FBI and Brooklyn Prosecutors Seize 112 Servers in Crypto Investment Scam Crackdown

241 Sites Offline, 112 Servers Seized

Brooklyn prosecutors and the FBI have taken down the online infrastructure of a cryptocurrency investment scam that pulled tens of millions of dollars from US residents, most of them Russian speakers. The action was carried out last week and announced publicly on Wednesday, October 14. The scheme aimed squarely at Russian-speaking communities inside the United States, a focus that reflects how fraud groups exploit language-based trust networks. Investigators shut down 241 websites and seized 112 servers hosted at providers in Eastern Europe and the United States, according to the announcement from the District Attorney’s Office. No arrests have been made. Prosecutors described the server seizures, rather than arrests, as the operation’s core measure against the group. District Attorney Eric Gonzalez said the operation’s victims, mostly Russian speakers, lost “many millions of dollars” to an elaborate investment scheme before being targeted a second time with “false promises to recover their money.” He credited his office’s Virtual Currency Unit and the FBI with tracing the scam’s backend. Alona Katz, the assistant district attorney who led the investigation, put the outcome in plain terms: the operation “disabled the back end.” The seized machines sat at commercial hosting firms on two continents, which allowed the group to run its fraud sites and victim outreach from infrastructure that looked routine from the outside. Taking the servers offline was decisive because it cut off the ability to open new domains and to contact people who had already lost money. The case reflects an infrastructure-first approach to crypto enforcement: instead of waiting for arrests or a trial, prosecutors went after the hosting layer that kept the operation alive day to day.

Recovery Fraud and $11.4 Billion in Losses

The scheme worked in two stages, according to investigators. Victims first handed over money against promised investment returns, a pitch that in this sector often borrows the language of products such as contract trading or managed accounts. Once the funds were gone, the same operators came back posing as recovery specialists and demanded fresh payments with assurances that the original losses could be won back. Recovery scams of this shape rely on a simple asymmetry: the victim knows the first loss is real, so an offer to reverse it feels plausible, and every extra payment deepens the commitment. The two-stage structure also explains why the takedown targeted servers rather than accounts: the recovery stage required staying in contact with past victims, and the servers carried that contact. The takedown lands amid a broader rise in cryptocurrency fraud across the United States. FBI figures show Americans reported $11.4 billion in crypto fraud losses in 2025, a 22% increase over the previous year. Money collected in operations of this kind typically moves fast through accounts at a crypto exchange, which makes the trail harder to follow and helps explain why prosecutors have shifted weight toward the servers and domains that make a fraud run. In this case the seizure stopped the operators from opening new websites or reaching existing victims again. Prosecutors did not put a precise figure on the amount taken, describing the theft only as tens of millions of dollars. That vagueness is typical at the infrastructure stage of a case, when money tracing is still underway. Two questions the announcement leaves open: how much stolen money can be recovered, and whether charges will follow against the people who ran the network.

What stands out in this operation is what it did not do: nobody was arrested. An infrastructure seizure buys time, but operators who remain free can rent new servers and rebuild a web presence within weeks, which makes a follow-on indictment or another round of hosting seizures the next data point to watch. The announcement is also silent on whether proceeds were laundered through a crypto mixer, so the financial trail stays unpublished for now. The 22% climb in reported losses points in the same direction: long-con investment fraud, unlike a one-shot lure such as a fake airdrop, keeps victims engaged for months, and that relationship is exactly what the recovery pitch monetizes. Charges, if they come, would land in a separate track.