Loading story…
European law enforcement agencies arrested nine individuals suspected of operating a large-scale cryptocurrency investment fraud network that defrauded victims of over €600 million. The suspects allegedly created dozens of fake cryptocurrency investment platforms, luring victims with promises of high returns through social media ads, cold calls, and fabricated celebrity endorsements. Once funds were transferred, victims were unable to recover their money, while the criminals laundered the stolen assets using blockchain technology. The coordinated operation, led by Eurojust and involving authorities from France, Belgium, Cyprus, Spain, and Germany, resulted in simultaneous arrests and searches in Cyprus, Spain, and Germany, with significant seizures of cash, cryptocurrencies, and bank assets.
The investigation revealed that the network used sophisticated methods to conceal the origins of the stolen funds, cycling them through various wallets and exchanges. Authorities seized €800,000 in bank accounts, €415,000 in cryptocurrencies, and €300,000 in cash during the raids. The operation underscores the growing threat of organized cybercrime leveraging fake investment platforms to target individuals across Europe, and highlights the importance of international cooperation in combating large-scale financial fraud in the cryptocurrency sector.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
During the European operation, authorities seized significant assets connected to the fraud and laundering network. The seizures were part of the broader dismantling of the criminal organization.
Europol and Eurojust, working with national authorities, carried out a coordinated operation in Cyprus, Spain, and Germany that led to the arrest of nine suspects linked to the crypto fraud and money laundering network. The action also disrupted the infrastructure supporting the scheme.
A criminal network defrauded victims worldwide of more than €600 million using fake cryptocurrency investment platforms. The scheme was promoted through social media, cold calls, and fabricated endorsements, while laundering methods were used to hide the proceeds.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Austrian and Albanian authorities, supported by **Europol** and **Eurojust**, dismantled a large online investment fraud operation that allegedly stole at least **€50 million** from victims across Europe and other regions. The network operated from call centers in **Tirana, Albania**, where investigators said it was run like a legitimate business with up to **450 employees** spanning management, finance, IT, HR, customer acquisition, and retention roles. Victims were lured through fake broker and cryptocurrency investment platforms promoted on search engines, websites, and social media, then pressured by multilingual operators posing as brokers or advisers to transfer more money. A coordinated action on **17 April** led to **10 arrests**, searches of **three call centers** and **nine homes**, and the seizure of **€891,735 in cash** along with hundreds of computers and phones. Investigators said the group used remote access software and an international money-laundering scheme to divert funds rather than invest them, and in some cases targeted victims a second time with a bogus recovery service that demanded a **€500** cryptocurrency payment. Authorities said the seized infrastructure and data are expected to support additional investigations in other affected countries.
Jul 3, 2026
Dutch police said they dismantled an international investment fraud operation that allegedly used fake cryptocurrency trading platforms and bogus financial advisers to steal from victims worldwide. Investigators said the network had operated since at least 2021 through roughly 20 to 24 call centers in multiple countries, with more than 700 staff persuading targets to invest and then showing fictitious profits to induce additional payments. Authorities linked at least 550 fraud reports and about **$28.6 million** in reported losses to the group, while estimating victims in the Netherlands alone lost nearly **€25 million** and that tens of thousands of people may have been affected globally. Authorities made multiple arrests across several countries and identified a 46-year-old Israeli-Polish suspect as a central figure in the scheme. The suspect, described as a well-known hacker, was arrested in Poland on May 26 and extradited to the Netherlands; investigators allege he played a key technical and organizational role in helping the group conceal identities, mask call-center locations, and evade law enforcement. Dutch investigators said they traced IP addresses, financial routes, and other digital evidence to map the organization’s infrastructure, and believe the operation at one point generated more than **€100 million per month**.
Jul 18, 2026
Law enforcement agencies across multiple countries have conducted significant operations targeting cybercriminal groups responsible for large-scale financial fraud, data breaches, and cryptocurrency theft. In Spain, police arrested a 19-year-old hacker accused of stealing and attempting to sell 64 million personal data records from nine companies, while Ukrainian authorities apprehended a separate data broker who used custom malware to compromise accounts and sell access on hacker forums. In California, a member of the so-called "Social Engineering Enterprise" pleaded guilty to laundering millions in cryptocurrency stolen through sophisticated social engineering attacks, with the group responsible for a $263 million heist and extravagant spending of the proceeds. Meanwhile, Russian police dismantled a gang that used NFCGate-based malware to steal millions from bank customers by tricking victims into installing fake banking apps and harvesting card credentials for remote theft. A major international operation led by Europol and Eurojust dismantled a €700 million cryptocurrency scam network in Europe that used deepfake videos and aggressive marketing to lure victims into fake investment schemes. The network operated numerous fraudulent platforms, laundered funds through complex channels, and was taken down in coordinated raids across several countries, resulting in arrests and the seizure of cash, cryptocurrencies, and luxury items. These actions highlight the growing sophistication of cyber-enabled financial crime and the increasing collaboration between law enforcement agencies to disrupt such operations on a global scale.
Jun 29, 2026