- Brooklyn prosecutors and the FBI seized or disrupted 241 websites and 112 servers tied to a crypto investment scam that allegedly stole tens of millions of dollars from Russian-speaking victims in the US, following a three-year investigation into infrastructure hosted in Ukraine and other Eastern European countries. No arrests were announced.
- Recovery has been minimal. Authorities have seized about $300,000 against losses described as tens of millions, and prosecutors said some victims lost their entire life savings.
- The scheme ran twice on the same people. Victims were recruited through Russian-language Facebook advertisements and coached by fake advisers to buy cryptocurrency and send it to fraudulent trading platforms, which locked accounts or demanded further payments for supposed taxes and fees when withdrawals were attempted. Recovered data showed operators contacted victims again a few weeks later, offering to retrieve the stolen funds.
- The scale of the category is substantial. Crypto investment scams accounted for roughly 84% of the $8.65 billion in investment fraud losses reported to the FBI in 2025, and crypto-linked losses across all internet crime totalled $11.37 billion, about 54% of the $20.88 billion overall.
What Happened?
District Attorney Eric Gonzalez said the operators tried to exploit victims again with false promises to recover their money. His Virtual Currency Unit had previously seized or disrupted 400 domains tied to crypto investment fraud, but replacement sites kept appearing, so this operation targeted the servers holding victim data and the software running the fraud, aiming to prevent operators from quickly launching new sites.
Why It Matters?
Roughly $300,000 recovered against tens of millions stolen is about one percent, and that figure should govern how anyone thinks about this risk. With no arrests announced and the infrastructure hosted across Eastern Europe, enforcement in this area disrupts operations without returning money. For advisers the conclusion is that prevention is the only control that works, because the recovery path effectively does not exist once funds have moved. That is also the distinction between crypto fraud and a brokerage failure, where insurance and regulatory mechanisms provide some recourse. The second contact is the detail most worth passing to clients. These operators returned weeks later posing as recovery services, which is a documented pattern that targets people already identified as vulnerable and already financially damaged. Anyone whose client has been defrauded should treat an unsolicited offer to recover the funds as almost certainly originating from the same network. The enforcement shift is instructive too. Seizing 400 domains failed because replacements appeared, so investigators moved to the servers holding the data and software, which is an attempt to attack the production layer rather than the symptom. That mirrors the approach European regulators have taken with stablecoins, where ESMA is restricting authorised intermediaries precisely because it cannot reach an issuer outside its jurisdiction. Enforcement in digital assets is converging on chokepoints, because the direct targets are usually beyond reach. The category numbers put this in proportion. Crypto-linked losses now represent a majority of all reported internet crime losses by value, and investment scams dominate within that. The recruitment method here, Russian-language advertisements reaching a specific linguistic community through a mainstream platform, is affinity fraud delivered at scale through ordinary advertising infrastructure.
What Next?
Whether replacement sites appear despite the server seizures is the test of whether this approach works better than domain takedowns. Watch for arrests, since none have been announced and the operators remain outside US jurisdiction. Brooklyn authorities say they are working to recover more than the $300,000 seized so far. For the industry, the question is whether advertising platforms face pressure over financial promotions of this kind, given the recruitment channel is a mainstream one. The FBI’s next annual report will show whether the share of internet crime losses attributable to crypto continues rising from its current majority.
Affected Tickers and Coins: META, COIN
Source: CoinDesk
