From Hari Shankar Tibrewal To Satish Sanpal To Dawood Ibrahim, How Dubai Has Become A Haven For Indian Criminals, Economic Offenders, Absconders

How an Illegal Betting Empire from Bhilai Built a Global Conglomerate, Laundered Billions Through Every Institutional Gatekeeper, Acquired a Wall Street Company — and Left a Netflix Star as Its Most Visible Ghost

A Comprehensive Investigative Analysis

Based exclusively on Enforcement Directorate investigations, Provisional Attachment Order No. 16/2026, multiple police FIRs across three states, prosecution complaints, and recorded statements of accused persons.

11 July 2026

He arrived on Netflix wearing gold chains and a $3 billion smile. Behind him, a Dubai apartment that could double as a small art museum. Outside, the skyline of a city that has perfected the art of letting money forget where it came from. The cameras rolled. The algorithm delivered. India watched Desi Bling and saw a success story.

What the algorithm never showed — what no glamorous establishing shot could capture — was a Look-Out Circular sitting quietly in the Ministry of Home Affairs database. The moment Satish Sanpal sets foot on Indian soil, he can be detained. In the subterranean world of Indian enforcement agencies, a different title precedes his name: Satta King.

This is not a story about one man on a streaming platform. This is the story of India’s most sophisticated illegal online betting conglomerate — an empire that generated ₹450 crore every single month at its peak, employed a thousand young men in Dubai call centres, sold franchises like McDonald’s sold burgers, partnered with Kolkata’s financial underground, and ultimately used the proceeds of cricket bets placed by college students in Andhra Pradesh to acquire a controlling stake in a NASDAQ-listed American technology company.

It is a story of breathtaking audacity, institutional failure on a continental scale, and unanswered questions that still hang over a Netflix smile. And it is not over.

I. THE SCREEN TEST: A GHOST IN GOLD CHAINS

Dubai, 2024. The cameras of Netflix’s Desi Bling — a love letter to Indians who have conquered the Gulf — found their ideal protagonist in Satish Sanpal. Compact, self-assured, carrying himself with the easy confidence of a man who has never had to queue for anything, Sanpal described his empire in the rounded numbers of someone who no longer needs to check bank balances: $3 billion in assets. Businesses. Properties. The kind of wealth that photographs beautifully and streams even better.

The show aired. Viewers watched. The Netflix algorithm did exactly what algorithms are designed to do: it amplified the glittering surface and buried the subterranean truth.

That truth is this: Sanpal’s name does not appear in the 88-page Provisional Attachment Order No. 16 of 2026 that documents ₹940.77 crore in attached assets linked to the Mahadev network. The Enforcement Directorate’s Raipur order focuses on Sourabh Chandrakar, Ravi Uppal, Hari Shankar Tibrewal (HST), and Vikas Garg. Sanpal’s “Satta King” designation and the Look-Out Circular that keeps him tethered to Dubai belong to a separate investigative thread originating in Jabalpur police cases.

Yet the question the article forces upon us is far more uncomfortable than a simple name-check. In an ecosystem with this many shell companies, this many offshore entities, this many billions of rupees, and this many moving parts, how many Sanpals are there? How many figures orbit the Mahadev empire without their names ever appearing in a single court document? Advocate Pranay Pathak, practising before the Madhya Pradesh High Court and previously associated with high-profile spiritual figures, is now pressing precisely this question on behalf of complainant Saurabh Bawariya. Their demand is unambiguous: the Enforcement Directorate must register an ECIR against Sanpal and bring him back under the Fugitive Economic Offenders Act, 2018.

If they succeed, the ghost on Netflix will finally have a case file with his name on it. Until then, he remains the most visible unanswered question in India’s largest betting scandal.

II. A GOD IS BORN IN BHILAI: THE ARCHITECTS OF MAHADEV

To understand what a Satta King means in 2026, one must travel back to Bhilai — a steel town in Chhattisgarh where the ambitions of young men have always been proportional to how quickly they need to escape.

Sourabh Chandrakar was not supposed to be anyone’s idea of a criminal mastermind. By some accounts, he sold juice before he discovered that there was infinitely more money in persuading people to bet on whether a batsman would hit a boundary. His partner was Ravi Uppal. Together, operating from Dubai’s comfortable anonymity, they built the Mahadev Online Book.

