Crypto Scam Network Seized: FBI Shuts 112 Servers and 241 Sites

US authorities dismantled an Eastern European crypto scam network that stole tens of millions from Russian-speaking Americans. The Brooklyn District Attorney’s Office and the FBI seized 112 servers and shut down 241 websites, cutting off the infrastructure that allowed the scammers to spin up new domains and contact victims.

How the Scam Operated

The network ran a front-end that mimicked legitimate investment portals. Victims were asked to transfer crypto to a wallet controlled by the operators. The site then displayed fabricated performance charts. Once the funds were in the scammers’ control, the sites disappeared, leaving victims unable to recover their assets. The operators lured victims back with false promises of refunds, further eroding trust.

Operational Breakthrough

The Brooklyn District Attorney’s Office credited its Virtual Currency Unit and the FBI with uncovering the network’s infrastructure. Seizing the servers was key because it disabled the backend that allowed the scammers to create new sites and contact victims. Assistant District Attorney Alona Katz, who led the investigation, said the team "disabled the back end of the operation." The servers were hosted by companies in Eastern Europe and the United States, indicating a transnational supply chain. By taking control of the hosting environment, authorities cut off the ability to spin up new domains or move the backend to a different host.

Market Context

The crackdown comes amid a rise in cryptocurrency-related fraud across the US. FBI figures cited by Bloomberg show Americans reported $11.4 billion in crypto fraud losses in 2025, a 22% increase from the previous year. The Brooklyn operation is one of the largest single-event takedowns in recent months.

Practical Risk for Crypto Users

The operation demonstrates that even well-publicized scams can persist if their backend infrastructure remains intact. Users who have already transferred funds to suspicious sites should monitor the status of the domain and the wallet address. If the domain is shut down, the wallet may still hold the stolen assets, but the likelihood of recovery diminishes.

What Readers Should Verify

  • Domain ownership: Check the WHOIS records of any investment site that requests crypto deposits. A mismatch between the domain registrar and the claimed company can signal a scam.
  • Wallet addresses: Verify that the wallet address matches the one displayed on the site’s official documentation. A single address used across multiple sites is a red flag.
  • Refund promises: If a site claims to refund stolen funds, confirm the claim through independent channels. Scammers often use the promise of a refund to lure victims back.

Implications for the Crypto Ecosystem

The seizure of 112 servers and shutdown of 241 sites shows that backend infrastructure is a critical choke point in crypto fraud. Regulators may use this case to push for stricter hosting and domain registration oversight. The incident also highlights the need for users to perform due diligence before transferring funds.

Open Questions

  • Legal follow-up: With no arrests made, it remains unclear whether authorities will pursue civil claims against the hosting companies or the individuals behind the servers.
  • Future tactics: Scammers may shift to new domains or use decentralized hosting solutions. Monitoring domain registration patterns could provide early warning.

Key Takeaways

  • 112 servers seized, 241 sites shut.
  • The network targeted Russian-speaking Americans and stole tens of millions.
  • Cutting off backend infrastructure is an effective tactic to disrupt crypto scams.

Explore more on this topic