Brooklyn Prosecutors Disrupt Crypto Scam, Seize 112 Servers

Brooklyn prosecutors disclosed an international operation that disrupted 112 servers and 241 domains tied to a cryptocurrency investment scam targeting Russian-speaking Americans. The scheme allegedly stole tens of millions of dollars, but investigators have seized only about $300,000 so far. Prosecutors say the same network later contacted some victims with offers to recover their losses, seeking another opportunity to exploit them.

The three-year investigation traced the operation to Russian-language Facebook ads, followed by calls from people posing as investment advisers. Victims were directed to fraudulent trading websites and told to buy cryptocurrency. When they tried to withdraw, some found their accounts locked or were told to pay additional fees or taxes. Recovered server data showed operators approached victims weeks later with recovery offers.

Why it matters

The operation targeted the infrastructure behind the fraud, including cloud-based servers hosted by companies in Eastern Europe and the United States. Authorities sought to disable the websites, software and victim records used to run the scheme and contact people again. The effort involved the FBI and private-sector organizations including Shadowserver, Coeus and UltaHost.

The case also highlights a second layer of risk for scam victims: fraudulent recovery services can use information gathered during an initial theft to solicit more money. Prosecutors say the network used Russian-language ads and targeted communities including Brooklyn’s Russian-speaking population. Some victims lost their entire life savings.

Market impact

Authorities have not identified alleged operators or announced arrests, and they have not disclosed how many victims received recovery offers or whether any paid. The District Attorney’s Office also has not said whether victims have received money back or provided a restitution timetable.

The seizure remains small compared with the alleged losses. Investigators continue trying to recover assets, while previous efforts to disrupt about 400 domains linked to crypto investment fraud were followed by replacement websites.