Brooklyn DA Pulls the Plug on Multinational Crypto Scam Network
Key Takeaways
- •The Brooklyn District Attorney's office and the FBI seized or disrupted 241 scam domains and more than 100 cloud servers in an operation spanning three time zones.
- •The seized servers stored victim information, website content, and operating software, making the scam network far harder to rebuild than simple domain takedowns would allow.
- •The fraud began with Russian-language investment ads on Facebook that connected victims with Russian-speaking advisors who guided them onto a fake cryptocurrency platform.
- •Victims were locked out of withdrawals or charged fake fees and taxes, and some were later contacted again by scammers posing as asset recovery services.
- •The three-year investigation has recovered approximately $300,000, a small fraction of the tens of millions of dollars in reported losses.
The Brooklyn District Attorney's office has dismantled the online backbone of a multinational cryptocurrency scam that drained tens of millions of dollars from Russian-speaking victims across the United States.
Working alongside the FBI, investigators executed search warrants across three time zones in a matter of hours, seizing or disrupting 241 scam domains and more than 100 cloud servers hosted by Eastern European and American companies. The servers held the scammers' victim data, site content, and operating software, according to a statement issued Wednesday.
The operation went a step beyond domain takedowns, which have been a common tool against online fraud. A blocked web address can be replaced in minutes, but the platforms, victim data, and operating software stored on seized servers are far harder to recreate — and losing that data also limits the operators' ability to re-contact people they have already targeted.
"Our groundbreaking Virtual Currency Unit identified the fraud, tracked the stolen cryptocurrency, broke new ground by uncovering the infrastructure behind the operation, and worked with the FBI to dismantle it," Brooklyn District Attorney Eric Gonzalez said.
READ MORE: — Brooklyn District Attorney Eric Gonzalez (@BrooklynDA) October 14, 2026
"By disrupting more than 100 servers and hundreds of fraudulent websites, we have struck at the heart of this criminal enterprise and made it far harder for these scammers to victimize others," Gonzalez added. "I commend our investigators and thank the FBI for their partnership in this extraordinary operation."
The scheme began with Russian-language investment advertisements on Facebook that lured victims toward Russian-speaking "advisors." The advisors then called targets and walked them through opening accounts on a fake crypto platform and purchasing digital assets.
Weeks or months later, when victims attempted to withdraw their funds, they were locked out or hit with bogus "fees" and "taxes." Some lost their life savings. The scammers then returned for more: posing as recovery services, they contacted victims weeks later and promised to retrieve the stolen money. Such follow-on "recovery" fraud, which targets people who have already been victimized once, is a widely documented tactic in investment scams.
The Virtual Currency Unit had already taken down 400 scam domains, but new ones kept appearing. Striking the servers behind them cuts off the scammers' ability to launch new sites quickly or reach past victims.
The three-year investigation has recovered about $300,000 so far — a small fraction of the reported losses — and prosecutors say they are working to claw back more.
This post first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.
