Ukrainian police and the Security Service of Ukraine, or SBU, said they had broken up an international crypto scam network built around fake investment platforms. The scheme displayed steadily rising returns to victims on screen, but when users tried to withdraw funds, the platform directed them to connect a real wallet and then used a wallet drainer to remove the assets.
Fake profits on screen, drained wallets at withdrawal
According to a news release cited from the National Police of Ukraine, the group followed a standardized process. Victims were guided to register on sham investment platforms where they saw apparent profits continue to rise. Police said those profit figures were manually adjusted by backend operators to create the illusion of successful investing.
When a victim requested a withdrawal, the platform asked the user to connect a real wallet for "verification." What appeared to be a small test action instead triggered a hidden wallet drainer. Once the transfer went through, the victim was locked out of the platform.
The SBU said the group’s monthly turnover reached as much as $1 million. Authorities have so far identified at least 62 victims from more than 20 countries, and more than 46 Ukrainians were involved in running the operation.
Passport details, passwords and photos were also collected
Police said the operation was not limited to stealing crypto assets. During registration and identity verification, the platforms gathered a range of personal data, including:
- passport information
- phone numbers
- email accounts
- login names and passwords
- personal photos
Authorities said that information could give the group access to victims’ digital assets and could also be used in later fraud attempts.
Investigators identified a 25-year-old IT specialist as a central figure
Investigators said they had identified a 25-year-old IT specialist as the core figure in the group. He allegedly recruited more than 46 Ukrainians and set up multiple offices in Kyiv and nearby areas, with specific roles assigned across the network.
- Technical staff built and maintained the fake platforms and kept them running online
- Sales staff contacted potential victims and managed office operations
- Security staff provided physical protection support
Dutch servers provided a key lead
Authorities said the case advanced after investigators traced the group’s server infrastructure to the Netherlands. Police obtained access to a database stored there.
The database included:
- lists of victims
- crypto wallet addresses
- amounts suspected of being stolen
- internal communications
- operational procedures for the fake platforms
Investigators said those records helped reconstruct how the fraud worked and verify victims. Ukrainian police and the SBU then carried out 34 searches in Kyiv and surrounding areas.
More than 100 computers and 15 vehicles seized
According to police, items seized in the operation included:
- more than 100 computers
- more than 100 mobile phones
- 79 SIM cards
- documents and cash
- 15 vehicles
Identified victims came from countries including Germany, Poland, Lithuania, Latvia, Spain, France, the United Kingdom, Canada and Israel. The investigation remains open as authorities continue to search for additional suspects and more victims, and work to determine the total amount of crypto assets stolen.
Wallet drainers are being used in organized fraud operations
The case points to a wider shift in crypto fraud methods described by the authorities. Rather than relying on victims to knowingly transfer funds, wallet drainers can empty a wallet while the user believes they are completing a minor verification step.
In this case, the fake platform was used to build trust, while the wallet connection step served as the point of attack. Police disclosures also indicate that personal data and wallet-related information could be taken at the same time, raising the risk of follow-on fraud such as identity abuse or targeted phishing.