NCB busts pan-India Darknet Drug Network "Team Kalki"; seizes of LSD, MDMA

The network, active on darknet marketplaces and the encrypted messaging platform Session (messaging app) since January 2025, was targeted following three months of intelligence-gathering. The NCB launched a coordinated operation in New Delhi, resulting in the dismantling of the syndicate.

Authorities seized a substantial haul of drugs during the operation, including 2,338 LSD blotters, 160 MDMA (Ecstasy) pills totalling 77.517 grams, 73.612 grams of charas, 3.642 grams of amphetamine, and 3.6 kg of liquid MDMA, recovered from 13 domestic parcels and two international consignments originating from the Netherlands linked to the network, according to a release.

The seizure highlights the growing use of darknet marketplaces and encrypted communication platforms by drug traffickers to distribute narcotic drugs and psychotropic substances. The operation marks one of the significant crackdowns on darknet-based narcotics trafficking networks operating in India.

Investigation revealed that the darknet vendor "Team Kalki" was operated by Anurag Thakur along with his associate Vikas Rathi. Both accused are habitual offenders and were previously arrested in cases registered under the Narcotic Drugs and Psychotropic Substances (NDPS) Act, 1985.

Vikas Rathi had earlier been lodged in Tihar Jail in connection with a charas trafficking case registered by the Delhi Police Special Cell, while Anurag Thakur had been imprisoned in a methamphetamine trafficking case registered by the Delhi Police Crime Branch. Both were lodged in Tihar Jail for the same time, during which they came together and later operated the darknet drug network "Team Kalki."

Initially, the accused were active on the dark web forum "Dread," where the vendor account maintained a four-star rating, indicating successful completion of a large number of orders. Once they established on Dread, also started their operations on the encrypted Session messaging application for vending and order fulfilment.

Preliminary investigation indicates that the network had a pan-India distribution footprint and employed sophisticated methods to evade law enforcement detection. It has further been revealed that the accused allegedly sourced LSD and MDMA from international darknet vendors based in the Netherlands, Poland and Germany. Orders from customers across India were received through encrypted platforms such as the dark web forum "Dread" and the Session messaging application, enabling anonymity and concealment of digital footprints.

Upon receiving orders from customers, one of the accused would relay the order details to his associate, who handled the packaging and dispatch of the narcotic consignments. The drugs were subsequently sent to customers across various parts of the country through courier and parcel services.

The investigation has also uncovered the use of a "dead drop" delivery technique, wherein parcels containing narcotic drugs and psychotropic substances were placed at pre-determined locations instead of being handed over directly to customers. Buyers were subsequently informed of the location details, enabling them to collect the parcels while minimising the risk of detection.

The "dead drop" delivery method was used only in limited areas of Delhi, and primarily for customers with a history of multiple prior orders. For pan-India deliveries, the accused predominantly used Speed Post and other courier/parcel services. As part of a cautious operational approach to avoid detection, a different courier or parcel service booking office was used for each consignment.

Further investigation has revealed that the network had dispatched narcotic drugs to several states across India. Some consignments were intercepted and seized by law enforcement agencies before delivery in Delhi, Tamil Nadu, Telangana, Kerala and Karnataka, and the details of such cases are being analysed.

The network is suspected to have dispatched more than 1,000 consignments since Jan 2025. Multiple electronic devices have been recovered from the accused, and a cryptocurrency wallet linked to the operation has been identified.

The accused accepted payments through cryptocurrencies using unhosted wallets, including Monero and USDT. The proceeds were routed through multiple intermediary wallets, with conversion charges of up to 10%, to convert the funds into USDT, which was subsequently stored in cold wallets. In certain instances, mule KYC-compliant wallets were also used to route the proceeds into the formal banking system.

For receiving USDT payments, temporary unhosted wallets were created dynamically, and the funds received were immediately transferred through multiple layers of intermediary wallets to beneficiary wallets, thereby attempting to obscure the transaction trail and hinder tracking by law enforcement agencies.

NCB is continuing the investigation to identify other associates, trace financial transactions, and uncover the international supply chain linked to the network. Further efforts are underway to dismantle the entire operational ecosystem of "Team Kalki."

This operation is part of NCB's sustained nationwide crackdown on darknet-enabled drug trafficking and synthetic drug networks. In past, NCB has successfully conducted several major operations, including Operation Ketamelon (2025) and Operation Zambada (2023), targeting organised drug trafficking syndicates and dismantling supply chains linked to international darknet markets. (ANI)