NCB’s strong attack on darknet drug mafia, ‘Team Kalki’ busted

Narcotics Control Bureau (NCB) has taken major action against the darknet drug network. NCB has busted a pan-India drug distribution network operating under the name ‘Team Kalki”. This network was active since January 2025 through the darknet platform and encrypted messaging app “Session”. Based on intelligence developed over the last three months, NCB has busted this network by conducting an operation in New Delhi.

Drug consignment recovered

During the operation, NCB officials recovered 2,338 LSD blotters, 160 MDMA (ecstasy) pills (total weight 77.517 grams), 73.612 grams of hashish, 3.642 grams of amphetamine and 3.6 kg of liquid MDMA from 13 domestic parcels and 2 parcels coming from Netherlands. The seizures highlight that drug traffickers are increasingly using darknet marketplaces and encrypted communication platforms to supply narcotics and psychotropic substances.

Major action against smuggling network

This action is being considered a major action against the darknet based narcotics smuggling network in India. Investigation has so far revealed that the darknet vendor “Team Kalki” was being operated by Anurag Thakur along with his associate Vikas Rathi. Both the accused are habitual criminals and have been arrested earlier in cases registered under the Narcotic Drugs and Psychotropic Substances (NDPS) Act, 1985.

This is how Team Kalki started

Vikas Rathi was earlier lodged in Tihar jail in a charas smuggling case registered by the Special Cell of Delhi Police, while Anurag Thakur was in jail in a methamphetamine smuggling case registered by the Delhi Police Crime Branch. Both were lodged in Tihar Jail at the same time, where they met and later together they started the darknet drug network “Team Kalki”.

Vendor account had received four star rating

The accused were initially active on the dark web forum “Dread”, where their vendor accounts had a four-star rating, indicating a large number of successful order completions. After getting established on “Dread”, the accused also started selling and ordering supply of drugs through encrypted messaging app “Session”.

Network to Netherlands, Poland and Germany

Preliminary investigation has revealed that the distribution network of this network was spread across India and the accused were using sophisticated methods to evade law enforcement agencies. It has also been revealed that the accused used to procure drugs like LSD and MDMA from international darknet vendors based in Netherlands, Poland and Germany.

The consignment was sent through courier and parcel services.

Orders from customers across the country were received through dark web forum “Dread” and encrypted messaging app “Session”, keeping their identity and digital footprint hidden. After receiving orders from customers, one of the accused used to pass on the order information to his associate, who handled the packaging of drugs and sending the parcels. After this, the consignment of drugs was sent to different parts of the country through courier and parcel services.

Dead drop delivery technique also used

The investigation also revealed that the network also used “dead drop” delivery technique. In this, the parcels containing drugs were kept at pre-determined places instead of being given directly to the customers. Later the buyers were given information about that location, so that they could pick up the parcel from there and the risk of getting caught was less. This method was mainly used in limited areas of Delhi and only for those customers who already had a record of many orders. Speed ​​post and other courier services were mainly used for delivery to other parts of the country. To avoid detection, different courier or parcel booking offices were used for sending each consignment.

Consignment of drugs was sent to many states

Further investigation revealed that this network had sent consignments of drugs to many states of the country. Some parcels were seized by law enforcement agencies even before delivery in Delhi, Tamil Nadu, Telangana, Kerala and Karnataka, the details of which are being analyzed. Investigating agencies suspect that this network has sent more than 1,000 parcels since January 2025. Several electronic devices have also been recovered from the accused and a cryptocurrency wallet linked to this operation has also been identified.

Use of unhosted wallets like Monero, USDT for payments

The accused used cryptocurrencies for payments and received money through unhosted wallets like Monero and USDT. After this, the amount was routed through several intermediary wallets and after paying a conversion charge of about 10 percent, it was converted into USDT, which was then stored in the cold wallet. In some cases, Mule KYC-based wallets were also used to transfer funds to the formal banking system.

Now NCB team is locating the associates

Temporary unhosted wallets were created to receive USDT payments and as the money arrived, it was transferred through multiple layers of intermediary wallets, thereby hiding the transaction trail and making it difficult for law enforcement agencies to track. NCB is now continuing the investigation to identify other associates associated with this network, trace financial transactions and uncover the international supply chain. Also, efforts are being made to destroy the entire operational ecosystem of “Team Kalki”.

Even before this, NCB took major action

This action is part of NCB’s nationwide campaign against drug smuggling and synthetic drug networks taking place through the darknet. Even before this, NCB has carried out major operations like Operation Catamelon (2025) and Operation Zambada (2023) to dismantle organized drug smuggling gangs and supply chains linked to the international darknet market.

Latest India News