The Brooklyn District Attorney’s office, in a sweeping coordinated effort alongside the Federal Bureau of Investigation, has dismantled the online infrastructure of a sophisticated multinational cryptocurrency scam that targeted Russian-speaking victims across the United States, draining tens of millions of dollars in life savings.
Operating across multiple time zones in a rapid, synchronized strike, federal and local investigators executed a wave of search warrants over the course of just a few hours. The operation successfully seized or disrupted 241 fraudulent domains alongside more than 100 cloud servers hosted by a mix of Eastern European and American companies. According to an official statement released by prosecutors on Wednesday, these compromised servers served as the centralized digital engine for the criminal enterprise, housing vital victim data, deceptive site content, and the core operating software needed to execute the fraud.
The takedown marks a significant milestone in the ongoing battle against transnational digital asset crime, showcasing the tactical evolution of law enforcement agencies in dealing with borderless cyber threats.
"Our groundbreaking Virtual Currency Unit identified the fraud, tracked the stolen cryptocurrency, broke new ground by uncovering the infrastructure behind the operation, and worked with the FBI to dismantle it," Brooklyn District Attorney Eric Gonzalez said in a statement detailing the successful enforcement action.
Gonzalez emphasized the scale and impact of the operation, noting that targeting the root technology of the scheme delivers a severe blow to the perpetrators. "By disrupting more than 100 servers and hundreds of fraudulent websites, we have struck at the heart of this criminal enterprise and made it far harder for these scammers to victimize others. I commend our investigators and thank the FBI for their partnership in this extraordinary operation," he added.
The criminal enterprise relied on a meticulously crafted social engineering and technical framework designed to exploit trust within specific linguistic communities. The fraud typically began on social media platforms, where perpetrators posted Russian-language investment advertisements on Facebook. These ads were carefully tailored to catch the attention of individuals seeking financial growth through digital assets, utilizing familiar cultural and linguistic cues to lower the guard of prospective targets.
Once a user expressed interest, a dynamic personal touch was introduced. A professional-sounding, Russian-speaking individual posing as a dedicated financial "advisor" would reach out directly via telephone or messaging applications. Over a series of conversations, this advisor would build rapport, establish false credibility, and methodically guide the victim through the process of opening an account on what appeared to be a legitimate, highly sophisticated cryptocurrency trading platform. Trusting the guidance of their assigned mentor, victims would purchase digital assets and transfer them into the platform, watching online dashboards that displayed fabricated, upwardly trending portfolio balances.
The illusion of profitable investing would continue for weeks or even months, encouraging victims to invest increasingly larger sums of money, often liquidating retirement accounts, borrowing against their homes, or handing over their entire life savings. However, the true nature of the scam would only reveal itself when victims attempted to cash out or withdraw their funds.
At that critical juncture, the platform’s mechanics would suddenly shift. Victims would find themselves abruptly locked out of their accounts. Those who managed to maintain contact were informed that they needed to pay exorbitant, unexpected "fees" and "taxes" before any withdrawals could be processed. Of course, any additional funds paid to cover these fabricated costs simply vanished into the criminal network, compounding the financial devastation.
The psychological toll on the victims was profound, but the cruelty of the criminal syndicate often did not stop there. In a particularly predatory twist, many victims who had already been cleaned out were targeted a second time. Weeks after the initial fraud, scammers would re-emerge, this time posing as specialized recovery services. Reaching out to the desperate individuals who had lost everything, these secondary actors promised to track down and retrieve the stolen cryptocurrency for a fee—only to fleece them yet again.
Prior to the latest coordinated server strike, the Brooklyn District Attorney’s Virtual Currency Unit had already aggressively targeted the surface-level manifestations of the enterprise, systematically identifying and taking down approximately 400 individual scam domains. However, investigators quickly realized that simply playing whack-a-mole with domains was insufficient, as the operators routinely spun up new web addresses almost as fast as law enforcement could shutter them.
Recognizing that the operational resilience of the scam relied on a centralized web of hosting infrastructure, prosecutors and federal agents shifted their focus to the underlying cloud servers. Hitting these backend servers directly crippled the syndicate’s operational capacity, effectively cutting off their ability to quickly launch new replacement websites or easily reach back out to past victims through their existing databases.
The massive disruption operation is the culmination of an intensive three-year investigation into the multinational syndicate. While the digital assets stolen by the enterprise total in the tens of millions of dollars, recovering funds that have been aggressively laundered across decentralized blockchain networks and cross-border jurisdictions remains an immense challenge. To date, prosecutors have successfully recovered about $300,000 of the stolen funds.
Despite the difficulties inherent in tracing and repatriating cryptocurrency across international lines, the Brooklyn District Attorney’s office stated that their investigation remains active and ongoing. Prosecutors and federal investigators are continuing their efforts to trace additional assets, identify other co-conspirators involved in the multinational network, and claw back as much of the victims’ hard-earned money as possible.
