NCB Dismantles Massive Darknet Drug Network Known as ‘Team Kalki’
Two habitual offenders arrested; network involved in substantial drug distribution via the darknet since 2025.
Background of the Case
- The Narcotics Control Bureau (NCB) dismantled a pan-India darknet drug distribution network named ‘Team Kalki’ in March 2026.
- The network had reportedly been operating since January 2025 through darknet forums and encrypted communication platforms.
- Two main accused — Anurag Thakur and Vikas Rathi — have been arrested so far.
- Both individuals were previously arrested under the Narcotic Drugs and Psychotropic Substances (NDPS) Act and had earlier served time in Tihar Jail, where they are believed to have formed the partnership that later ran the network.
This case highlights the growing role of digital technologies, darknet markets, and cryptocurrencies in organised drug trafficking.
Drugs Seized in the Operation
The NCB seized multiple narcotic and psychotropic substances from 15 intercepted parcels (13 domestic and 2 international):
- 2,338 LSD blotters
- 160 MDMA (Ecstasy) pills weighing more than 77 g
- 73.61 g of charas (hashish)
- 3.64 g of amphetamine
- 3.6 kg of liquid MDMA
Some of the seized parcels were international shipments originating from the Netherlands, indicating links with global drug suppliers.
Modus Operandi of the Network
Use of the Darknet
- The accused initially operated on the darkweb forum “Dread”, a platform commonly used for anonymous discussions and illegal marketplaces.
- After establishing contacts, they expanded operations through the encrypted messaging application “Session.”
These platforms provided high anonymity, encrypted communication, and pseudonymous identities, making detection difficult for law enforcement agencies.
Drug Procurement and Distribution
The supply chain operated in several stages:
International sourcing
- LSD and MDMA were procured from darknet vendors located in the Netherlands, Poland, and Germany.
Order placement
- Customers across India placed orders through encrypted communication channels.
Packaging and dispatch
- One accused coordinated orders, while the other handled packaging and courier dispatch.
Distribution
-
Drugs were delivered across multiple States including:
- Delhi
- Tamil Nadu
- Telangana
- Kerala
- Karnataka
The network is suspected to have sent more than 1,000 consignments since January 2025, indicating the scale of operations.
Delivery Techniques Used
Courier-Based Distribution
- For pan-India deliveries, drugs were sent through courier and parcel services.
- To evade detection, the network used different courier booking offices for each consignment.
This strategy reduced the risk of pattern detection by authorities.
“Dead Drop” Delivery Method
In limited areas of Delhi, the network used the dead drop technique:
- Parcels were placed at pre-determined hidden locations rather than handed over directly.
- Buyers received location details after payment.
- Customers collected the package themselves.
This method minimized direct contact between seller and buyer, reducing the risk of identification.
Financial Transactions and Cryptocurrency Use
The network used cryptocurrencies and complex laundering techniques to obscure financial trails.
Payment Methods
-
Payments were accepted through unhosted cryptocurrency wallets, including:
- Monero (known for strong privacy features)
- USDT (Tether)
Money Laundering Techniques
To avoid detection:
- Temporary unhosted wallets were dynamically created for receiving payments.
- Funds were immediately transferred across multiple intermediary wallets.
- Cryptocurrency was eventually converted into USDT, often incurring conversion charges of up to 10%.
- Funds were then stored in cold wallets (offline wallets).
Entry into the Formal Financial System
- In some cases, proceeds were routed through mule accounts with KYC-compliant wallets, allowing conversion into regular banking channels.
This layered structure makes tracking illicit financial flows extremely difficult.
Investigation and Enforcement
The NCB investigation is ongoing and focuses on:
- Identifying other associates involved in the network
- Tracing cryptocurrency transactions
- Mapping the international supply chain
The agency is also examining previously intercepted consignments across several States to establish the network’s full extent.
Related Anti-Darknet Operations by NCB
The NCB has previously conducted major operations targeting international darknet drug networks:
- Operation Ketamelon (2025)
- Operation Zambada (2023)
These operations reflect a growing focus on cyber-enabled narcotics trafficking.
