INTERPOL’s Operation First Light 2026 ran from 15 January to 30 April 2026, spanning 97 countries, and ended with 5,811 arrests, $293 million in intercepted assets, and a freeze on exactly 31,014 bank accounts, but the headline numbers obscure a harder finding: cross-chain token swaps are outpacing the real-time tools built to stop them.
What Operation First Light 2026 Actually Achieved
Coordinated out of Lyon, France, the operation targeted social engineering scams across the full spectrum: business email compromise (BEC), romance scams, sextortion, impersonation, and investment fraud, along with the laundering infrastructure supporting each category.
Investigators identified more than 142,000 victims, solved 23,715 cases, named 15,606 suspects, and issued 99 notices and diffusions. The sweep produced a range of enforcement actions across jurisdictions with very different crypto regulatory environments.
Singapore and Oman jointly blocked a $6.6 million transfer tied to a BEC scheme. In Macao, police intervened before a victim could send nearly $372,000 to scammers impersonating public officials. Eswatini police arrested 82 people after dismantling a network allegedly running from a fake Brazilian police station, convincing victims to transfer funds for ‘safekeeping.’ Palau deported 22 individuals accused of operating hotel-based scam centres that routed proceeds through cryptocurrency and illegal gambling sites.
A central tool throughout was INTERPOL’s Global Rapid Intervention of Payments (I-GRIP) mechanism, launched in 2022 and operating across INTERPOL’s secure I-24/7 police communications network. Cybersecurity Magazine has previously documented I-GRIP stopping a $42 million BEC transfer. The mechanism works by connecting law enforcement directly with financial institutions to freeze suspicious fiat and cryptocurrency transfers in near real-time.
Where I-GRIP Hit Its Limit
The Thailand case is the one worth paying attention to. Thai police arrested two suspects whose operation allegedly moved romance scam proceeds through multiple digital assets using cross-chain token swaps to obscure the origin of funds. One 20-year-old suspect’s wallet processed more than $122.5 million over a 10-month period.
According to TechTimes, the cross-chain routing was used precisely because it takes funds beyond I-GRIP’s real-time freeze capability. The mechanism can halt a suspicious fiat wire or a straightforward on-chain transfer, but cross-chain swaps fragment the transaction trail across multiple ledgers, creating gaps that current interagency tooling cannot close fast enough to intercept.
Tomonobu Kaya, director of INTERPOL’s Financial Crime and Anti-Corruption Centre, noted that criminal syndicates continue exploiting human psychology and argued that coordinated international action remains necessary. The Thailand case suggests the coordination gap is partly technical, not just jurisdictional.
AudiA6 and the Broader Laundering Ecosystem
Operation First Light sits within a wider enforcement wave. On 11 June 2026, authorities dismantled the AudiA6 crypto laundering service. The DOJ charged two alleged operators with processing more than $389 million in transactions and receiving over 10,000 Bitcoin since 2021.
Europol’s own assessment valued the pipeline at EUR 336 million, a different figure from a different authority measuring a different scope. The two numbers are not contradictory; they reflect the DOJ’s transaction-volume count versus Europol’s valuation of the criminal pipeline. Polish Police had already arrested a Ukrainian national connected to the group on 15 September 2025, preceding the June 2026 takedown by nine months.
According to Chainalysis, AudiA6’s administrators also ran Dark2Web, an underground cybercrime forum used to advertise laundering services and recruit clients. The service had deep ties to sanctioned Russian exchanges including Bitzlato and Garantex, linking it directly to the sanctioned exchange ecosystem that regulators have been targeting since 2022.
Servers were seized, crypto assets frozen, and the group’s online infrastructure replaced with seizure notices across multiple jurisdictions.
The operational pattern across both AudiA6 and Operation First Light is consistent: fiat interception tools are maturing, but the laundering layer has moved up the complexity curve toward cross-chain routing and sanctioned-exchange relays. The next enforcement cycle will need tooling that can follow funds across bridge contracts in real time, not just flag them after the hop has settled.
