The Brooklyn District Attorney’s Office said on Oct. 14 that a cross-border law enforcement operation had shut down 112 servers and 241 websites tied to a crypto investment scam. Prosecutors said the sites supported a fraud network believed to have taken tens of millions of dollars from victims across the United States.
Investigators said the scheme did not end with the initial theft. Weeks after victims lost money, the same group allegedly contacted some of them again and claimed it could help recover the stolen assets, using that claim to demand more payments. Prosecutors said some victims lost their life savings.
Three-year probe traced a repeat-targeting operation
According to Brooklyn District Attorney Eric Gonzalez, the group built a polished fake investment operation aimed at Russian-speaking people in the U.S. After the first round of fraud, the same network allegedly returned with offers to recover stolen crypto and used that as a second way to extract money.
The investigation lasted three years, prosecutors said. Many victims were based in Brooklyn, which has a large Russian-speaking community. Data pulled from the seized servers showed that the operators kept communication channels open after the original fraud and later used them to try to exploit victims again.
How the scam worked
Investigators said the scheme started with Russian-language ads on Facebook promoting crypto investment opportunities.
People who responded were contacted by callers posing as Russian-speaking investment advisers. Those callers directed victims to phishing websites presented as crypto trading platforms, helped them register accounts, and pushed them to buy digital assets.
Victims then sent crypto to wallet addresses provided by the fake platforms, believing they were funding legitimate investments. The fraud became clear only weeks or months later, when investors tried to withdraw funds. Some accounts were locked. Others were told they had to pay additional fees or taxes before any funds could be released.
Prosecutors said the losses created by that first stage became the basis for a second round of fraud.
Fake asset recovery followed the initial scam
Server evidence cited by prosecutors showed that, several weeks after the first theft, the operators contacted victims again and said they could help recover the missing assets.
Because the first scheme had already collected detailed victim information, the group was able to target people who had already suffered major financial losses. Authorities did not say how many victims received these “asset recovery” pitches or how many sent more money.
The Federal Bureau of Investigation has previously warned about this pattern, saying fake crypto recovery services often target people who have already been harmed by investment fraud. Prosecutors described the Brooklyn case as a clear example.
According to the DA’s office, these operations often demand upfront payments, provide misleading asset-tracing reports, or falsely claim ties to law enforcement in order to persuade victims to transfer more money.
Investigators moved beyond domain seizures
The operation, carried out with FBI assistance, targeted more than front-end scam sites. Prosecutors said the focus was the broader infrastructure that kept the platforms online, stored victim data, and supported continued contact with victims.
The Brooklyn DA’s virtual currency unit had previously seized and shut down about 400 domains tied to crypto scams. Prosecutors said operators could quickly replace those sites, allowing the fraud to continue even after enforcement action.
That led investigators to move beyond domain takedowns. In an operation last week spanning three time zones, the DA’s office obtained search warrants and coordinated the shutdown of cloud servers hosted by service providers in Eastern Europe and the United States.
According to the DA’s office, the group relied on network equipment and IP addresses in Ukraine and other Eastern European countries. The aim of the server takedown was to cut off the software, back-end site data, and victim information databases used by the operation. Prosecutors also said the move was meant to make it harder for the group to quickly rebuild phishing sites and continue contacting victims with bogus recovery offers.
Tens of millions lost, about $300,000 seized
The enforcement effort also received support from private-sector groups including Shadowserver, Coeus, and UltaHost.
Even with the infrastructure disruption, recovering stolen crypto remains difficult. Prosecutors estimate that the scheme involved tens of millions of dollars, but investigators have so far seized only about $300,000 in illicit proceeds.
The DA’s office did not say whether any victims have recovered part of their funds and did not provide a compensation timetable. Authorities also did not identify suspects or announce any arrests.
Investigators said efforts to trace the remaining assets are ongoing. Most of the stolen funds in the case are still unaccounted for.
