# Brooklyn crypto scam takedown targets 241 domains Author: KriptoMeta Editorial Team Language: English Published: 2026-10-15T15:37:45+03:00 Updated: 2026-10-16T14:02:12+03:00 ![A disconnected network cabinet representing disruption of crypto scam infrastructure](https://kriptometa.com/uploads/kripto-dolandiriciligina-operasyonda-alan-adi-hedef-alindi-49a5ad0cad1c_article.webp) ## Key takeaways - The operation took place last week and was announced on October 14. - Authorities seized or disrupted 241 domains and 112 servers. - Estimated losses run into tens of millions of dollars; about $300,000 has been seized. A three-year investigation led authorities to the servers behind fraudulent investment sites. Prosecutors say the same organization later approached victims again, promising to recover their stolen money. Brooklyn prosecutors say an operation supported by the FBI seized or disrupted 241 domains and 112 servers used in a cryptocurrency investment scam. According to the [district attorney’s October 14 announcement](https://www.brooklynda.org/2026/10/14/brooklyn-das-virtual-currency-unit-dismantles-infrastructure-of-multinational-crypto-investment-scam-that-targeted-russian-speakers/), the network targeted Russian-speaking people across the United States, with Brooklyn residents disproportionately affected. The office’s Virtual Currency Unit, or VCU, had investigated the organization for three years. Search warrants and other enforcement actions were carried out last week across three time zones within a few hours. The announcement did not give the operation’s exact date. ## An investment ad led to blocked withdrawals Victims described responding to a Russian-language investment advertisement on Facebook. A Russian-speaking caller posing as an investment adviser would then guide them through opening an account on a fraudulent investment website, buying cryptocurrency and transferring it to [wallet addresses](https://kriptometa.com/en/glossary/wallet-address) linked to the platform. Impersonating a trusted person or service to obtain payments is a form of [phishing](https://kriptometa.com/en/glossary/phishing). After weeks or months of supposed investing, people who tried to withdraw their money were locked out or told to pay additional fees and taxes. Prosecutors estimate that tens of millions of dollars were stolen. Some victims lost their entire life savings. **About $300,000 has been seized.** That amount does not cover the estimated total losses. The office says it is working to recover more assets; it has not announced a distribution to victims or a firm repayment timetable. ## Investigators moved from domains to servers Before the latest operation, VCU had already seized or disrupted 400 domains associated with cryptocurrency investment fraud. New scam sites nevertheless appeared quickly. Investigators then identified the supporting servers and coordinated an international takedown with the FBI. The cloud servers were hosted by companies in Eastern Europe and the United States. Prosecutors say the organization relied on infrastructure and IP addresses in Ukraine and other Eastern European countries. The action sought to deny access to the websites’ underlying data, victim information and operational software. ## A second approach promised to recover the money Recovered data also revealed a cryptocurrency recovery scam run by the same organization. Victims were contacted again a few weeks after the initial deception and told their stolen assets could be recovered. A link in an advertisement or an address supplied by a caller does not independently verify the service. Our [guide to checking fake sites and phishing requests](https://kriptometa.com/en/crypto-phishing-fake-token-checks) explains how to compare domains through a separate source and avoid unsolicited “recovery specialists” when seeking help. [Brooklyn district attorney’s operation announcement of October 14, 2026](https://x.com/BrooklynDA/status/2110442752635011352)