Brooklyn Crypto Fraud Takedown Targets Servers Behind Repeat Scams

Brooklyn prosecutors and the FBI disrupted infrastructure behind an alleged crypto investment fraud targeting Russian speakers in the United States. The operation went beyond closing websites to seize servers holding victim information and fraud software, after earlier domain takedowns failed to stop replacement sites.

Investigators moved beyond fraudulent websites

Brooklyn authorities and the FBI seized or disrupted 241 websites and 112 servers connected to a scheme prosecutors estimate stole tens of millions of dollars. The enforcement actions took place last week following a three-year investigation, according to CoinDesk’s report. Brooklyn District Attorney Eric Gonzalez’s Virtual Currency Unit led the investigation.

The infrastructure intervention followed repeated attempts to close the network’s public-facing sites. Investigators had previously seized or disrupted 400 associated domains, but replacements continued to emerge. CoinDesk reported that authorities therefore targeted servers containing victim records and the software supporting the fraudulent platforms.

The distinction matters because removing a website does not necessarily remove the machinery behind it. Operators who retain their software and contact records can attempt to rebuild elsewhere. Disrupting those resources was the stated purpose of the broader enforcement action, rather than simply making existing investment pages inaccessible.

Investment advertisements led to withdrawal demands

According to Decrypt, victims responded to Facebook advertisements written in Russian and subsequently received calls from purported investment advisers. Those callers helped them establish accounts on supposed crypto investment platforms, purchase cryptocurrency and transfer it to addresses associated with the sites.

The platforms presented an investment experience that broke down when customers wanted their money back. Decrypt reported that withdrawal attempts after weeks or months resulted in account restrictions or demands for additional taxes and fees. Protos additionally described fabricated gains displayed to victims and characterised the advertised operation as a phony forex investment site.

These accounts describe a fraud conducted through cryptocurrency transfers, advertising and deceptive account interfaces. A displayed balance is not the same thing as assets that an account holder can withdraw. That distinction explains how an apparently profitable account could coexist with demands that victims send still more money.

Victim records supported another approach for money

The alleged operation did not end when victims discovered that their investments were inaccessible. Decrypt reported that information recovered from the servers showed subsequent approaches offering to retrieve stolen assets. These contacts came a few weeks after the original fraud, according to the district attorney’s office.

CoinDesk likewise described false recovery offers directed at people already targeted by the investment scheme. That makes the retained victim information an important part of the case, alongside the trading-platform software. The infrastructure allegedly supported both the original solicitation and renewed contact with people who had already lost money.

For affected holders, the practical distinction is between an official recovery effort and an unsolicited promise from another supposed service. The reporting establishes that recovery claims themselves formed part of this alleged network’s conduct. A new approach about missing cryptocurrency therefore does not, by itself, demonstrate that an independent recovery process exists.

The seizure totals measure disruption, not repayment

Authorities have seized about $300,000 and are pursuing further recovery, according to CoinDesk and Decrypt. Prosecutors estimate losses in the tens of millions of dollars, and said some people lost their life savings. The seized amount should therefore not be confused with a final restitution total or a complete accounting of losses.

The central operational figures describe different aspects of the investigation. Website and server totals measure infrastructure affected, while the money seized measures assets recovered so far. None of those measures establishes how much individual victims will ultimately receive.

Decrypt reported that enforcement actions spanned three time zones and involved servers hosted by companies in Eastern Europe and the United States. The reported use of infrastructure and IP addresses in Ukraine and elsewhere in Eastern Europe describes the network’s technical footprint, not a determination of every operator’s identity.

• Authorities seized or disrupted 241 websites and 112 servers.
• Investigators had previously acted against 400 associated domains.
• About $300,000 has been seized, with further recovery efforts continuing.

Reports agree on the operation but differ on arrests

The outlets broadly agree on the infrastructure totals, Russian-language targeting and fraudulent recovery approaches. Decrypt gives additional detail about the victim journey and the investigation’s duration. Protos highlights the false investment gains, while CoinDesk explains why investigators shifted their attention from domains to servers.

There is a narrower difference in the arrest reporting. Cointelegraph said no arrests were made, whereas CoinDesk said none were announced. The latter wording addresses public disclosure rather than definitively establishing whether anyone was detained.

Cointelegraph also reported, citing Bloomberg, that Assistant District Attorney Alona Katz described the action as disabling the operation’s back end. Decrypt attributed to prosecutors the assessment that server removal disrupted rapid website replacement and contact with existing victims. Those accounts explain the operational objective without establishing that every participant or associated resource has been located.

Recovery and replacement infrastructure remain the tests

The immediate follow-up is whether investigators recover additional assets and identify people responsible for running the alleged scheme. Another unresolved issue is whether replacement platforms emerge despite the server intervention. Earlier domain closures did not prevent new sites, which is why the infrastructure strategy is central to judging the operation’s lasting effect.

The case also sits within a broader investment-fraud problem. According to CoinDesk, the FBI received reports of investment-fraud losses totaling $8.65 billion in 2025, with cryptocurrency investment scams accounting for approximately 84%. That national figure is separate from the estimated losses attributed to this network.

For crypto holders and project teams, the relevant lesson is about verification rather than market direction. Investment advertisements, adviser calls and account dashboards were all alleged components of the deception. Further official announcements about asset recovery, identified operators and disrupted infrastructure will be more informative than claims made by supposed recovery intermediaries.

FAQ

What did Brooklyn prosecutors and the FBI take down?

Authorities seized or disrupted 241 websites and 112 servers associated with an alleged crypto investment scam targeting Russian-speaking victims in the United States. Investigators targeted servers after earlier actions against domains failed to prevent replacement sites.

How much money has been recovered from the alleged scam?

According to CoinDesk, efforts to recover additional funds continue after Brooklyn authorities seized approximately $300,000. Prosecutors estimate that the scheme stole tens of millions of dollars, but the reporting does not establish a final restitution amount.

How were victims targeted again after losing cryptocurrency?

According to CoinDesk and Decrypt, the scammers contacted victims a few weeks later with false offers to recover their assets. Records recovered from servers helped investigators establish that the alleged operation also included this recovery fraud.

Sources

• Protos: FBI helps smash crypto scam targeting Russian speakers in Brooklyn (2026-10-15)
• CoinDesk: How Brooklyn prosecutors and the FBI took down a massive crypto fraud network targeting Russian speakers (2026-10-15)
• Decrypt: Brooklyn Prosecutors Take Down 112 Servers Behind Crypto Scam Targeting Russian Speakers (2026-10-15)
• Cointelegraph: US authorities dismantle crypto scam network that stole tens of millions (2026-10-14)