Ukrainian police have shut down a network of fake investment platforms and identified 62 victims in more than 20 countries. The theft was triggered by the victims themselves.
Each platform showed clients their balances growing, then blocked withdrawals. To supposedly verify the system was working, users were asked to connect their main wallet and approve a test transaction for a minimal amount, which handed the operators access instead.
Ukraine’s National Police said that investigators from its Main Investigation Department, working with the Security Service of Ukraine under the procedural guidance of the Prosecutor General’s Office, dismantled the network after accessing a database stored on servers in the Netherlands, and identified 62 victims across more than 20 countries.
The withdrawal request was the trigger. Victims who tried to take money out of the fake platforms were told the system needed checking first and asked to approve a small test transaction.
Approving it did not move a small sum. According to Ukraine’s National Police, it granted the operators access to the wallet, after which a drainer embedded in the site emptied it automatically, and the victim was locked out of their account.
How the Scheme Worked
Users were invited to register on a platform, connect a crypto wallet, and transfer funds for what were presented as investment projects. Participants then manually simulated financial transactions, displaying growing balances in each client’s personal account.
When a user attempted to withdraw, the option was blocked. To supposedly verify that the platform was working, they were asked to connect their main wallet and confirm a test transaction for a minimal amount.
Police say the operators used a drainer, a concealed mechanism built into the site. Believing they were approving a small transfer, users were in fact granting access to their wallet. The drainer then moved the assets automatically to wallets the suspects controlled, and the victim’s access to the platform was blocked.
Personal Data Was Collected Alongside the Funds
During registration and verification, the operators also gathered clients’ personal information. Police list passport details, phone numbers, email addresses, passwords, logins, and photographs.
That collection is separate from the theft itself and leaves victims exposed after the fact, since the same credentials often unlock exchange accounts and email. The Crypto Times has previously reported on drainer infrastructure, which the Ethereum Foundation and Security Alliance have been working to disrupt, and on drainer campaigns run through fake advertisements.
The Organization Behind It
According to investigators, the organizer recruited more than 46 Ukrainian citizens and set up several fraudulent offices in Kyiv and the surrounding region.
IT specialists built and maintained the fake investment sites, kept them running, and protected them from being blocked. Other participants administered the offices, spoke with prospective victims, and handled security.
Police say the suspects used premium-class vehicles and that some cars and property were registered in the names of their wives and other relatives. The organizer moved with an armed escort.
A Database in the Netherlands
Investigators located server equipment in the Netherlands on which the suspects stored a database and obtained access to it. Police say it contained lists of victims, their wallet addresses, the amounts stolen, internal correspondence between participants, and details of how the fake platforms operated.
Analysis of that data allowed investigators to document the mechanism in detail and identify the victims. Among them are citizens of Germany, Poland, Lithuania, Latvia, Spain, France, the United Kingdom, Canada, and Israel.
Searches and Seizures
Police carried out 34 searches across Kyiv and the Kyiv region, at suspects’ homes, at the fraudulent offices, and in vehicles.
Seizures included more than one hundred computers, more than one hundred mobile phones, 79 SIM cards, a GSM gateway, documents, draft notes, cash, and 15 vehicles.
The pre-trial investigation continues under Part 5 of Article 190 of Ukraine’s Criminal Code, covering fraud. Police say they are still establishing the full circle of those involved, further victims, and the total value of the losses, which has not yet been stated.
The operation follows a separate crackdown in July in which Ukrainian police dismantled a network of fraudulent crypto exchanges across seven regions, seizing more than UAH 20 million in cash. In April, US authorities seized 503 fake investment websites built on the same model of displaying fabricated returns to victims who had deposited crypto.
