Key Takeaways
- • Ukraine's National Police, Security Service, and Prosecutor General dismantled a network of fake cryptocurrency investment platforms that operated across more than 20 countries, with investigators confirming 62 victims and estimated monthly turnover reaching $1 million at peak operation.
- • The scheme employed wallet-draining tactics: victims were recruited through Telegram advertisements, directed to fraudulent websites mimicking legitimate platforms, and instructed to connect cryptocurrency wallets and deposit funds before being stolen from upon withdrawal attempts.
- • Law enforcement conducted 34 coordinated searches and seized over 100 computers, more than 100 mobile phones, and 15 vehicles; more than 46 Ukrainian nationals were identified as network participants, with authorities still identifying additional perpetrators and victims.
- • The operation maintained multiple physical offices in Kyiv and surrounding regions with specialized roles: developers managed infrastructure and platform accessibility, while other members handled customer communications, office operations, and security functions.
Summary
Ukrainian authorities have shut down a sophisticated cryptocurrency investment fraud network that siphoned funds from victims across more than 20 countries. The National Police of Ukraine's Main Investigation Department, working jointly with the Security Service of Ukraine (SBU) and the Office of the Prosecutor General, identified at least 62 confirmed victims while the network operated with an estimated monthly turnover of up to $1 million at its peak.
The scheme operated through fabricated cryptocurrency investment platforms advertised primarily on Telegram. Potential victims were presented with apparently legitimate investment opportunities and instructed to register accounts, connect cryptocurrency wallets, and deposit funds. Once funds were transferred to the network's infrastructure, scammers displayed fake positive investment returns to encourage additional deposits. When victims attempted to withdraw their holdings, wallet-draining malware or manual theft emptied their accounts entirely.
The criminal organization was geographically centered in Kyiv with multiple operational offices in the surrounding region. More than 46 Ukrainian nationals participated in the network, each fulfilling distinct operational roles. Backend developers maintained the fraudulent websites and worked continuously to restore platform access when law enforcement or security firms attempted to block domains. Additional participants staffed physical offices, managed customer communications, and provided operational security. Authorities have not yet completed the investigation and continue identifying other participants, victims, and the total amount stolen.
Law enforcement's enforcement action involved 34 coordinated searches and resulted in the seizure of more than 100 computers, over 100 mobile phones, and 15 vehicles. The operation represents a significant cross-border law enforcement escalation in cryptocurrency fraud enforcement, demonstrating Ukraine's institutional capacity to dismantle complex international fraud networks operating from its territory.
The scheme operated through fabricated cryptocurrency investment platforms advertised primarily on Telegram. Potential victims were presented with apparently legitimate investment opportunities and instructed to register accounts, connect cryptocurrency wallets, and deposit funds. Once funds were transferred to the network's infrastructure, scammers displayed fake positive investment returns to encourage additional deposits. When victims attempted to withdraw their holdings, wallet-draining malware or manual theft emptied their accounts entirely.
The criminal organization was geographically centered in Kyiv with multiple operational offices in the surrounding region. More than 46 Ukrainian nationals participated in the network, each fulfilling distinct operational roles. Backend developers maintained the fraudulent websites and worked continuously to restore platform access when law enforcement or security firms attempted to block domains. Additional participants staffed physical offices, managed customer communications, and provided operational security. Authorities have not yet completed the investigation and continue identifying other participants, victims, and the total amount stolen.
Law enforcement's enforcement action involved 34 coordinated searches and resulted in the seizure of more than 100 computers, over 100 mobile phones, and 15 vehicles. The operation represents a significant cross-border law enforcement escalation in cryptocurrency fraud enforcement, demonstrating Ukraine's institutional capacity to dismantle complex international fraud networks operating from its territory.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.