Key Takeaways
- • Brooklyn District Attorney Eric Gonzalez's office, working with the FBI, seized 241 web domains and 112 servers used in a cryptocurrency investment fraud targeting Russian-speaking residents of Brooklyn, according to The Record from Recorded Future News.
- • Victims, lured by Russian-language Facebook ads, were walked through opening crypto accounts and transferring funds, then locked out and asked for extra fees and taxes; authorities believe victims lost millions and clawed back about $300,000.
- • The scammers ran a secondary recovery scam, contacting victims weeks later and offering to recover their stolen crypto for a fee.
- • Investigators traced infrastructure to Ukraine and other Eastern European countries, with search warrants executed in several countries to seize domains and servers.
- • A Treasury Department report cited in the coverage says more than $12.7 billion was stolen from Americans in crypto investment scams between September 2023 and December 2025.
Summary
Brooklyn District Attorney Eric Gonzalez said his office, in cooperation with the FBI, seized and disrupted 241 web domains and 112 servers used in a cryptocurrency fraud scheme aimed at the Russian-speaking community in Brooklyn, according to The Record from Recorded Future News. Gonzalez said the tools had been used to steal millions of dollars from victims.
The investigation began about three years ago, when a number of Russian-speaking victims told prosecutors they had responded to Facebook ads in Russian offering investment opportunities. An investment adviser then contacted them and guided them through creating cryptocurrency accounts and transferring funds to investment platforms. When victims attempted to withdraw their money, they were locked out and told they needed to pay additional fees and taxes to access their funds. Several of the seized websites were designed to resemble legitimate investment platforms and referenced U.S. government agencies or wealthy individuals such as Elon Musk. Authorities say victims likely lost millions, though about $300,000 in stolen funds was recovered.
Investigators found that the criminals used IP addresses and infrastructure in Ukraine and several other Eastern European countries. Search warrants executed in multiple countries enabled law enforcement to seize the domains and servers, which contained victim information, website data and operational software. The seized data also showed a secondary operation in which scammers contacted victims weeks after the initial fraud and offered, for a price, to recover their stolen cryptocurrency. Gonzalez said, "These criminals stole many millions of dollars from Russian-speaking victims through an elaborate investment scheme, then tried to exploit them again with false promises to recover their money."
Gonzalez noted that his office has taken several similar actions over the past two years, seizing about 400 domains tied to cryptocurrency investment fraud. Because new scam websites repeatedly reappeared shortly after takedowns, law enforcement increasingly targeted the European backend servers that power the sites.
The case comes against a broader backdrop of crypto investment fraud. A Treasury Department report released last month found that more than $12.7 billion was stolen from Americans in cryptocurrency investment scams between September 2023 and December 2025, with victims in all 50 states and U.S. territories.
The investigation began about three years ago, when a number of Russian-speaking victims told prosecutors they had responded to Facebook ads in Russian offering investment opportunities. An investment adviser then contacted them and guided them through creating cryptocurrency accounts and transferring funds to investment platforms. When victims attempted to withdraw their money, they were locked out and told they needed to pay additional fees and taxes to access their funds. Several of the seized websites were designed to resemble legitimate investment platforms and referenced U.S. government agencies or wealthy individuals such as Elon Musk. Authorities say victims likely lost millions, though about $300,000 in stolen funds was recovered.
Investigators found that the criminals used IP addresses and infrastructure in Ukraine and several other Eastern European countries. Search warrants executed in multiple countries enabled law enforcement to seize the domains and servers, which contained victim information, website data and operational software. The seized data also showed a secondary operation in which scammers contacted victims weeks after the initial fraud and offered, for a price, to recover their stolen cryptocurrency. Gonzalez said, "These criminals stole many millions of dollars from Russian-speaking victims through an elaborate investment scheme, then tried to exploit them again with false promises to recover their money."
Gonzalez noted that his office has taken several similar actions over the past two years, seizing about 400 domains tied to cryptocurrency investment fraud. Because new scam websites repeatedly reappeared shortly after takedowns, law enforcement increasingly targeted the European backend servers that power the sites.
The case comes against a broader backdrop of crypto investment fraud. A Treasury Department report released last month found that more than $12.7 billion was stolen from Americans in cryptocurrency investment scams between September 2023 and December 2025, with victims in all 50 states and U.S. territories.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.