Sharjah Police have dismantled four interconnected international criminal networks accused of combining cryptocurrency theft, cyberattacks, social engineering, money laundering and physical violence, arresting 33 suspects in one of the UAE’s largest disclosed digital-asset crime operations.
The operation, codenamed “End of Battle,” involved suspects from 12 nationalities and was carried out by Sharjah Police in cooperation with the UAE Ministry of Interior and other local and international authorities.
Sharjah Police said authorities seized and confiscated more than AED200 million, placed more than 3,000 digital wallets under audit and investigation, protected more than 30 companies and institutions worldwide, and secured assets valued at more than AED65 billion.
Those figures describe different parts of the investigation and should not be treated as interchangeable. The AED65 billion represents assets authorities say were secured, not money stolen by the networks. Sharjah Public Prosecution separately put the funds involved in alleged money-laundering offenses at AED8.825 billion, approximately $2.4 billion.
The suspects have been accused of criminal activity, but those allegations remain subject to the judicial process.
Four Networks Allegedly Divided the Criminal Work
Authorities described a structure in which different groups specialized in different stages of the operation rather than every suspect carrying out the same type of attack.
One network allegedly conducted cyberattacks and stole customer information and databases. A second handled money laundering through virtual assets and other financial channels. A third allegedly used social engineering to manipulate victims and steal digital wallets, while a fourth was accused of using violence and intimidation to obtain access to victims’ wallet credentials.
The structure is significant because it connects several types of crypto crime that are often investigated separately.
A stolen customer database, for example, can provide the identifying information needed for a convincing targeted social-engineering attack. Successful wallet theft then creates another problem: converting and laundering the assets without exposing the people controlling them.
Authorities allege that the networks operated as parts of the same wider organization.
Sharjah Public Prosecution said illicit proceeds were routed through bank accounts, digital wallets and multiple platforms, with companies and intermediaries allegedly used to disguise the source and movement of the funds before value was converted into property and other investments.
Police Say Closed Platforms Changed Every Eight Hours
The investigation also provides unusual detail about how the alleged organization attempted to keep members and communications hidden.
Sharjah Police said the networks used layers of encryption and closed digital platforms accessible only to members. Some of those platforms reportedly changed every eight hours in an effort to make surveillance, tracking and attribution more difficult.
Police said their Digital Crimes Department uncovered the underlying infrastructure through extended monitoring and analysis before dismantling the four networks and their affiliated groups.
The investigation ultimately extended well beyond online activity. Authorities said the organization was also linked to violent assaults, while local reporting on the police briefing described alleged plans targeting owners of digital wallets.
That creates a direct connection between cybercrime and the physical security of people controlling valuable crypto assets. The problem was illustrated separately in Canada this week, where a cryptocurrency exchange owner was allegedly kidnapped at gunpoint by suspects police say wanted access to digital assets and business security systems.
In both threat models, strong cryptography alone is not enough. An attacker who cannot technically break a wallet may instead try to deceive, threaten or physically coerce the person who can authorize a transaction.
More Than 3,000 Wallets Are Now Part of the Investigation
The examination of more than 3,000 digital wallets could become one of the most consequential parts of the Sharjah investigation.
Public blockchains can allow investigators to reconstruct transfers, identify transaction timing and trace funds as they move between addresses, exchanges, bridges and other services. But a wallet address is evidence of blockchain activity, not automatically proof of who controlled it.
The distinction matters particularly in an investigation involving thousands of addresses. One person can control many wallets, while a single exchange, protocol or intermediary address can process assets belonging to many unrelated users.
Recent crypto investigations have shown how easily the two questions can become confused. In one case, a disputed wallet attribution caused an apparent hacker transfer to Binance to unravel after an address was identified as infrastructure used by THORChain rather than an attacker-controlled wallet.
Sharjah authorities have not publicly released the 3,000 addresses, a breakdown of the assets held in them or the methodology used to determine which wallets required investigation.
The $54 Million Seizure Is Not the Same as the $2.4 Billion Laundering Case
The headline numbers also need careful separation.
More than AED200 million, equivalent to roughly $54 million, was seized and confiscated during the operation. Prosecutors, however, allege that approximately AED8.825 billion passed through the money-laundering operation.
The difference is substantial, but it is normal for the value of alleged criminal financial flows to be much larger than the assets eventually frozen or seized. Laundered money can be converted, spent, transferred overseas, divided among intermediaries or moved through assets and services outside the immediate reach of investigators.
Even when blockchain investigators can see where cryptocurrency went, seeing it is not the same as controlling it. As Dave Finances has previously examined, tracing, freezing, seizing and ultimately returning stolen crypto are separate stages.
The same caution applies to the AED65 billion figure. Police described that amount as assets secured or protected as a result of the operation. It should not be interpreted as AED65 billion seized from suspects or as a confirmed loss suffered by victims.
Why the Four-Network Structure Matters
The most important feature of the case may not be the size of any individual seizure. It is the degree of specialization authorities say existed inside the alleged organization.
Crypto crime is often described as if a hacker compromises a wallet, steals tokens and launders them alone. A mature criminal network can operate more like a supply chain.
One group obtains data. Another converts that data into convincing social-engineering attacks. Another takes control of assets. Financial specialists then attempt to obscure the proceeds, while a separate group can apply physical pressure when digital methods fail.
That structure makes defenses built around one threat increasingly inadequate.
A company can keep its private keys technically secure and still expose executives or customers through leaked identity data. A user can avoid phishing links but remain vulnerable to physical coercion. An exchange can detect suspicious wallet movements but still struggle to determine the beneficial owner behind a chain of intermediary accounts.
For crypto companies, this makes security architecture as much an organizational issue as a software problem. Access to major wallets should be divided so that compromising or coercing one employee is insufficient. Sensitive customer data should be separated from systems that reveal balances or withdrawal authority, while high-value transfers can require multiple independent approvals.
For investigators, the Sharjah case also shows why blockchain transparency is useful but incomplete. The more than 3,000 wallets may provide a detailed map of the financial layer, but turning that map into criminal attribution still requires evidence connecting addresses to people, companies, devices and real-world conduct.
Operation End of Battle is therefore more than another crypto seizure story. If the authorities’ allegations are proven, it describes an organization that connected hacking, stolen data, social engineering, digital-wallet theft, laundering and physical intimidation into a single cross-border operation.
The AED200 million seizure is the most immediately measurable result. The larger question is how much of the alleged AED8.825 billion laundering network can ultimately be traced, frozen and recovered — and how many of the more than 3,000 wallets can be reliably tied to the people and entities now facing prosecution.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574