FBI and Brooklyn Prosecutors Seize 112 Servers in Crypto Investment Scam Crackdown

Update 12:51 UTC: The infrastructure seizure came as the FBI's annual internet crime report put crypto at roughly 84% of the $8.65 billion in investment-fraud losses reported in 2025, with crypto-linked losses across all categories totaling $11.37 billion.

241 Sites Offline, 112 Servers Seized

Brooklyn prosecutors and the FBI have taken down the online infrastructure of a cryptocurrency investment scam that pulled tens of millions of dollars from US residents, most of them Russian speakers. The action was carried out last week and announced publicly on Wednesday, October 14. The scheme aimed squarely at Russian-speaking communities inside the United States, a focus that reflects how fraud groups exploit language-based trust networks. Investigators shut down 241 websites and seized 112 servers hosted at providers in Eastern Europe and the United States, according to the announcement from the District Attorney’s Office. No arrests have been made. Prosecutors described the server seizures, rather than arrests, as the operation’s core measure against the group. District Attorney Eric Gonzalez said the operation’s victims, mostly Russian speakers, lost “many millions of dollars” to an elaborate investment scheme before being targeted a second time with “false promises to recover their money.” He credited his office’s Virtual Currency Unit and the FBI with tracing the scam’s backend. Alona Katz, the assistant district attorney who led the investigation, put the outcome in plain terms: the operation “disabled the back end.” The seized machines sat at commercial hosting firms on two continents, which allowed the group to run its fraud sites and victim outreach from infrastructure that looked routine from the outside. Taking the servers offline was decisive because it cut off the ability to open new domains and to contact people who had already lost money. The case reflects an infrastructure-first approach to crypto enforcement: instead of waiting for arrests or a trial, prosecutors went after the hosting layer that kept the operation alive day to day.

Two details from the DA’s office add texture to the operation. Investigators executed search warrants across three time zones over several hours, and the seized systems held website content, victim information and the software running the fraud. The unit had already taken down or disrupted 400 domains tied to crypto investment fraud before this action, but replacement sites kept appearing, which is why prosecutors moved up to the hosting layer this time. The entry point, according to prosecutors, was Russian-language Facebook ads, followed by calls from Russian-speaking “advisers” who walked victims through buying crypto and transferring it to platform addresses; withdrawals were then blocked or conditioned on extra fees and taxes. About $300,000 in stolen funds has been seized so far, with tracing work ongoing. The operation capped a three-year investigation.

Further details from the DA's office add context to the takedown's scale: prosecutors called it one of the largest cyber enforcement actions the office has ever carried out, and DA Eric Gonzalez said that disabling more than 100 servers and hundreds of fraudulent sites struck at the "core" of the criminal network, making it far harder for the operators to victimize new targets. FBI New York's James C. Barnacle said the bureau's specialists worked alongside the Kings County District Attorney's Office to map the scheme and take down more than a hundred domains. The announcement also follows a separate Brooklyn case from last year, in which a man posing as crypto exchange customer support stole nearly $16 million from roughly 100 victims; he has pleaded guilty and was recently sentenced to up to 12 years in prison.

Data pulled from the seized servers confirmed the recovery stage in detail: weeks after the initial fraud, the same operators contacted victims again with promises to return their stolen assets, the DA's office said. The scam hit Brooklyn's large Russian-speaking population disproportionately, and investigators said some victims lost their entire life savings after the Facebook ad response and subsequent coaching from a so-called investment advisor. The unit's three-year investigation showed why the hosting layer mattered: even after 400 prior domain seizures, replacement scam websites kept appearing. The office has recovered about $300,000 of the estimated tens of millions stolen so far and is working to claw back more.

The DA's office described the takedown as one of the biggest operational cyber disruptions ever undertaken by a local prosecutor's office, and the FBI's role in mapping the network's infrastructure, which sat on IP addresses in Ukraine and elsewhere in Eastern Europe, was central to the action. The scam sites presented themselves as forex investment platforms, showing victims fabricated gains before locking withdrawals and demanding extra payments. The infrastructure seizure came as the FBI's annual internet crime report put crypto at roughly 84% of the $8.65 billion in investment-fraud losses reported in 2025, with crypto-linked losses across all categories totaling $11.37 billion.

Recovery Fraud and $11.4 Billion in Losses

The scheme worked in two stages, according to investigators. Victims first handed over money against promised investment returns, a pitch that in this sector often borrows the language of products such as contract trading or managed accounts. Once the funds were gone, the same operators came back posing as recovery specialists and demanded fresh payments with assurances that the original losses could be won back. Recovery scams of this shape rely on a simple asymmetry: the victim knows the first loss is real, so an offer to reverse it feels plausible, and every extra payment deepens the commitment. The two-stage structure also explains why the takedown targeted servers rather than accounts: the recovery stage required staying in contact with past victims, and the servers carried that contact. The takedown lands amid a broader rise in cryptocurrency fraud across the United States. FBI figures show Americans reported $11.4 billion in crypto fraud losses in 2025, a 22% increase over the previous year. Money collected in operations of this kind typically moves fast through accounts at a crypto exchange, which makes the trail harder to follow and helps explain why prosecutors have shifted weight toward the servers and domains that make a fraud run. In this case the seizure stopped the operators from opening new websites or reaching existing victims again. Prosecutors did not put a precise figure on the amount taken, describing the theft only as tens of millions of dollars. That vagueness is typical at the infrastructure stage of a case, when money tracing is still underway. Two questions the announcement leaves open: how much stolen money can be recovered, and whether charges will follow against the people who ran the network.

What stands out in this operation is what it did not do: nobody was arrested. An infrastructure seizure buys time, but operators who remain free can rent new servers and rebuild a web presence within weeks, which makes a follow-on indictment or another round of hosting seizures the next data point to watch. The announcement is also silent on whether proceeds were laundered through a crypto mixer, so the financial trail stays unpublished for now. The 22% climb in reported losses points in the same direction: long-con investment fraud, unlike a one-shot lure such as a fake airdrop, keeps victims engaged for months, and that relationship is exactly what the recovery pitch monetizes. Charges, if they come, would land in a separate track.