Brooklyn DA and FBI disrupt 241 scam domains in crypto investment fraud aimed at Russian speakers
The Brooklyn District Attorney's Virtual Currency Unit says it seized or disrupted 241 scam web domains and 112 servers used in a crypto investment scam, with the FBI's help.
Brooklyn District Attorney Eric Gonzalez announced on 14 October 2026 that his office's Virtual Currency Unit, with the help of the FBI, disrupted a multinational cryptocurrency investment scam that targeted Russian-speaking people in the United States. According to the office, 241 scam web domains were seized or disrupted and 112 servers were disrupted.
The office describes how the scam worked. Victims saw a Russian-language Facebook advertisement offering investment opportunities and were then called by a Russian-speaking person presenting as an investment advisor. The advisor coached them to open an account on a cryptocurrency investment website, buy cryptocurrency and send it to addresses linked to the platform. When victims tried to withdraw, they were locked out or told to pay extra fees and taxes. The office says the scammers later ran a recovery scam, promising to get the stolen money back.
The office says the infrastructure was tied to IP addresses in Ukraine and other Eastern European countries, and that about 400 scam domains had been seized or disrupted before this action. It estimates that tens of millions of dollars were stolen and says about $300,000 has been seized so far, with work continuing to recover more. The release does not announce criminal charges.
Why it matters to AML professionals
Crypto investment scams move victims' money from bank accounts into crypto and then to addresses the scammers control. Banks and crypto platforms are often the last chance to stop a payment or spot a victim. Follow-up recovery scams mean the same customer can be targeted twice.
Red flags in this case
- A customer making first-time crypto purchases after contact from an online investment adviser
- Repeated transfers to a crypto platform followed by requests to pay fees or taxes before a withdrawal
- A customer paying a third party who promises to recover money lost in an earlier scam
- Customers acting on instructions received by phone or messaging app from someone they met through a social media advert
If this landed in your queue
- Contact the customer to ask how they found the investment and who is guiding them
- Check the receiving crypto platform or wallet against known scam lists and blockchain analytics
- Consider delaying or stopping the payment under your firm's fraud procedures and record the conversation
- File a suspicious activity report listing the domains, wallets and payment details involved
Key terms
- Recovery scam
- A follow-up fraud in which criminals contact scam victims and charge a fee to recover lost money that is never returned.
- Domain seizure
- Law enforcement taking control of a website address so it shows a seizure notice instead of the criminal site.
Interview angle
An elderly customer wants to send more money to a crypto site so they can withdraw their profits. What do you do?
Explain that paying fees to release profits is a classic scam sign; talk to the customer, check the platform, follow fraud procedures and report suspicion.
Sources
Go deeper on AMLift
Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.
Report an error
Every report is checked against the official source. If we got something wrong, the story is corrected.