Brooklyn DA, FBI disrupt 112 servers behind Russian-language crypto fraud network

The Brooklyn District Attorney's Office, led by DA Eric Gonzalez, and the FBI disrupted a crypto investment fraud network targeting Russian speakers, seizing or disrupting 112 servers and 241 websites following a three-year investigation by the DA's Virtual Currency Unit. The action, announced the week of October 13, 2026 and reported by CoinDesk and Decrypt, targeted the infrastructure rather than individuals. Prosecutors estimate tens of millions of dollars stolen; about $300,000 has been seized so far. No arrests were announced.

How the scheme worked

• Lead generation: Russian-language Facebook ads promising investment opportunities drew victims onto landing pages controlled by the scheme.
• Advisory contact: fake "investment advisers" called victims and coached them to buy cryptocurrency and transfer it to fraudulent trading platforms the ring operated.
• Fake dashboards: the platforms simulated returns on-screen while funds were already out of the user's reach.
• Second-wave fraud: weeks later, the same victims were re-contacted by "recovery" scammers from the same network, offering to retrieve the stolen funds for a fee — a known predatory follow-on.

Gonzalez's quote in CoinDesk's version: scammers "tried to exploit them again with false promises to recover their money."

What was disrupted

• Servers: 112 seized or disrupted.
• Domains: 241 websites.
• Jurisdiction: Brooklyn District Attorney's Office (state), partnering with the FBI (federal). Neither EN write-up names Homeland Security Investigations or the Secret Service, which usually appear in multi-agency crypto takedowns of this size.
• Investigation duration: three years, by the DA's Virtual Currency Unit.
• Seized funds: about $300,000 to date. The decentralized architecture of the scheme means most proceeds have already moved through mixers or off-ramps.

What the public filings do not include

• No defendants named. No arrests were announced.
• No criminal charges listed. The action is described as a disruption of infrastructure, not an indictment.
• No block explorer evidence. CoinDesk and Decrypt do not publish wallet clusters, mixer routes, exchange on-ramps or specific tx hashes used by the ring.
• No timeframe for the fraud itself beyond the three-year investigation window.

The gap between "tens of millions stolen" and "$300,000 recovered" is the operative figure. Fraud rings of this shape typically funnel through chain-hopping across Tron (USDT), Ethereum (USDT, USDC) and increasingly through non-custodial swap aggregators; the public release does not identify the stablecoins or routes used here.

What to watch

1. A superseding indictment. Server seizures without arrests are often prepositioning for a later indictment of operators abroad. Whether Brooklyn files one, and against whom, is the signal that distinguishes an operational disruption from a prosecutable case.
2. Treasury OFAC action. If the ring is linked to a sanctioned Russian cybercrime group, OFAC designations and SDN additions would follow and are the standard second step. Nothing has been published yet.
3. Victim restitution channel. Of the $300,000 recovered, how much is accessible to victims via the Brooklyn DA's asset forfeiture process. US state-level recoveries rarely return more than a single-digit percentage.
4. Chainalysis / TRM reports. The private-sector attribution firms typically publish a technical write-up on networks of this size within weeks. Those tend to carry the wallet clusters the DA release omits.
5. Russian-language Facebook ad targeting controls. Meta's enforcement of its own crypto-investment advertising policy in Russian-language markets is the upstream choke point. Whether Meta publishes a parallel takedown would show whether this was a coordinated action.

Context

Brooklyn's Virtual Currency Unit has been one of the more active US state-level crypto prosecutors. CoinDesk notes the office has brought prior crypto-fraud cases, though specific case counts and totals are not published in either write-up. The pattern of language-specific affinity fraud — targeting Russian speakers here, previously Chinese ("pig-butchering") and Korean networks — is the dominant retail crypto fraud shape of the current cycle. Prior coverage on this site includes the FBI's September disclosure that "pig-butchering" losses crossed $5.6B in 2024 and the Treasury-led seizures tied to Southeast Asian compounds.