Ukraine has dismantled a sophisticated network of fake crypto investment platforms that allegedly drained wallets belonging to people in more than 20 countries. According to reports from the Security Service of Ukraine (SBU), investigators from the Main Investigation Department worked with the National Police to uncover the operation, which maintained several offices in Kyiv and the surrounding region. The network reportedly handled up to $1 million per month at its peak, with more than 46 Ukrainians recruited into the operation. As reported by the SBU on 1 September, investigators identified the alleged organizer as a 25-year-old Kyiv IT specialist who recruited other tech workers in the capital to pose as cryptocurrency-platform representatives.
Authorities have so far identified 62 victims from more than 20 countries, including citizens of Germany, Poland, Lithuania, Latvia, Spain, France, the UK, Canada and Israel. The SBU reports that the case reaches beyond Ukraine because the alleged victims were EU citizens. The scheme began with advertising distributed through Telegram, where potential customers were offered opportunities to invest in crypto projects. Users who registered were instructed to connect a cryptocurrency wallet and transfer funds to the platform, after which employees manually simulated investment activity and showed customers rising account balances inside their dashboards.
The alleged theft entered another stage when customers attempted to withdraw their funds, according to investigators. Operators blocked withdrawal requests and told victims that another verification procedure was required before their money could be released. Users were instructed to connect their primary cryptocurrency wallet and approve a small test transaction to demonstrate that the platform was functioning. The websites contained a wallet drainer that used the authorization to transfer assets from connected wallets to addresses controlled by the group, after which victims lost access to the investment platform. The network found victims by posting about supposedly lucrative crypto projects in popular Telegram channels, then showed them fabricated trading results and fake profits to make the operation look legitimate.
Ukrainian officers carried out 23 searches at homes, offices and vehicles across Kyiv and the surrounding region as part of the investigation. According to the SBU, police seized over 100 computers and other computer equipment, more than 100 mobile phones, 79 SIM cards and a GSM gateway. Authorities seized 16 high-end cars, including Porsche, BMW, and Mercedes-Benz models, along with money believed to be criminal proceeds. Police recovered cash and records connected with the operation, while 15 vehicles were taken during the searches. Some cars and real estate used by members of the network had been registered in the names of suspects' wives and other relatives, investigators noted. Authorities have not yet named any suspects, and the investigation is ongoing.
Those involved could face up to 12 years in prison with confiscation of property, according to the SBU. Authorities were still deciding whether to serve notices of suspicion, while the investigation continued under the Prosecutor General's Office. The operation follows Ukraine's previous international law enforcement efforts, including working with the FBI, EU law enforcement, and Polish counterintelligence to disrupt Russian military-intelligence spying through hacked routers in April. The SBU did not name any foreign law enforcement partners involved in this crypto investigation.
