Brooklyn District Attorney Eric Gonzalez announced the dismantling of a multinational crypto investment scam infrastructure targeting Russian-speaking Americans. Working with the FBI, the Virtual Currency Unit disrupted 112 servers and seized 241 web domains used in the scheme. The operation, which had been under investigation for three years, relied on Facebook ads to lure victims into fake investment platforms where they transferred cryptocurrency to addresses controlled by scammers.
Prosecutors estimate the fraud stole tens of millions of dollars from victims, some of whom lost their entire life savings. The scam involved "investment advisors" who coached victims through the process, only to lock them out or demand additional fees when withdrawal attempts were made. Data from the seized servers revealed that the criminals also ran a secondary recovery scam, contacting victims weeks later with false promises to retrieve stolen assets.
The servers were hosted by Eastern European and American companies, utilizing infrastructure and IP addresses in Ukraine and other regions. While the unit had previously disrupted 400 domains linked to the fraud, new sites continued to emerge until this server-level takedown removed the scammers' ability to quickly recreate contact points. Authorities have recovered approximately $300,000 so far and are continuing efforts to reclaim more funds.
This enforcement action highlights the limitations of domain-only seizures in combating resilient crypto fraud networks. By targeting the underlying server infrastructure across multiple jurisdictions, Brooklyn prosecutors addressed the root cause of rapid site regeneration, suggesting a shift toward deeper technical disruption rather than superficial blocking. The involvement of the FBI underscores the cross-border nature of these operations, particularly given the reliance on Eastern European hosting and IP addresses.
The dual-layered fraud—initial theft followed by a recovery scam—exploits victim vulnerability and complicates asset tracing. The disproportionate impact on Brooklyn’s Russian-speaking community indicates that localized demographic targeting remains a potent vector for global cybercrime. Future investigations may need to focus more heavily on the financial intermediaries and hosting providers that enable such persistent infrastructure, as law enforcement moves beyond reactive website takedowns to proactive network dismantlement.
