Key Takeaways
- • Brooklyn District Attorney Eric Gonzalez disclosed on Oct. 14 an international operation that disrupted 112 servers and 241 websites tied to a crypto investment scheme that allegedly stole tens of millions of dollars from U.S. victims.
- • The scheme targeted Russian-speaking Americans through Russian-language Facebook ads and impersonated Russian-speaking investment advisers, with Brooklyn, home to a large Russian-speaking population, a concentration of victims.
- • After the initial theft, the same network returned weeks later posing as recovery services, a tactic the FBI has identified as a common pattern in crypto fraud.
- • Investigators have seized only about $300,000 in stolen assets against losses estimated at tens of millions of dollars, and no arrests or named operators were announced.
- • The operation targeted cloud servers hosted by companies in Eastern Europe and the United States, with infrastructure reportedly in Ukraine and other Eastern European countries.
Summary
Brooklyn prosecutors disclosed on October 14 that an international enforcement operation had disrupted 112 servers and 241 websites supporting a cryptocurrency investment scheme that allegedly stole tens of millions of dollars from victims across the United States. The operation was conducted with help from the Federal Bureau of Investigation and several private-sector organizations, including Shadowserver, Coeus and UltaHost. According to prosecutors, the scheme was a two-stage fraud. In the first stage, the network targeted Russian-speaking investors through Russian-language Facebook advertisements promoting cryptocurrency investment opportunities. Respondents received phone calls from individuals posing as Russian-speaking investment advisers, who directed them to trading websites, helped open accounts and instructed them to buy digital assets and transfer them to wallet addresses linked to the platforms.
The deception typically surfaced weeks or months later, when victims sought withdrawals. Some found their accounts locked, while others were told to pay additional fees or taxes before funds could be released. Prosecutors said recovered server data showed the operators then contacted victims several weeks after the initial fraud, offering to recover the missing assets. Authorities did not disclose how many victims received these offers or whether any made further payments. The FBI has warned that fraudulent recovery businesses commonly target people who have already lost money to investment scams, sometimes demanding upfront payments, providing misleading asset-tracing reports or falsely claiming law enforcement ties.
The District Attorney's Virtual Currency Unit had previously seized or disrupted about 400 domains linked to crypto investment fraud, but replacement sites appeared quickly. Last week's operation, which spanned three time zones, therefore extended to search warrants and the disruption of cloud-based servers hosted by companies in Eastern Europe and the United States. Prosecutors said the network relied on infrastructure and internet addresses in Ukraine and other Eastern European countries. The aim was to cut off access to software, website data and victim records, and to prevent the operators from rebuilding quickly and using stored customer information to approach victims again.
Recovery of the stolen funds remains a separate challenge. Prosecutors estimate the scheme stole tens of millions of dollars, but only about $300,000 in assets has been seized so far. The District Attorney's Office has not said whether victims have recovered any funds or set a restitution timetable. The announcement did not identify the alleged operators or announce any arrests, and investigators continue efforts to recover additional assets.
The deception typically surfaced weeks or months later, when victims sought withdrawals. Some found their accounts locked, while others were told to pay additional fees or taxes before funds could be released. Prosecutors said recovered server data showed the operators then contacted victims several weeks after the initial fraud, offering to recover the missing assets. Authorities did not disclose how many victims received these offers or whether any made further payments. The FBI has warned that fraudulent recovery businesses commonly target people who have already lost money to investment scams, sometimes demanding upfront payments, providing misleading asset-tracing reports or falsely claiming law enforcement ties.
The District Attorney's Virtual Currency Unit had previously seized or disrupted about 400 domains linked to crypto investment fraud, but replacement sites appeared quickly. Last week's operation, which spanned three time zones, therefore extended to search warrants and the disruption of cloud-based servers hosted by companies in Eastern Europe and the United States. Prosecutors said the network relied on infrastructure and internet addresses in Ukraine and other Eastern European countries. The aim was to cut off access to software, website data and victim records, and to prevent the operators from rebuilding quickly and using stored customer information to approach victims again.
Recovery of the stolen funds remains a separate challenge. Prosecutors estimate the scheme stole tens of millions of dollars, but only about $300,000 in assets has been seized so far. The District Attorney's Office has not said whether victims have recovered any funds or set a restitution timetable. The announcement did not identify the alleged operators or announce any arrests, and investigators continue efforts to recover additional assets.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.