Ukraine's National Police and Security Service have shut down a network of fake investment platforms that drained crypto wallets from citizens of more than 20 countries. Investigators have already identified 62 victims, among them residents of Germany, Poland, Lithuania, Latvia, Spain, France, the UK, Canada and Israel.
Cyber Police Shut Down the Kyiv Network
The organizer turned out to be a 25-year-old IT specialist who recruited at least 46 Ukrainians to staff several offices in Kyiv and the surrounding region. Part of the team built fake websites and kept them online despite blocking attempts, while others handled calls, sales and security. According to the Security Service, the network's turnover peaked at up to $1 million a month.
The pitch started on Telegram channels. There, the group advertised supposedly profitable crypto projects and invited followers to register on a site designed to look like a real exchange.
Investigators treat the 62 confirmed victims as only part of the real picture. Not every transaction could be tied to a specific person, so police are still identifying additional victims from the seized database.
How the Scheme Drained Victims' Funds
Users who responded to the ads connected a crypto wallet and sent money toward the supposed investment projects. Staff manually faked the trading, letting each client's dashboard balance climb steadily even though no real trades ever happened. When a victim tried to withdraw funds, the platform blocked the request under various pretexts.
Registration also required passport details, phone numbers, logins, passwords and photos. All of it landed in the organizers' internal database along with each victim's wallet addresses and the amounts stolen.
Most of the victims are citizens of EU countries rather than Ukraine. The ad copy and payment details were tailored to each target country's audience, while the support team and developers worked out of the same Kyiv office.
What Investigators Seized in the Raids
Investigators found a server holding the group's database in the Netherlands and gained access to it. The records showed not just a list of victims but internal staff correspondence and the full mechanics of how the fake platforms operated.
During 34 searches across Kyiv and the region, officers seized:
- more than 100 computers and about as many phones
- 79 SIM cards and a GSM gateway used for mass calling
- 15 cars, some of them registered to suspects' relatives
- cash and equipment used to run the offices
Access to the seized database let investigators reconstruct a timeline for each victim. They could see the registration date, the size of the first transfer, and the moment the wallet was emptied for good.
The organizer traveled with armed guards. The case is being prosecuted under Part 5 of Article 190 of Ukraine's criminal code. Police say they are still identifying everyone involved, additional victims and the full scale of the losses.
The Bigger Picture on Crypto Fraud in Ukraine
This isn't the first major case of its kind recently. In June, Ukraine moved $8.3 million in seized USDT into a state-run wallet for the first time. Confiscated crypto had never previously been placed under official state management.
The Royal United Services Institute estimates Ukraine's total losses from crypto crime at at least $10 billion. Researchers argue that tighter rules on confiscating and managing seized assets could recover a significant share of those funds and unpaid taxes for the budget.
Fake platforms like this one work because they copy the interface of real exchanges while skipping any licensing checks. On large platforms such as Binance, withdrawals and identity verification follow platform rules, while the fraudulent site existed only to empty a client's wallet once.
At Kurslog, we regularly remind readers of one rule. No legitimate exchanger or exchange will ever ask you to approve a "test" transaction to unlock a withdrawal. That request is always a sign of a drainer, not a platform check.
Comments
Your email address will not be published. Required fields are marked *