Brooklyn DA and FBI Seize 112 Servers in Crypto Scam Takedown

Brooklyn District Attorney Eric Gonzalez announced that his Virtual Currency Unit, working with the FBI, disrupted a multinational crypto fraud operation that targeted Russian speakers in the United States. The action shut down 241 web domains and 112 servers, which the office calls one of the biggest operational cyber disruptions ever undertaken by a local prosecutor's office.

The operation was carried out last week, after a three-year investigation. No arrests have been announced.

A victim's side of this starts quietly. An ad in Russian promises an investment opportunity. Then a call comes, from someone who speaks the language and offers to help.

An Ad in Russian, Then a Call From an "Advisor"

Scammers drew people in through Russian-language Facebook ads, then had fake advisers call them. The adviser coached each victim through opening an account on what looked like a crypto investment platform, then through buying crypto and sending it to addresses tied to that site, according to the District Attorney's announcement.

The sending step is the one that can't be undone. A card payment can be disputed and reversed. A crypto transfer settles, and it's gone.

For weeks or months, the platform shows a balance. That balance isn't the victim's money, and there's no button that moves it back.

When Withdrawals Locked, a Second Pitch Arrived

Withdrawal is where the design of the scheme shows itself. Victims who tried to take money out found their accounts locked, or were told they owed more for supposed taxes and fees.

Then the same operators came back. Data recovered in the investigation showed they contacted victims a few weeks after the initial fraud, this time offering to retrieve the stolen funds.

These criminals stole many millions of dollars from Russian-speaking victims through an elaborate investment scheme, then tried to exploit them again with false promises to recover their money.

That second approach is what turns a single theft into a funnel. Someone who has already lost their savings is a qualified lead for a paid "recovery" that doesn't exist, and the websites, the accounts and the phone scripts needed to run it are already built.

Why Investigators Went After Servers This Time

The unit had taken down domains before. It had seized or disrupted 400 domains tied to crypto investment fraud, and replacement sites kept appearing.

This time the targets were the servers, hosted by Eastern European and American companies, that held the victim data and the software the fraud ran on. Last week, the unit executed numerous search warrants and other enforcement actions across three time zones over the course of several hours.

The operation seized and disrupted not only 241 scam cryptocurrency investment domains but, more significantly, a large cluster of over 100 cloud-based servers hosted by Eastern European and American companies, depriving the scammers of access to the data that populates the domains, victim information, and their operational software.

The office says the disruption takes away the scammers' ability to quickly create new websites and contact pre-existing victims. Gonzalez said the network relied on online infrastructure and IP addresses in Ukraine and other Eastern European countries.

Brooklyn authorities have seized about $300,000 so far and are working to recover more. The office estimates tens of millions of dollars were stolen, with some victims losing their entire life savings.

The Scale Behind a Single Case

The FBI's Internet Crime Complaint Center logged $8.65 billion in investment fraud losses in 2025, its costliest crime category, within $20.88 billion in total reported losses across 1,008,597 complaints. That total was 26% higher than in 2024, and losses tagged to cryptocurrency reached $11.37 billion, about 54% of the total, across 181,565 complaints.

Crypto investment scams accounted for roughly 84% of the investment-fraud figure, the bureau's annual report says.

The FBI has also run a counter-effort, Operation Level Up, which it says has reduced potential losses by more than $500 million since 2024.

The test of going after servers instead of front pages is a plain one. If the fake platforms stay offline, the next batch of victims never picks up the phone.