Brooklyn: 241 Fake Crypto Sites Aimed at Russian Speakers Shut Down

The advert appeared in a Facebook feed, in Russian. It promised strong returns from cryptocurrency, and in many cases it came with a video of Elon Musk urging people to invest. The video was a deepfake, a computer-made fake of his face and voice. A few days after someone clicked, the phone rang. A friendly "investment adviser" was on the line, speaking Russian, ready to help open an account.

For three years that phone call reached hundreds of Russian-speaking Americans, many of them in the Brooklyn neighbourhoods of Brighton Beach, Sheepshead Bay, Midwood and Borough Park. On Wednesday 14 October 2026 the Brooklyn District Attorney, Eric Gonzalez, announced that his office and the FBI had pulled the plug on the machine behind it. In an operation carried out the week before, investigators seized or disrupted 241 scam websites and 112 servers, the computers that ran them. No one has been arrested.

"These criminals stole many millions of dollars from Russian-speaking victims through an elaborate investment scheme, then tried to exploit them again with false promises to recover their money," Gonzalez said. His office estimates that tens of millions of dollars were taken, with some victims losing their entire life savings. About $300,000 has been seized so far.

How the con worked

The pattern was the same each time, according to the District Attorney's office. The victim answered a Russian-language Facebook advert. A Russian-speaking "adviser" called back and coached them through opening an account on what looked like a professional trading platform. Under the adviser's guidance the victim bought cryptocurrency, digital money that can be sent anywhere in the world in minutes, usually through a real exchange, which works much like a stockbroker for crypto. The victim then sent the coins to an address controlled by the platform.

The platform was fake. It was a website showing a balance that went up, like a brokerage statement printed by the broker's own forger. Victims "invested" for weeks or months, often adding more as their imaginary profits grew. When they asked to withdraw, they were locked out, or told they first had to pay fees and taxes. Those payments vanished too.

This is the scheme known as pig butchering, named after the farmer's habit of fattening the pig before slaughter. Most pig butchering starts with a wrong-number text or a dating app. This network went straight to paid adverts, aimed at a single language community, and used a shared accent and culture to win trust quickly. Brooklyn has an estimated 120,000 Russian speakers, according to The Record, which is why the scam hit the borough harder than anywhere else.

The second robbery

The servers held a nasty surprise. Data recovered by investigators showed the same operators were also running a recovery scam. A few weeks after the first theft, victims were contacted again by people offering to get their stolen crypto back, for a fee. It was the same gang selling the cure for the injury it had caused.

Recovery scams are common because the victims are easy to find: the scammers already have their names, phone numbers and a record of how much they were willing to pay. Every genuine law enforcement agency gives the same advice. Nobody legitimate charges an upfront fee to return stolen crypto.

Three years of whack-a-mole

The case began in October 2023, when the District Attorney's new Virtual Currency Unit, set up by Gonzalez that year, started getting regular complaints from Russian-speaking residents about losses of thousands of dollars. The unit is led by Assistant District Attorney Alona Katz.

In June 2024 the office announced its first big seizure: 70 linked scam domains, the web addresses the fake platforms lived on. That release identified more than 20 Brooklyn victims aged 35 to 75, most of them over 50, who reported individual losses from $18,000 to more than $117,000. New York victims had lost more than $1 million, and Russian-speaking victims in California, Maryland, Washington, Nebraska, Florida, Illinois, South Carolina and Pennsylvania another $4 million. The websites shared the same login page, the same hosting company and the same domain registrar, the company that rents out web addresses.

In December 2024 the unit seized another 70 domains and tried something new. It took control of the web-based mail server the fake advisers used, pulled out the contact list and emailed about 1,200 people, warning them that "advisers" writing from stocks-finance.com addresses were scammers. The office said it was the first time this kind of server had been seized in such a probe.

A related case in June 2025, run with the New York Attorney General, Letitia James, and the New York State Department of Financial Services (DFS), showed how the adverts were paid for. That investigation began when DFS spotted a site called WhalesTrade.com displaying a fake BitLicense, the New York crypto licence. Prosecutors said the scammers used more than $1 million of stolen crypto to pay "Black Hat" advertisers based in Vietnam, people who place adverts Facebook would otherwise block. One converted victims' Bitcoin into Vietnamese currency to buy more ads. Meta, Facebook's owner, shut down more than 700 accounts tied to the advertiser, the Attorney General froze about $300,000 and the District Attorney seized $140,000. More than 300 victims were identified in that case. The DA's releases describe the same playbook but do not say the 2025 and 2026 cases were the same gang.

By last week the unit had seized or disrupted about 400 domains in total. The problem, the office admitted, was that new sites "popped up quickly".

©CMZ chart. Data: Brooklyn District Attorney

Why the servers matter

Seizing a domain is like taking down a shop sign. With a court order, the registrar points the web address to a law enforcement notice instead of the fake platform. That warns anyone still sending money: in 2024 several victims called the DA's office mid-transfer after seeing the notice. But the gang can simply rent a new address and put the same site back up within hours.

The servers are the shop itself. They held the website content, the victim lists and the software that ran the operation. Investigators traced them, and the IP addresses (a computer's address on the internet) the gang used, to Ukraine and other Eastern European countries, hosted by Eastern European and American companies. Over several hours across three time zones, the Virtual Currency Unit executed search warrants and, with the FBI's New York field office, took down more than 100 cloud servers at once. The office thanked the FBI, the nonprofit security group Shadowserver, the firm Coeus and the hosting company UltaHost.

"We disabled the back end of the operation," Katz told Bloomberg. Without the servers, the gang cannot quickly spin up new sites or reach the victims already on its books. James C. Barnacle, who heads the FBI's New York office, said the DA's office "got to the bottom of the plot".

What the operation did not do is catch anyone. The people behind it are believed to be abroad, beyond easy reach of a Brooklyn courtroom, and the money has largely been cashed out overseas. That is why the office has said, since 2024, that its strategy is disruption and warning rather than recovery.

The bigger picture

Brooklyn is a small corner of a very large problem. Americans reported $11.4 billion in crypto fraud losses to the FBI in 2025, a 22% rise on the year before, with more than 18,000 people reporting losses above $100,000, Bloomberg reported. A Treasury Department report in September 2026 put losses to crypto investment scams between September 2023 and December 2025 at more than $12.7 billion, The Record said.

The District Attorney's advice is plain: no investment advice from anyone not met in person, no trading apps downloaded from unknown websites, a licence check with DFS for any crypto company operating in New York, and never a payment to recover lost money. Brooklyn residents can report scams to the DA's office, and anyone in the US can report to the FBI's Internet Crime Complaint Center at ic3.gov.