Ukraine destroys a cryptocurrency investment scam with a monthly turnover of up to US$1 million

Ukraine destroys a network of transnational fake cryptocurrency investment platforms, and 62 victims have been identified.

Ukraine police recently successfully dismantled a criminal network involving fake cryptocurrency investment platforms. The gang is suspected of stealing funds from user wallets in more than 20 countries around the world. So far, investigators have identified 62 victims.

Modus operandi and scale

According to information jointly released by the National Police of Ukraine, the Security Bureau and the Office of the Prosecutor General, the criminal group has multiple offices in Kiev and surrounding areas and recruited more than 46 Ukraine members to participate in the operation. At its peak operating period, the network's monthly turnover was as high as US$1 million.

The gang used channels such as Telegram to use high returns as bait to attract potential investors. Victims were guided to register the website and connect to a cryptocurrency wallet to transfer money. Back-office developers then maintain the infrastructure to ensure that the platform is not blocked, while front-office employees are responsible for communicating with customers and providing technical support.

Once funds are transferred, insiders manually simulate trading activity. The asset appreciation seen by the victim on the dashboard is purely fictional and is designed to induce him to continue investing or try to withdraw cash.

"Wallet remover" carries out theft

The fraud enters the second stage when the victim attempts to withdraw funds. The operator will block withdrawals on the grounds that "additional verification procedures are needed" and require users to connect to the main wallet to approve a small test transaction to prove that the platform is operating normally.

However, this authorization triggered a malicious script built into the website (known as the "wallet remover"). The script uses user-approved permissions to transfer assets from the wallet to addresses controlled by criminal groups. This is a typical "authorization-phishing" attack that transfers tokens without obtaining the user's private key. Such tactics are similar to recent Hyperliquid-related fraud incidents, which take advantage of users 'neglect of blockchain authorizations.

In addition to stealing encrypted assets, the platform also illegally collected a large amount of sensitive personal information, including passport information, phone numbers, emails, account login credentials, passwords and photos.

Cross-border tracking and evidence fixation

Investigators used technical means to trace the location of the server and found that the data was stored in the Netherlands. Authorities obtained access to the database, which included the victim's wallet address, stolen money records, internal communication records of the gang and details of the platform's operations. This evidence helps police track cyber footprints and identify people involved in the case across multiple countries.

Large-scale arrest operation

Ukraine police carried out 34 search operations in Kiev and surrounding areas, seizing more than 100 computers and other electronic devices, more than 100 mobile phones, 79 SIM cards, and GSM gateways and other equipment. In addition, cash and related accounting records were seized and 15 cars were seized. Investigation revealed that some vehicles and properties were registered in the names of relatives of the suspects, and the main organizers were accompanied by armed bodyguards when traveling.

International background and subsequent impact

The case is part of an international crackdown on online investment fraud and cryptocurrency social engineering scams. Previously, INTERPOL had launched a number of special operations, such as Operation Jackal IV and Operation First Light, which arrested thousands of suspects around the world, intercepted hundreds of millions of dollars in illegal assets, and identified hundreds of thousands of victims.

Currently, the case is under criminal investigation in accordance with Article 190, paragraph 5 (Fraud) of the Criminal Code of Ukraine. As other people involved in the case and victims are still being traced, the final amount of the loss has not yet been announced. At the same time, Ukraine is improving its cryptocurrency processing process in criminal cases, and has previously transferred more than US$8.3 million confiscated USDTs into state-managed wallets for the first time. Experts estimate that strengthening the tracking, seizure and management rules for illegal cryptocurrencies will help Ukraine recover at least $10 billion in stolen funds and tax losses.