Dismantling of the Ketamelon Darknet Narcotics Syndicate in Operation MELON

Executive Summary

In mid-2025, the Narcotics Control Bureau (NCB) Cochin Zonal Unit executed Operation MELON, dismantling India's premier Level-4 darknet narcotics syndicate operating under the vendor moniker "Ketamelon". The illicit enterprise was masterminded by Edison Babu, a 35-year-old mechanical engineering graduate from Muvattupuzha, Kerala, who operated a nationwide digital distribution network for synthetic hallucinogens and dissociative anesthetics, primarily Lysergic acid diethylamide (LSD) and ketamine. The syndicate bridged cyber-enabled commerce with physical distribution by exploiting international mail routes and domestic postal networks to fulfill hundreds of orders across major Indian metropolitan centers and remote regions.

The syndicate maintained strict technical operational security by accessing Tor-hidden marketplaces exclusively via bootable live operating systems designed to operate in volatile memory and leave no persistent forensic footprint. All financial operations were conducted via cryptocurrencies, with the operator accepting payments in privacy coins like Monero (XMR) to defeat ledger analysis and subsequently swapping profits into Tether (USDT) on hardware wallets. High-purity LSD was imported from apex international suppliers, notably the UK-based vendor "Gunga Din," a known reshipper for the global "Dr. Seuss" (Tribe Seuss / Gamma Goblin) cartel, before being repackaged with darknet-acquired forged government identities and dispatched via courier.

The network was dismantled through a hybrid investigation combining mail profiling, physical surveillance, and digital financial tracing. A key element of the operation was the collaboration between Indian authorities and Binance's Global Financial Intelligence Unit, which successfully unmasked custodial wallet transactions and froze the operator's digital assets. The enforcement action culminated in the seizure of over 1,100 LSD blots, quantities of ketamine, hardware wallets, and the attachment of over ₹3 crore in combined digital and real estate assets.

Verification of Claims

1. Claim: The NCB conducted Operation MELON against the Ketamelon darknet syndicate. → Verified → Confirmed by official NCB press release on July 1, 2025.
2. Claim: Edison Babu operated the Ketamelon vendor account as the syndicate mastermind. → Partially verified → Formally arraigned in the NCB chargesheet and identified across investigative disclosures; formal guilt remains subject to court adjudication.
3. Claim: Law enforcement seized 1,127 LSD blots and 131.66 grams of ketamine. → Verified → Confirmed across NCB releases: 280 blots from intercepted postal parcels and 847 blots plus 131.66g ketamine from the residential raid.
4. Claim: Ketamelon held India's only Level-4 vendor rating on darknet marketplaces. → Reported → Documented in official NCB statements and media reporting, though independent darknet marketplace tier verification methodologies were not publicly released.
5. Claim: The operator accessed darknet marketplaces using a bootable live operating system. → Verified → The physical recovery of a USB pen drive containing a bootable OS (reported as KITES OS / TAILS OS) was confirmed in NCB seizure documentation.
6. Claim: The syndicate fulfilled between 600 and 1,200 drug consignments across India. → Partially verified → Discrepancy in official timelines: Initial post-raid releases cited approximately 600 shipments over 14 months, while subsequent December 2025 court chargesheets cited approximately 1,200 consignments over two and a half years.
7. Claim: Narcotics were sourced from the global "Dr. Seuss" cartel via UK vendor "Gunga Din." → Partially verified → Documented in NCB investigative summaries and chargesheet records; full international legal attribution remains subject to foreign proceedings.
8. Claim: Binance assisted the NCB by tracing crypto transactions and freezing assets. → Verified → Confirmed by public threat intelligence disclosures released by Binance's Global Financial Intelligence Unit and NCB investigative reports.

Timeline

Attack Anatomy

Initial Access: To establish physical logistics without exposing his true identity, the operator purchased forged Indian government identification (Aadhaar, PAN, and Voter IDs) on darknet forums using cryptocurrency. These credentials were used to book domestic courier consignments anonymously.

