Ukraine's National Police and Security Service (SBU) said Tuesday that they had shut down a network of fake investment platforms operated from Kyiv that drained cryptocurrency wallets belonging to people in more than 20 countries.

Investigators have so far identified 62 victims, among them citizens of Germany, Poland, Lithuania, Latvia, Spain, France, the UK, Canada and Israel. The geographic spread reflects the borderless nature of crypto fraud: scams run from one jurisdiction can target wallet users anywhere, often leaving victims with little recourse once assets are transferred to attacker-controlled wallets.

The Security Service described the organizer as a 25-year-old IT specialist and put the operation's turnover at up to $1 million per month at its peak. According to the agency, the scheme recruited more than 46 Ukrainians and ran several offices in Kyiv and the surrounding region. Developers built the fake platforms and kept them online despite blocking attempts, while other staff manned the offices, worked the phones and handled security. The setup — call-center staff, developers and dedicated security — mirrors the structure of industrial-scale fraud operations documented elsewhere in Eastern Europe, where fake trading platforms have long been a mainstay of organized online fraud.

Поліцейські припинили діяльність мережі фейкових інвестиційних платформ, через які шахраї викрадали криптовалюту у громадян понад 20 країн Наразі поліцейські встановили 62 потерпілих. 🔗 Деталі: pic.twitter.com/QblK1EWXi8 — Національна поліція України (@NPU_GOV_UA) September 1, 2026

How the scam worked

The pitch began on Telegram, where the group advertised supposedly profitable crypto projects. Users who signed up connected a wallet and sent funds for what they were told were investment projects. Staff then faked the trading by hand, showing balances climbing in each customer's dashboard.

When victims tried to withdraw, the requests were blocked. To verify the platform was working, victims were told, they needed to connect their main wallet and approve a small "test" transaction. That approval fed a drainer built into the site, which moved the assets to wallets controlled by the group and locked the victim out. This is a hallmark of wallet-drainer attacks: rather than stealing credentials alone, the malware tricks users into signing a transaction that hands over control of their on-chain assets directly.

Where the money went

Investigators traced server equipment in the Netherlands holding the group's database and gained access to it. The database listed victims, their wallet addresses, the sums taken, internal correspondence and records of how the platforms operated. The registration and verification process had also harvested passport details, phone numbers, email addresses, logins, passwords and photographs — personal data that fraud groups have been known to reuse for follow-on scams and identity theft.

Officers carried out 34 searches across Kyiv and the surrounding region, seizing more than 100 computers, more than 100 phones, 79 SIM cards, a GSM gateway, cash and 15 cars. Some vehicles and property were registered to suspects' wives and relatives. According to investigators, the organizer moved around with armed guards.

The case is proceeding under Part 5 of Article 190 of Ukraine's criminal code, the provision covering large-scale fraud committed by an organized group. Police say they are still working to identify everyone involved, additional victims and the total sum stolen — a figure that could grow well beyond the 62 victims confirmed so far, given the group's claimed turnover and operations across more than 20 countries.

The bust follows other Ukrainian efforts against crypto crime. In June, Ukraine moved more than $8.3 million in seized USDT into a state-run wallet, the first time confiscated crypto had been placed under state management. The Royal United Services Institute has estimated that tighter rules could recover at least $10 billion in stolen funds and lost tax revenue for the country. For Ukraine, which has sought closer alignment with European Union financial-regulation standards, enforcement actions like this one signal a broader push to treat crypto fraud as a priority crime category rather than a niche offense.