TLDR
- Ukrainian police shut down a network of fake crypto investment platforms targeting users in over 20 countries
- The scam used hidden “drainer” code to steal funds once users connected their wallets
- The operation pulled in up to $1 million a month and had at least 62 confirmed victims
- A 25-year-old IT specialist led the scheme, recruiting over 46 Ukrainians across multiple Kyiv offices
- Police seized 100+ computers, 100+ phones, cash, and 15 vehicles during 34 searches
Ukrainian authorities have taken down a network of fake cryptocurrency investment platforms that allegedly stole digital assets from victims across more than 20 countries. The operation is estimated to have generated up to $1 million a month.
LATEST: 🚨 Ukrainian police busted a Kyiv-based crypto drainer ring accused of stealing up to $1M a month by tricking victims into signing malicious wallet-draining transactions. pic.twitter.com/EpgLJH40fd
— CoinMarketCap (@CoinMarketCap) September 4, 2026
How the Scam Worked
The platforms showed users fake account balances that appeared to grow over time. Operators manually adjusted these balances to make victims believe their investments were performing well.
When users tried to withdraw their money, the platforms asked them to connect their main crypto wallets. Hidden “drainer” code inside the websites then used that access to move funds automatically to wallets controlled by the scammers.
More disturbing news with the state of law enforcement are coming from 🇺🇦Ukraine.
The photo depicts a safe of a top prosecutor, Serhiy Kropiva, Head of the Cyber Crime Department at the Office of the Prosecutor General (OPG) of Ukraine, who ran an organised criminal ring… pic.twitter.com/H5k7NShc2o
— Dovydas Vitkauskas (@Dovydas44444) September 5, 2026
Once the transfer was complete, victims were locked out of the platform entirely.
Beyond crypto theft, the sites also collected personal data during registration. Operators gathered passport details, phone numbers, email addresses, passwords and photographs.
That data could potentially be used in other types of fraud, investigators said.
The Investigation
The Security Service of Ukraine (SBU) and the National Police identified a 25-year-old IT specialist as the lead organizer. He reportedly recruited more than 46 Ukrainian citizens and ran several offices in Kyiv and the surrounding region.
Staff roles within the operation were divided. Some workers built and maintained the fake websites, others contacted potential victims, and some handled office management or security.
A key breakthrough came when authorities traced server equipment used by the group to the Netherlands. They gained access to a database stored there containing victim lists, crypto wallet addresses, stolen amounts and internal communications.
Those records helped investigators rebuild the full picture of how the scheme worked.
Victims came from Germany, Poland, Lithuania, Latvia, Spain, France, the United Kingdom, Canada, Israel and other countries. Investigators have so far confirmed 62 victims, though the actual number is believed to be higher.
Raids and Seizures
Police carried out 34 searches across Kyiv and the surrounding region. They seized more than 100 computers, more than 100 phones, 79 SIM cards, documents, cash and 15 vehicles.
A separate report noted that 16 luxury cars, including Porsche, BMW and Mercedes-Benz models, were among the items seized.
Authorities searched 23 offices and homes during the operation.
The investigation remains open under Ukraine’s fraud laws. Police are still working to identify more people involved, locate additional victims and calculate the total amount of cryptocurrency stolen.
No suspects have been publicly named at this stage.
