The scam was at the centre of a series of investigative reports published by The Indian Express in July last year on how digital scamsters moved crores in minutes through a maze of 141 deposits in 23 banks across 15 states.

According to investigators tracking the Gurugram case, the recovery of Ayyappa’s phone from police in Gujarat, where he was arrested in October 2025 before obtaining bail, has confirmed that cyber gangs have been erasing their banking trails by converting stolen funds into USDT, the stablecoin issued by US-based Tether.

Investigators said Ayyappa was arrested by a three-member Gurugram police team using “technical investigation”. The team camped near his home in the Dilkhush Nagar area for three days before the arrest at his residence, where he was staying with his wife, 19-year-old son and 15-year-old daughter. Ayyappa is currently lodged in Haryana’s Bhondsi jail.

Speaking to The Indian Express, Dr Hitesh Yadav, Deputy Commissioner of Police, Gurugram (South), who heads the SIT, said: “We had been on Ayyappa’s trail for very long. He is the main link in the Gurugram digital arrest case between the secondary layer of mule accounts and the key conspirators who are yet to be apprehended. We will now follow the guidelines of the Ministry of Home Affairs to convert the USDT found in Ayyappa’s phone into Indian currency and effect a recovery for the complainant.”

In the Gurugram case — just one of the 1.23 lakh such crimes reported in 2024, involving a total of Rs 1,935 crore in stolen money — The Indian Express had reported that scamsters routed Rs 5.85 crore from the victim’s HDFC Bank accounts through three layers: the ICICI Bank account of Piyush, a resident of Subana village in Jhajjar district, Haryana; 25 other accounts in 10 banks across the country; and onward to 141 more accounts.

This newspaper also reported that the second layer of 25 accounts included at least 11 in the Sreenivasa Padmavathi Co-operative Urban Bank in Hyderabad. The account-holders included a tailor and a carpenter who told police that Samudrala Venkateswarlu, one of the bank’s directors, had allegedly made them sign blank cheque books and withdrawal forms on the pretext of getting them jobs.

Piyush and a group of associates were arrested and are on bail. Samudrala was arrested on April 29 by the SIT. During interrogation, Samudrala allegedly told police that the “Hyderabad gang” used to withdraw money from mule accounts, convert it to USDT, and transfer the cryptocurrency to Ayyappa.

“That made Ayyappa a prime suspect in the case and his ongoing interrogation is now expected to give more valuable leads on solving this and other digital arrest cases,” Yadav said.

The Indian Express had reported that the SIT was alerted by the Union Home Ministry’s cyber fraud unit, the Indian Cyber Crime Coordination Centre (I4C), that the 11 Hyderabad accounts are also allegedly at the heart of 181 other such complaints. According to one complaint, Rs 21 crore had allegedly passed through these accounts in just three months.

Surendra Rohilla, the Investigating Officer of the Gurugram case who led the team that arrested Ayyappa, told The Indian Express that during interrogation, it emerged that USDT and Telegram chats linked to the case were allegedly in his phone that was confiscated by the Gujarat police.

“Ayyappa was the main middleman and mediator in the deal. After everybody was paid their cuts, the USDT would be routed to cyber gangs in Cambodia. In all, Ayyappa has confessed that he earned commissions of over Rs 1.5 crore since October last year from various cyber crimes, including this one,” Rohilla said.

Police records show that Ayyappa, who hails from Tadepalligudem town in Godavari, recently started a business in fish trading. At least 16 cases were lodged against him between 2024 and 2025, many by the cyber police in Ahmedabad. While several have been dismissed, there are three “active” cases lodged against him by the cyber police at Shahibaug in Ahmedabad. He was on bail when the Gurugram SIT arrested him.

“Once Ayyappa confessed that all Telegram chats connected to the Gurugram case and the record of his USDT deposits were in the confiscated phone, the team obtained a court order and got it transferred as case evidence,” Rohilla said. Ayyappa had allegedy not told Gujarat police about the cryptocurrency transactions and USDT details on his phone, linked to the Gurugram case, he said.

Meanwhile, the Gurugram executive has recovered Rs 1.05 crore of the stolen money — some from banks used in the scam and some in cash recovered from Samudrala at the time of his arrest.