Ukraine's National Police and Security Service have dismantled a network of fraudulent cryptocurrency investment platforms operated from Kyiv, the agencies announced Tuesday.
The operation targeted users across more than 20 countries, including Germany, Poland, Lithuania, Latvia, Spain, France, the United Kingdom, Canada and Israel. Investigators have identified 62 victims so far, though authorities say the investigation is ongoing to identify additional victims and determine the total amount stolen.
How the Scheme Operated
The network, which reached a peak turnover of up to $1 million monthly, recruited victims primarily through Telegram advertisements promoting supposedly profitable cryptocurrency projects. Participants connected their digital wallets and deposited funds for purported investment activities.
Once enrolled, victims saw fabricated trading activity and climbing balances on their dashboards. When users requested withdrawals, the platforms blocked the transactions. Victims were then told they needed to verify the platform's functionality by connecting their main wallet and approving a small test transaction—a step that triggered a wallet drainer built into the site, moving their assets to accounts controlled by the criminal group and locking them out of their holdings.
Investigation and Arrests
The 25-year-old organizer recruited more than 46 Ukrainian associates to develop and maintain the fake platforms, staff multiple offices in Kyiv and surrounding areas, and manage customer communications. Developers worked to keep the platforms operational despite blocking attempts.
Investigators traced server infrastructure in the Netherlands hosting the group's database and gained access to it, uncovering records of victims, wallet addresses, stolen amounts, internal communications and operational details. The database also contained harvested personal information including passport details, phone numbers, email addresses, logins, passwords and photographs collected during user registration and verification processes.
Law enforcement conducted 34 searches across Kyiv and the region, seizing more than 100 computers, more than 100 phones, 79 SIM cards, a GSM gateway, cash and 15 vehicles. Some vehicles and property were registered to suspects' relatives.
The case proceeds under Part 5 of Article 190 of Ukraine's criminal code. Authorities continue investigating to identify all participants and determine the full scope of losses.