Key Concerns Highlighted by the Case
- Increasing use of the darknet for narcotics trade
- Expansion of cryptocurrency-based payment systems
- Growing international drug supply chains
- Use of courier networks and anonymous delivery techniques
- Difficulty in tracking financial flows and identifying offenders
The case illustrates how digital technologies are transforming organised drug trafficking, requiring stronger coordination between cybercrime units, financial intelligence agencies, and international law enforcement bodies.
Attribution
Original content sources and authors
Syllabus classification
How this article maps to GS papers
Main syllabus
GS3Internal SecurityQuick Q&A
What is the darknet and how is it increasingly being used for illegal narcotics trade in India?
The darknet refers to a portion of the internet that is intentionally hidden and accessible only through specialised software such as Tor (The Onion Router). Unlike the surface web, which can be accessed through standard browsers, darknet platforms are designed to provide anonymity by masking the identity and location of users. While this technology was initially developed to protect privacy and enable secure communication, it has increasingly been misused for illegal activities such as drug trafficking, arms trade, cybercrime, and money laundering.
In recent years, the darknet has become a major platform for the global narcotics trade. Online marketplaces operating on encrypted networks allow vendors to sell drugs anonymously to customers across the world. Transactions are usually conducted using cryptocurrencies such as Bitcoin, Monero, or USDT, which provide additional layers of anonymity. In the case highlighted in the article, the network named “Team Kalki” used darknet forums like “Dread” and encrypted messaging applications to receive orders from customers across India.
The operation of such networks demonstrates how digital technologies have transformed the drug trade. Instead of traditional street-level transactions, narcotics can now be ordered online and delivered through courier services. For example, the accused in the case sourced LSD and MDMA from international vendors in the Netherlands, Germany, and Poland and distributed them through parcels across multiple Indian states.
The rise of darknet drug markets poses serious challenges for law enforcement agencies because transactions are encrypted and decentralised. As a result, combating such networks requires advanced cyber investigation techniques, international cooperation, and specialised agencies such as the Narcotics Control Bureau (NCB) to monitor digital trafficking routes.
In recent years, the darknet has become a major platform for the global narcotics trade. Online marketplaces operating on encrypted networks allow vendors to sell drugs anonymously to customers across the world. Transactions are usually conducted using cryptocurrencies such as Bitcoin, Monero, or USDT, which provide additional layers of anonymity. In the case highlighted in the article, the network named “Team Kalki” used darknet forums like “Dread” and encrypted messaging applications to receive orders from customers across India.
The operation of such networks demonstrates how digital technologies have transformed the drug trade. Instead of traditional street-level transactions, narcotics can now be ordered online and delivered through courier services. For example, the accused in the case sourced LSD and MDMA from international vendors in the Netherlands, Germany, and Poland and distributed them through parcels across multiple Indian states.
The rise of darknet drug markets poses serious challenges for law enforcement agencies because transactions are encrypted and decentralised. As a result, combating such networks requires advanced cyber investigation techniques, international cooperation, and specialised agencies such as the Narcotics Control Bureau (NCB) to monitor digital trafficking routes.
Why does the emergence of darknet-based narcotics networks pose a major challenge for law enforcement agencies?
Darknet-based narcotics networks present complex challenges for law enforcement because they combine advanced digital technologies with traditional criminal operations. Unlike conventional drug trafficking, which often relies on physical networks and direct transactions, darknet markets operate through encrypted platforms that protect the identity of buyers and sellers. This anonymity makes it difficult for authorities to track criminal actors using traditional surveillance techniques.
One major challenge is the use of cryptocurrencies for financial transactions. Digital currencies such as Monero and USDT are often used because they offer greater privacy than traditional banking systems. In the case of the “Team Kalki” network, payments were routed through multiple intermediary wallets before being stored in cold wallets, making it extremely difficult to trace the financial trail. Additionally, criminals sometimes use mule accounts or KYC-compliant wallets to convert digital assets into conventional currency.
