Brooklyn DA and FBI pull 241 sites and 112 servers out of a crypto scam aimed at Russian speakers — $300,000 recovered, no arrests

Brooklyn prosecutors and the FBI seized or disrupted 241 websites and 112 servers last week in a takedown of a crypto investment-fraud network that allegedly stole tens of millions of dollars from Russian-speaking people in the United States. The action followed a three-year investigation, Brooklyn District Attorney Eric Gonzalez said in remarks reported by both CoinDesk and Protos. So far authorities have seized about $300,000. No arrests were announced.

How the scheme worked

The mechanics described by Gonzalez's office follow a well-worn "pig-butchering" pattern, localized for a specific community. Victims were drawn in through Russian-language social-media advertising — CoinDesk describes Facebook ads "that promised investment opportunities," while Protos describes "Russian-tailored ads" steering people to a "phony forex investment site." The two accounts differ on the exact pitch (generic crypto investing versus a forex-trading front); both agree the ads were language-targeted and promised substantial returns.

People who responded were then contacted by fake "advisers" who coached them to buy cryptocurrency and move it onto fraudulent trading platforms. The platforms displayed fabricated gains. When victims tried to withdraw, their accounts were locked or they were told to pay additional "taxes" or "fees" to release the money, according to both outlets.

The part that distinguishes this network is the second bite. After the initial theft, the operators came back — "a few weeks after the initial fraud," per data investigators recovered, cited by CoinDesk — posing as recovery services and promising to retrieve the stolen funds for victims they had already cleaned out. Gonzalez said the scammers "tried to exploit them again with false promises to recover their money."

Why the servers, not just the sites

This was not the DA's first pass at the problem. Gonzalez's Virtual Currency Unit had previously seized or disrupted 400 domains tied to crypto investment fraud, CoinDesk reported — but replacement sites kept reappearing. The strategy this time was to go after the back end: the 112 servers, hosted by companies in Eastern Europe and the US, that stored victim data and ran the fraud software. The infrastructure and IP addresses traced to Ukraine and other Eastern European countries. Targeting the servers rather than only the front-end domains was intended to stop operators from spinning up new sites as fast as old ones were pulled.

Protos quoted the operation being described as "one of the biggest operational cyber disruptions undertaken by a local prosecutor's office." The attribution for that characterization is not specified in either account.

The scale, in the FBI's own numbers

The case lands against a backdrop the FBI quantified in its annual report. Per CoinDesk's reading of that report, crypto investment scams accounted for roughly 84% of the $8.65 billion in investment-fraud losses reported to the bureau in 2025. Crypto-linked losses across all internet-crime categories totaled $11.37 billion — about 54% of the $20.88 billion overall. CoinDesk noted explicitly that "both percentages are calculated from the FBI's totals," i.e. the outlet derived the ratios from the bureau's dollar figures rather than quoting them directly.

Key facts

• 241 websites and 112 servers seized or disrupted in an operation carried out last week (CoinDesk; Protos — Protos refers to the 241 as "domains").
• ~$300,000 seized so far; prosecutors say some victims lost their entire life savings (CoinDesk; Protos).
• Tens of millions of dollars allegedly stolen from Russian-speaking victims in the US (CoinDesk; Protos).
• Three-year investigation; infrastructure and IP addresses traced to Ukraine and other Eastern European countries; servers hosted by Eastern European and US companies (CoinDesk).
• No arrests announced (CoinDesk).
• 400 domains previously seized or disrupted by the DA's Virtual Currency Unit, which kept being replaced (CoinDesk).
• Recovery re-targeting: operators contacted victims again roughly a few weeks after the first theft (CoinDesk, citing recovered data).
• FBI 2025 report: crypto scams ≈84% of $8.65B in reported investment-fraud losses; crypto-linked losses ≈$11.37B, ≈54% of $20.88B total internet-crime losses — ratios calculated by CoinDesk from FBI totals.

The real-world read

The honest framing here is disruption, not dismantlement. "Seized or disrupted" is doing real work in the announcements: taking down domains and servers is not the same as arresting the people running them, and the releases confirm no arrests. The DA's own track record is the tell — the Virtual Currency Unit knocked out 400 domains before and the sites kept coming back, which is precisely why this round targeted servers. That's a smarter tactic, but it's an admission that front-end takedowns alone hadn't worked. Whether going after the back end sticks any better is unproven.

The money math is sobering and worth stating plainly: against "tens of millions" allegedly stolen, about $300,000 has been recovered — on the order of a few cents on the dollar at best. Officials say they are working to recover more, but nothing in the announcements suggests victims should expect to be made whole. With operators and IP infrastructure sitting in Ukraine and Eastern Europe and no one in custody, the practical reach of a Brooklyn prosecutor is limited.

A note on the numbers readers will see quoted elsewhere: the eye-catching "84% of investment-fraud losses" and "54% of all internet-crime losses" figures were derived by CoinDesk from the FBI's dollar totals, not stated as percentages by the bureau — CoinDesk says so itself. The underlying dollar figures are the FBI's; the percentages are a secondary calculation. Treat them as such.

Two things that bled into these write-ups deserve flagging. First, the CoinDesk page carried a clearly sponsored item — "Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins," promising "5–7% yield" and a growing "$4B" market — which is marketing, not reporting, and has nothing to do with this case. The irony of a yield-promising ad appearing beside a story about yield-promising fraud is not lost on us; we mention it only to be clear which is which. Second, Protos appended an unrelated sidebar about FBI Director Kash Patel and Russia optics, which is editorial commentary tangential to the takedown and not evidence about this network.

Finally, what isn't said: no indictment, no named defendants, no breakdown of how many victims or how the "tens of millions" figure was arrived at, and no detail on which hosting companies cooperated. These are open questions, not confirmed facts.

Opinion, and whose

• That this ranks among "the biggest operational cyber disruptions undertaken by a local prosecutor's office" is a characterization reported by Protos; the party making the claim is not identified, and it should be read as framing, not a measured fact.
• The implicit theory that attacking servers (rather than domains) will slow the reconstitution of these scams is the DA's office's operating rationale, per CoinDesk. It is a reasonable bet, not a demonstrated outcome.

Sources

• CoinDesk (Tier 2, secondary), "How Brooklyn prosecutors and the FBI took down a massive crypto fraud network targeting Russian speakers," 2026-10-15 — primary reporting of the takedown, the 241/112 and $300,000 figures, the three-year investigation, the recovery re-targeting, and the FBI annual-report statistics (with the explicit note that the percentages were calculated from FBI totals). The same page also carried a sponsored/marketing item on "Productive Stablecoins" yields, unrelated to this story and flagged here as marketing.
• Protos (Tier 2, secondary), "FBI helps smash crypto scam targeting Russian speakers in Brooklyn," 2026-10-15 — corroborates the 241 domains / 112 servers, the $300,000 seizure, the forex-site framing, and the recovery-scam pattern; attributes the "one of the biggest" characterization. Includes an unrelated editorial sidebar on FBI Director Kash Patel and Russia, not used here.
• Primary sources cited by the above: statements from Brooklyn DA Eric Gonzalez and his Virtual Currency Unit, and the FBI's 2025 annual internet-crime report (for the loss totals).

This is news reporting, not financial or legal advice; nothing here is a recommendation to buy, sell, or use any product or service.