuade pensioners to put money into investment opportunities that did not exist. The arrangement — foreign nationals running call centers against pensioners on another continent — underscored the cross-border reach of the networks Interpol described.

Among the other arrests announced were a Nigerian suspect accused of running a phishing and business email compromise operation that collected approximately 2.1 million email addresses, as well as 30 suspects linked to a cybercrime operation in the Republic of Congo.

"Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale," said Neal Jetton, Interpol's director of cybercrime.

Private-sector partners including Group-IB, Kaspersky, blockchain analytics firm Uppsala Security and Meta supported the operation, according to Interpol. Several investigations remain active as authorities work to identify additional suspects and trace further illicit proceeds.

Crypto Crime in Africa

Operation Serengeti III follows Operation Catalyst, a joint Interpol and Afripol crackdown on terrorist financing and cybercrime in which authorities arrested 83 people across six African countries in 2025. That operation flagged $260 million in illicit crypto and fiat funds, of which $600,000 had been seized, and identified high-value crypto wallets that Interpol said were "potentially linked" to terrorist financing. The $105 million recovered in Serengeti III represents a substantial increase over the $600,000 seized during that earlier operation.

At the time of that earlier operation, an Interpol expert told Decrypt that criminals were "increasingly" using cryptocurrency in Africa, but that digital assets were not yet the main channel through which most cybercrime proceeds were paid or settled. Serengeti III's results underscore that evolving role: cryptocurrency appeared in the operation as mining infrastructure in Angola, as a laundering channel in the Nigerian fraud case and, in the prior Catalyst sweep, through wallets flagged as potentially linked to terrorist financing.