Crypto fraud: FBI and Brooklyn dismantle the infrastructure of a network that targeted Russian speakers

Hit the servers rather than the windows. This Wednesday, October 14, Brooklyn prosecutor Eric Gonzalez announced the dismantling of the infrastructure of a large-scale crypto fraud network. With the FBI, its unit dedicated to cryptocurrencies seized or disrupted 241 websites and 112 servers. The scam targeted Russian-speaking victims in the United States, and allegedly stole tens of millions.

The key points of this article:

The FBI and the Brooklyn district attorney seized or disrupted 241 fraudulent sites and 112 servers after three years of investigation.

The network targeted Russian-speaking victims through Russian-language Facebook ads and fake investment advisors.

The scammers tried their luck again with victims with false offers to recover the funds.

Approximately $300,000 has been seized to date, and no arrests have been announced.

From fake Facebook ads to locked platforms

The modus operandi, described by the prosecutor, indeed follows the classic mechanics of investment scams. First, the scammers lured their victims with Russian-language Facebook ads promising profit opportunities. Fake advisors then called the prey to guide them towards purchasing cryptocurrencies, to be sent to fraudulent trading platforms.

When it came time to withdraw their funds, investors hit a wall. The platform locked their accounts, or demanded additional payments under the guise of taxes and fees. In addition, the network tried its luck again a few weeks after the first scam. The data seized shows that he then offered victims to recover their funds in exchange for new payments, an obviously false promise.

We had already documented this technique of double punishment in our pig butchering files, where victims are made to remember their losses. Note that the software behind these fake trading scams is sold as a turnkey solution, as detailed in our investigation into the Airsoft affair.

Hit servers, not sites

The prosecutor’s Virtual Currency Unit had already seized or disrupted 400 domains related to crypto investment fraud. However, replacement sites continued to proliferate, each closure calling for its copy. This time, investigators changed targets. They targeted the servers, hosted by companies in Eastern Europe and the United States, which stored victims' data and network software. In practice, hitting the infrastructure costs fraudsters more than closing a domain name. The aim is to prevent operators from quickly relaunching new platforms.

Authorities have seized about $300,000 so far, and are seeking to recover more. According to prosecutor Gonzalez, some victims lost their entire savings. The case remains open, with no arrests announced for the moment.