Written by Oluwapelumi Adejumo, cryptoslate
Compiled by Saoirse, Foresight News
Scammers who defrauded millions of dollars from Russian-speaking investors returned to contact these victims weeks later, promising to help them recover all their losses.
On October 14, Brooklyn prosecutors publicly announced the case. A multinational joint law enforcement operation shut down 112 servers and 241 involved websites. These sites served cryptocurrency investment scams and are believed to have extracted tens of millions of dollars from victims across the United States.
The operation, assisted by the U.S. Federal Bureau of Investigation (FBI), targeted the entire underlying infrastructure used to operate the scam platforms, maintain them, and sustain communication channels with victims. Data extracted from the servers showed that the same criminal group also attempted to exploit victims again after they had already suffered losses in the initial fraud.
Brooklyn District Attorney Eric Gonzalez said the scam group first set up an elaborately packaged investment trap targeting Russian-speaking residents of the United States; after succeeding, they falsely claimed they could help victims recover stolen crypto assets and used the opportunity to extort more money.
The three-year investigation showed that a large number of victims were concentrated in Brooklyn, which has a large Russian-speaking community. Prosecutors said some victims lost their life savings as a result.
The seized backend data also reconstructed the scammers' complete playbook: after completing the first round of fraud, they continued to retain contact channels with victims. Once the fake investment platform refused to process users' withdrawal requests, the scammers seized on victims' anxiety to get their money back and sought opportunities to induce them to pay more.
Prosecutors target the server infrastructure behind the serial scams
The investigation traced the entire scheme back to Russian-language Facebook ads that heavily promoted various cryptocurrency investment opportunities.
People attracted by the ads would receive calls from individuals posing as Russian-speaking investment consultants. These so-called consultants guided victims to cryptocurrency trading phishing websites, helped them register accounts, and induced them to purchase digital assets.
Believing it was real, victims transferred cryptocurrency to wallet addresses provided by the phishing platforms, mistakenly thinking the funds were being invested in legitimate investment projects.
The fraud was fully exposed only when investors applied to withdraw funds weeks or even months later. Some victims' accounts were directly locked; others were told they had to pay additional fees or taxes before the platform would release the funds.
And the scammers used the losses they had created to continue profiting.
Based on forensic materials from the servers, prosecutors showed that weeks after the initial fraud, scam operators would contact victims again, claiming they could help recover the stolen assets.
Using victim information collected in the first round of the scam, the criminal group precisely targeted this group of people who had already suffered significant financial losses and carried out a second round of extraction.
Officials did not disclose the number of victims who received such "asset recovery" scripts, nor how many victims were defrauded into transferring money again.
The FBI had already warned about this widespread industry modus operandi: fake crypto asset recovery outfits specifically hunt victims who have already been harmed in investment scams, and this Brooklyn case is a typical example.
The same group of scammers first carried out cryptocurrency investment fraud against Russian-speaking communities in the United States, then weeks later posed as an asset recovery institution to defraud them a second time. Law enforcement seized 112 servers and 241 domains, cutting off victim information and criminal software to prevent further harm.
Such illicit operations typically demand upfront payments, issue misleading asset tracing reports, or falsely claim cooperation with law enforcement as a way to trick victims into sending more money.
In this case, investigators focused on destroying the entire criminal infrastructure, a system that kept scam websites running continuously and also made it easier for scammers to repeatedly harass and contact victims.
The Virtual Currency Unit of the Brooklyn District Attorney's Office had previously seized and shut down about 400 domains related to cryptocurrency scams. But criminals can quickly build replacement sites, and even after law enforcement crackdowns, scam activity still resurfaces.
This situation prompted the investigation team to move beyond the traditional approach of only seizing website domains.
In an enforcement operation last week spanning three time zones, prosecutors issued search warrants and coordinated the shutdown of cloud servers hosted by multiple Eastern European and U.S. service providers.
According to the District Attorney's Office, the criminal group relied on network equipment and IP addresses in Ukraine and other Eastern European countries to carry out the crimes.
The purpose of directly targeting the servers was to cut off the programs, website backend data, and victim information databases on which the scam group depended.
It was also intended to prevent scammers from quickly rebuilding phishing websites and from using retained victim data to continue pushing fake asset recovery scams.
The enforcement operation received coordinated support from the FBI and several private organizations, including Shadowserver, Coeus, and UltaHost.
Although the blow to the criminal infrastructure was significant, recovering stolen cryptocurrency remains a major challenge.
Prosecutors estimate the total amount involved in the scam reached tens of millions of dollars, but the investigation team has so far seized only about $300,000 in illicit funds.
The District Attorney's Office did not say whether victims had recovered any funds, nor did it provide a compensation timeline. The official announcement did not disclose the identities of those involved or announce any arrests.
Investigators are still tracing the remaining assets, and the vast majority of the stolen funds in this multinational fraud case remain unaccounted for.