Ukrainian police took down a crypto scam that stole up to $1 million a month

The balances on the screen kept climbing.

For users of a group of websites now under investigation in Ukraine, they took that to mean their investments were growing.

Their climbing balances, however, were just building up a false sense of security. When it came time to withdraw, things changed.

According to Ukrainian authorities, when the would-be investors attempted to withdraw their money, these platforms asked users to connect their main crypto wallets. When that access came, they were used to approve what appeared to be a small test transaction.

Suddenly, their money was gone.

Ukrainian authorities said the operation leveraged a crypto “drainer” hidden inside the websites, so access to the users’ wallets automatically moved their funds to wallets under the operators’ control.

Once the funds were transferred, the victim was locked out of the platform. Ukrainian police said they shut down the network, which allegedly targeted people in over 20 countries. Investigators have so far identified 62 victims and the Security Service of Ukraine (SBU) said the operation’s turnover could reach $1 million a month.

The fake gains displayed before the theft were part of the scheme. Police said operators manually created transactions and adjusted users’ account balances to make it appear that their investments were growing.

The platforms weren’t just after crypto. During registration and identity checks, the operators collected passport information, phone numbers, email addresses, login details, passwords and photographs, police said.

That gave the alleged scheme access to digital assets and personal information that could potentially be used in other forms of fraud.

Investigators say the lead organizer, a 25-year-old IT specialist, recruited more than 46 Ukrainian citizens and operated several offices in Kyiv and the surrounding region. Technical workers built and maintained the fake sites and worked to keep them online. Other staff contacted potential victims, managed the offices or provided security.

Police said victims came from Germany, Poland, Lithuania, Latvia, Spain, France, the U.K., Canada, Israel and other countries.

Infrastructure clues

A major break in the investigation came from infrastructure outside Ukraine.

Authorities traced server equipment used by the group to the Netherlands and obtained access to a database stored there. The records included lists of victims, crypto wallet addresses, amounts allegedly stolen, internal communications and information about how the fake platforms operated.