Ukrainian authorities have dismantled a large crypto investment scam that allegedly targeted victims across more than 20 countries and generated monthly turnover of up to $1 million at its peak.
The operation used fake cryptocurrency investment platforms to convince users that their investments were generating profits. When victims attempted to withdraw their money, however, they were allegedly directed through an additional verification process that ultimately allowed a wallet drainer to steal cryptocurrency from their connected wallets.
Investigators have identified at least 62 victims so far, but authorities believe the final number could increase as they continue analyzing the network’s infrastructure and records.
Ukraine dismantles international crypto scam network
The National Police of Ukraine said its Main Investigation Department worked alongside the Security Service of Ukraine and the Office of the Prosecutor General to uncover the operation.
Investigators discovered several offices operating in Kyiv and the surrounding region.
More than 46 Ukrainian citizens were allegedly recruited to work within the network, while authorities are still attempting to identify additional participants.
According to investigators, a 25-year-old IT specialist organized the operation.
At its peak, the network reportedly handled as much as $1 million in monthly turnover.
Authorities have currently identified 62 victims from more than 20 countries, including people from Germany, Poland, Lithuania, Latvia, Spain, France, the United Kingdom, Canada and Israel.
The final number of victims and the total amount stolen remain under investigation.
Fake crypto investment platforms promised profitable returns
The alleged scam began with websites designed to resemble legitimate cryptocurrency investment platforms.
Potential victims were reportedly targeted through advertisements distributed on Telegram.
The promotions offered opportunities to invest in supposedly profitable cryptocurrency projects.
After registering, users were instructed to connect their crypto wallets and transfer funds to the platform.
The operation had multiple teams working behind the scenes.
Developers reportedly maintained the websites and infrastructure, including keeping the platforms accessible when attempts were made to block them.
Other members communicated with customers, operated from physical offices and provided security for the organization.
Once victims deposited cryptocurrency, employees allegedly manipulated the investment dashboards to create the appearance of successful trading.
Users could see their account balances increasing, giving them the impression that their investments were generating genuine profits.
Investigators said the displayed investment activity was fabricated.
Fake profits encouraged victims to stay invested
Showing users artificial profits was an important part of the alleged scheme.
Victims who believed their investments were performing well had fewer reasons to suspect that the platform was fraudulent.
The increasing balances could also encourage them to leave their funds on the platform or potentially deposit additional cryptocurrency.
The problem became clear when customers attempted to withdraw their supposed profits.
Instead of processing withdrawal requests, operators allegedly introduced another verification requirement.
That process eventually exposed victims to a more direct form of crypto theft.
Wallet drainer activated when victims tried to withdraw
According to investigators, customers attempting to withdraw funds were told they needed to complete an additional verification process.
Victims were instructed to connect their primary cryptocurrency wallet and authorize a small test transaction.
The platform presented this step as a way to confirm that withdrawals were working correctly.
However, investigators said the websites contained wallet-draining functionality.
The authorization allegedly allowed assets from the connected wallet to be transferred to addresses controlled by the scammers.
Once the cryptocurrency had been removed, victims reportedly lost access to the investment platform.
This technique resembles approval phishing attacks, where criminals trick users into approving malicious blockchain permissions.
Importantly, scammers using this method may not need access to the victim’s private key.
Instead, the victim can unknowingly authorize a malicious smart contract or transaction that gives the attacker permission to move certain assets.
Wallet drainers remain a major crypto threat
The Ukrainian case follows several other incidents involving malicious wallet authorizations.
In August, a Hyperliquid user reportedly lost around 550,000 USDC after interacting with a fraudulent website promoted through a Google advertisement.
Security researchers later connected that website to infrastructure associated with the Inferno drainer ecosystem.
That operation reportedly used malicious scripts, automated draining tools, approval commands and mechanisms for consolidating stolen cryptocurrency.
The Ukrainian investment scheme used a different method to attract victims, but the final stage was similar.
Users were persuaded to authorize a transaction before assets were removed from their wallets.
This demonstrates why crypto users should treat unexpected wallet connection and transaction-approval requests with caution, particularly when they appear during withdrawal or verification procedures.
Scammers allegedly collected personal information too
Cryptocurrency was not the only information allegedly collected by the fake platforms.
The registration and verification process reportedly gathered substantial amounts of personal data.
According to Ukrainian authorities, the platforms collected information including passport details, telephone numbers, email addresses, login credentials, passwords and photographs.
This potentially increases the impact of the operation beyond the cryptocurrency that was stolen.
