{"investigation":{"slug":"ukrainian-fake-crypto-investment-ring-kyiv-2026","entity_name":"Ukrainian Fake Crypto Investment Ring (Kyiv, 2026)","trust_score":0,"severity_base":null,"score_modifier":-1.4,"confidence":0.92,"status":"published","content_type":"investigation","summary":"A Kyiv-based criminal network allegedly operated multiple fake cryptocurrency investment platforms that faked rising balances and then drained victims' wallets through a bogus 'test transaction', targeting victims in more than 20 countries with an estimated peak monthly turnover of up to $1 million. Ukraine's National Police, the Security Service of Ukraine (SBU) and the Office of the Prosecutor General dismantled the operation in early September 2026 through 34 searches. The alleged organizer, a 25-year-old IT specialist, reportedly recruited more than 46 Ukrainian citizens; 62 victims were identified and the pre-trial investigation is ongoing.","sections":[{"content":"Ukrainian authorities dismantled a Kyiv-based network of fake cryptocurrency investment platforms in early September 2026. The operation was a joint effort by the National Police of Ukraine (Main Investigation Department) and the Security Service of Ukraine (SBU, also rendered SSU), under the guidance of the Office of the Prosecutor General. Raids began on or around September 1, 2026; dev.ua reported 23 searches at that early stage, and the total later reported was 34 synchronized searches across Kyiv and the surrounding region. Early English-language coverage appeared from September 2 (Euromaidan Press) and September 3 (crypto.news, Crypto Times), and CoinDesk published detailed reporting on September 6, 2026. Investigators estimated the network's peak monthly turnover at up to $1 million and identified 62 victims in more than 20 countries. Servers supporting the operation were traced to the Netherlands, where investigators obtained access to databases reportedly containing victim lists, wallet addresses, amounts stolen and internal communications. The investigation was opened under Part 5 of Article 190 of the Ukrainian Criminal Code (aggravated fraud), which carries up to 12 years in prison with confiscation of property.","heading":"Operation Overview and Law Enforcement Action","sources":[{"url":"https://www.coindesk.com/business/2026/09/06/ukrainian-police-took-down-a-crypto-scam-that-stole-up-to-usd1-million-a-month","name":"Ukrainian police took down a crypto scam that stole up to $1 million a month — CoinDesk","type":"news_article","credibility":1},{"url":"https://decrypt.co/377245/ukraine-busts-kyiv-crypto-drainer-ring-moving-up-to-1m-monthly","name":"Ukraine Busts Kyiv Crypto Drainer Ring Moving Up to $1M Monthly — Decrypt","type":"news_article","credibility":2},{"url":"https://dev.ua/en/news/aitivtsi-kryptoshakhrai-iz-shchomisiachnym-oborotom-1-mln-1788255784","name":"The SBU and National Police have exposed a network of IT crypto fraudsters in Kyiv — dev.ua","type":"news_article","credibility":2},{"url":"https://crypto.news/ukraine-shuts-crypto-investment-scam-with-up-to-1m-monthly-turnover/","name":"Ukraine shuts crypto investment scam with up to $1M monthly turnover — crypto.news","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/09/03/ukraine-dismantles-crypto-fraud-network-with-62-victims-across-20-countries/","name":"Ukraine Dismantles Crypto Fraud Network With 62 Victims Across 20 Countries — Crypto Times","type":"news_article","credibility":2},{"url":"https://euromaidanpress.com/2026/09/02/ukraine-kyiv-crypto-fraud-network-eu-citizens/","name":"Ukraine says it busted a Kyiv crypto ring that drained EU citizens' wallets — Euromaidan Press","type":"news_article","credibility":2},{"url":"https://www.archynewsy.com/ukraine-busts-kyiv-crypto-ring-that-drained-eu-wallets-of-1m-monthly/","name":"Ukraine Busts Kyiv Crypto Ring That Drained EU Wallets of $1M Monthly — Archynewsy","type":"news_article","credibility":2},{"url":"https://coincentral.com/ukraine-police-bust-crypto-scam-stealing-up-to-1-million-a-month","name":"Ukraine Police Bust Crypto Scam Stealing Up to $1 Million a Month — CoinCentral","type":"news_article","credibility":2}],"severity":"critical"},{"content":"According to investigators, the network operated multiple websites designed to mimic legitimate cryptocurrency investment platforms, following a two-stage confidence-fraud playbook. First, operators