Ukrainian police dismantle cross‑border fake crypto investment network

Ukraine’s National Police, together with the Security Service of Ukraine and the Office of the Prosecutor General, have dismantled a network of fake cryptocurrency investment platforms that operated from offices in Kyiv and surrounding regions. The scheme attracted victims from over 20 countries and, at its peak, generated up to $1 million in monthly turnover.

How the scam worked

The group created websites that mimicked legitimate crypto‑investment platforms and advertised them on Telegram. Users were instructed to connect a cryptocurrency wallet and transfer funds. After deposit, the sites displayed fabricated trading activity and rising balances. When victims attempted to withdraw, the operators blocked the request and asked for a small test transaction to “verify” the platform. The test transaction granted the scammers permission to move the victim’s tokens, allowing a wallet‑drainer contract to transfer the assets to addresses controlled by the group.

Scale of the operation

• 34 searches were conducted at homes, offices and vehicles in Kyiv and nearby areas.
• More than 100 computers, 100 mobile phones, 79 SIM cards and a GSM gateway were seized.
• 15 vehicles were confiscated.
• Servers located in the Netherlands held a database with victim details, wallet addresses and stolen amounts.
• 62 victims have been identified, including citizens of Germany, Poland, Lithuania, Latvia, Spain, France, the UK, Canada and Israel.
• More than 46 Ukrainians were recruited to staff the operation.

Assets involved

The investigation recovered records of stolen cryptocurrency, notably USDT and USDC, and seized cash. Ukrainian authorities have previously transferred over $8.3 million in seized USDT to a state‑managed wallet.

Legal proceedings

The case is being prosecuted under Part 5 of Article 190 of Ukraine’s Criminal Code, which addresses fraud. Authorities continue to identify additional participants, victims and the total value of assets taken.

Broader context

This operation follows a series of international law‑enforcement actions targeting crypto‑related fraud, including INTERPOL’s Operation Jackal IV and Operation First Light, which have resulted in thousands of arrests and the seizure of hundreds of millions of dollars in illicit assets.