Brooklyn prosecutors and the FBI have disrupted a multinational cryptocurrency investment scam that targeted Russian-speaking Americans, seizing or disabling 112 servers and 241 fraudulent domains in coordinated actions last week across three time zones. The servers were hosted by Eastern European and American companies, while investigators identified infrastructure and internet addresses in Ukraine and other Eastern European countries. No arrests were announced.
The investigation began three years ago after Russian-speaking Brooklyn residents reported responding to Russian-language Facebook advertisements promising investment opportunities. Purported advisers then guided victims through opening cryptocurrency accounts, buying digital assets and transferring them to addresses linked to fake investment platforms. After weeks or months, victims who tried to withdraw funds were locked out or told to pay additional fees and taxes.
Information recovered from the servers showed that the operation also pursued victims a second time. Weeks after the initial theft, scammers contacted victims with promises to recover their cryptocurrency for another payment. Some fake platforms used references to U.S. Government agencies or prominent figures to appear legitimate.
The Brooklyn District Attorney’s Virtual Currency Unit had previously seized or disrupted about 400 domains tied to cryptocurrency investment fraud, but new sites continued to appear. Investigators therefore targeted the cloud servers that supplied the websites with data, victim information and operational software, cutting off the infrastructure used to create replacement sites and contact earlier victims.
Prosecutors estimate that the scheme stole tens of millions of dollars, including some victims’ entire life savings. Authorities have recovered about $300,000 so far and are seeking to claw back more. The operation involved assistance from the FBI, Shadow Server, Coeus and UltaHost.