advertised supposedly profitable crypto investment projects through popular Telegram channels. Victims who signed up registered accounts, connected a cryptocurrency wallet and deposited funds. Platform staff then manually fabricated trading activity, adjusting each victim's dashboard to show steadily rising balances; no actual trading or investment occurred. When victims tried to withdraw, operators blocked the requests and told them to approve a small 'test transaction' to verify the platform. Approving it allegedly gave operators covert access to the victim's connected primary wallet and triggered embedded wallet-draining code, which transferred the victim's actual holdings to wallets controlled by the network; victims were then locked out of the platform.","heading":"Alleged Scam Mechanics","sources":[{"url":"https://decrypt.co/377245/ukraine-busts-kyiv-crypto-drainer-ring-moving-up-to-1m-monthly","name":"Ukraine Busts Kyiv Crypto Drainer Ring Moving Up to $1M Monthly — Decrypt","type":"news_article","credibility":2},{"url":"https://www.cryptowisser.com/news/ukraine-busts-fake-crypto-investment-ring-scamming-20-countries/","name":"Ukrainian Police Bust International Crypto Scam With 62 Identified Victims — CryptoWisser","type":"news_article","credibility":2},{"url":"https://crypto.news/ukraine-shuts-crypto-investment-scam-with-up-to-1m-monthly-turnover/","name":"Ukraine shuts crypto investment scam with up to $1M monthly turnover — crypto.news","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/09/03/ukraine-dismantles-crypto-fraud-network-with-62-victims-across-20-countries/","name":"Ukraine Dismantles Crypto Fraud Network With 62 Victims Across 20 Countries — Crypto Times","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Authorities identified the alleged organizer as a 25-year-old IT specialist based in Kyiv; his name had not been publicly disclosed in available reporting as of September 2026. According to investigators, he recruited more than 46 Ukrainian citizens and ran several offices in Kyiv and the surrounding region. Reported roles in the network included developers and IT specialists who built and maintained the fake investment websites, technical infrastructure and embedded drainer code; phone operators and administrative staff who handled victim outreach and communications; office staff who managed dashboards and fabricated trade activity; and security personnel. Reporting also stated that suspects used premium vehicles, that assets were allegedly registered in the names of wives and relatives, and that the alleged organizer reportedly travelled with an armed escort. Decrypt and crypto.news described the physical offices, paid staff and defined roles as indicating a structured organization rather than opportunistic individual fraud. No convictions had been entered as of the announcement.","heading":"Alleged Organizer and Network Structure","sources":[{"url":"https://www.coindesk.com/business/2026/09/06/ukrainian-police-took-down-a-crypto-scam-that-stole-up-to-usd1-million-a-month","name":"Ukrainian police took down a crypto scam that stole up to $1 million a month — CoinDesk","type":"news_article","credibility":1},{"url":"https://decrypt.co/377245/ukraine-busts-kyiv-crypto-drainer-ring-moving-up-to-1m-monthly","name":"Ukraine Busts Kyiv Crypto Drainer Ring Moving Up to $1M Monthly — Decrypt","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/09/03/ukraine-dismantles-crypto-fraud-network-with-62-victims-across-20-countries/","name":"Ukraine Dismantles Crypto Fraud Network With 62 Victims Across 20 Countries — Crypto Times","type":"news_article","credibility":2},{"url":"https://crypto.news/ukraine-shuts-crypto-investment-scam-with-up-to-1m-monthly-turnover/","name":"Ukraine shuts crypto investment scam with up to $1M monthly turnover — crypto.news","type":"news_article","credibility":2}],"severity":"critical"},{"content":"In the 34 searches, law enforcement seized more than 100 computers, more than 100 mobile phones, 79 SIM cards, one GSM gateway, documents, cash and 15 vehicles. One early Ukrainian-language report instead cited 16 premium vehicles, including Porsche, BMW and Mercedes-Benz models. The disposition of seized assets and funds had not been publicly reported.","heading":"Seizures","sources":[{"url":"https://www.coindesk.com/business/2026/09/06/ukrainian-police-took-down-a-crypto-scam-that-stole-up-to-usd1-million-a-month","name":"Ukrainian