Crypto Scammers Targeted Victims Twice, Prosecutors Say

Brooklyn prosecutors disclosed the alleged fraud after an international operation disrupted 112 servers and 241 websites linked to a cryptocurrency investment scheme. The operation involved the Brooklyn District Attorney’s Office, the Federal Bureau of Investigation and private cybersecurity companies.

Investigators traced the scheme to Russian-language Facebook advertisements promoting cryptocurrency investments. People who responded were contacted by individuals posing as Russian-speaking investment advisers and directed to websites that appeared to offer legitimate digital-asset trading.

The alleged victims were helped to open accounts and told to buy cryptocurrency. They then transferred the assets to wallet addresses controlled by the operators. The fraud often became clear weeks or months later, when victims could not withdraw their money. Some found their accounts locked. Others were told to pay additional fees or taxes before their funds could be released.

Data recovered from the seized servers showed that the operators contacted some victims again several weeks after the initial theft. The scammers allegedly offered to recover the missing cryptocurrency in exchange for additional payments. Prosecutors did not disclose how many people received the offers or how much money, if any, they sent.

Brooklyn District Attorney Eric Gonzalez described the scheme as an operation that targeted Russian-speaking Americans and sought further payments after the initial losses. The three-year investigation found a concentration of victims in Brooklyn, which has a large Russian-speaking population. Prosecutors said some victims lost their entire life savings.

The District Attorney’s Virtual Currency Unit had previously disrupted about 400 domains linked to cryptocurrency investment fraud. Replacement websites appeared quickly, leading investigators to focus on the servers and other infrastructure supporting the schemes.

During an operation last week, authorities executed search warrants across three time zones and disrupted cloud-based servers hosted by companies in Eastern Europe and the United States. The network used internet addresses in Ukraine and other Eastern European countries, according to the District Attorney’s Office.

Investigators sought to cut off access to the websites, software and victim records used to run the scheme and contact former customers. The server seizures were intended to prevent the operators from rebuilding the platforms and using stored information to make further recovery offers.

Shadowserver, Coeus and UltaHost assisted with the operation. Authorities have not identified the alleged operators or announced any arrests.

Prosecutors estimate that the scheme stole tens of millions of dollars. Investigators have seized about $300,000 in assets. The District Attorney’s Office has not disclosed whether victims received any recovered funds or set a timetable for restitution.

The FBI has warned that fraudulent cryptocurrency recovery services often target people who have already lost money in investment scams. Such operations may demand upfront fees, provide false asset-tracing reports or falsely claim connections to law enforcement agencies.