The district attorney's Virtual Currency Unit had already seized or disrupted 400 cryptocurrency fraud domains before this operation, and new sites kept replacing them. The office says it has recovered about $300,000 of an estimated tens of millions of dollars.
Brooklyn District Attorney Eric Gonzalez said on Wednesday that his office's Virtual Currency Unit had seized and disrupted 241 cryptocurrency investment scam domains and a cluster of 112 servers, in an operation carried out with the FBI's New York field office last week. The office described it as one of the largest cyber enforcement actions taken by a local prosecutor.
The servers, rather than the websites, were the escalation. Before last week the unit had already seized or disrupted 400 domains tied to cryptocurrency investment fraud. Those earlier seizures were effective at warning people who landed on the pages, the office said, because a law enforcement notice replaces the site, a tactic the FBI has also used to gather information on people visiting a seized domain. New scam websites then appeared quickly in their place.
So the unit went after the infrastructure behind the pages. The office said the cluster of 112 cloud servers, hosted by companies in Eastern European countries and the United States, held the data that populated the domains, victim information and the operators' software. Taking it offline is meant to strip the operation of both its ability to create replacement websites and its means of contacting people it had already defrauded.
"Our groundbreaking Virtual Currency Unit identified the fraud, tracked the stolen cryptocurrency, broke new ground by uncovering the infrastructure behind the operation, and worked with the FBI to dismantle it," Gonzalez said in the announcement.
Investigators from the unit, which Assistant District Attorney Alona Katz leads, executed search warrants and took other enforcement actions across three time zones over several hours last week, according to the office, which has been investigating the operation for three years. The infrastructure and IP addresses the operators relied on sat in Ukraine and other Eastern European countries.
The scam itself followed one sequence, which the unit said it heard repeatedly from a cluster of Russian-speaking victims in Brooklyn. A victim answered a Facebook advertisement in Russian offering investment opportunities. A caller describing himself as an investment advisor followed up, also in Russian, and talked the victim through opening an account on a cryptocurrency investment platform website. With the advisor's help the victim bought cryptocurrency and sent it to addresses linked to those websites. After weeks or months of what looked like investing, the victim tried to make a withdrawal and was either locked out of the account or told that further fees and taxes were due first.
Data recovered from the servers also showed the operators running a second scheme against the same people, the office said: a recovery scam that contacted victims a few weeks after the original deception, promising to get the stolen assets back.
The office said the contents of the seized servers confirmed the losses suffered by Russian-speaking victims in Brooklyn and elsewhere in the country, which makes the seized hardware a source of evidence on losses as well as a disruption target.
Brooklyn is home to a large Russian-speaking population, and the office said the scheme hit the borough disproportionately hard compared with the rest of the country. It estimates that tens of millions of dollars were taken in total, with some victims losing their entire life savings. That figure is the office's own estimate, and it has published no victim count. For scale, the FBI's annual internet crime report recorded $11.4 billion in reported cryptocurrency fraud losses across the United States in 2025, of which investment scams accounted for $7.2 billion.
Against that, the recovery is small. The office said it has seized about $300,000 of the stolen funds so far and is working to claw back more.
"This case is a prime example of what can be done through the power of our partnerships with state, local, and international law enforcement," said James C. Barnacle, the assistant director in charge of FBI New York.
The announcement names no suspects and reports no arrests or charges, which sets it apart from operations such as the April takedown of nine scam centers in Dubai that produced at least 276 arrests. What a local prosecutor could reach in this case was the hosting layer, and alongside the FBI the office thanked three private companies, Shadow Server, Coeus and UltaHost, for their assistance and cooperation.