police took down a crypto scam that stole up to $1 million a month — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.cryptotimes.io/2026/09/03/ukraine-dismantles-crypto-fraud-network-with-62-victims-across-20-countries/","name":"Ukraine Dismantles Crypto Fraud Network With 62 Victims Across 20 Countries — Crypto Times","type":"news_article","credibility":2},{"url":"https://www.cryptowisser.com/news/ukraine-busts-fake-crypto-investment-ring-scamming-20-countries/","name":"Ukrainian Police Bust International Crypto Scam With 62 Identified Victims — CryptoWisser","type":"news_article","credibility":2},{"url":"https://dev.ua/en/news/aitivtsi-kryptoshakhrai-iz-shchomisiachnym-oborotom-1-mln-1788255784","name":"The SBU and National Police have exposed a network of IT crypto fraudsters in Kyiv — dev.ua","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Investigators formally identified 62 victims at the time of the announcement, but said the actual victim pool was expected to be substantially larger. The network allegedly targeted victims in more than 20 countries; reporting by Decrypt, CryptoWisser and Crypto Times named Germany, Poland, Lithuania, Latvia, Spain, France, the United Kingdom, Canada and Israel among them. Euromaidan Press, citing the SBU, and dev.ua reported that the network directed particular attention toward EU citizens. The peak monthly turnover of up to $1 million was cited by authorities as indicative of scale, but the total cumulative amount stolen had not been officially calculated or disclosed.","heading":"Victims and Geographic Scope","sources":[{"url":"https://www.cryptowisser.com/news/ukraine-busts-fake-crypto-investment-ring-scamming-20-countries/","name":"Ukrainian Police Bust International Crypto Scam With 62 Identified Victims — CryptoWisser","type":"news_article","credibility":2},{"url":"https://decrypt.co/377245/ukraine-busts-kyiv-crypto-drainer-ring-moving-up-to-1m-monthly","name":"Ukraine Busts Kyiv Crypto Drainer Ring Moving Up to $1M Monthly — Decrypt","type":"news_article","credibility":2},{"url":"https://euromaidanpress.com/2026/09/02/ukraine-kyiv-crypto-fraud-network-eu-citizens/","name":"Ukraine says it busted a Kyiv crypto ring that drained EU citizens' wallets — Euromaidan Press","type":"news_article","credibility":2},{"url":"https://dev.ua/en/news/aitivtsi-kryptoshakhrai-iz-shchomisiachnym-oborotom-1-mln-1788255784","name":"The SBU and National Police have exposed a network of IT crypto fraudsters in Kyiv — dev.ua","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/09/03/ukraine-dismantles-crypto-fraud-network-with-62-victims-across-20-countries/","name":"Ukraine Dismantles Crypto Fraud Network With 62 Victims Across 20 Countries — Crypto Times","type":"news_article","credibility":2},{"url":"https://crypto.news/ukraine-shuts-crypto-investment-scam-with-up-to-1m-monthly-turnover/","name":"Ukraine shuts crypto investment scam with up to $1M monthly turnover — crypto.news","type":"news_article","credibility":2}],"severity":"high"},{"content":"The network's registration process required victims to submit personally identifying information, including passport details, photographs, phone numbers, email addresses, account login credentials and passwords. Prosecutors and law enforcement noted that this exposed victims to further fraud beyond their immediate crypto losses, including identity theft, account takeovers on legitimate cryptocurrency exchanges, phishing and credential-stuffing attacks. Whether the harvested data had been sold or passed to third parties before the takedown had not been publicly confirmed as of September 2026.","heading":"Identity Theft and Data Harvesting Risk","sources":[{"url":"https://www.coindesk.com/business/2026/09/06/ukrainian-police-took-down-a-crypto-scam-that-stole-up-to-usd1-million-a-month","name":"Ukrainian police took down a crypto scam that stole up to $1 million a month — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.cryptowisser.com/news/ukraine-busts-fake-crypto-investment-ring-scamming-20-countries/","name":"Ukrainian Police Bust International Crypto Scam With 62 Identified Victims — CryptoWisser","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/09/03/ukraine-dismantles-crypto-fraud-network-with-62-victims-across-20-countries/","name":"Ukraine Dismantles Crypto Fraud Network With 