FOR IMMEDIATE RELEASE
Wednesday, October 14, 2026
Brooklyn DA’s Virtual Currency Unit Dismantles Infrastructure of
Multinational Crypto Investment Scam that Targeted Russian Speakers
112 Servers and 241 Scam Domains Disrupted, Dismantling Fraudsters’ Online
Infrastructure in One of the Largest Cyber Enforcement Actions Taken by Local Prosecutor
Brooklyn District Attorney Eric Gonzalez announced today that, in one of the biggest operational cyber disruptions undertaken by a local prosecutor’s office, his Virtual Currency Unit (VCU) successfully disrupted a multinational cryptocurrency fraud operation that targeted members of the Russian community in the U.S. The law enforcement cyber action disabled the global scam operation, seizing and disrupting 241 web domains and 112 servers, the contents of which confirmed the millions of dollars lost by the Russian community in Brooklyn, and throughout the country.
Brooklyn District Attorney Eric Gonzalez said, “When scammers halfway around the world target Brooklyn residents, they should know they are not beyond our reach. These criminals stole many millions of dollars from Russian-speaking victims through an elaborate investment scheme, then tried to exploit them again with false promises to recover their money. Our groundbreaking Virtual Currency Unit identified the fraud, tracked the stolen cryptocurrency, broke new ground by uncovering the infrastructure behind the operation, and worked with the FBI to dismantle it. By disrupting more than 100 servers and hundreds of fraudulent websites, we have struck at the heart of this criminal enterprise and made it far harder for these scammers to victimize others. I commend our investigators and thank the FBI for their partnership in this extraordinary operation. We will continue using every tool at our disposal to protect Brooklyn residents from increasingly sophisticated fraud.”
James C. Barnacle, Assistant Director in Charge, FBI New York, said, “This case is a prime example of what can be done through the power of our partnerships with state, local, and international law enforcement. Just as we rely on our law enforcement partners to disrupt criminals by any means, we also rely on the American public to let us know when they see criminal activity take place. Our partners at Kings County District Attorney’s Office were swift to involve our subject matter experts and together we got to the bottom of the plot, seizing over one hundred domains. The FBI will continue to support our partners with every available resource, human and technological, for the betterment of our New York communities.”
The District Attorney said that over the past three years, VCU has been investigating a large-scale scam organization running a cryptocurrency investment scam targeting members of the Russian-speaking community in the U.S. As Brooklyn is home to a very large Russian population, the scam disproportionately affected Brooklyn residents when compared to the rest of the country.
The criminals relied on cyber infrastructure and IP addresses in Ukraine and other Eastern European countries to carry out their operation. Last week, VCU executed numerous search warrants and took other enforcement actions across three time zones over the course of several hours. The operation seized and disrupted not only 241 scam cryptocurrency investment domains but, more significantly, a large cluster of over 100 cloud-based servers hosted by Eastern European and American companies, depriving the scammers of access to the data that populates the domains, victim information, and their operational software.
Prior to last week’s actions, VCU had already seized or disrupted 400 domains associated with cryptocurrency investment fraud. While the domain seizures were highly effective at alerting potential victims to the websites about the on-going scam, new scam websites popped up quickly. In response, VCU has now escalated the law enforcement operation by identifying the servers supporting the scam, worldwide, and, with the assistance of the FBI, coordinated an international cyber take-down. This disruption, to the underlying infrastructure of the scam operation, takes away the scammer’s ability to quickly create new websites and contact pre-existing victims.
Data recovered also revealed that the scammers were operating a cryptocurrency recovery scam operation, contacting the victims a few weeks after the initial deception with the promise that they could recover the stolen assets.
At the beginning of the investigation, VCU identified a large cluster of Russian-speaking victims in Brooklyn who all shared a similar narrative: the victim responded to a Facebook ad in Russian for investment opportunities; they then received a follow-up call from an “investment advisor” who spoke to them in Russian; the “investment advisor” coached them into creating an account on a cryptocurrency investment platform website; with the help of the “advisor,” the victim purchased cryptocurrency and transferred it to cryptocurrency addresses linked to the investment platform websites; and after “investing” for several weeks or months, the victim attempted to make a withdrawal but was locked out of their account or told they had to pay additional fees and taxes.
It is estimated that tens of millions of dollars were stolen in the course of the scheme, with some victims losing their entire life savings. The DA’s Office has been able to seize about $300,000 in stolen funds so far and is working to claw back more.
The District Attorney thanked the FBI, Shadow Server, Coeus, and UltaHost for their assistance and cooperation in the investigation.
The case was investigated by Assistant District Attorney Alona Katz, Chief of the District Attorney’s Virtual Currency Unit, Assistant District Attorney Alex Davis of the Virtual Currency Unit, Virtual Currency Unit Analyst Christopher Vellios, Senior Virtual Currency Analyst Paul Stenzel, Intelligence Analysts Timothy Brown and Sourov Talukder of the KCDA Digital Evidence Lab, under the supervision of Assistant District Attorney Jingu Chong, Chief of the Digital Evidence Lab, and the Detective Investigators Bureau.
#
Seizure Notice that now appears on the disrupted websites
Homepages of two of the scam domains
