Key Takeaways
- • Brooklyn District Attorney Eric Gonzalez's office dismantled the online infrastructure of a crypto scam targeting Russian speakers, seizing or disrupting 241 scam domains and 112 servers with FBI assistance.
- • Investigators put losses in the tens of millions of dollars, with some victims losing their entire life savings; prosecutors have seized about $300,000 so far and are working to claw back more.
- • The scheme lured victims through Russian-language Facebook ads, then used fake "investment advisors" to coax them into crypto accounts and transfers to addresses tied to the platform, after which withdrawals were blocked or victims were asked for extra fees and taxes.
- • The same operators ran a follow-on recovery scam, contacting victims weeks or months later with promises to retrieve stolen crypto.
- • The takedown targeted infrastructure hosted by Eastern European and American firms, with the scammers reportedly running on servers in Ukraine and elsewhere in Eastern Europe, limiting their ability to launch new sites or contact existing victims.
Summary
Brooklyn District Attorney Eric Gonzalez's office has dismantled the online backbone of a cryptocurrency fraud aimed at Russian speakers, according to the office's press release as reported by BeInCrypto. The scheme drew victims in through Russian-language Facebook advertisements promising investment opportunities. Victims who responded were called by a Russian-speaking "investment advisor" who guided them through opening an account on a crypto platform, helped them buy cryptocurrency, and directed them to send it to addresses tied to that platform.
According to the DA's office, victims who later attempted to withdraw found their accounts locked, while others were told to pay additional fees and taxes before accessing their funds. The office estimates that tens of millions of dollars were stolen, with some victims losing their entire life savings. Prosecutors have seized approximately $300,000 in stolen funds so far and are working to recover more.
Data from the seized servers showed that the same group also ran a recovery scam. A few weeks after the initial theft, operators contacted victims again, offering to retrieve their stolen crypto. This second layer of fraud is what the article's headline refers to as hitting victims twice.
The investigation was built around infrastructure rather than individual sites. The DA's unit had previously seized or disrupted some 400 domains tied to crypto investment fraud, but replacement sites kept appearing quickly. Investigators traced the servers behind them and coordinated search warrants across three time zones with the FBI. Besides the 241 domains, more than 100 cloud servers hosted by Eastern European and American firms were disrupted, with the scammers operating on infrastructure in Ukraine and elsewhere in Eastern Europe. Prosecutors said the takedown removes access to victim data, site content, and operational software, and strips the group of its ability to spin up new sites quickly or contact existing victims.
The case forms part of a broader US effort against cross-border crypto fraud. The article notes that in July federal authorities seized $25 million linked to international fraud networks, and in September the US and UK signed a pact targeting scam compounds overseas.
According to the DA's office, victims who later attempted to withdraw found their accounts locked, while others were told to pay additional fees and taxes before accessing their funds. The office estimates that tens of millions of dollars were stolen, with some victims losing their entire life savings. Prosecutors have seized approximately $300,000 in stolen funds so far and are working to recover more.
Data from the seized servers showed that the same group also ran a recovery scam. A few weeks after the initial theft, operators contacted victims again, offering to retrieve their stolen crypto. This second layer of fraud is what the article's headline refers to as hitting victims twice.
The investigation was built around infrastructure rather than individual sites. The DA's unit had previously seized or disrupted some 400 domains tied to crypto investment fraud, but replacement sites kept appearing quickly. Investigators traced the servers behind them and coordinated search warrants across three time zones with the FBI. Besides the 241 domains, more than 100 cloud servers hosted by Eastern European and American firms were disrupted, with the scammers operating on infrastructure in Ukraine and elsewhere in Eastern Europe. Prosecutors said the takedown removes access to victim data, site content, and operational software, and strips the group of its ability to spin up new sites quickly or contact existing victims.
The case forms part of a broader US effort against cross-border crypto fraud. The article notes that in July federal authorities seized $25 million linked to international fraud networks, and in September the US and UK signed a pact targeting scam compounds overseas.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.