62 Victims Across 20 Countries — Crypto Times","type":"news_article","credibility":2},{"url":"https://crypto.news/ukraine-shuts-crypto-investment-scam-with-up-to-1m-monthly-turnover/","name":"Ukraine shuts crypto investment scam with up to $1M monthly turnover — crypto.news","type":"news_article","credibility":2}],"severity":"high"},{"content":"As of September 2026, the case was at the pre-trial investigation stage: no convictions had been entered, no trial dates had been set and no court proceedings had been reported. The organizer and network members are accused, not convicted, and the allegations are not adjudicated findings. Investigators said they were continuing to identify additional participants and victims and to calculate total losses. Facts not yet publicly established included the identities of the alleged organizer and other participants, the precise total losses, the domain names or branding used by the fake platforms, the full extent of the victim pool beyond the 62 confirmed cases, and the disposition of seized assets and funds.","heading":"Legal Status and Ongoing Investigation","sources":[{"url":"https://decrypt.co/377245/ukraine-busts-kyiv-crypto-drainer-ring-moving-up-to-1m-monthly","name":"Ukraine Busts Kyiv Crypto Drainer Ring Moving Up to $1M Monthly — Decrypt","type":"news_article","credibility":2},{"url":"https://dev.ua/en/news/aitivtsi-kryptoshakhrai-iz-shchomisiachnym-oborotom-1-mln-1788255784","name":"The SBU and National Police have exposed a network of IT crypto fraudsters in Kyiv — dev.ua","type":"news_article","credibility":2},{"url":"https://crypto.news/ukraine-shuts-crypto-investment-scam-with-up-to-1m-monthly-turnover/","name":"Ukraine shuts crypto investment scam with up to $1M monthly turnover — crypto.news","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/business/2026/09/06/ukrainian-police-took-down-a-crypto-scam-that-stole-up-to-usd1-million-a-month","name":"Ukrainian police took down a crypto scam that stole up to $1 million a month — CoinDesk","type":"news_article","credibility":1}],"severity":"medium"}],"timeline":[{"date":"2026-09","event":"On September 1, 2026, the SBU and National Police begin raids on the network's offices in Kyiv and the surrounding region; dev.ua reports 23 searches at that stage.","source":"dev.ua (Ukrainian-language outlet)","source_url":"https://dev.ua/en/news/aitivtsi-kryptoshakhrai-iz-shchomisiachnym-oborotom-1-mln-1788255784"},{"date":"2026-09","event":"On September 2, 2026, Euromaidan Press publishes early English-language coverage, citing an SBU statement that the network targeted EU citizens.","source":"Euromaidan Press","source_url":"https://euromaidanpress.com/2026/09/02/ukraine-kyiv-crypto-fraud-network-eu-citizens/"},{"date":"2026-09","event":"On September 3, 2026, crypto.news, Crypto Times and CoinSpectator publish reporting on the raids, citing 34 searches, 62 victims in more than 20 countries and up to $1 million in monthly turnover.","source":"crypto.news / Crypto Times","source_url":"https://crypto.news/ukraine-shuts-crypto-investment-scam-with-up-to-1m-monthly-turnover/"},{"date":"2026-09","event":"On September 6, 2026, CoinDesk publishes detailed reporting (attributed on one page to a National Police of Ukraine statement and on the other to the Security Service of Ukraine): 34 searches; more than 100 computers, more than 100 phones, 79 SIM cards and 15 vehicles seized; 62 victims identified across 20+ countries; a 25-year-old IT specialist named as alleged organizer.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/09/06/ukrainian-police-took-down-a-crypto-scam-that-stole-up-to-usd1-million-a-month"},{"date":"2026-09","event":"On September 6, 2026, Decrypt publishes a detailed account of the wallet-draining mechanism (test-transaction approval triggering embedded drainer code), the Netherlands servers, and the harvesting of victims' passport data and passwords at registration.","source":"Decrypt","source_url":"https://decrypt.co/377245/ukraine-busts-kyiv-crypto-drainer-ring-moving-up-to-1m-monthly"},{"date":"2026-09","event":"crypto.news and other outlets report the 34 raids across the Kyiv region and seizures of 100+ computers, 100+ phones, 79 SIM cards, 15 vehicles and cash, and investigators' access to servers in the Netherlands (dated September 6, 2026 on one source