⚠️ DISCLAIMER: Ministry of Cyber Affairs is an independent news, guides and directory service on cybercrime and cybersecurity, for victims and investigators. It is NOT an official government or ministry portal.
Website Scam CheckerNew
Back to News

ED Searches Mudrex and Instadapp Over Rs 5,000 Crore in Cross-Border Crypto Transfers

30 October 2026
Source:Directorate of Enforcement
Share
ED Searches Mudrex and Instadapp Over Rs 5,000 Crore in Cross-Border Crypto Transfers

The Enforcement Directorate searched premises in Bengaluru and Madhya Pradesh on 27 October 2026 under FEMA over unauthorised cross-border transfers using stablecoins worth more than Rs 5,000 crore. The probe covers RPFAS Technologies, which runs Mudrex and Saber.money (about Rs 4,600 crore), and DeFi platform Instadapp/Fluid (about USD 40 million), with shell entities in tax havens.

The Enforcement Directorate (ED), Bengaluru Zonal Office, searched premises in Bengaluru and Madhya Pradesh on 27 October 2026 under Section 37 of the Foreign Exchange Management Act (FEMA), 1999, over unauthorised cross-border financial transactions using cryptocurrency, especially stablecoins, worth more than Rs 5,000 crore.

ED announced the searches on 29 October.

Mudrex and Saber.money

The investigation began with complaints of large-scale FEMA violations by Bengaluru-based RPFAS Technologies Private Limited, which operates the platforms Mudrex and Saber.money.

ED said the company ran an unauthorised cross-border payment system using stablecoins such as USDT and USDC, bypassing authorised banking channels, and advertised instant money transfer across borders without RBI authorisation.

The platforms offered on-ramp and off-ramp services, converting rupees and other currencies into crypto and back.

Saber.money's website markets itself as stablecoin payment infrastructure for India and South East Asia.

According to ED, the modus operandi was:

  • A user registers on the platform.
  • Money is deposited into the company's bank account.
  • The money buys virtual digital assets, mainly stablecoins such as USDT.
  • The assets are sold on Indian crypto exchanges and the proceeds remitted to the receiver.

ED said the company did not comply with RBI rules on inward and outward remittances.

It operated through related entities registered abroad but controlled from India, used large OTC deals and shell entities incorporated in Canada, Lithuania and the USA, and held large crypto assets on foreign platforms such as Binance and Bybit.

Preliminary findings put the FEMA contravention at more than Rs 4,600 crore.

Instadapp and Fluid

ED also searched two premises in Bengaluru and one in Madhya Pradesh linked to Instadapp, a decentralised finance (DeFi) protocol on Ethereum that now operates largely as Fluid.

Though presented as run by US-registered Instadapp Labs LLC, ED said it is managed from India by its founders, including Sowmay Jain.

ED said protocol revenue and investor funds were received as stablecoins in multi-signature wallets of Interop Labs Ltd (British Virgin Islands) controlled from India.

The stablecoins were sold on Independent Reserve and QCP Capital in Singapore, and the proceeds credited to Singapore accounts of Upsurge Labs and Bhindi Labs.

The money then reached India as payments for software development and consultancy, which ED called bogus.

Singapore prepaid cards were used for Indian expenses, and funds were moved to the founders' Dubai bank accounts.

The searches found that the shell entities in Delaware, the British Virgin Islands, Singapore and Dubai had no physical office or staff.

Preliminary findings put the contravention at about USD 40 million.

Investigation is ongoing.

More in Cybercrime Trends

Related articles

Cybercrime Trends (News)

Spain's National Police Arrest 43 Over Bank Antifraud SMS Scam That Took More Than $1.26 Million

Spain's National Police have arrested 43 people accused of posing as bank antifraud departments in a smishing and vishing scheme that defrauded more than 130 victims of over $1.26 million (€1.14 million). Officers said they had clarified 134 offences. The suspects face charges of belonging to a criminal group, fraud and money laundering. A further 13 people were questioned without being detained, and 95 have been formally accused in all. The year-long inquiry is continuing.

12 Nov 2026
Cybercrime Trends (News)

India's UP Police Arrest Man Accused of Running Telegram Groups to Share Child Sexual Abuse Material, Acting on NCMEC CyberTipline Alert

Police in Bhadohi, in India's Uttar Pradesh state, have arrested a 27-year-old man accused of creating multiple Telegram groups to collect and share child sexual abuse material (CSAM). The case began with a CyberTipline report received at Koirauna police station. An FIR was registered under India's IT Act, the POCSO Act and the Bharatiya Nyaya Sanhita. Officers recovered a Redmi (Xiaomi 15) phone said to have been used in the offence. The arrest was made on 10 November 2026.

12 Nov 2026
Cybercrime Trends (News)

India's ED Arrests Crypto Founder Over Betting and Cyber-Fraud Laundering via Jubilee Hills Mercantile Co-operative Bank, Nagarbhavi Credit Society

India's Enforcement Directorate has arrested Sagar Dash, founder of Armstrong Exchange Pvt Ltd, in its money laundering probe into the All Panel Exchange (APX) betting platform. ED alleges victims' money moved through mule accounts at Jubilee Hills Mercantile Co-operative Bank, Hyderabad, and shell firms into an account at Nagarbhavi Credit Co-operative Society, Bengaluru, and that Dash used the society's KYC and forged papers to open a crypto account. About $960,000 is frozen.

11 Nov 2026