Another difficulty lies in the use of global supply chains. Drugs can be sourced from international darknet vendors located in different countries and shipped through postal or courier services. This transnational nature requires cooperation between multiple law enforcement agencies across borders. Without such coordination, criminal networks can exploit jurisdictional gaps.
Furthermore, criminals employ sophisticated delivery methods such as the “dead drop” technique, where drugs are hidden in public locations and customers are informed of the pickup point later. Such techniques reduce direct interaction between traffickers and buyers, making detection more difficult. Therefore, addressing darknet drug trafficking requires advanced cyber forensics, international intelligence sharing, and stronger digital regulatory frameworks.
One major challenge is the use of cryptocurrencies for financial transactions. Digital currencies such as Monero and USDT are often used because they offer greater privacy than traditional banking systems. In the case of the “Team Kalki” network, payments were routed through multiple intermediary wallets before being stored in cold wallets, making it extremely difficult to trace the financial trail. Additionally, criminals sometimes use mule accounts or KYC-compliant wallets to convert digital assets into conventional currency.
Another difficulty lies in the use of global supply chains. Drugs can be sourced from international darknet vendors located in different countries and shipped through postal or courier services. This transnational nature requires cooperation between multiple law enforcement agencies across borders. Without such coordination, criminal networks can exploit jurisdictional gaps.
Furthermore, criminals employ sophisticated delivery methods such as the “dead drop” technique, where drugs are hidden in public locations and customers are informed of the pickup point later. Such techniques reduce direct interaction between traffickers and buyers, making detection more difficult. Therefore, addressing darknet drug trafficking requires advanced cyber forensics, international intelligence sharing, and stronger digital regulatory frameworks.
How do cryptocurrencies and encrypted communication platforms facilitate illegal drug distribution networks?
Cryptocurrencies and encrypted communication platforms play a central role in enabling modern drug trafficking networks operating through the darknet. These technologies provide anonymity, security, and decentralised financial systems that make it difficult for law enforcement agencies to track illegal activities.
Cryptocurrencies such as Monero, Bitcoin, and USDT are widely used in darknet transactions because they allow users to transfer funds without relying on traditional banking systems. In many cases, traffickers create temporary digital wallets to receive payments and then move funds through multiple intermediary wallets. This process, often called “layering,” obscures the origin of funds and makes financial tracing extremely complex. In the case mentioned in the article, the accused dynamically created unhosted wallets and transferred funds through several layers before storing them in cold wallets.
Encrypted messaging applications also play a critical role in facilitating communication between buyers and sellers. Platforms like Session or other end-to-end encrypted services ensure that conversations cannot be easily intercepted by law enforcement agencies. These platforms allow traffickers to manage orders, coordinate logistics, and communicate with customers securely.
Combined with courier-based logistics systems, these digital tools have created a new model of drug distribution that is more decentralised and technologically sophisticated. Instead of large physical drug shipments, small parcels are sent across multiple locations, reducing the risk of large-scale seizures. This integration of digital technologies and logistics infrastructure has made the modern narcotics trade more resilient and difficult to dismantle.
Cryptocurrencies such as Monero, Bitcoin, and USDT are widely used in darknet transactions because they allow users to transfer funds without relying on traditional banking systems. In many cases, traffickers create temporary digital wallets to receive payments and then move funds through multiple intermediary wallets. This process, often called “layering,” obscures the origin of funds and makes financial tracing extremely complex. In the case mentioned in the article, the accused dynamically created unhosted wallets and transferred funds through several layers before storing them in cold wallets.
Encrypted messaging applications also play a critical role in facilitating communication between buyers and sellers. Platforms like Session or other end-to-end encrypted services ensure that conversations cannot be easily intercepted by law enforcement agencies. These platforms allow traffickers to manage orders, coordinate logistics, and communicate with customers securely.
