Brooklyn Prosecutors Dismantle 112 Servers Behind Crypto Scam Targeting Russian Speakers
Key Takeaways
- •Brooklyn prosecutors and the FBI seized or disrupted 241 web domains and 112 servers tied to a crypto investment scheme, bringing the total domains removed in the three-year investigation to 641.
- •The scheme allegedly stole tens of millions of dollars from Russian-speaking Americans, with about $300,000 in stolen funds recovered so far and efforts continuing to reclaim more.
- •Victims were recruited through Russian-language Facebook ads and coached by fake 'investment advisors' to buy cryptocurrency and send it to platform-linked addresses, later finding withdrawals blocked or conditioned on extra fees and taxes.
- •Data from the seized servers revealed that the scammers also ran a recovery scam, contacting victims weeks after the initial fraud with false promises to retrieve their money.
- •The servers were hosted by Eastern European and American companies, and the scammers relied on infrastructure and IP addresses in Ukraine and other Eastern European countries.
Brooklyn prosecutors have dismantled the online infrastructure of a multinational crypto investment scam that targeted Russian speakers in the United States, seizing and disrupting 241 web domains and 112 servers, District Attorney Eric Gonzalez announced on Wednesday.
The enforcement actions, carried out by the office's Virtual Currency Unit alongside the FBI, involved search warrants and other measures executed across three time zones last week. Prosecutors estimate the scheme stole tens of millions of dollars from Russian-speaking Americans—some of it victims' entire life savings—and about $300,000 in stolen funds has been seized so far, with efforts underway to recover more.
The servers were hosted by Eastern European and American companies, and the scammers relied on infrastructure and IP addresses in Ukraine and other Eastern European countries, according to the announcement.
"These criminals stole many millions of dollars from Russian-speaking victims through an elaborate investment scheme, then tried to exploit them again with false promises to recover their money," Gonzalez said.
How the Scam Worked
A large cluster of victims in Brooklyn had each responded to a Russian-language Facebook ad for investment opportunities and then received a call from an "investment advisor" who coached them into opening an account on a crypto investment website, the office said.
With the advisor's help, victims bought cryptocurrency and sent it to addresses linked to the platforms. When they tried to withdraw their funds after weeks or months of "investing," they were locked out of their accounts or told to pay additional fees and taxes.
Data from the seized servers showed the scammers also ran a recovery scam, contacting victims a few weeks after the initial fraud and promising to get their stolen assets back, the DA's office said.
Brooklyn's Virtual Currency Unit
The unit had been investigating the operation for three years. Brooklyn's large Russian-speaking population meant the scam hit the borough's residents disproportionately, according to the release.
Before last week, the unit had already seized or disrupted 400 domains linked to the fraud, but new scam websites kept appearing. Taking down the servers removes the scammers' ability to quickly create new sites and contact existing victims, the office said—a shift in emphasis, since the earlier round of domain seizures had not stopped new sites from surfacing. Counting the 241 domains seized in the latest action, the investigation has now taken 641 scam domains out of circulation.
The takedown is not the Brooklyn DA's only recent crypto fraud case. Its prosecutors previously charged a local man who stole $16 million from nearly 100 Coinbase users through a phishing scheme; he was later sentenced to up to 12 years in prison.
