Protocols & Policy · Enforcement
The Brooklyn DA's Virtual Currency Unit says it seized or disrupted 241 scam domains and 112 servers behind an investment fraud that stole an estimated tens of millions of dollars.
The Brooklyn District Attorney's Virtual Currency Unit and FBI New York have taken down the online infrastructure of a crypto investment scam that targeted Russian speakers in the U.S., the DA's office said on Oct. 14. The operation seized and disrupted "241 web domains and 112 servers," according to the office (source 1).
The office called it "one of the biggest operational cyber disruptions undertaken by a local prosecutor's office" (source 1).
The release names no defendants and does not mention any arrests.
The scheme followed a set pattern, the office said. Victims answered "a Facebook ad in Russian for investment opportunities," then got a call from an "investment advisor" who spoke Russian and coached them into opening an account on a crypto investment website. With the advisor's help, victims bought crypto and sent it to addresses linked to those sites. After weeks or months, a victim who tried to withdraw "was locked out of their account or told they had to pay additional fees and taxes" (source 1).
Then came a second pass. Data recovered in the operation showed the group also ran a "cryptocurrency recovery scam operation," contacting victims a few weeks later "with the promise that they could recover the stolen assets" (source 1).
The money figures are the DA's. "It is estimated that tens of millions of dollars were stolen in the course of the scheme, with some victims losing their entire life savings," the release says. "The DA's Office has been able to seize about $300,000 in stolen funds so far and is working to claw back more" (source 1). The office gives no more precise loss total and no victim count.
The case has run for years. The DA said the unit has spent "the past three years" investigating the organization, and that because Brooklyn is home to a very large Russian population, "the scam disproportionately affected Brooklyn residents when compared to the rest of the country" (source 1).
The new step is the servers. Before last week, the unit had "already seized or disrupted 400 domains associated with cryptocurrency investment fraud," but "new scam websites popped up quickly," the release says. Last week it executed search warrants across three time zones over several hours, hitting "a large cluster of over 100 cloud-based servers hosted by Eastern European and American companies." That cut the operators off from "the data that populates the domains, victim information, and their operational software." The office said the criminals relied on infrastructure and IP addresses "in Ukraine and other Eastern European countries" (source 1).
| What the DA said | Figure | Source |
|---|---|---|
| Scam domains seized or disrupted last week | 241 | 1 |
| Servers seized or disrupted last week | 112 | 1 |
| Domains seized or disrupted before last week | 400 | 1 |
| Estimated stolen | "tens of millions of dollars" | 1 |
| Seized so far | about $300,000 | 1 |
| Length of investigation | three years | 1 |
"When scammers halfway around the world target Brooklyn residents, they should know they are not beyond our reach," Gonzalez said (source 1).
James C. Barnacle, Assistant Director in Charge of FBI New York, said the Kings County office "were swift to involve our subject matter experts and together we got to the bottom of the plot, seizing over one hundred domains" (source 1).
The office thanked the FBI, Shadow Server, Coeus and UltaHost for their help. It did not say which companies hosted the seized servers, though it said a seizure notice now appears on the disrupted sites (source 1).
The pattern the office described ran from a Facebook ad to a Russian-speaking "investment advisor," a platform that blocked withdrawals and, weeks later, an offer to recover the stolen money (source 1).
Holding the Corner.
Not financial advice.