How Authorities Trace Bluechip Scam Money Trail CCTV Shows Founder Stuffing Cash Into Bags

As Indian investigators widen their probe into the Dh400-million BlueChip investment scam, cybersecurity specialists say the case reflects a wider global shift in how regulators now track digital money flows once considered untraceable.

The development comes days after the arrest of BlueChip founder Ravindra Nath Soni, whose Dubai-based operations collapsed last year, leaving hundreds of UAE residents facing massive losses.

Soni, wanted in Dubai for multiple cheque defaults and investor complaints, was arrested on November 30 in Dehradun after police tracked a food-delivery order placed from his hideout - ending an 18-month manhunt first exposed by Khaleej Times. Since his arrest, several UAE investors have travelled to India to lodge fresh complaints and join the expanding criminal case.

Stay up to date with the latest news. Follow KT on WhatsApp Channels.

BlueChip shut down abruptly in March 2024 after promising investors three per cent monthly returns. What looked like a thriving operation - complete with awards, celebrity appearances and a polished corporate façade - collapsed overnight when payouts stopped and the office was abandoned.

CCTV footage that has emerged from the days before the shutdown shows Soni inside the Bur Dubai office collecting large wads of cash from drawers, stacking them on a table and stuffing them into a suitcase and also a carry bag. Investigators are reviewing the footage as they assess how much money left the office in the scheme's final days. Watch the video, by a former BlueChip staff member, here:

In May 2024, Khaleej Times reported that Soni transferred $41.35 million to an unknown cryptocurrency wallet, just days before the company shut down. That transfer has now become a key line of inquiry for Indian investigators.

Dubai-based cybersecurity expert Rayad Kamal Ayub, Managing Director of Rayad Group Technology, said the BlueChip case illustrates how digital forensics have become central to modern financial investigations and reflects a broader transformation in global financial policing. He told Khaleej Times that investigations today are no longer limited to bank transfers; modern financial crime trails often span multiple wallets, cross-chain movements, OTC brokers and mixing services, but unlike traditional banking networks, blockchain activity leaves a permanent footprint.

According to Ayub, early analysis in the BlueChip case mirrors patterns seen in major international fraud networks: large inflows from multiple wallets into a central destination, followed by rapid fragmentation across new wallets and eventual re-aggregation near exchanges or unregulated brokers.“When we see that level of placement and layering, regulators immediately test whether the wallets share common ownership,” he said.“These patterns are typical of laundering operations tied to Ponzi-style schemes.”

Ayub said regulators today rely on an increasingly sophisticated ecosystem of blockchain-intelligence tools capable of mapping relationships between thousands of wallets, issuing real-time alerts for suspicious movements and identifying links to darknet clusters, mixers and sanctioned entities.

He added that widely used platforms such as Chainalysis, Elliptic and TRM Labs now allow investigators to map wallet networks, flag risky behaviour and follow funds as they move across different blockchains.

“What used to take months now takes hours. Even when criminals hop chains or use semi-private platforms, every step adds another data point. Once matched with exchange KYC records, identities can be uncovered quickly.”

He noted that major global cases - from the US Department of Justice's record $15 billion crypto forfeiture last year to coordinated international cyber operations and the tracing of North Korean hacks - have accelerated the development of forensic alliances among regulators worldwide.“If a suspicious wallet touches Europe or Asia, that data can be shared almost instantly. Five years ago, this level of coordination didn't exist.”

Investigators in India are examining whether BlueChip funds were moved through hawala channels alongside crypto conversions, a combination that complicates the trail but does not erase it.“Blockchain anonymity is largely a myth,” Ayub said.“Wallets, exchanges, IP addresses, device fingerprints - everything connects. Once regulators open a file, nothing stays hidden for long.”

Senior Indian police officials say the financial scope of the scam is expanding rapidly.

Speaking to Khaleej Times, Anjali Vishwakarma, Additional Deputy Commissioner of Police (ADCP) Law & Order, Kanpur Nagar, said investigators have already identified more than ten bank accounts operated by Soni across multiple Indian cities.“We are now following the money trail outside the formal banking system, including funds moved to cryptocurrency wallets,” she said.

Kanpur Police Commissioner Raghubir Lal said the fraud is“far larger than initially understood” and now bears the hallmarks of a cross-border financial crime. He said investigators have identified 12 overseas associates, including individuals in Dubai, who allegedly helped move the money. Forensic analysis has traced transactions worth millions layered through multiple accounts before being converted into cryptocurrency via partners abroad.

For UAE victims, the widening investigation has brought a degree of hope after months of uncertainty. A Dubai resident from Kerala who lost Dh1 million said,“What matters now is whether any of this money can be recovered.”

MENAFN07122025000049011007ID1110449687