ISI-TIKA nexus exposed: Crypto pipelines and mule accounts fuel plot to revive dormant terror networks for UP Election sabotage

Indian intelligence agencies have uncovered a sophisticated cross-border funding conspiracy in which Pakistan’s Inter-Services Intelligence (ISI) is collaborating with Türkiye’s official development agency, the Turkish Cooperation and Coordination Agency (TIKA), to inject fresh capital into long-dormant terror modules. The objective is clear: rebuild operational capacity from a base in Jammu and Kashmir, reactivate old local networks, and extend disruption into Uttar Pradesh, Delhi, Uttarakhand and Gujarat—with a sharp focus on sabotaging the coming Uttar Pradesh assembly elections.

Security assessments identify TIKA as a primary conduit for funds that the ISI intends to redirect toward Indian terror revival. Unlike older hawala or cash-courier routes, the planned pipeline is digital-first. Money is to be moved into India—specifically into Jammu and Kashmir—through online encrypted payment applications that allow rapid, low-visibility transfers across the border.

A top intelligence official described the shift: “Instead of traditional banking or manual transactions, they rely heavily on digital wallets, e-commerce networks, and crypto apps to route money through digital hawala channels. Crypto wallet apps are the primary digital hawala tools.” Security networks have flagged that foreign handlers bypass traditional banks by transferring crypto tokens such as TRX/Tron directly into private, non-KYC wallets using VPNs. Operatives then convert these holdings via peer-to-peer traders in metro hubs like Delhi or Mumbai.

Monitored platforms include Binance’s peer-to-peer trading system, which facilitates unauthorized cross-border transactions; Trust Wallet and TokenPocket, used to create decentralized, KYC-exempt digital wallets receiving funds from handlers based in Pakistan, China and Southeast Asia; and Pakistani mobile wallet apps Easypaisa and SatiPay, identified for collecting and distributing funds near border entry points. For cross-border routing through intermediate hubs, these digital wallets push money toward border regions via regional mobile financial services.

Once inside India, the funds are laundered and distributed through a network of mule accounts—bank accounts controlled by intermediaries who move money in small, repeated transactions to terror-linked recipients and overground facilitators. Jammu and Kashmir Police have previously traced multi-layered online financial trails across standard Indian payment frameworks, including UPI gateways. Syndicates register dozens of local mule accounts using stolen or rented identities and retail merchant apps to rapidly move small batches of money between accounts, confusing bank tracking algorithms.

A mule account network typically works as follows: handlers and middlemen scout for accounts through social media or use fake “work-from-home,” part-time job or online trading scams to trick ordinary people into handing over bank credentials. In other cases, accounts are opened with stolen identities or under local shell companies. Funds are deposited directly into these accounts, remain there for only a short window—often 24 to 48 hours—and are then quickly split, transferred across multiple secondary accounts, converted into cryptocurrency, or routed through bulk payment and payment gateway systems. Overseas handlers manage the entire network.

Law enforcement agencies, including the J&K Police Cyber Police Station and central security forces, froze more than 8,000 mule accounts across the region last year. Investigations revealed networks tied to massive cyber-fraud rackets, including a ₹209-crore case that was solved. Agencies have flagged hundreds of thousands of mule accounts across India, including in Jammu and Kashmir, with an estimated ₹2,500 crore moving through these illicit channels every month. This layered digital-to-mule system is deliberately designed to reduce physical footprints and complicate tracking.

Agencies describe the dormant cells of older outfits such as Hizbul Mujahideen (HM), Lashkar-e-Taiba (LeT), The Resistance Front (TRF) and Jaish-e-Mohammed (JeM) as a “dry nursery.” The fresh TIKA-linked financing is meant to irrigate that nursery: reconstruct leadership structures, restore organisational capacity, and bring inactive local support networks back online.

A concrete indicator emerged in a recent Shopian operation in which ten people were arrested while gathering and distributing funds for these defunct networks. Notably, some of those arrested came from Kathua in the Jammu division evidence that handlers are deliberately trying to push activity beyond the Kashmir Valley into previously quieter areas.

Old overground workers are being systematically approached and activated, primarily through social-media channels. Handlers use these platforms to re-establish contact, issue instructions, and draw former facilitators back into the fold without the need for high-risk physical meetings.

The operational plan prioritises disruption of upcoming assembly elections, with Uttar Pradesh as the principal target alongside Uttarakhand and Gujarat. Intelligence inputs shared with the Ministry of Home Affairs and Uttar Pradesh Police warn that the revived modules, once funded and reactivated, are expected to generate instability, communal tension and security diversions timed to the poll calendar. Parallel expansion into Delhi, Maharashtra and Bihar is flagged as a longer-term effort to create multi-state pressure points.

The conspiracy pairs state-linked Turkish development funding with ISI direction, digital payment apps for inbound transfer, mule-account networks for domestic circulation, social-media reactivation of old local facilitators, and a clear intent to use a rebuilt Jammu and Kashmir base for election-focused disruption and wider anti-India activity. Counter-terror agencies are treating the alert as a live, multi-layered threat.

ALSO READ | Cracks widen in National Conference after cabinet expansion; all eyes on Aga Ruhullah's November 3 move