Personal information collected through fraudulent platforms can create additional risks for victims, including impersonation attempts, account compromises and future targeted scams.
Servers in the Netherlands contained victim records
Investigators traced infrastructure used by the network to servers located in the Netherlands.
Authorities obtained access to a database stored on those servers.
The database reportedly contained cryptocurrency wallet addresses belonging to victims as well as records showing the amounts allegedly stolen from individual users.
Investigators also discovered internal communications between members of the organization and information describing how the fraudulent platforms operated.
Access to these records helped authorities trace the operation across multiple countries and identify individuals who had interacted with the fake websites.
The international nature of the infrastructure highlights the challenges law enforcement agencies face when investigating cryptocurrency scams that operate across several jurisdictions.
Global authorities increase pressure on crypto investment scams
The Ukrainian investigation comes amid a broader international crackdown on cryptocurrency investment fraud and online social engineering.
INTERPOL has conducted several major operations targeting investment scams, romance fraud and crypto-related money laundering.
Operation Jackal IV reportedly resulted in 58 arrests and the identification of 263 suspects after law enforcement agencies across 22 countries targeted various fraud networks.
South African authorities seized approximately $2.67 million and blocked hundreds of bank accounts during the operation.
Romanian police also arrested suspects linked to a major investment scheme reportedly associated with approximately €143 million.
Another large INTERPOL campaign, Operation First Light, produced thousands of arrests across dozens of countries and territories.
Authorities intercepted hundreds of millions of dollars in suspected illicit assets while targeting investment fraud, impersonation scams, romance scams and other social-engineering operations.
These cases show how online investment fraud increasingly combines traditional manipulation techniques with cryptocurrency infrastructure.
Approval phishing draws law enforcement attention
Wallet approval scams have also become a separate area of focus for authorities.
Earlier this year, a UK-led international operation involving authorities in the United States and Canada froze more than $12 million in suspected scam proceeds.
Investigators identified more than 20,000 potential victims.
That operation focused on schemes where users were persuaded to sign malicious blockchain authorizations.
Once approved, those permissions could allow scammers to transfer cryptocurrency without directly stealing the user’s private keys.
The method demonstrates an important distinction between traditional wallet compromise and approval phishing.
A wallet itself may remain technically secure while the user unknowingly grants an attacker permission to move assets.
Ukrainian police conduct 34 searches
Ukrainian authorities carried out 34 searches at offices, homes and vehicles across Kyiv and the surrounding region.
Police seized more than 100 computers and other pieces of computer equipment.
Investigators also recovered more than 100 mobile phones, 79 SIM cards and a GSM gateway.
Cash and documents allegedly connected to the operation were also seized.
Authorities took control of 15 vehicles during the searches.
Investigators said some vehicles and real estate associated with members of the organization had been registered under the names of suspects’ wives and other relatives.
The alleged organizer was also reported to have traveled with armed security.
Investigation into stolen crypto continues
The criminal case is being investigated under Part 5 of Article 190 of Ukraine’s Criminal Code, which covers fraud.
Authorities have not yet announced a final figure for the amount of cryptocurrency stolen.
Investigators are continuing to identify suspected participants, locate additional victims and analyze records recovered from the operation.
The number of known victims could therefore increase beyond the 62 currently identified.
Ukraine has also been developing procedures for handling cryptocurrency seized during criminal investigations.
In June, authorities transferred more than $8.3 million in confiscated USDT into a state-managed wallet, marking an important development in the country’s handling of seized digital assets.
Stronger procedures for tracing and managing cryptocurrency could become increasingly important as authorities investigate more blockchain-based financial crimes.
Crypto investors should remain cautious
The Ukrainian case demonstrates how sophisticated crypto investment scams can become.
Rather than immediately stealing deposited funds and disappearing, the alleged operators created functioning websites, simulated investment returns and maintained customer communication.
The apparent profits helped make the platforms look legitimate.
The most dangerous stage reportedly came when victims attempted to withdraw their money.
By presenting a wallet connection and transaction approval as a routine verification procedure, attackers could potentially gain authorization to transfer additional assets from the victim’s wallet.
Crypto users should carefully review wallet permissions before approving transactions, particularly when a platform unexpectedly requests access to a primary wallet.
Guaranteed returns, withdrawal problems, unexpected verification payments and requests for unusual wallet permissions can all be warning signs of investment fraud.
For Ukrainian investigators, the case is not over.
Authorities are continuing to trace additional participants and victims while working to determine the full amount of cryptocurrency allegedly stolen through the fake investment platforms.