Execution: The operator accessed Tor-hidden marketplaces via a specialized, bootable live operating system (reported as KITES OS / TAILS OS) stored on a USB drive. The environment executed entirely within volatile system RAM, ensuring no operational logs, browser histories, or cryptographic keys were written to the local hard drive.

Persistence: The enterprise maintained continuity through persistent vendor account reputations across multiple.onion marketplaces and established PGP-encrypted communication channels with international cartel reshippers, rather than persistent host implants.

Collection: Customer orders and delivery addresses were gathered via darknet messaging interfaces and secured using PGP encryption. Payments were collected exclusively via Monero (XMR) to mathematically obscure transaction ledgers.

Exfiltration: Exfiltration occurred across two dimensions: physical distribution of bulk cartel shipments repackaged into hundreds of fragmented parcels sent via domestic post, and financial exfiltration via the conversion of Monero into Tether (USDT) stored on hardware wallets and off-ramped through centralized custodial exchanges.

Impact: The syndicate distributed synthetic narcotics across India before being dismantled, leading to the seizure of 1,127 LSD blots, 131.66g ketamine, and the forfeiture of more than ₹3 crore in digital and physical assets.

Threat Actor Profile

• Name / Alias: Edison Babu / "Ketamelon"; associates Arun Thomas, Sandeep Sajeev (UK), Harikrishnan Aji Nawas (Australia), Deoal K.V.
• Attribution Confidence: High — Attributed via physical seizures, CPU imaging, residential modem IP correlation, unmasked custodial exchange accounts, and formal court chargesheets.
• Motivation: Financial.
• Sophistication Level: Moderate to Advanced — Demonstrated disciplined operational security combining RAM-only live operating systems, multi-hop onion routing, PGP asymmetric encryption, Monero privacy coin adoption, and compartmentalized international logistics.
• Known Previous Operations: Offline ketamine trafficking; stepped in to inherit the distribution lines of the dismantled Zambada cartel in 2023.
• Nation-State Nexus: No — Strictly a financially motivated transnational cybercrime syndicate.
• MITRE ATT&CK Techniques:
  • T1090.003 — Proxy: Multi-hop Proxy
  • T1071.001 — Application Layer Protocol: Web Protocols
  • T1027 — Obfuscated Files or Information
  • T1070.006 — Indicator Removal on Host: Timestomp / OS Amnesia
  • T1573.002 — Encrypted Channel: Asymmetric Cryptography
• Operational Security (OpSec): Employed live amnesic operating systems, Tor proxying, PGP encryption, and Monero transactions to prevent disk-level forensics and blockchain tracing. Critical failure points occurred at physical-digital intersections: postal parcel profiling at the Kochi Foreign Post Office, residential modem IP correlation with Tor timestamps, and converting cryptocurrency to fiat via KYC-compliant centralized exchanges.

Technical Indicators

domains: []
ip_addresses: []
file_hashes: []
urls: []
cryptocurrency_assets:
  - "Monero (XMR) used for inbound transaction privacy"
  - "Tether (USDT) held on seized hardware wallet (~70 Lakh INR)"
operational_infrastructure:
  - "Bootable KITES OS / TAILS OS on USB removable media"
  - "Tor hidden services (.onion marketplaces)"
  - "Binance custodial exchange accounts (frozen)"
  - "Kochi Foreign Post Office (logistical intercept node)"
aliases:
  - "Ketamelon"
  - "Gunga Din"
  - "Dr. Seuss / Tribe Seuss / Gamma Goblin"
  - "Pradeep Bhai"

Legal and Regulatory Response

Law Enforcement Actions

The Cochin Zonal Unit of the Narcotics Control Bureau spearheaded Operation MELON, intercepting suspicious parcels on June 28, 2025, and executing a search of Babu's residence on June 29, 2025. Digital forensics teams gathered IP logs, communications from the suspect's residential modem, and imaged seized CPUs and storage drives.

