A major joint operation in Kyiv by the National Police of Ukraine and the State Security Service led to the dismantling of a highly structured criminal organization specialized in creating fake financial investment platforms. This clandestine network operated like a legitimate business, led by a 25-year-old IT specialist supported by more than forty-six associates and protected by armed guards. At the peak of its fraudulent activity, this infrastructure managed to embezzle up to one million dollars per month from individual investors.
The modus operandi combined traditional social engineering with sophisticated technical mechanisms specific to Web3. Victims were initially lured through aggressive advertising campaigns on the Telegram messaging app. Once registered on the fake portals, targets observed fictitious returns manually altered by the cybercriminals. The trap was sprung during withdrawal requests: the scammers used technical verification as a pretext, requiring the connection of the main crypto wallet and the validation of a seemingly harmless transaction. In reality, this signature activated a drainer-type malware, authorizing the automated transfer of all tokens to the organization's addresses.
The scope of the damage is international, with at least sixty-two identified victims spread across more than twenty countries, including France, Germany, the United Kingdom, and Canada. The law enforcement intervention resulted in 34 searches, leading to the seizure of more than a hundred computers, dozens of mobile devices, network equipment, luxury vehicles, and cash. The recovery of central servers based in the Netherlands also provided investigators with complete operation logs. The suspects now face up to twelve years in prison for organized fraud.
This case illustrates the increasing professionalization of threats facing the digital asset sector. By exploiting users' lack of knowledge regarding permissions granted to smart contracts, cybercriminals manage to bypass the theoretical security of self-custody. For the crypto ecosystem, this case highlights the absolute necessity of raising investor awareness about the risks of signing unknown transactions, while demonstrating the effectiveness of cross-border police cooperation against decentralized financial crimes.