Ukrainian police have dismantled a fraud network posing as a cryptocurrency investment platform. The investigation revealed that the group recruited users in more than 20 countries, with 62 confirmed victims and monthly transaction volumes reaching up to $1 million at its peak.
Fabricated returns to attract deposits
Investigators say the network created multiple websites designed to resemble legitimate platforms, promoting high-yield cryptocurrency projects. After users deposited funds, the backend artificially simulated trading activity to continuously display profits on account dashboards.
The police stated that the transaction records and profit data displayed on the website were not genuine, intended solely to lure users into investing more money. Ukraine’s security services identified a 25-year-old IT professional as the organizer of the network.
Wallet theft triggered during withdrawal
The actual coin theft occurs when users request withdrawals. Investigators say the platform first intercepts the withdrawal request, then demands that users connect their main wallet and authorize a small test transaction under the pretext of "additional verification."
Once the user completes authorization, the embedded wallet-stealing program transfers assets from the connected wallet to addresses controlled by the group. After the assets are transferred, victims typically also lose access to their platform accounts.
The Ukrainian side also stated that these platforms not only defraud cryptocurrency assets but also collect personal information such as passport details, phone numbers, email addresses, account usernames, passwords, and photos during the registration and verification process.
The Dutch server holds victim data.
Investigators traced the involved server equipment to the Netherlands, and law enforcement has gained access to one of the databases. The database contains victim information, wallet addresses, individual stolen amounts, as well as internal communications and platform operation records of the gang.
Confirmed victims are from more than 20 countries, including Germany, Poland, Lithuania, Latvia, Spain, France, the United Kingdom, Canada, and Israel. As further analysis of the server data continues, the number of victims and the scale of losses may still increase.
34 searches resulted in the seizure of a large amount of equipment
Ukrainian police reported that law enforcement conducted 34 searches in Kyiv and surrounding areas, including residences, offices, and vehicles.
- More than 100 computers and other computer equipment were seized.
- Seized over 100 mobile phones, 79 SIM cards, and a GSM gateway system
- Seize 15 vehicles, along with cash and related records.
The investigation also found that some vehicles and properties were registered under the names of the suspects' spouses and relatives. Police stated that the criminal organization operated multiple offices in Kyiv and surrounding areas and recruited more than 46 Ukrainian nationals to participate in its operations.
The case is currently being pursued under Ukraine’s criminal code provisions on fraud. Police state that they are still identifying additional suspects, more victims, and totaling the amount of crypto assets stolen through these platforms.