Brooklyn prosecutors have uncovered a cryptocurrency investment fraud that allegedly stole tens of millions of dollars from Russian-speaking Americans before targeting some of the same victims with a second offer: help recovering their missing funds. The enforcement operation disrupted 112 servers and 241 websites connected to the scheme, but only about $300,000 in assets has been seized so far.
According to CryptoSlate, prosecutors disclosed the case on October 14 after a three-year investigation carried out with assistance from the Federal Bureau of Investigation and several private-sector organizations. The operation focused on the digital infrastructure used to operate fraudulent investment platforms, communicate with victims and retain information that could be used for further attacks.
The case highlights a particularly damaging form of cryptocurrency fraud. Victims were not only allegedly deceived into transferring funds to fake investment services; after losing money, they could be approached again by people claiming to have the ability to retrieve the stolen cryptocurrency. Authorities have not said how many people received these recovery offers or how many made additional payments.
How the investment fraud worked
Investigators said the scheme began with Russian-language advertisements on Facebook promoting cryptocurrency investment opportunities. People who responded were contacted by individuals presenting themselves as Russian-speaking investment advisers.
The supposed advisers guided prospective investors to cryptocurrency trading websites, helped them open accounts and instructed them to buy or transfer digital assets. Victims then sent cryptocurrency to wallet addresses associated with the platforms, believing that their money was being invested through a legitimate service.
The fraud often became visible only when investors attempted to withdraw their funds weeks or months later. Some found that their accounts had been locked. Others were told that they had to pay extra fees or taxes before their money could be released. These additional demands made it possible for the operators to seek still more money from people who were already facing losses.
The recovered server data showed that the operators later contacted victims again, often several weeks after the original fraud. They claimed to offer assistance recovering the missing assets. Because the criminals already possessed information about the victims, their transactions and their losses, the follow-up approach gave them a new opportunity to exploit people who were likely to be especially vulnerable.
Brooklyn was a focal point of the investigation because it has a large Russian-speaking population. Prosecutors said some victims lost their entire life savings. Brooklyn District Attorney Eric Gonzalez said the operation first used an elaborate investment fraud and then attempted to obtain further payments by presenting itself as a cryptocurrency recovery service.
Authorities disrupt the network’s infrastructure
The investigation went beyond individual websites. Prosecutors said the criminal network depended on servers, domains, software and stored victim information to keep its platforms running and to maintain contact with people who had already been defrauded.
During an operation conducted across three time zones the previous week, investigators executed search warrants and coordinated the disruption of cloud-based servers hosted by companies in the United States and Eastern Europe. The network used internet infrastructure in Ukraine and other Eastern European countries, according to the Brooklyn District Attorney’s Office.
In total, authorities disrupted 112 servers and 241 domains. The goal was to cut access to the websites and data supporting the investment operation, while also making it more difficult for the criminals to rebuild their platforms and reuse customer records for recovery scams.
The FBI participated in the effort, along with Shadowserver, Coeus and UltaHost. The District Attorney’s Virtual Currency Unit had previously seized or disrupted roughly 400 domains tied to cryptocurrency investment fraud. However, replacement websites appeared quickly, prompting investigators to concentrate more heavily on the underlying server infrastructure rather than targeting websites alone.
The broader pattern is familiar to law-enforcement agencies. The FBI has warned that fraudulent cryptocurrency recovery businesses may approach people who have already lost money, demand upfront payments, issue misleading asset-tracing reports or falsely claim links to law enforcement. In such cases, the promise of recovering funds can become another method of taking money from the original victim.
Stolen funds remain largely unaccounted for
The infrastructure takedown does not automatically return the money lost by investors. Prosecutors estimate that the scheme took tens of millions of dollars, while investigators have seized only about $300,000 in stolen assets so far.
The Brooklyn District Attorney’s Office has not disclosed whether victims have received any recovered funds or provided a timetable for restitution. The announcement also did not identify alleged operators or announce arrests. Investigators are continuing to search for additional assets, leaving most of the money linked to the operation unaccounted for.
The distinction matters because disrupting websites and servers can stop or limit a fraud operation, but tracing cryptocurrency and establishing who is entitled to recovered assets are separate steps. For victims, the enforcement action therefore represents a major interruption to the network, not confirmation that their losses will be repaid.
Moneyiar market picture
Moneyiar market data recorded at approximately 9:38–9:39 p.m. local time on October 15 showed declines across the four listed assets:
- Monad (MON): $0.0231524884, down 4.02% over 24 hours and 5.47% over seven days.
- Nexus (NEX): $0.0000007385, down 4.47% over 24 hours and 7.33% over seven days.
- Data Network (DATA): $0.1905308515, down 3.94% over 24 hours and 2.83% over seven days.
- ECOMI (OMI): $0.0002645106, down 2.50% over 24 hours and 2.37% over seven days.
These figures are Moneyiar data at the stated times and are separate from the Brooklyn investigation.
