A three-year investigation found that some victims of fake investment platforms were approached again with promises to recover their money. Authorities disrupted 112 servers and 241 websites, but have seized about $300,000.
The alleged scheme took tens of millions of dollars, but authorities have seized about $300,000 in assets so far. Brooklyn District Attorney Eric Gonzalez said some victims lost their entire life savings. His office has not said whether any seized money has reached victims.
On Oct. 14, 2026, Brooklyn prosecutors and the FBI's New York field office announced a takedown targeting 112 servers and 241 websites tied to an alleged cryptocurrency investment fraud. The three-year investigation led to the seizure of infrastructure hosted by providers in Eastern Europe and the United States. Prosecutors said the servers held victim information and data from fake investment sites. They also contained software used to run the operation. Investigators say the same network later contacted some victims, offering to recover their cryptocurrency in exchange for more payments.
Follow-up fraud
The investigation had been underway for about three years. Gonzalez said Russian-speaking Americans were targeted through an elaborate investment operation, with many victims in Brooklyn. In a statement, he said criminals stole millions from Russian-speaking victims, then tried to exploit some of them again with false promises to recover their money. Prosecutors said some victims lost their entire life savings.
The initial pitch began with Russian-language ads on Facebook. People who responded got calls from individuals posing as Russian-speaking investment advisers. The callers directed them to trading websites and helped them set up accounts. Victims then bought digital assets and transferred cryptocurrency to wallet addresses associated with the platforms, believing they were making legitimate investments.
The deception often came to light weeks or months later, when people tried to withdraw their funds. Some found their accounts locked. Others were told to pay fees or taxes before their money could be released. Data recovered from the servers showed that operators approached some victims again weeks after the initial fraud, claiming they could retrieve the missing assets. Authorities have not disclosed how many people received these offers or whether anyone paid.
Investigators say the second pitch drew on information collected during the investment scam. That gave the operators a way to target people who had already lost money. The FBI has warned more broadly that fraudulent crypto-recovery businesses often pursue people who have lost funds to investment scams. Some demand upfront fees. Others rely on misleading tracing reports or falsely claim ties to law enforcement.
The follow-up strategy differs from the device-level threat described in an earlier iPhone spyware report. Both cases involve crypto users being targeted again after sensitive information was obtained.
Servers over websites
The District Attorney's Virtual Currency Unit had previously seized or disrupted about 400 domains linked to crypto investment fraud. Replacement sites sprang up quickly, prosecutors said. Investigators then widened their focus beyond individual web addresses and targeted the infrastructure behind the operation.
Shortly before the Oct. 14 announcement, prosecutors executed search warrants during an operation spanning three time zones. They also coordinated the disruption of cloud servers hosted by companies in Eastern Europe and the United States. The network relied on infrastructure and internet addresses in Ukraine and other Eastern European countries, according to the District Attorney's Office. Investigators aimed to cut operators off from the software and website data used to run the platforms. They also targeted victim records that could be used to contact people who had invested.
The FBI took part in the operation alongside private-sector organizations. Named partners included Shadowserver. Coeus and UltaHost also participated. Prosecutors said the effort aimed to make it harder for the network to rebuild its sites and use stored victim information for more recovery pitches. The Brooklyn District Attorney's Office outlined the operation and described what investigators found on the seized servers.
Recovery remains limited
The takedown has not resolved the financial losses. Prosecutors estimate that the alleged scheme stole tens of millions of dollars, but investigators have seized only about $300,000 so far. They are working to recover additional assets. The District Attorney's Office has provided no timetable for restitution and has not said whether victims have recovered any funds.
The announcement did not identify the alleged operators or report any arrests. Investigators are continuing efforts to recover assets, while most of the money prosecutors say was stolen remains unaccounted for.
Taking down a website and recovering cryptocurrency are separate outcomes. A victim can lose access to a fraudulent platform without the stolen assets being located or returned. The office has not said whether any seized funds have reached victims, and it has provided no restitution timetable.
