They Drained Victims' Life Savings, Then Called Back Offering to Recover It. Brooklyn Just Pulled 241 of Their Sites
First they stole your savings. A few weeks later they called back to offer you a way to get it back.
That’s the two-step scheme Brooklyn prosecutors and the FBI say they just hit. They seized or disrupted 241 scam websites and more than 100 servers. CoinDesk puts the server count at 112. The fraud network behind them allegedly drained tens of millions of dollars from Russian-speaking victims across the United States.
The amount recovered after a three-year investigation is about $300,000.
What Happened
On Wednesday, October 14, 2026, Brooklyn District Attorney Eric Gonzalez announced the takedown, which was run with the FBI. Investigators executed search warrants across three time zones within hours.
The servers were hosted by Eastern European and US companies. They held victim data, site content and the software used to run the fraud. According to CoinDesk, the network used IP addresses in Ukraine and other Eastern European countries.
The servers were the real target. The DA’s Virtual Currency Unit had already taken down about 400 scam domains tied to crypto investment fraud, and new ones kept appearing to replace them. Taking out the backend is meant to stop the operators from launching new sites within a day.
No arrests or charges have been announced. Neither the number of victims nor the exact total stolen has been disclosed.
How the Scam Worked
- The ad. Russian-language Facebook ads promised investment opportunities.
- The “advisor.” A Russian-speaking adviser called victims and walked them through buying crypto and depositing it on a fake trading platform.
- The lockout. When victims tried to withdraw, their accounts were frozen, or they were told to pay “taxes” and “fees” before any funds would be released.
- The second hit. Weeks later, the scammers contacted victims again, this time posing as a recovery service that could get the stolen money back.
Gonzalez said the operators “tried to exploit them again with false promises to recover their money.” Prosecutors said some victims lost their entire life savings.
The Bigger Picture
This is one network. The FBI’s 2025 internet crime numbers, as cited by CoinDesk, show how large the overall problem is:
- Crypto investment scams made up roughly 84% of the $8.65 billion in investment-fraud losses reported to the FBI.
- Crypto-linked losses across all categories totaled $11.37 billion, about 54% of the $20.88 billion total.
Compare those numbers with $300K recovered after three years. Taking down infrastructure is now the main tool, because the money is usually gone before anyone files a report.
Rule of thumb: nobody legitimate cold-calls you offering to recover stolen crypto for an upfront fee. A “recovery service” that contacts you first is almost always the same people who scammed you.
Why This Matters for Crypto Jobs
1. Local prosecutors are hiring crypto investigators now, not just the feds. A county DA’s office ran a three-year, multi-time-zone crypto investigation using its own Virtual Currency Unit. Demand for on-chain investigators, blockchain intelligence analysts and digital forensics specialists is moving down from federal agencies into state and local offices, and the firms that support them, like Chainalysis and TRM Labs, are hiring to match.
2. Trust & safety is a growth function. Every exchange that real victims used to buy crypto before sending it to a fake platform has to deal with the fallout: chargebacks, SAR filings and frozen funds. Fraud analysts, AML investigators and scam-intervention teams that can spot a customer being coached in real time are some of the most useful hires a CEX can make.
3. Infrastructure takedowns need people who understand infrastructure. This case was won on servers, not wallets. People who can connect hosting providers, domains and on-chain flows into one picture are exactly the people prosecutors need. That means threat intel, OSINT and security engineers who know both web infrastructure and blockchains.
The Bottom Line
The fake trading platform was only the first half of the scheme. The fake recovery service was built to take whatever victims had left. Brooklyn cut off the infrastructure behind both, but no one has been arrested and almost none of the money has come back. Expect replacement sites.
Want to be on the side that catches these crews? Browse thousands of Web3 roles in forensics, compliance, security and more at Cryptogrind, the job board built for people who actually ship.
Discussion
Comments are powered by GitHub. Sign in with your GitHub account to chime in.