The name was not accidental. Mahadev — another name for Lord Shiva, the Destroyer. There was both arrogance and prophecy in the choice. What they created was not merely a betting website. In structural terms, it was a franchise empire — McDonald’s for Satta. A scalable, replicable model that any small operator with capital could join.

Here is how the machine worked. Chandrakar and Uppal sold “panels” — franchise units — to operators across India. Each panel was essentially a licence to run a regional Mahadev operation. Buy in, receive login credentials, WhatsApp numbers, scripts, and the entire operational playbook. Local bettors were directed to place wagers on cricket matches, casino games, and card games. The split was ruthlessly efficient: the franchisee kept 20–30 per cent of profits. The House — Chandrakar and Uppal — kept 70–80 per cent.

At its peak, Mahadev had more than 2,000 active panels running simultaneously across the country. At ₹30–40 lakh in net profit per panel per month, the arithmetic writes itself with terrifying clarity. Investigators calculate that the Mahadev Online Book alone generated ₹450 crore — every single month.

The money never went into traceable bank accounts. It flowed into benami accounts — accounts opened in the names of ordinary citizens who had no idea their PAN cards, Aadhaar details, and signatures had been harvested and weaponised. A vegetable vendor in Chhattisgarh was approached with an offer for a mobile SIM plan. He submitted his documents. Within weeks, crores moved through an account in his name. He discovered the fraud only after his bank access was frozen. A welder’s former employer opened accounts in both the welder’s name and his wife’s name, retaining the debit cards and registered mobiles. Both accounts were later frozen. Neither individual had any involvement in the betting operation. This was not incidental. This was the operating model.

To run the empire from Dubai, Chandrakar and Uppal needed an army. They recruited from home — nearly 1,000 young people from Chhattisgarh districts, lured by salaries they would never see in Bhilai or Raipur. These men staffed the call centres that kept the operation running around the clock. The platforms they operated had names designed to sound legitimate: laser247.com, betbhai.com, tigerexch247.com, cricketbet9.com, play247.win. There were sixty offshore gambling websites in the constellation. Allied platforms — Reddy Anna and FairPlay — operated in the same ecosystem.

This was not crime as the public imagines it. This was a conglomerate.

III. THE SKYEXCHANGE ALLIANCE: KOLKATA ENTERS THE FRAME

No empire expands in isolation. From Kolkata, Hari Shankar Tibrewal — known in enforcement circles simply as “HST” — was running his own operation: Skyexchange. The platform was co-owned and co-promoted with Chandrakar and Uppal — a partnership forensically detailed in ED prosecution complaints and WhatsApp chats recovered from associates’ phones.

Tibrewal was a different species from the Bhilai boys. He was Kolkata-old-money-adjacent, operating in the grey zones of the city’s financial underground with the practised ease of someone who knew precisely how every rule bent. He lived partly in Dubai. He had stockbrokers, shell companies, and — crucially — the contacts needed to move money into places it would never be found.

Skyexchange generated ₹22 crore per week. Over its operating life of 178 documented weeks, the Enforcement Directorate calculated a total of ₹3,916 crore in Proceeds of Crime from Skyexchange alone. Then there was Lotus365, operated by Girish Talreja (also known as Ratan Lal Jain, also known as Aman). ₹50 crore a month from April 2020. Total Proceeds of Crime: ₹2,400 crore.

Add Mahadev Online Book, and the combined illegal betting empire was generating upwards of ₹5,000 crore per year at the network’s height. These are not the numbers of a street bookie. These are the numbers of a mid-sized legitimate enterprise that simply never paid tax, never registered, and never existed on any government ledger.

IV. THE PROBLEM WITH SUCCESS: BUILDING THE LAUNDROMAT

The problem with generating ₹5,000 crore a year in criminal proceeds is brutally practical: you cannot leave it in a suitcase. You cannot buy property with it. You cannot invest it. You cannot, under any circumstances, let it be traced back to men whose names sit on multiple FIRs across three states.

You need a laundromat.

In Kolkata, HST found Amit Saraogi — a man whose business card might as well have read “Accommodation Entry Operator.” In the specialised language of financial crime, accommodation entries are bank transactions deliberately created to give black money a paper trail that makes it look like legitimate income. Saraogi ran a factory of such entries.

