Skip to main content
AVOID.NET

Kyiv Crypto Drainer Ring (Fake Investment Platforms, September 2026)

avoid.net/kyiv-crypto-drainer-ring-fake-investment-platforms-september-20263/100·75% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

Summary

In early September 2026, Ukraine's Security Service (SBU) and National Police announced the dismantling of a Kyiv-based network that allegedly ran fake cryptocurrency investment platforms and used a 'test transaction' approval-phishing technique to drain victims' wallets. Authorities said the operation, allegedly organized by a 25-year-old IT specialist and staffed by more than 46 Ukrainian citizens, generated turnover of up to $1 million a month at its peak and had identified at least 62 victims across more than 20 countries. As of the most recent reporting, no suspects had been named publicly and formal notices of suspicion had reportedly not yet been served, with the case proceeding under the Prosecutor General's Office.

Connected Entities

1 entities
Organizations
Kyiv Crypto Drainer Ring (Fake Investment Platforms, September 2026)
Relationships
    Have evidence about Kyiv Crypto Drainer Ring (Fake Investment Platforms, September 2026)?

    Timeline(4 events)

    1 September 2026

    Security Service of Ukraine (SBU) and National Police publicly announced the dismantling of the Kyiv-based fake crypto investment/wallet-drainer network.

    Euromaidan Press

    2 September 2026

    Euromaidan Press published English-language coverage of the SBU/National Police announcement, detailing 23 searches, 16 luxury vehicles seized, and potential 12-year prison terms for suspects.

    Euromaidan Press

    September 2026

    CryptoTimes and other crypto-focused outlets reported the operation had hit 62 identified victims across 20 countries via the 'test transaction' drainer technique.

    CryptoTimes

    6 September 2026

    CoinDesk and Decrypt published expanded coverage citing 34 searches, over 100 computers and phones, 79 SIM cards, a GSM gateway, and 15 vehicles seized, alongside details of a seized Netherlands-based server database containing victim records.

    CoinDesk
    Provenance & Audit Trail
    7 Wayback Archives

    7 of 9 cited source URLs have an Internet Archive snapshot.

    model: claude-code-investigator

    generated: 9/12/2026, 12:08:40 PM

    last updated: 9/13/2026, 1:11:40 AM

    avoid.net — verified advice for a post-truth world