page).","source":"crypto.news","source_url":"https://crypto.news/ukraine-shuts-crypto-investment-scam-with-up-to-1m-monthly-turnover/"},{"date":"2026-09","event":"The Security Service of Ukraine confirms the peak monthly turnover estimate of about $1 million and identifies a 25-year-old IT specialist as the alleged lead organizer who recruited more than 46 Ukrainian citizens (dated September 7, 2026 on one source page).","source":"crypto.news (citing SSU statement)","source_url":"https://crypto.news/ukraine-shuts-crypto-investment-scam-with-up-to-1m-monthly-turnover/"}],"sources_used":[{"url":"https://www.coindesk.com/business/2026/09/06/ukrainian-police-took-down-a-crypto-scam-that-stole-up-to-usd1-million-a-month","name":"Ukrainian police took down a crypto scam that stole up to $1 million a month — CoinDesk","type":"news_article","archive_url":"https://web.archive.org/web/20260916010303/https://www.coindesk.com/business/2026/09/06/ukrainian-police-took-down-a-crypto-scam-that-stole-up-to-usd1-million-a-month","credibility":1},{"url":"https://decrypt.co/377245/ukraine-busts-kyiv-crypto-drainer-ring-moving-up-to-1m-monthly","name":"Ukraine Busts Kyiv Crypto Drainer Ring Moving Up to $1M Monthly — Decrypt","type":"news_article","archive_url":"http://web.archive.org/web/20260904045303/https://decrypt.co/377245/ukraine-busts-kyiv-crypto-drainer-ring-moving-up-to-1m-monthly","credibility":2},{"url":"https://www.cryptowisser.com/news/ukraine-busts-fake-crypto-investment-ring-scamming-20-countries/","name":"Ukrainian Police Bust International Crypto Scam With 62 Identified Victims — CryptoWisser","type":"news_article","archive_url":"https://web.archive.org/web/20260912211522/https://www.cryptowisser.com/news/ukraine-busts-fake-crypto-investment-ring-scamming-20-countries/","credibility":2},{"url":"https://www.archynewsy.com/ukraine-busts-kyiv-crypto-ring-that-drained-eu-wallets-of-1m-monthly/","name":"Ukraine Busts Kyiv Crypto Ring That Drained EU Wallets of $1M Monthly — Archynewsy","type":"news_article","archive_url":"https://web.archive.org/web/20260912211218/https://www.archynewsy.com/ukraine-busts-kyiv-crypto-ring-that-drained-eu-wallets-of-1m-monthly/","credibility":2},{"url":"https://crypto.news/ukraine-shuts-crypto-investment-scam-with-up-to-1m-monthly-turnover/","name":"Ukraine shuts crypto investment scam with up to $1M monthly turnover — crypto.news","type":"news_article","archive_url":"http://web.archive.org/web/20260903150041/https://crypto.news/ukraine-shuts-crypto-investment-scam-with-up-to-1m-monthly-turnover/","credibility":2},{"url":"https://dev.ua/en/news/aitivtsi-kryptoshakhrai-iz-shchomisiachnym-oborotom-1-mln-1788255784","name":"The SBU and National Police have exposed a network of IT crypto fraudsters in Kyiv — dev.ua","type":"news_article","archive_url":"https://web.archive.org/web/20260912210722/https://dev.ua/en/news/aitivtsi-kryptoshakhrai-iz-shchomisiachnym-oborotom-1-mln-1788255784","credibility":2},{"url":"https://euromaidanpress.com/2026/09/02/ukraine-kyiv-crypto-fraud-network-eu-citizens/","name":"Ukraine says it busted a Kyiv crypto ring that drained EU citizens' wallets — Euromaidan Press","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/09/03/ukraine-dismantles-crypto-fraud-network-with-62-victims-across-20-countries/","name":"Ukraine Dismantles Crypto Fraud Network With 62 Victims Across 20 Countries — Crypto Times","type":"news_article","archive_url":"http://web.archive.org/web/20260903124518/https://www.cryptotimes.io/2026/09/03/ukraine-dismantles-crypto-fraud-network-with-62-victims-across-20-countries/","credibility":2},{"url":"https://coincentral.com/ukraine-police-bust-crypto-scam-stealing-up-to-1-million-a-month","name":"Ukraine Police Bust Crypto Scam Stealing Up to $1 Million a Month — CoinCentral","type":"news_article","archive_url":"https://web.archive.org/web/20260924124802/https://coincentral.com/spot-bitcoin-etfs-extend-streak-as-80k-holds/","credibility":2,"archive_timestamp":"2026-09-24T12:48:02+00:00"}],"source_tags":[],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-09-12T17:22:36.732802+00:00","updated_at":"2026-10-27T06:52:54.039+00:00"},"source_quality":{"total":9,"tier1":0,"tier2":2,"tier3":0,"unrated":7},"follower_count":null,"content_updated_at":"2026-10-27T06:52:54.734Z","last_fact_checked_at":"2026-10-27T06:52:54.405Z","fact_check_next_allowed_at":"2026-11-03T06:52:54.405Z","update_next_allowed_at":"2026-11-03T04:26:01.712Z"}