Ukraine's National Police and Security Service (SBU) say they have shut down a network of fake investment platforms, run from Kyiv, that drained cryptocurrency from victims across more than 20 countries — a wallet-drainer operation that allegedly turned over up to $1 million a month at its peak.
How the Scheme Worked
According to the agencies, the group advertised supposedly profitable crypto projects on Telegram and signed users up through websites built to look like investment platforms. Victims connected wallets and sent funds for what they were told were investment projects; staff then faked trading by hand, displaying climbing balances on each customer's dashboard.
When victims asked to withdraw, the requests were blocked. To "verify" the platform worked, victims were told to connect their main wallet and approve a small test transaction. That approval fed a drainer built into the site, which moved the assets to wallets the group controlled and locked the victim out.
Investigators have identified 62 victims so far, including citizens of Germany, Poland, Lithuania, Latvia, Spain, France, the UK, Canada, and Israel.
The Takedown
Officers traced server equipment in the Netherlands holding the group's database and gained access to it. The data listed victims and their wallet addresses, the sums taken, internal correspondence, and operational records of the platforms. Registration and verification forms had also harvested passport details, phone numbers, email addresses, logins, passwords, and photographs.
Police conducted 34 searches across Kyiv and the surrounding region, seizing more than 100 computers, more than 100 phones, 79 SIM cards, a GSM gateway, cash, and 15 cars — some registered to suspects' relatives.
The Allegations
The SBU described the organizer as a 25-year-old IT specialist who recruited more than 46 Ukrainians and ran several offices in the Kyiv region, with developers keeping the platforms online against blocking attempts and staff working the phones. The organizer, according to the agency, moved with armed guards.
The case is proceeding under Part 5 of Article 190 of Ukraine's criminal code, which covers fraud on a particularly large scale. Police say they are still identifying everyone involved, additional victims, and the total sum stolen. No convictions have been recorded, and the figures above remain law-enforcement allegations pending proceedings.
The takedown follows Ukraine's move in June to place more than $8.3 million in seized USDT under state management — the first time confiscated crypto had been managed by the state there — as the country builds machinery for handling crypto-crime proceeds.
TrustGrade covers the enforcement and security-tooling ecosystem. For verified trust data on the projects and firms shaping it, see trustgrade.ai.