The victim, Ashok Vijayvargiya, a senior Chartered Accountant and Chief Returning Officer of the Madhya Pradesh Chamber of Commerce and Industries, allegedly lost Rs 21,05,92,000 between December 2025 and July 2026 after being lured into a fake USDT cryptocurrency trading scheme.
According to the preliminary investigation by the Gwalior State Cyber Cell, the money did not remain confined to a few fraudulent accounts. Instead, it was allegedly transferred through a highly complex four-layer banking network spread across several states, making recovery and tracking difficult.
The suspected fake trading platform displayed fictitious profits exceeding Rs 33 crore, convincing Vijayvargiya that his investments were generating substantial returns. However, when he attempted to withdraw the amount, the alleged fraudsters blocked the transaction and demanded additional payments.
The Cyber Cell has so far managed to freeze around Rs 2 crore, but investigators stated that the remaining funds were allegedly transferred, withdrawn, converted or used for other payments before action could be taken.
Preliminary findings indicate that the fraudsters used a multi-level transfer structure to hide the movement of funds. The cyber team has prepared a detailed list of 77 bank accounts and initiated action to block and investigate them.
From these first-layer accounts, the money allegedly moved into 493 second-layer accounts. It was then distributed further into approximately 12,700 third-layer accounts.
Investigators detected around 7,500 additional transactions in the fourth layer, where the money was allegedly withdrawn or converted through ATMs, shopping vouchers, cash vouchers, online payments and cryptocurrency transactions, including USDT.
The investigation has so far identified approximately 20,049 transactions connected to the fraud.
Officials believe the funds were deliberately divided into multiple amounts and circulated rapidly so that they would not remain in any account long enough to allow banks or law enforcement agencies to freeze them.
The investigation trail has reached bank accounts in Karnataka, Tamil Nadu, Andhra Pradesh, Kerala, Haryana, Uttar Pradesh, Gujarat, Rajasthan, Madhya Pradesh, Jharkhand, West Bengal and Chhattisgarh.
Investigators suspect that the network extends across the country, with several suspected mule accounts being operated or controlled at different levels.
The large-scale transaction pattern indicates that not every account holder involved may be directly connected with the masterminds. Some accounts may belong to money mules, individuals who allow their accounts to be used for receiving and transferring illegal funds in exchange for commissions. Others may be linked to fake companies, intermediaries, digital wallet operators or organised cybercrime networks.
The Cyber Cell is now investigating the final destination of the money after it passed through the fourth layer.
State Cyber Cell Deputy Superintendent of Police Sanjeev Nayan Sharma confirmed that the case involved a nationwide network of accounts and transactions.
“In one of the country's major fraud cases, senior Chartered Accountant Ashok Vijayvargiya was swindled out of Rs 21.06 crore under the guise of cryptocurrency, or USDT, trading. The funds were transferred through thousands of accounts across the country using a four-layer structure,” Sharma said.
He added that investigators were initially focusing on the accounts that directly received money from the victim.
“Our technical team is scrutinising 77 first-layer bank accounts, and we have successfully frozen approximately Rs 2 crore across various accounts. We are also tracking the IP addresses associated with fraudulent links and WhatsApp numbers,” the Deputy Superintendent of Police said.
Sharma said the technical investigation includes three WhatsApp numbers, multiple bank accounts and the online trading platform used in the alleged fraud.
“A case has been registered under relevant legal provisions. The team is working to freeze bank accounts, trace IP addresses and identify and arrest the accused,” he said.
The First Information Report was registered against unidentified accused under Sections 318(4) and 319(2) of the Bharatiya Nyaya Sanhita and Section 66D of the Information Technology Act. The complaint records the alleged financial loss at Rs 21,05,92,000.
The case has drawn comparisons with the popular “Pooja” conversation theme from the Ayushmann Khurrana film Dream Girl. However, in Gwalior, the interaction was not fictional entertainment but an alleged real-life cybercrime operation.
According to the complaint, Vijayvargiya received a message in December 2025 from an Indian mobile number. The sender introduced herself as “Divya” and claimed to be an investment adviser.
She allegedly informed him that investments in USDT Tether, a cryptocurrency designed to maintain a value linked to the United States dollar, could generate unusually high returns in a short period.
The initial communication reportedly took place through an Indian mobile number before shifting to other numbers, including a number carrying the United States country code, +1 (516) 713-7291.
Police are verifying this number and suspect that it may be a virtual number, meaning the communication may not have physically originated from the United States.
The alleged fraudsters sent Vijayvargiya a link to an online trading platform and assisted him in creating an account. After registration, the platform displayed investment opportunities involving USDT, Bitcoin and other digital assets. The suspected fraudsters remained in regular contact through WhatsApp and guided him through the investment process.
The initial investments were intentionally kept small. On December 25, 2025, Vijayvargiya allegedly transferred Rs 10,000 four times through UPI. A few days later, around Rs 1 lakh was transferred through a friend's UPI account.
The platform displayed profits from these investments. On January 7, the alleged fraudsters transferred Rs 1.88 lakh into Vijayvargiya’s HDFC Bank account as an initial return.
The actual credit of money into his bank account strengthened his belief that the platform was genuine and that the individuals advising him were trustworthy.
Cybercrime investigators said allowing victims to withdraw small profits is a common method used in online investment frauds to build confidence before demanding larger investments.
After gaining his trust, the alleged fraudsters increased the investment demands. On December 31, Vijayvargiya had already transferred Rs 15 lakh through RTGS from his Union Bank account to an account provided by the alleged operators.
Over the following months, crores of rupees were transferred into multiple bank accounts.
Business associates connected with Vijayvargiya reportedly stated that he may not have been the only person whose money became linked with the platform. According to them, more than 35 acquaintances and business associates who trusted his financial judgment and were prepared to invest based on his advice may also have become connected with the operation.
As the deposits increased, the suspected trading platform continued displaying rising returns. Eventually, Vijayvargiya’s account allegedly showed a profit or withdrawal value of approximately Rs 33.25 crore.
However, when he attempted to withdraw the amount, the transaction was blocked. The alleged fraudsters then demanded Rs 10.84 crore as income tax before releasing the money.
This marked the final stage of the alleged fraud. Every attempt to withdraw the displayed profit reportedly resulted in fresh demands for additional payments.
To make the process appear legitimate, the alleged handlers reportedly offered to contribute Rs 5.34 crore themselves and asked Vijayvargiya to arrange the remaining amount.
Even after further payments and assurances, the money was not released. The alleged fraudsters later demanded another Rs 1 crore as a “risk margin”, claiming it was required because the withdrawal amount exceeded the permitted limit.
Vijayvargiya then realised that the profits displayed on the platform may never have existed.
He provided WhatsApp conversations, transaction screenshots, bank statements and details of several beneficiary accounts to the Cyber Cell.
Police stated that the complaint was also registered through the National Cyber Crime Reporting Portal and the 1930 cybercrime helpline. The timely reporting helped banks and cyber investigators place approximately Rs 2 crore on hold in different accounts.
A major focus of the investigation is the number carrying the United States country code. Police are examining whether it was genuinely operated from abroad or was a virtual number created through an internet-based service.
Investigators are also tracing IP addresses linked to WhatsApp communications and the suspected trading platform.
The case highlights the growing complexity of cryptocurrency-related cyber frauds, where victims are targeted through fake investment opportunities and stolen funds are moved through multiple layers of accounts across the country before authorities can intervene
About The Author
Comment List