By his own admission to investigators, Saraogi provided bank entries against cash totalling ₹525 crore. The mechanism was simple and dizzying in its scale: cash from the Skyexchange-Mahadev network was deposited through a web of at least thirty shell companies — entities with names like Fartile Trading Pvt. Ltd., Mocktail Trading Pvt. Ltd., and, with almost comic brazenness, Moppingtopping Trading Pvt. Ltd. — and emerged on the other side as “loans” and “investments” complete with full documentation.

₹175 crore from these entries went to a Delhi-based businessman named Vikas Garg, flowing through his companies GG Engineering Ltd. and Teamo Productions HQ Ltd. But ₹175 crore was merely the warm-up act.

The main act was an operation of such breathtaking audacity that, when the investigating officer first presented it to his superiors, it reportedly required three readings before anyone could believe it.

V. THE WALL STREET PLAY: FROM IPL BETS TO NASDAQ OWNERSHIP

Hari Shankar Tibrewal, using the proceeds of his illegal Skyexchange betting platform, set up a network of overseas entities — shell companies incorporated in Dubai, Mauritius, and the United Kingdom. These entities were used to invest in Indian-listed companies through the Foreign Portfolio Investor (FPI), Foreign Direct Investment (FDI), Qualified Institutional Placement (QIP), and Foreign Currency Convertible Bond (FCCB) routes.

This is the sophisticated version of washing dirty laundry: push the money out of India as undeclared cash, launder it through offshore shells, and bring it back in through the front door as “foreign investment.” On paper, it was indistinguishable from legitimate capital inflows that pass through Indian financial channels every single day.

The primary recipient was Vikas Garg and his listed companies — most critically M/s Eraaya Lifespaces Ltd., along with Vikas Lifecare and Vikas Ecotech. Total foreign investment received by Garg’s entities from these overseas conduits: ₹1,272.56 crore (with earlier documentation recording ₹765.77 crore specifically acknowledged by Garg himself as originating from the Kolkata businessman’s betting operations).

What did Vikas Garg do with this money?

He bought an American company.

EBIX Inc. — once a respected NASDAQ-listed global fintech company with 25 subsidiaries operating across insurance, financial services, and healthcare technology — had filed for bankruptcy protection in the United States in December 2023. When EBIX emerged from US Insolvency Court proceedings in August 2024, the company’s new majority owner — 97.58 per cent shareholding, acquired for approximately ₹1,175 crore (USD 138.577 million) — was M/s Eraaya Lifespaces Ltd.

The source of those funds? The ED’s investigation traces them, step by forensic step, back to HST, back to Skyexchange, back to the ₹22-crore-a-week illegal betting operation run in partnership with Sourabh Chandrakar and Ravi Uppal.

Illegal cricket bets placed by college students in Andhra Pradesh had funded the acquisition of a NASDAQ company.

On 5 June 2026, the Enforcement Directorate issued Provisional Attachment Order No. 16 of 2026, freezing ₹940.77 crore in assets connected to Garg — including 12,84,000 shares in EBIX Inc., another 2,13,200 shares, and twelve immovable properties spread across Goa, Delhi, Dehradun, Alwar, and Shahjahanpur. EBIX management received notice that assets valued at ₹893 crore could not be moved. An order issued from a zonal office in Raipur was now constraining assets linked to a company trading on the NASDAQ.

This was the tenth such order in the Mahadev case. The previous nine had already attached ₹2,825 crore. The cumulative total now exceeds ₹3,765 crore. Sixteen Provisional Attachment Orders have been issued so far. The investigation is not over.

VI. THE INSTITUTIONAL COLLAPSE: HOW EVERY GATEKEEPER FAILED

This is the most damning analytical finding of the entire saga. The money did not merely move. It moved through every single institutional checkpoint specifically designed to prevent precisely this outcome.

Indian banks processed the transactions. Foreign investment structures provided the routing. Corporate fundraising channels absorbed the capital. Statutory auditors signed the disclosures. Regulators across multiple jurisdictions saw nothing unusual enough to intervene. An American bankruptcy court approved the acquisition after due process. The SEC received the filings. Only after the deal had closed did investigators allege that the underlying capital was criminal.

Every institutional checkpoint — anti-money laundering systems, KYC compliance protocols, cross-border capital surveillance mechanisms, securities oversight frameworks, professional gatekeepers, and court-supervised due diligence — appears to have been navigated successfully.

That may be the most remarkable — and most terrifying — part of this story. It forces a question that extends far beyond one betting empire: How many transactions already moving through the global financial system look perfectly legitimate — and are not?

