How Brooklyn Prosecutors and the FBI Disrupted a Crypto Fraud Network Targeting Russian Speakers

Table of Contents

• You might want to know
• How the operation disrupted the fraud network
• Key Insights Table
• Afterwards...

You might want to know

• How did investigators disrupt a fraud operation that had repeatedly replaced its scam websites?
• Why did the criminals contact victims again after the initial investment theft?

How the operation disrupted the fraud network

Brooklyn prosecutors and the Federal Bureau of Investigation (FBI) have seized or disrupted 241 websites and 112 servers connected to a cryptocurrency investment fraud that allegedly targeted Russian-speaking people in the United States. The operation followed a three-year investigation into a network accused of stealing tens of millions of dollars. Authorities said the scheme combined Russian-language social media advertising, fraudulent investment platforms and fake advisers to persuade victims to send cryptocurrency to the criminals.

The coordinated action was carried out last week, according to Brooklyn District Attorney Eric Gonzalez. Investigators identified online infrastructure and internet protocol (IP) addresses associated with Ukraine and other Eastern European countries. Some of the servers involved were hosted by companies in Eastern Europe and the United States. No arrests were announced in connection with the operation at the time described in the report.

The alleged fraud began with Russian-language advertisements on Facebook that promoted supposed investment opportunities. People who responded were contacted by individuals posing as financial advisers. These fake advisers encouraged potential victims to purchase cryptocurrency and transfer it to platforms presented as trading services. The platforms were fraudulent, and the apparent investment activity was part of the deception rather than a genuine opportunity to trade.

Once victims attempted to withdraw money, the platforms reportedly blocked access to their accounts or demanded additional payments. The charges were described as taxes, fees or other costs needed to release the funds. These demands could deepen a victim’s losses: after transferring cryptocurrency once, a person might send more money in the hope of recovering an apparent balance or completing a withdrawal. In reality, the additional payments were another part of the alleged scheme.

The operation also exposed a second stage of victimization. After the initial theft, the scammers allegedly contacted people again with false offers to recover their money. Gonzalez said the operators “tried to exploit them again with false promises to recover their money.” Data recovered during the investigation indicated that the follow-up approaches came a few weeks after the initial fraud. The criminals presented themselves as capable of retrieving stolen funds, seeking to persuade people who had already suffered losses to pay again or disclose further information.

This type of follow-up can be particularly damaging because victims may be anxious to get their savings back and may believe that a recovery service has access to investigators, exchanges or technical methods that can reverse a transaction. Cryptocurrency transfers are generally difficult to reverse once confirmed, so a promise to retrieve funds should be treated cautiously. The source report describes the recovery offers in this case as false and says they were used to target victims a second time.

Before the latest action, the Brooklyn District Attorney’s Virtual Currency Unit had seized or disrupted 400 domains associated with cryptocurrency investment fraud. However, replacement websites continued to appear. That experience shaped the approach investigators took in this case. Rather than focusing only on individual domains, they also targeted the servers that stored victim information and the software used to operate the fraud. By disrupting this underlying infrastructure, authorities aimed to make it harder for the operators to quickly launch new sites and resume their activity.

Websites are the visible front end of an online fraud, but they may depend on servers, databases, software and other services to function. If a criminal group can simply register another domain after a takedown, removing one web address may have only a temporary effect. Targeting servers and operational tools can potentially interfere with several parts of the system at once. In this investigation, officials said the servers held victim data as well as software used to run the operation. The stated goal was to prevent the network from rapidly rebuilding its online presence.

The scale of the alleged losses is significant, although authorities have not recovered an equivalent amount. Brooklyn officials have seized about $300,000 so far and are working to recover more. Prosecutors said some victims lost their entire life savings. The reported amount seized is therefore a portion of the tens of millions of dollars the operation allegedly stole, and recovery efforts remain ongoing.

The case also sits within a wider pattern of reported investment fraud involving cryptocurrency. According to the FBI’s annual report, cryptocurrency investment scams accounted for roughly 84% of the $8.65 billion in investment-fraud losses reported to the bureau in 2025. Across all categories of internet crime, cryptocurrency-linked losses totaled $11.37 billion, approximately 54% of the $20.88 billion overall. The two percentages are calculated from the FBI’s totals.

Those figures describe losses reported to the FBI; they do not, by themselves, establish the outcome of any individual case or indicate that every reported loss has been verified or recovered. They do, however, help explain why investigators and prosecutors are devoting attention to schemes that use cryptocurrency transfers, online advertising and cross-border digital infrastructure. The Brooklyn investigation illustrates how a scam can combine several tactics: language-specific marketing to find potential victims, impersonation to build trust, fake platforms to collect funds and recovery claims to pursue people after the original loss.

Authorities’ disruption of 241 scam websites and 112 servers represents a substantial interruption of the infrastructure identified in the investigation. But the earlier experience with replacement domains also shows why a takedown does not automatically resolve every issue. Investigators must pursue the people and assets behind the operation, identify affected victims, and continue efforts to prevent the network from rebuilding. The report did not announce arrests, and the amount recovered so far remains about $300,000.

Disclosure and policies: CoinDesk is an award-winning media outlet covering the cryptocurrency industry. Its journalists follow a strict set of editorial policies. CoinDesk has adopted principles intended to support the integrity, editorial independence and freedom from bias of its publications. CoinDesk is part of Bullish (NYSE:BLSH), an institutionally focused global digital asset platform providing market infrastructure and information services. Bullish owns and invests in digital asset businesses and digital assets. CoinDesk employees, including journalists, may receive Bullish equity-based compensation.

Key Insights Table

Afterwards...

The next steps will involve continuing to trace assets, identify affected victims and assess whether the disrupted network can restore its operations. Because replacement domains appeared after earlier takedowns, targeting servers and the software behind a scam may offer a broader way to interrupt its activity—but the investigation’s outcome will depend on further enforcement and recovery efforts. For individuals, the case is also a reminder to verify investment services independently and to be especially skeptical of anyone who promises to recover cryptocurrency for an upfront payment. The figures reported by the FBI underline the scale of the challenge, while the Brooklyn operation shows how coordinated action can target the infrastructure supporting a cross-border fraud network.