Hassan Maishera
TL;DR
-
Ukrainian authorities dismantled a network of fake investment platforms that allegedly targeted users in more than 20 countries.
-
The websites displayed fabricated profits before convincing victims to connect their primary crypto wallets and approve a transaction.
-
A hidden crypto drainer then transferred assets to wallets controlled by the operators.
Fake Investment Websites Displayed Fabricated Profits
Ukrainian authorities have shut down a network of fake investment platforms accused of stealing cryptocurrency and personal data from people in more than 20 countries.
The websites allegedly showed users steadily increasing account balances, creating the impression that their investments were generating substantial returns. Ukrainian police said these gains were fabricated to earn users’ trust and encourage them to deposit more funds.
Operators manually created false transactions and adjusted balances displayed in users’ accounts. The apparent profits existed only on the platform and could not be withdrawn.
The alleged scam became apparent when users attempted to access their supposed earnings.
When victims requested withdrawals, the platforms instructed them to connect their primary cryptocurrency wallets and authorize what appeared to be a small test transaction.
The websites allegedly contained a concealed crypto drainer that used the approval to transfer assets automatically to wallets controlled by the operators. Once the transfer was complete, victims lost access to their platform accounts.
Ukraine’s National Police said it dismantled the network after identifying 62 victims. The Security Service of Ukraine, or SBU, estimated that the operation’s monthly turnover may have reached $1 million.
Authorities are continuing to search for other victims and determine the total amount stolen.
The websites were allegedly designed to collect more than cryptocurrency. During registration and identity-verification procedures, users provided passport details, telephone numbers, email addresses, account credentials, passwords and photographs, police said.
This gave the operators access to valuable personal data that could potentially be used for identity theft, account takeovers or other fraudulent activity.
The scheme therefore exposed victims to continued risks even after their digital assets had been transferred.
Suspected Organizer Recruited More Than 46 People
Investigators identified the operation’s alleged leader as a 25-year-old information technology specialist.
Authorities said the organizer recruited more than 46 Ukrainian citizens and ran several offices across Kyiv and the surrounding region.
Technical workers reportedly created and maintained the fraudulent websites while ensuring they remained accessible. Other employees contacted prospective victims, managed the offices or provided physical security.
The platforms allegedly targeted users in Germany, Poland, Lithuania, Latvia, Spain, France, the United Kingdom, Canada and Israel, among other countries.
Infrastructure located outside Ukraine produced a significant breakthrough in the investigation.
Authorities traced servers used by the network to the Netherlands and obtained access to a database stored there. Its contents allegedly included lists of victims, cryptocurrency wallet addresses, stolen amounts, internal communications and details about the operation of the fraudulent platforms.
Investigators used those records to reconstruct the scheme, trace transactions and identify victims.
The cross-border infrastructure illustrates how online fraud operations can target users in numerous jurisdictions while distributing their technology and data across different countries.
Ukrainian police and the SBU subsequently conducted 34 searches across Kyiv and its surrounding region.
Authorities seized more than 100 computers, over 100 mobile phones, 79 SIM cards, documents, cash and 15 vehicles during the raids.
The investigation remains active under Ukraine’s fraud laws. Police are working to identify additional participants, locate more victims, and calculate the total amount of cryptocurrency allegedly stolen by the network.
