Ukraine's National Police and Security Service said Tuesday they had broken up a fake investment platform network operating out of Kyiv. The scheme used a built-in wallet-draining tool to steal cryptocurrency from users in more than 20 countries.
So far, investigators have identified 62 victims from Germany, Poland, Lithuania, Latvia, Spain, France, the United Kingdom, Canada, and Israel, among other countries. The organizer brought in more than 46 Ukrainian nationals to staff several offices in Kyiv and nearby areas. Developers built the bogus platforms and worked to dodge takedowns. Others handled phone-based customer service and security.
According to the Security Service of Ukraine, the organizer was a 25-year-old IT specialist. At its height, the group was making as much as $1 million a month. It started with ads for cryptocurrency investment projects on Telegram. Once users signed up and connected their wallets, the group manually faked transactions to display inflated balances in the backend. Then came the trap. When users tried to withdraw funds, the platform prompted them to connect their main wallet and approve a small "test" transaction. That approval activated a built-in wallet-draining tool. The assets were sent to wallets controlled by the group, and the victims were locked out of their accounts.
Investigators traced the group's database servers to the Netherlands. Those servers held victims' information, wallet addresses, stolen amounts, internal communications, and platform operating data. They also contained passports, phone numbers, emails, login passwords, and photos. Police carried out 34 searches in Kyiv and the surrounding region. They seized more than 100 computers, over 100 mobile phones, 79 SIM cards, a GSM gateway, cash, and 15 vehicles.