On October 14, 2026, the Brooklyn District Attorney's Office and the FBI announced the disruption of a multinational crypto scam network that stole tens of millions of dollars from Russian-speaking Americans. Authorities seized 112 servers and 241 web domains operating across Ukraine and Eastern Europe. The fraudsters lured victims through Russian-language Facebook ads and later targeted them with fake recovery services. Prosecutors have recovered $300,000 in stolen funds, though no arrests have been made.
Seizure of server infrastructure
- ▪Seizing the 112 servers disabled the scammers' operational software, victim database, and backend infrastructure, preventing them from quickly spinning up replacement sites.
- ▪The scammers relied on cyber infrastructure and IP addresses located in Ukraine and other Eastern European countries.
- ▪Prosecutors and the FBI seized and disrupted 112 cloud servers hosted by Eastern European and American firms across three time zones in October 2026.
Results of law enforcement action
- ▪The Brooklyn District Attorney's Office has seized approximately $300,000 in stolen funds so far and is working to recover additional assets.
- ▪On October 14, 2026, the Brooklyn District Attorney's Office and the FBI announced a joint enforcement action that disrupted a multinational cryptocurrency scam operation.
- ▪Law enforcement authorities made no arrests in connection with the October 2026 cryptocurrency scam infrastructure disruption.
Disruption of fraudulent web domains
- ▪Prior to the October 2026 server takedown, the Brooklyn District Attorney's Virtual Currency Unit had seized or disrupted 400 domains during a three-year investigation.
- ▪Law enforcement authorities seized and disrupted 241 fraudulent web domains associated with the international cryptocurrency fraud network.
Victims and overall financial losses
- ▪The cryptocurrency scam operation specifically targeted Russian-speaking Americans, with a large concentration of victims located in the New York borough of Brooklyn.
- ▪Prosecutors estimated overall victim losses from the cryptocurrency investment scam in the tens of millions of dollars, with some individuals losing their entire life savings.
How the fake investment scheme worked
- ▪When victims attempted to withdraw their crypto assets after weeks or months, the platform operators locked their accounts or demanded additional fees and taxes.
- ▪Victims who responded to the Facebook advertisements were contacted by Russian-speaking callers posing as investment advisors.
- ▪The fraudsters recruited victims using Russian-language Facebook advertisements that promised investment opportunities.
- ▪Fake investment advisors coached victims on opening accounts on fraudulent crypto platforms and sending cryptocurrency to specific wallet addresses.
Secondary recovery scam scheme
- ▪Weeks after stealing victims' cryptocurrency, the fraudsters initiated a secondary recovery scam, contacting victims with false promises to retrieve their stolen funds for a fee.
- ▪Server data seized by law enforcement revealed that the same criminal network operated both the initial fake investment scheme and the secondary recovery scam.
Story comments
Loading comments…