Combined with courier-based logistics systems, these digital tools have created a new model of drug distribution that is more decentralised and technologically sophisticated. Instead of large physical drug shipments, small parcels are sent across multiple locations, reducing the risk of large-scale seizures. This integration of digital technologies and logistics infrastructure has made the modern narcotics trade more resilient and difficult to dismantle.
What factors explain the growing use of courier networks and parcel services in narcotics trafficking?
The increasing use of courier networks in narcotics trafficking reflects the evolving strategies of criminal organisations seeking to reduce the risk of detection. Traditionally, drug trafficking relied on physical handovers or smuggling through transport routes such as land borders or seaports. However, modern trafficking networks increasingly exploit legitimate logistics systems such as postal and courier services to distribute small quantities of narcotics across wide geographical areas.
One major reason for this shift is the efficiency and reach of modern logistics infrastructure. Courier services can deliver packages quickly across different states or even internationally, making them ideal for distributing narcotics in small consignments. In the case of the “Team Kalki” network, the accused reportedly dispatched more than 1,000 consignments across India using various courier services.
Another factor is the ability to avoid detection by using multiple courier booking offices. By sending each consignment through a different courier office, traffickers reduce the likelihood of patterns being detected by law enforcement agencies. Small packages containing drugs such as LSD blotters or MDMA pills can easily be concealed within ordinary parcels.
Additionally, the integration of darknet marketplaces with courier logistics has created an e-commerce-like drug distribution system. Customers place orders online, make payments through cryptocurrency, and receive deliveries through postal channels. This model allows traffickers to scale their operations nationally while maintaining anonymity. Consequently, monitoring parcel networks and improving coordination between law enforcement agencies and logistics providers has become a critical aspect of drug control strategies.
One major reason for this shift is the efficiency and reach of modern logistics infrastructure. Courier services can deliver packages quickly across different states or even internationally, making them ideal for distributing narcotics in small consignments. In the case of the “Team Kalki” network, the accused reportedly dispatched more than 1,000 consignments across India using various courier services.
Another factor is the ability to avoid detection by using multiple courier booking offices. By sending each consignment through a different courier office, traffickers reduce the likelihood of patterns being detected by law enforcement agencies. Small packages containing drugs such as LSD blotters or MDMA pills can easily be concealed within ordinary parcels.
Additionally, the integration of darknet marketplaces with courier logistics has created an e-commerce-like drug distribution system. Customers place orders online, make payments through cryptocurrency, and receive deliveries through postal channels. This model allows traffickers to scale their operations nationally while maintaining anonymity. Consequently, monitoring parcel networks and improving coordination between law enforcement agencies and logistics providers has become a critical aspect of drug control strategies.
Critically analyse the effectiveness of India’s legal and institutional framework in combating modern narcotics trafficking networks.
India’s legal framework for combating drug trafficking is primarily based on the Narcotic Drugs and Psychotropic Substances (NDPS) Act, 1985. The Act provides strict provisions for controlling the manufacture, possession, sale, and trafficking of narcotic drugs. It empowers agencies such as the Narcotics Control Bureau (NCB), state police forces, and customs authorities to investigate drug-related offences and prosecute offenders. The NDPS Act also includes stringent penalties, including long-term imprisonment and heavy fines, to deter drug trafficking activities.
Despite these strong legal provisions, the emergence of digital and darknet-based drug markets has created new enforcement challenges. Traditional law enforcement methods are often insufficient to track online transactions, encrypted communications, and cryptocurrency payments. Criminal networks can operate across multiple jurisdictions, making it difficult for national agencies to dismantle entire supply chains.
However, Indian agencies have increasingly adopted advanced investigative methods. For instance, operations such as Operation Ketamelon (2025) and Operation Zambada (2023) targeted international darknet markets and demonstrated the growing cyber capabilities of Indian authorities. Collaboration with global law enforcement agencies and cybercrime units has also improved intelligence gathering and financial tracking.
