Ukrainian authorities shut down a Kyiv-based crypto scam that allegedly siphoned up to $1 million a month from investors in more than 20 countries, the National Police and Security Service announced.
Investigators have identified 62 victims so far, spread across more than 20 countries. Germany, Poland, Lithuania, Latvia, Spain, France, the UK, Canada and Israel are among them, according to the National Police. More than 46 Ukrainians were recruited into the network. Authorities said they are still identifying additional participants.
A 25-year-old Kyiv IT specialist organized the ring, the Security Service of Ukraine (SBU) said. Monthly turnover hit $1 million at its peak.
The operation began with crypto investment ads on Telegram. Users who responded were told to connect a wallet and deposit funds. Once the money landed, employees manually simulated fake gains on the platforms’ dashboards. Every account looked profitable. The returns were not real.
Withdrawals were blocked. Victims who tried to cash out were instructed to connect their primary wallet and approve a “small test transaction.” That approval was the trap. A wallet drainer used it to move assets to addresses the group controlled, crypto.news reported.
A single click granted the drainer full wallet access. The same approval-phishing technique appeared in August, when a Hyperliquid user lost roughly 550,000 USDC to a fake Google-ad site tied to the Inferno drainer, crypto.news noted.
Registration on the fake platforms collected passport copies, phone numbers, emails, logins, passwords and photographs. Investigators traced the group’s servers to the Netherlands and obtained the full database. It contained victim lists, wallet addresses, stolen amounts and internal correspondence among the group.
The National Police’s Main Investigation Department ran the case alongside the SBU and the Office of the Prosecutor General. Officers carried out 34 searches across Kyiv and the surrounding region. They seized more than 100 computers, more than 100 mobile phones, 79 SIM cards, a GSM gateway, cash and 15 vehicles, the National Police said.
Some cars and real estate were registered under the names of suspects’ wives and relatives. The alleged organizer traveled with armed guards.
Criminal proceedings were opened under Part 5 of Article 190 of Ukraine’s Criminal Code, which covers fraud. No total loss figure has been disclosed. The investigation is continuing.
The bust comes as Ukrainian authorities push to trace and recover stolen crypto. In June, Ukraine moved more than $8.3 million in seized USDT to a state-managed wallet. It was the first reported placement of confiscated crypto assets under state management, crypto.news reported. A Royal United Services Institute estimate cited by both crypto.news and Yellow suggests stronger oversight could help Ukraine recover up to $10 billion in stolen funds and lost tax revenue.
The fake dashboards showed profits. The real wallets did not.
Still unknown: the aggregate amount stolen, the identities of the suspects, and whether any funds have been recovered. Police have not said how many people were arrested or formally charged.
