The Brooklyn District Attorney’s office has knocked a global crypto scam operation offline. The network allegedly cost Americans tens of millions of dollars.
On October 14, 2026, Brooklyn District Attorney Eric Gonzalez announced that his office had disrupted 241 fraudulent domains and 112 cloud servers tied to a multinational crypto investment fraud. A county prosecutor going after infrastructure spread across two continents is not the usual job description.
Inside the takedown
The enforcement actions happened the week before Gonzalez went public. The office’s Virtual Currency Unit, known as the VCU, carried out the operation.
The targeted infrastructure sat in Eastern Europe and the United States. Investigators worked alongside the FBI’s New York field office.
The action has been described as one of the largest cyber enforcement efforts ever carried out by a local prosecutor’s office. The case grew out of an investigation spanning roughly three years.
No arrests were announced as part of this operation. No suspects were named either.
How the scam allegedly worked
The scheme specifically targeted Russian-speaking individuals. It began with Russian-language advertisements on Facebook.
Those ads promoted crypto investment opportunities. Clicking through led victims to fake investment platforms built to look legitimate.
Then came the human touch. Victims were contacted by so-called “advisors” who pushed them to buy digital assets and transfer them onward.
The damage, by the numbers
Investigators confirmed losses in the millions of dollars within Brooklyn’s Russian-speaking community alone. Across the broader US population, losses reached tens of millions of dollars.
Those figures cover the roughly three-year span of the investigation.
A unit built for this
The operation builds on earlier work by the VCU. A prior operation from 2024 to 2025 targeted around 70 fraudulent domains and was linked to approximately $5 million in losses nationwide. An earlier strategy involved confiscating scammers’ email servers to gather victim contact lists, allowing the VCU to warn potential victims directly and limit additional losses.
The latest action extends that track record with an approach centered on infrastructure. Rather than waiting to trace stolen funds after the fact, the office went after the machinery. Domains are the bait, and servers are the hooks. Removing both is meant to cut off the supply of new victims.
What this means for investors
For everyday crypto investors, the most practical lesson is about the delivery method. This scheme did not rely on exotic hacking. It ran on social media ads, convincing websites and persuasive phone calls.
Anyone approached by an unsolicited “advisor” urging them to move crypto should treat that as a warning sign. That goes double when the opportunity first surfaced in a Facebook ad.
Still, the limits are worth noting. An infrastructure takedown disrupts an operation, but it does not necessarily end one. With no arrests or named suspects so far, the people behind the network could potentially try to rebuild under new domains.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.