Government Directives

The NCB initiated steps to obtain INTERPOL Red Corner Notices against the two overseas accused, Sandeep Sajeev in the UK and Harikrishnan in Australia, to support extradition. The distinction matters: a Blue Corner Notice seeks information about a person's identity or movements, whereas a Red Corner Notice seeks their location and provisional arrest pending extradition. Reporting describes the NCB as beginning that process on filing the chargesheet, not as having obtained the notices. Authorities initiated Mutual Legal Assistance Treaty (MLAT) requests to compel foreign judicial cooperation, and the case was integrated into INTERPOL's Operation Lionfish-Mayag III.

Platform Response

Binance's Global Financial Intelligence Unit (FIU) collaborated with the NCB and the Data Security Council of India (DSCI), deploying blockchain analytics to trace transaction trails through swap layers and executing freezes on associated custodial accounts.

Criminal Proceedings

On December 23, 2025, the NCB filed a comprehensive chargesheet before the District Sessions Court in Ernakulam formally indicting Edison Babu, Arun Thomas, Sandeep Sajeev, and Harikrishnan Aji Nawas under the Narcotic Drugs and Psychotropic Substances (NDPS) Act, 1985. Legal proceedings remain pending adjudication.

Impact Assessment

• Suspected LSD Blots Seized: Confirmed: 1,127 total blots (280 intercepted at the post office, 847 seized at the residence).
• Ketamine Seized: Confirmed: 131.66 grams.
• Cryptocurrency Assets Seized (Initial): Confirmed: Approximately ₹70 lakh in USDT held in a hardware wallet.
• Total Case-Related Crypto Frozen: Reported: Between ₹90 lakh and ₹1.50 crore across linked accounts.
• Real Estate Assets Attached: Confirmed: Over ₹85 lakh (commercial shopping complex in Muvattupuzha and land in Idukki).
• Total Financial Seizures: Reported: Exceeding ₹3 crore in combined digital and physical assets.
• Street Value of Seized Narcotics: Estimated: Approximately ₹35.12 lakh to ₹40 lakh.
• Consignment Volume: Reported: 600 parcels over 14 months (initial release) / ~1,200 consignments over 2.5 years (court chargesheet).
• Geographic Footprint: Confirmed: Distribution confirmed across Delhi, Bengaluru, Chennai, Bhopal, Patna, Himachal Pradesh, and Uttarakhand.
• Arrests and Indictments: Confirmed: 2 domestic arrests (Edison Babu, Arun Thomas); 4 individuals formally named in the court chargesheet.

Lessons and Defensive Recommendations

For Security Teams / SOC Analysts: Monitor enterprise networks for unauthorized Tor traffic, onion routing protocols, and anomalous encrypted proxy connections. Treat removable media configured with live amnesic operating systems as volatile evidence, capturing memory state prior to system shutdown to prevent data loss. Correlate suspicious cryptocurrency transactions with physical telemetry, such as residential modem logs, courier dispatch records, and forged identity submissions.

For Developers and Architects: Further details are not yet publicly available.

For Platform / Cloud Providers: Centralized cryptocurrency exchanges must maintain automated AML monitoring to identify rapid swapping between privacy-centric assets (Monero) and fiat-pegged stablecoins (USDT). Maintain rapid-response law enforcement liaison channels to support lawful asset freezing before funds are off-ramped to fiat banking networks. Retain API access metadata, session timestamps, and IP logs in accordance with regulatory standards to facilitate cross-border judicial tracing.

For Leadership / CISO: Treat darknet-enabled cybercrime and hybrid physical-digital operations as cross-domain operational risks requiring coordinated collaboration across cyber threat intelligence, fraud, legal, and law enforcement teams. Establish formalized public-private intelligence-sharing frameworks to expedite evidence handover during complex financial investigations. Ensure enterprise incident response policies include protocols for preserving digital evidence across edge routing hardware, endpoint volatile memory, and third-party financial platforms.

