Ukraine: This network of fake crypto platforms stole up to $1 million per month!

One million dollars a month, without ever placing a single order. The Ukrainian national police and the SBU, the country's security service, announced the dismantling of a network of fake investment platforms operated from Kiev. Sixty-two victims have already been identified in more than twenty countries, including France, Germany, Spain, the United Kingdom, Poland, Canada, and Israel. At the head of the operation was, according to the authorities, a 25-year-old computer scientist surrounded by armed guards. More than 46 people had been recruited to operate several offices in the Ukrainian capital and its region.

Key Points

• The Ukrainian police and the SBU dismantled a network of fake crypto investment platforms in Kiev, with 62 victims identified in over 20 countries.
• Led by a 25-year-old computer scientist and supported by more than 46 employees, the network generated up to $1 million per month.
• The trap relied on a fake "test transaction" that activated a drainer and emptied the victim's main wallet.
• 34 searches, over 100 computers, 79 SIM cards, and 15 vehicles seized; prosecutions could lead to twelve years in prison.

Fake investments operated from offices in Kiev

According to official sources, the organization operated like a real business. Developers created the platforms and kept them online despite attempts to block them. Other employees handled calls, clients, or office security. At the height of its activity, the network reportedly diverted up to one million dollars per month, according to the SBU.

The recruitment of victims began on Telegram, with ads touting supposedly highly profitable crypto projects. Interested individuals created an account, connected a wallet, and transferred funds that were supposed to be invested.

No real operations were actually executed. Employees manually modified the dashboards to display rising balances and give the impression that investments were generating profits.

The registration and verification process also allowed the group to collect personal data: copies of passports, photographs, phone numbers, email addresses, usernames, and passwords.

The test transaction that allowed wallets to be drained

The trap closed when clients requested to withdraw their money. Withdrawals were then blocked under various pretexts. To resolve the issue, the victim had to connect their main wallet and approve a small "test transaction" presented as a simple technical verification.

This validation actually granted the malicious system integrated into the site the ability to transfer assets to addresses controlled by the group. Once the funds were moved, the victim also lost access to their account on the fake platform.

Investigators found servers in the Netherlands containing the organization's database. This database listed victims, their wallet addresses, the amounts stolen, internal correspondence, and detailed information about the operation of the sites.

During 34 searches conducted in Kiev and its region, authorities seized over 100 computers, more than 100 phones, 79 SIM cards, a GSM gateway, cash, and 15 vehicles. Several cars and assets had been registered in the names of the wives or relatives of the suspects.

Prosecutions have been initiated based on part 5 of article 190 of the Ukrainian Penal Code, dedicated to frauds committed by organized groups or on a very large scale. The investigation continues to identify other participants, locate new victims, and establish the total amount of diverted funds.

The case shows how a classic financial scam can be adapted to cryptocurrencies. Fake returns serve to build trust, but the final theft only occurs when the victim themselves validates an operation presented as harmless. In such situations, the sudden blocking of a withdrawal followed by a request to connect to a second wallet constitutes an immediate warning signal, but evidently, the victims did not know this.