Crypto Fraud: FBI and Brooklyn Dismantle Infrastructure of a Network Targeting Russian Speakers

Strike the servers rather than the storefronts. On Wednesday, October 14, Brooklyn District Attorney Eric Gonzalez announced the dismantling of the infrastructure of a large-scale crypto fraud network. Together with the FBI, his dedicated cryptocurrency unit seized or disrupted 241 websites and 112 servers. The scam targeted Russian-speaking victims in the United States and is believed to have stolen tens of millions.

Key Points of This Article:

• The FBI and the Brooklyn District Attorney seized or disrupted 241 fraudulent websites and 112 servers after three years of investigation.
• The network targeted Russian-speaking victims through Russian-language Facebook ads and fake investment advisors.
• The scammers attempted to lure victims back with false offers to recover funds.
• Approximately $300,000 has been seized to date, and no arrests have been announced.

From Fake Facebook Ads to Locked Platforms

The modus operandi, as described by the prosecutor, indeed follows the classic mechanics of investment scams. First, the scammers attracted their victims with Russian-language Facebook ads promising yield opportunities. Fake advisors then called the targets to guide them towards purchasing cryptocurrencies, to be sent to fraudulent trading platforms.

When investors attempted to withdraw their funds, they hit a wall. The platform locked their accounts, or demanded additional payments under the pretext of taxes and fees. Moreover, the network would try its luck again a few weeks after the initial scam. The seized data shows that it then offered victims a chance to recover their funds in exchange for new payments, a promise that was obviously false.

We had already documented this double punishment technique in our pig butchering files, where victims are re-victimized for their losses. It is worth noting that the software behind these fake trading scams is sold as a turnkey solution, as detailed in our investigation into the Airsoft case.

Hitting the Servers, Not the Sites

The Virtual Currency Unit of the prosecutor had already seized or disrupted 400 domains related to crypto investment fraud. However, replacement sites continued to proliferate, with each closure prompting a copy. This time, investigators changed their target. They aimed at the servers, hosted by companies in Eastern Europe and the United States, that held the victims' data and the network's software. In practice, hitting the infrastructure costs fraudsters more than shutting down a domain name. The goal is to prevent operators from quickly launching new platforms.

Authorities have seized approximately $300,000 to date and are seeking to recover more. According to Prosecutor Gonzalez, some victims lost all their savings. The case remains open, with no arrests announced so far.

The overall context remains heavy. According to the FBI's annual report for 2025, crypto investment scams accounted for approximately 84% of the $8.65 billion in losses related to investment fraud. Furthermore, across all categories of cybercrime, losses related to cryptocurrencies reached $11.37 billion, or about 54% of the total. The bureau has also claimed $17 billion seized in the Blackout operation, indicating that the U.S. financial police have made crypto a priority. It remains to be seen whether the strike on the servers will sustainably slow down networks that have so far always managed to rise from their ashes.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.