5,811 suspects arrested and $293 million in illicit assets seized — those are the headline figures from a global enforcement push that targeted social engineering fraud and the money laundering that sustains it.
Operation First Light 2026: scale, targets, and outcomes
Operation First Light 2026 was a coordinated law enforcement action that ran between January 15 and April 30 and spanned 97 countries. According to INTERPOL, the operation resulted in 5,811 arrests, the seizure of $293 million in illicit assets, the identification of more than 142,000 victims, the blocking of 31,014 bank accounts, and the analysis of 152,808 cases. Investigators also identified 15,606 additional suspects beyond those taken into custody.
How authorities acted: raids, freezes, notices, and I-GRIP
INTERPOL described a mix of investigative and financial disruption techniques. "This included pro-active action against high-value targets, raiding identified premises, blocking or freezing bank accounts and virtual wallets, requesting INTERPOL Notices and Diffusions and proactively utilizing INTERPOL's Global Rapid Intervention of Payments (I-GRIP), a stop-payment mechanism that facilitates the swift blocking of illicit financial flows of both fiat and virtual assets," the organisation said. Those combined measures aimed both to apprehend individuals and to interrupt the flow of funds that sustain transnational fraud networks.
Who coordinated and who funded the operation
INTERPOL coordinated Operation First Light 2026, with funding provided by China's Ministry of Public Security. The operation also received support from regional policing bodies: ASEANAPOL, GCCPOL, and Europol. INTERPOL framed the action as part of broader, sustained cooperation among law enforcement bodies to counter cyber-enabled financial crime.
Continuity with prior operations: Synergia, Serengeti, Africa Cyber Surge, Red Card 2.0
Operation First Light was presented as one node in a series of INTERPOL-led and -supported actions. The release connected the effort to past campaigns: Operation Synergia II, which between April and August 2024 led to 41 arrests and the seizure of 1,037 servers and other cybercrime infrastructure operating across more than 22,000 IP addresses; the first stage of Operation Synergia, which identified 70 additional suspects and took down 1,300 command-and-control servers allegedly used in ransomware, phishing, and malware campaigns; and other joint operations named Operation Serengeti and Operation Africa Cyber Surge, said to have produced thousands of arrests and dismantled multimillion-dollar operations. More recent regionally focused work included Operation Red Card 2.0, during which African police arrested 651 suspects across 16 countries between December 8 and January 30, and Operation Synergia III, carried out between July 2025 and January 2026, which seized servers and sinkholed tens of thousands of IP addresses.
What this means for victims, financial institutions, and law enforcement
- Victims: The operation identified over 142,000 victims globally, underscoring the personal and economic reach of social engineering scams — including business email compromise, sextortion, impersonation, romance, and investment fraud — and highlighting that many more affected individuals may remain to be identified.
- Financial institutions and virtual-asset platforms: The blocking or freezing of 31,014 bank accounts and the use of I-GRIP to stop fiat and virtual-asset flows signal intensified expectations for fast, cross-border cooperation when suspicious transfers are detected.
- Law enforcement and international partners: The campaign illustrates an operational model that combines targeted arrests, financial countermeasures, and regional policing support — and it depends on sustained funding and coordination, in this case including financial backing from China's Ministry of Public Security and support from ASEANAPOL, GCCPOL, and Europol.
INTERPOL framed the operation as a necessary collective response to a growing transnational threat. "Criminal syndicates exploit human psychology to manipulate their targets, and no nation can stay safe unless all countries are equipped and committed to jointly fighting back," Tomonobu Kaya, director of the INTERPOL Financial Crime and Anti-Corruption Centre, said. He added that "INTERPOL is dedicated to supporting member countries in building a comprehensive, coordinated strategy to tackle cyber-enabled financial crimes, organized criminal networks and the money laundering that fuels them."
The public record supplied with the operation links a broad set of outcomes — arrests, asset seizures, frozen accounts, and large numbers of identified victims — to a persistent pattern of international enforcement. The statement from INTERPOL and the list of related operations make clear that this action fits into a continuing strategy of pairing law enforcement activity with financial disruption tools such as I-GRIP. Whether the arrests and asset seizures materially reduce fraud at scale will depend on subsequent prosecutions, continued follow-through on identified suspects, and sustained international cooperation.
