Crypto scammers who stole millions from Russian-speaking investors approached the same victims weeks later, promising to recover their losses.
On Oct. 14, Brooklyn prosecutors disclosed the fraud after an international enforcement operation disrupted 112 servers and 241 websites supporting a cryptocurrency investment scheme that allegedly stole tens of millions of dollars from victims across the United States.
The operation, conducted with help from the Federal Bureau of Investigation (FBI), targeted the infrastructure used to run fraudulent investment platforms and keep in contact with victims. Investigators recovered data showing the same criminal network tried to exploit people again after they lost money in the original scheme.
Brooklyn District Attorney Eric Gonzalez said the scammers had targeted Russian-speaking Americans through an elaborate investment operation before attempting to extract further payments by offering to retrieve stolen cryptocurrency.
The investigation, which has been underway for three years, identified a concentration of victims in Brooklyn, home to a large Russian-speaking population. Some victims lost their entire life savings, according to prosecutors.
The recovered information also exposed how the fraudsters maintained relationships with victims beyond the initial theft, creating opportunities to solicit additional payments after their fraudulent investment platforms stopped processing withdrawals.
Prosecutors target servers behind repeat crypto scam
Investigators traced the operation to Russian-language Facebook ads promoting cryptocurrency investment opportunities.
People who responded to the ads received phone calls from individuals posing as Russian-speaking investment advisers. The purported advisers then directed them to cryptocurrency trading websites, helped them create accounts, and instructed them to purchase digital assets.
Victims subsequently transferred cryptocurrency to wallet addresses linked to the investment platforms, believing their money was being deployed in legitimate investments.
The deception typically became apparent weeks or months later when investors attempted to withdraw their funds. Some discovered their accounts were locked, while others were told they needed to pay additional fees or taxes before the criminals could release their money.
The criminals then exploited the losses they had created.
Prosecutors said recovered server data showed the operators contacted victims several weeks after the initial fraud, claiming they could recover the missing assets.
The second approach allowed the network to use information collected during the investment scam to target people already facing substantial financial losses.
Authorities did not disclose how many victims received these recovery offers or whether they made additional payments.
The findings mirror a broader pattern the FBI has identified, warning that fraudulent cryptocurrency recovery businesses often target people who have already lost funds to investment scams.
Such operations can demand upfront payments, provide misleading asset-tracing reports or falsely claim relationships with law enforcement agencies to persuade victims to send more money.
In the Brooklyn case, investigators concentrated on dismantling the infrastructure that enabled the criminal network to maintain its websites and repeatedly contact victims.
The District Attorney’s Virtual Currency Unit had previously seized or disrupted about 400 domains linked to cryptocurrency investment fraud. However, replacement websites appeared quickly, allowing fraudulent operations to continue despite the enforcement actions.
That prompted investigators to expand their efforts beyond the websites themselves.
During an operation spanning three time zones last week, prosecutors executed search warrants and coordinated the disruption of cloud-based servers hosted by companies in Eastern Europe and the United States.
The criminal network relied on infrastructure and internet addresses in Ukraine and other Eastern European countries to operate, according to the District Attorney’s Office.
By targeting the servers, investigators sought to cut off access to the software, website data, and victim records the fraudulent platforms needed to operate.
The move also aimed to prevent the scammers from quickly rebuilding their websites and using stored customer information to approach existing victims with further recovery offers.
The enforcement effort involved cooperation from the FBI and several private-sector organizations, including Shadowserver, Coeus and UltaHost.
Despite the scale of the disruption, recovering the stolen cryptocurrency remains a separate challenge.
Prosecutors estimate the scheme stole tens of millions of dollars, but investigators have seized only about $300,000 in stolen assets so far.
The District Attorney’s Office has not disclosed whether victims have recovered any of those funds or provided a timetable for restitution. The announcement also did not identify the alleged operators or announce arrests.
Investigators continue efforts to recover additional assets, leaving most of the money stolen through the multinational operation unaccounted for.