A suspected crypto investment network operating from Himachal Pradesh’s Mandi district is now being examined for links stretching from Uttar Pradesh to Nepal after police found indications that the accused may have used similar high-return schemes outside the state.
Investigators say Maharashtra resident Anil Gaurav Dhote allegedly opened a company called Sirafina in Kamand in 2025 and promised investors that their money could double within 60 to 70 days through cryptocurrency trading. Around 22 investors and more than ₹4 crore in alleged investments have surfaced so far.
The case was initially registered by Padhar Police in January after one investor complained that he had transferred more than ₹31 lakh online and allegedly handed over another ₹4 lakh in cash.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
Fake profits allegedly turned investors into recruiters
Police say one of the most effective parts of the scheme was the way supposed profits were shown almost immediately after an investment.
If someone deposited ₹2 lakh, an increased balance could allegedly appear in the online account within one or two hours.
That did not necessarily mean any genuine crypto trade had taken place.
Investigators suspect the displayed figures were used to create the impression that the investment was already generating extraordinary returns.
Once investors saw their balances rising, some allegedly invested more money and encouraged relatives, friends and colleagues to join.
This effectively turned existing investors into informal recruiters without necessarily knowing that the displayed profits may have been artificial.
The method mirrors a common investment-fraud pattern: show success first, collect larger amounts later.
Company allegedly promised money would double in 60 to 70 days
According to the investigation, Sirafina allegedly promoted crypto trading with promises that investments could double within roughly two months.
Such a return would mean a 100% gain in only 60 to 70 days.
One complainant told police that he was promised returns through BTC and USD live trading and was given company-letterhead documents and security cheques to make the arrangement appear credible.
He allegedly transferred ₹31.05 lakh into bank accounts specified by the company and claimed to have paid another ₹4 lakh in cash.
When the money had not been returned by January, he approached the Kamand office.
The complaint alleges that he was abused and threatened when he demanded repayment, after which the matter reached police.
These remain allegations and have not been established through a court finding.
‘Server down’ allegedly became the excuse when withdrawals started
Police say the scheme changed once enough money had been collected.
Investors who attempted to withdraw their funds were allegedly told that the website server was down.
The balances remained visible, but the money could no longer be accessed.
Eventually, investors allegedly received neither their original capital nor the profits shown on screen.
This distinction is important in online investment fraud.
A balance displayed inside a private platform is not proof that the money exists.
Unless funds are actually held through a legitimate, independently verifiable trading or exchange account, the platform operator may be able to change the number shown to the user at will.
That fake balance can then be used to persuade the victim to invest more.
Police probe alleged UP and Nepal links
The investigation has now widened beyond Mandi.
Police say the accused’s network allegedly extended to Uttar Pradesh and Nepal and that investigators are examining whether similar frauds were carried out there earlier.
Dhote is from Maharashtra and has family connections in Kangra district, according to the police investigation.
Authorities are examining his earlier movements, associates, company documents, bank accounts and the online system used to display investment balances.
The cross-border element remains under investigation.
A link to Nepal does not by itself establish that money was transferred there or that a Nepal-based criminal network participated. Investigators still need to establish who operated the accounts, where the funds ultimately moved and whether others knowingly assisted the scheme.
₹4 crore may not be the final figure
Police have so far identified around 22 investors from available complaints and records.
The alleged amount exceeds ₹4 crore, but investigators believe the figure could increase because some victims may not yet have approached police.
That also means the current number should not be treated as a final audited loss.
Authorities are still matching bank transactions, investment records and individual complaints.
Separately, some reporting has cited substantially higher estimates involving additional investors, including people connected with IIT Mandi. Those higher figures have not yet been consistently confirmed across reliable sources, so the verified ₹4 crore-plus amount remains the safer figure at this stage.
What this means for you
Any scheme promising to double money within 60 or 70 days should be treated as an extreme warning sign. A rising balance on a website or app is not proof of a real investment; verify where the money is actually held and whether the entity is legally authorised before transferring funds.
The420 Insight
The strongest tool in this alleged scheme was not cryptocurrency itself. It was the fake appearance of success. Once investors saw apparently doubled balances on screen, some began bringing in friends and relatives, allowing trust within the community to do much of the recruiting for the operator.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