Nevertheless, several challenges remain. There is a need for stronger digital surveillance capabilities, improved cryptocurrency regulation, and enhanced cooperation between cybercrime units and narcotics agencies. Strengthening capacity in cyber forensics and developing specialised training for investigators will be crucial to effectively combat the evolving landscape of technology-driven narcotics trafficking.
Despite these strong legal provisions, the emergence of digital and darknet-based drug markets has created new enforcement challenges. Traditional law enforcement methods are often insufficient to track online transactions, encrypted communications, and cryptocurrency payments. Criminal networks can operate across multiple jurisdictions, making it difficult for national agencies to dismantle entire supply chains.
However, Indian agencies have increasingly adopted advanced investigative methods. For instance, operations such as Operation Ketamelon (2025) and Operation Zambada (2023) targeted international darknet markets and demonstrated the growing cyber capabilities of Indian authorities. Collaboration with global law enforcement agencies and cybercrime units has also improved intelligence gathering and financial tracking.
Nevertheless, several challenges remain. There is a need for stronger digital surveillance capabilities, improved cryptocurrency regulation, and enhanced cooperation between cybercrime units and narcotics agencies. Strengthening capacity in cyber forensics and developing specialised training for investigators will be crucial to effectively combat the evolving landscape of technology-driven narcotics trafficking.
Consider a scenario where a darknet-based drug network is operating across multiple Indian states. How should law enforcement agencies respond to dismantle such a network?
Case Study Scenario: Imagine a situation where a drug trafficking network operates through darknet platforms and distributes narcotics across multiple states using courier services. Customers place orders through encrypted messaging platforms and make payments using cryptocurrencies. The drugs are sourced from international vendors and delivered to buyers using parcel networks or dead-drop locations. This scenario reflects the modern pattern of drug trafficking observed in cases such as the “Team Kalki” network.
In such a situation, the first step for law enforcement agencies would be to conduct cyber intelligence operations. Specialised cyber units must monitor darknet forums, track suspicious cryptocurrency transactions, and identify digital communication patterns between buyers and sellers. Advanced cyber forensics tools can help uncover wallet addresses, trace transaction flows, and identify potential suspects.
Second, agencies must strengthen inter-agency coordination. Since such networks operate across multiple states, collaboration between the Narcotics Control Bureau, state police forces, customs authorities, and cybercrime units is essential. International cooperation may also be necessary to identify foreign suppliers and disrupt global supply chains.
Third, law enforcement should monitor logistics channels such as courier and parcel services to identify suspicious consignments. Establishing partnerships with courier companies and implementing risk-based screening mechanisms can help detect illegal shipments. Controlled deliveries may also be used to identify recipients and dismantle distribution networks.
Ultimately, tackling darknet drug trafficking requires a combination of cyber investigation, financial intelligence, and coordinated enforcement strategies. By integrating technological expertise with traditional policing methods, authorities can effectively disrupt complex digital narcotics networks.
In such a situation, the first step for law enforcement agencies would be to conduct cyber intelligence operations. Specialised cyber units must monitor darknet forums, track suspicious cryptocurrency transactions, and identify digital communication patterns between buyers and sellers. Advanced cyber forensics tools can help uncover wallet addresses, trace transaction flows, and identify potential suspects.
Second, agencies must strengthen inter-agency coordination. Since such networks operate across multiple states, collaboration between the Narcotics Control Bureau, state police forces, customs authorities, and cybercrime units is essential. International cooperation may also be necessary to identify foreign suppliers and disrupt global supply chains.
Third, law enforcement should monitor logistics channels such as courier and parcel services to identify suspicious consignments. Establishing partnerships with courier companies and implementing risk-based screening mechanisms can help detect illegal shipments. Controlled deliveries may also be used to identify recipients and dismantle distribution networks.
Ultimately, tackling darknet drug trafficking requires a combination of cyber investigation, financial intelligence, and coordinated enforcement strategies. By integrating technological expertise with traditional policing methods, authorities can effectively disrupt complex digital narcotics networks.
Practice questions
1 question for mains preparation