The Mahadev case is not merely a law enforcement success story about attachment of assets. It is an autopsy of systemic failure. It demonstrates that sophisticated criminal capital can, under the right conditions, wear the clothes of institutional legitimacy so convincingly that the system itself becomes an unwitting accomplice.

VII. THE NET CLOSES — AND OPENS NEW QUESTIONS

Eight FIRs have been registered across Chhattisgarh, Andhra Pradesh, and West Bengal. Multiple Prosecution Complaints have been filed. An Interpol Red Corner Notice is in play. A Supreme Court directive has been issued.

The Andhra Pradesh Police FIR (206/2023), registered at the Cyber Crime Police Station in Visakhapatnam, lists a Mahadev call centre operation with 19 persons arrested. It names Sourabh Chandrakar, Ravi Uppal, Kapil Chellani, and Satish Kumar as individuals who operated the platform.

Chandrakar was arrested in Dubai in November 2024. His extradition to India remains pending. Ravi Uppal, tracked to Dubai by Interpol, reportedly fled to Vanuatu — a Pacific island nation with no extradition treaty with India. The Supreme Court of India has directed the ED to locate and secure him. They remain, as of the latest reporting, operating on Vanuatu travel documents.

The Economic Offences Wing FIR 06/2024 from Raipur includes charges under the Prevention of Corruption Act — raising the spectre of political protection that allowed the operation to run undetected for years. Separate ED investigations allege that approximately ₹508 crore was paid by Mahadev promoters to powerful political figures in Chhattisgarh.

Sunil Bhandari — HST’s close associate and actual beneficial controller of Srestha Finvest Ltd. and Sylph Technologies Ltd. — has been served summons. Among the evidence recovered was a message on Bhandari’s phone containing a SkyExchange user ID, password credentials, and five crore betting points. Bhandari admitted using those credentials to place illegal bets on Champions Trophy and IPL matches, paying through cash courier networks. The same man helping move the money was also gambling on the platform generating it.

Gagan Gupta, a Dubai-based hawala operator and another HST associate, holds properties in his wife Deepika Gupta’s name. Prashant Bagri managed Skyexchange operations and, according to investigators, also managed Tibrewal’s stock portfolio — raising the deeply uncomfortable question of how much of India’s legitimate capital markets has been contaminated by this money.

This is Provisional Attachment Order No. 16. There have been fifteen before it. The investigation continues.

VIII. CRITICAL ANALYSIS: WHAT THIS CASE ACTUALLY REVEALS

Beyond the sensational numbers and the Netflix irony, the Mahadev-Skyexchange-EBIX trail constitutes one of the most significant case studies in modern Indian financial crime for several structural reasons.

First, the franchise model. Mahadev did not operate as a centralised betting ring. It operated as a distributed franchise system that externalised risk, maximised scale, and minimised the personal exposure of the principals. This is organisational sophistication that would be impressive in a legitimate corporation. In a criminal enterprise, it is exponentially more dangerous because it multiplies both the revenue base and the number of people with skin in the game who have every incentive to protect the system.

Second, the industrialisation of benami infrastructure. The systematic harvesting of Aadhaar and PAN details from ordinary citizens — vegetable vendors, welders, their wives — and the conversion of those identities into high-velocity money conduits represents a qualitative leap in the industrialisation of identity fraud. This is no longer opportunistic identity theft. This is identity farming as a core business process.

Third, the seamless integration of hawala, accommodation entries, and formal capital markets. The pathway from cash cricket bets → benami accounts → accommodation entries via shell companies with absurd names → offshore shells in Dubai/Mauritius/UK → FPI/QIP/FCCB into listed Indian companies → US bankruptcy court approval → NASDAQ ownership is a masterclass in layered laundering. Each layer provided a degree of separation. Each layer used a different regulatory regime’s weaknesses. The cumulative effect was near-perfect camouflage.

Fourth, the political economy of protection. The alleged ₹508 crore in payments to political figures in Chhattisgarh, combined with Prevention of Corruption Act charges in the Raipur FIR, suggests that the empire did not merely operate in the shadows. It may have purchased light. If proven, this would explain the multi-year operational freedom that allowed the network to reach its staggering scale.

