Ukraine’s National Police and Security Service said Tuesday they had shut down a network of fake investment platforms that drained crypto wallets belonging to people in more than 20 countries.
Investigators have identified 62 victims so far, including citizens of Germany, Poland, Lithuania, Latvia, Spain, France, the U.K., Canada, and Israel. Authorities said the organizer recruited more than 46 Ukrainians and ran several offices in Kyiv and the surrounding region.
According to the agencies, developers built the fake platforms and kept them online despite blocking attempts. Other members staffed the offices, worked the phones, and handled security.
Telegram pitch led users onto fake crypto platforms
The Security Service described the organizer as a 25-year-old IT specialist and said the group’s turnover reached up to $1 million a month at its peak. Its account said the scam started on Telegram, where the group advertised supposedly profitable crypto projects.
Users who signed up connected a wallet and sent funds for what they were told were investment opportunities. Staff then manually faked trading activity, showing balances rising inside each customer’s dashboard.
Withdrawal requests were blocked and a test transaction triggered the drainer
When victims tried to withdraw funds, the requests were blocked. They were then told that, to confirm the platform was working, they needed to connect their main wallet and approve a small test transaction.
Investigators said that approval activated a drainer embedded in the site. The assets were then moved to wallets controlled by the group, and the victim was locked out.
Database on servers in the Netherlands contained victim and platform records
Investigators traced server equipment in the Netherlands that held the group’s database and gained access to it. Authorities said the database listed victims, wallet addresses, sums taken, internal correspondence, and records showing how the platforms operated.
Registration and verification steps also collected passport details, phone numbers, email addresses, logins, passwords, and photographs, according to the investigation.
Police carried out 34 searches in and around Kyiv
Officers conducted 34 searches across Kyiv and the surrounding region. They seized more than 100 computers, more than 100 phones, 79 SIM cards, a GSM gateway, cash, and 15 cars.
Authorities said some vehicles and property were registered to suspects’ wives and relatives. The organizer also moved with armed guards.
The case is proceeding under Part 5 of Article 190 of Ukraine’s criminal code. Police said they are still identifying all people involved, additional victims, and the total amount stolen.
Seized crypto management has also moved forward in Ukraine
Decrypt noted that Ukraine moved more than $8.3 million in seized USDT into a state-run wallet in June, the first time confiscated crypto had been placed under state management. The Royal United Services Institute has estimated that tighter rules could recover at least $10 billion in stolen funds and lost tax revenue for the country.
