Ukrainian law enforcement has shut down a network of fake cryptocurrency investment platforms that investigators say were used to steal digital assets from people in more than 20 countries.
So far, police have identified 62 victims, including citizens of Germany, Poland, Lithuania, Latvia, Spain, France, the United Kingdom, Canada and Israel. Investigators say the network was operated from several fraudulent offices in Kyiv and the surrounding region.
How the fake investment platforms worked
According to Ukraine’s National Police, the scheme was built around websites designed to look like legitimate investment platforms.
Potential victims were encouraged to register, connect their cryptocurrency wallets and transfer funds supposedly for investment projects. Once they joined, members of the network manually created fake trading activity and displayed growing balances in the customers’ accounts, making it appear that their investments were generating profits.
But the profits were not real.
When a victim tried to withdraw their money, the withdrawal function was blocked. The victim was then told to connect their main cryptocurrency wallet and approve a small test transaction to supposedly verify that the platform was working correctly.
That transaction was the key to the theft.
A hidden crypto drainer emptied victims’ wallets
The fake websites contained a hidden mechanism known as a crypto drainer.
Victims believed they were approving a small test payment. Instead, the drainer gave the criminals the ability to transfer assets from their wallets to cryptocurrency addresses controlled by the group.
After the funds were transferred, victims lost access to the fake investment platform.
The operation also collected large amounts of personal information during registration and verification. Investigators say the criminals obtained passport details, telephone numbers, email addresses, usernames, passwords and photographs of customers.
More than 46 Ukrainians allegedly involved
Investigators say the organizer recruited more than 46 Ukrainian citizens and established several offices in Kyiv and the Kyiv region.
Different members of the operation reportedly had different roles. IT specialists created and maintained the fake investment websites and worked to keep them online despite attempts to block them. Other participants managed the offices, communicated with potential victims and provided security.
Additional reporting based on information from Ukraine’s Security Service identifies the alleged organizer as a 25-year-old IT specialist from Kyiv. At the height of the operation, its monthly turnover was reportedly as high as $1 million.
Investigators found the group’s database in the Netherlands
A major breakthrough came when Ukrainian investigators located server equipment in the Netherlands that allegedly stored the group’s database.
According to police, investigators gained access to the database and found information including lists of victims, cryptocurrency wallet addresses, the amounts of assets allegedly stolen, internal communications between members of the network and information about the operation of the fake platforms.
The information helped investigators document how the scheme operated and identify people who had been targeted.
Police seize computers, phones and 15 vehicles
Ukrainian law enforcement conducted 34 searches at the suspects’ homes, fraudulent offices and vehicles in Kyiv and the Kyiv region.
Investigators seized:
- more than 100 computers and other pieces of computer equipment;
- more than 100 mobile phones;
- 79 SIM cards;
- a GSM gateway;
- documents and handwritten records;
- cash;
- 15 vehicles.
Police also say members of the network used premium vehicles, while some vehicles and properties were registered in the names of their wives and other relatives. Investigators allege that the organizer travelled with armed security.
Investigation is still ongoing
The case is being investigated under Part 5 of Article 190 of Ukraine’s Criminal Code, concerning fraud.
Authorities are continuing to identify everyone involved, additional victims and the total amount of cryptocurrency allegedly stolen. Police have not yet announced a final figure for the losses.
The operation was uncovered by investigators from the Main Investigation Department of the National Police of Ukraine, working with the Security Service of Ukraine under the procedural supervision of the Office of the Prosecutor General.
