Ukrainian Police Break Up Crypto Scam Ring Targeting 20+ Countries

Authorities dismantle fake investment platform operation

Ukrainian police have shut down a criminal network that used fake crypto investment websites to steal funds from victims in more than 20 countries. Investigators say the group siphoned as much as $1 million a month.

The Security Service of Ukraine (SBU) and national police confirmed that they identified 62 victims so far. The investigation revealed that more than 46 Ukrainian citizens took part in the scheme, which relied on hidden software to drain users' digital wallets.

How the fraud worked

The operation used websites that looked like legitimate investment platforms. Users saw their account balances rise, creating the impression that their crypto investments were growing. However, police say operators manually manipulated these figures to lure victims deeper into the scam.

When users tried to withdraw their money, the platforms asked them to connect their main cryptocurrency wallets. Crypto wallets are digital tools that store and manage cryptocurrencies. Once connected, the sites prompted victims to approve what appeared to be a small test transaction. Unbeknownst to the users, the websites contained a hidden "drainer" program. This malicious software used the wallet connection to move all the user's funds to wallets controlled by the scammers. After the theft, victims were locked out of the platform.

Organizational structure and expansion

Investigators say the operation was led by a 25-year-old IT specialist who recruited over 46 people. The group set up several offices in Kyiv and the surrounding area. Different staff members handled technical tasks, managed offices, provided security, or contacted potential victims.

Police say victims came from Germany, Poland, Lithuania, Latvia, Spain, France, the UK, Canada, Israel, and other nations. In addition to stealing crypto, the scammers collected personal data during registration, including passport details, phone numbers, emails, and passwords.

Polish authorities help trace infrastructure

A key breakthrough came from outside Ukraine. Authorities traced the group's server equipment to Poland and accessed a database stored there. The recovered records included lists of victims, wallet addresses, stolen amounts, and internal communications that helped investigators understand how the scheme operated.

Following this lead, Ukrainian police carried out 34 searches in Kyiv. They seized more than 100 computers, over 100 phones, 79 SIM cards, documents, cash, and 15 vehicles.

Investigation status

The case is being investigated under Ukraine's fraud laws. Police say the investigation is ongoing and they are still working to identify additional participants and determine the total amount of cryptocurrency stolen. The SBU stated the operation's monthly turnover could reach $1 million, but confirmed victim counts and final financial losses remain under verification.

Key numbers

• Up to $1 million in alleged monthly turnover
• 62 identified victims
• More than 46 Ukrainian suspects involved
• Over 20 countries with alleged victims
• 34 police searches conducted
• 100+ computers and 100+ phones seized

Official statements

Ukrainian police announced the shutdown on social media, stating: "Police have stopped the activities of a network of fake investment platforms through which scammers kidnapped cryptocurrency from citizens of more than 20 countries." They confirmed the identification of 62 victims in a post dated September 1, 2026.

What is confirmed

Ukrainian authorities confirmed the shutdown of the network and the arrest of suspects. They verified the existence of the drainer software and the collection of user data. The total financial loss is estimated by the SBU but remains under investigation.

What is still unclear

It is not yet confirmed whether any stolen funds have been recovered or returned to victims. The full extent of the financial damage and the identities of all participants are still being determined.

Source:

• CoinDesk