Sources

1. Narcotics Control Bureau. "NCB Busts Top Darknet Drug Vendor 'Ketamelon' in operation MELON". July 1, 2025.
2. Narcotics Control Bureau. "NCB Press Releases". Accessed August 24, 2026.
3. INTERPOL. "Record-setting synthetic drug seizures in INTERPOL-coordinated operation". September 16, 2025.
4. The Hindu. "NCB files chargesheet in alleged darknet-based drug trafficking case". December 29, 2025. [PAYWALL].
5. Onmanorama. "NCB files chargesheet in 'Ketamelon' darknet drug syndicate case". December 29, 2025.
6. The Week / PTI. "NCB files chargesheet against four in darknet-based drug cartel case". December 29, 2025.
7. New Indian Express. "NCB files chargesheet against members of infamous darknet drug cartel". January 3, 2026.
8. India Today. "Who is Ketamelon? Kerala engineer behind India’s top darknet drug vendor". July 9, 2025.
9. Binance. "India’s NCB And Binance Join Forces to Take Down The Country’s Biggest Darknet Drug Network". August 19, 2025.
10. The Times of India. "How NCB & Binance brought down India’s top darknet drug syndicate". August 25, 2025. [PAYWALL].
11. The Times of India. "'Ketamelon' drug ring: Bootable darknet OS, crypto wallets seized; how Rs 5,000 LSD stamps reached homes in Patna, Delhi, Bhopal and more". July 2, 2025. [PAYWALL].
12. The Indian Express. "Mechanical engineer from a well-to-do family, how Kerala resident Edison became a kingpin selling LSD on dark web". July 7, 2025.
13. The Tribune India. "Op Melon: NCB dismantles India’s most prolific darknet syndicate 'Ketamelon'". 2025.
14. Mathrubhumi. "What is Ketamelon? India’s top darknet drug syndicate dismantled by NCB". 2025.
15. New Indian Express. "Ketamelon kingpin used ID cards sourced from darkweb for drugs trade". July 13, 2025.
16. NDTV. "Probe Agency NCB Busts 'Biggest' Darknet Drug Cartel Operating In India". August 1, 2023.
17. Hindustan Times. "NCB busts darknet LSD cartel in NCR; three held". 2023.
18. Digital Watch Observatory. "India’s top darknet dealer laundered crypto with Monero for two years". 2025.
19. Decrypt. "India’s 'Most Prolific Darknet Drug Syndicate' Used Monero to Evade Cops". 2025.
20. CCN. "India’s Darknet Drug Giant Busted With Aid From Binance". August 19, 2025.
21. MITRE ATT&CK. "Multi-hop Proxy, Sub-technique T1090.003". Accessed August 24, 2026.
22. MITRE ATT&CK. "Tor, Software S0183". Accessed August 24, 2026.
23. MITRE ATT&CK. "Encrypted Channel: Asymmetric Cryptography, T1573.002". Accessed August 24, 2026.
24. MITRE ATT&CK. "Communication Through Removable Media, T1092". Accessed August 24, 2026.
25. India Code. "Narcotic Drugs and Psychotropic Substances Act, 1985". Accessed August 24, 2026.

Corrections log — 2 September 2026: The paper stated that the NCB had secured INTERPOL Blue Corner notices against the two overseas accused. Reporting on the chargesheet describes the agency initiating steps to obtain Red Corner Notices to support extradition — a different instrument serving a different purpose, and a process begun rather than completed. Corrected in both the timeline and the Legal and Regulatory Response section.

All four accused named in this paper — Edison Babu, Arun Thomas, Sandeep Sajeev, and Harikrishnan — are named in the NCB's chargesheet as reported in Indian media. A chargesheet is an accusation, not a conviction, and all four are entitled to the presumption of innocence until a court determines otherwise.