Fifth, the contamination of legitimate markets. When Proceeds of Crime enter listed companies, fund acquisitions of foreign technology firms, and trade on the NASDAQ, the taint does not remain isolated. It raises fundamental questions about the integrity of price discovery, the reliability of disclosures, and the due diligence performed by every intermediary who touched the capital. The fact that Vikas Garg himself acknowledged the origin of the funds yet accepted them anyway is particularly revealing.

Sixth, the ghost problem. Satish Sanpal’s ambiguous position — highly visible on Netflix, subject to a Look-Out Circular, named in certain FIRs under variations of “Satish Kumar,” yet absent from the main ₹940 crore attachment order — crystallises a larger investigative challenge. In networks of this complexity, the public-facing figure and the actual controlling mind may be deliberately separated. The ongoing efforts by advocate Pranay Pathak to force an ECIR and Fugitive Economic Offenders proceedings against Sanpal will test whether the system can pierce that separation.

IX. THE STORY THAT IS NOT OVER

Somewhere in Vanuatu, a man who calls himself a co-founder of Mahadev Online Book watches the sea. Somewhere on a streaming platform, a man who calls himself a Dubai businessman watches himself on television, smiling. Somewhere in Raipur, an Enforcement Directorate file continues to grow. Somewhere in Jabalpur, an advocate is pressing for a new ECIR. Somewhere on the NASDAQ, shares of a company acquired with the proceeds of illegal cricket bets still trade.

The Lord Shiva of the betting underworld — Mahadev, the Destroyer — is still not fully named. The institutional gatekeepers who failed remain largely unexamined. The political protection alleged remains unproven in court. The full map of shell companies, beneficial owners, and market contamination is still being drawn.

What is already clear is this: a juice seller from Bhilai and his partners built an empire that outmanoeuvred Indian banks, offshore jurisdictions, American bankruptcy courts, and the global financial surveillance architecture. They turned illegal bets into Nasdaq ownership. They turned ordinary citizens’ identities into high-velocity laundering pipelines. And they left behind a Netflix star whose smile may yet become the most expensive smile in Indian criminal history.

The story is not over. It has barely begun to be told in full.

BY THE NUMBERS: THE MAHADEV EMPIRE IN HARD DATA

₹450 crore per month — Peak revenue of Mahadev Online Book (2020–2023)

2,000+ — Active betting panels simultaneously across India

₹3,916 crore — Proceeds of Crime from Skyexchange alone (HST)

₹2,400 crore — Proceeds of Crime from Lotus365 (Talreja/Aman)

₹5,000+ crore per year — Combined annual generation of the ecosystem at peak

₹525 crore — Cash accommodation entries facilitated by Amit Saraogi

₹1,272.56 crore — Overseas “investment” into Vikas Garg entities

97.58% — EBIX Inc. shareholding acquired using Proceeds of Crime

USD 138.577 million / ≈₹1,175 crore — Consideration paid for EBIX controlling stake

₹940.77 crore — Assets attached under PAO No. 16/2026 (EBIX shares + 12 properties)

₹3,765+ crore — Cumulative value of all attachments in the Mahadev case (as of June 2026)

16 — Provisional Attachment Orders issued so far

8 — FIRs across Chhattisgarh, Andhra Pradesh, and West Bengal

₹508 crore — Alleged payments to political figures in Chhattisgarh

~1,000 — Young Indians employed in Mahadev’s Dubai call centres

60+ — Offshore gambling websites in the Mahadev constellation

EDITORIAL & LEGAL NOTE

This investigative article is based entirely on publicly reported Enforcement Directorate investigations, Provisional Attachment Order No. 16 of 2026 and preceding orders, police FIRs registered in Chhattisgarh, Andhra Pradesh and West Bengal, prosecution complaints, and statements of accused persons recorded by investigators, as detailed in the original reporting by Palak Shah for BW Businessworld (19 June 2026 and 11 July 2026).

All persons named in this article who have not been convicted by a court of competent jurisdiction must be presumed innocent until proven guilty in accordance with the law. The allegations of political payments, the precise beneficial ownership structures, and the full extent of market contamination remain matters under active investigation and subject to judicial determination.

Names of shell companies, financial routes, and quantitative figures are drawn directly from the ED and police records as reported. This synthesis is offered as a comprehensive analytical and critical examination of the public record for the purpose of public interest journalism and informed discourse on systemic vulnerabilities in India’s financial and regulatory architecture.

The story continues.

Synthesised and analysed from original reporting by Palak Shah, BW Businessworld

11 July 2026