Ukraine arrests four suspects in crypto investment scam call-center ring that defrauded 135 Germans of €4.3M
Ukrainian police arrested four members of a cryptocurrency investment scam ring, including its organizer, after an investigation run by the Cyber Police Department of the National Police with the Main Investigation Department and German law enforcement. The group allegedly took more than €4.3 million from 135 German victims by posing as brokers and luring them into fraudulent online trading platforms. Its operators worked by phone and messaging apps and, in some cases, reached victims' online banking accounts. The suspects are in pre-trial detention and face up to 12 years in prison if convicted. The threat is financial fraud against individuals rather than a software flaw, so the takedown weakens one ring but does not remove the wider call-center scam market.
Detalhes técnicos
- Lure and social engineering: victims are approached through social media, dating sites and messaging apps, then steered into fake investments (article). The operators presented themselves as brokers and financial advisers and used controlled pseudo-broker platforms over IP telephony (incrypted.com).
- Account and asset takeover: after building trust, the group helped victims open accounts on cryptocurrency exchanges, buy digital assets and send them to addresses it controlled (article, incrypted.com).
- Laundering: the proceeds moved through bank accounts, cryptocurrency exchanges and transit wallets, were converted and were split among members (article).
- Investigation: the case is called Operation "Trade" and was run by a joint investigation team with German authorities (incrypted.com, 112.ua). The first stage in August 2026 involved 39 searches in Kyiv and in the Kyiv, Vinnytsia, Zaporizhzhia and Ivano-Frankivsk regions; the September stage added 17 searches (incrypted.com).
- Seizures: nearly 600,000 UAH (roughly $13,000), more than $90,000, mobile phones, hardware crypto wallets, SIM cards and computer equipment (article).
- Charges: fraud by a criminal organization and creating, leading or joining such an organization, under Part 4 of Article 28, Part 4 of Article 190 and Parts 1 and 2 of Article 255 of the Criminal Code of Ukraine (incrypted.com). The pre-trial investigation continues and police are looking for further victims (incrypted.com).
- Conflicting detail: the article says all four detainees are in pre-trial detention. incrypted.com reports that the court ordered pre-trial detention for the organizer and three accomplices, while a fifth co-organizer was placed under house arrest (incrypted.com). The article's account is the more recent one, but the court-level detail comes only from incrypted.com, and no Cyber Police primary release was available to check it.
Remediação
No vendor or authority guidance on defensive measures was found in the research. For defenders, the practical points are to warn customers about impersonated brokers and fake trading platforms, and to watch for crypto purchases followed by transfers to new wallets and for remote access to online banking.
Linha do tempo
-
Ukraine arrests four suspects in crypto investment scam call-center ring that defrauded 135 Germans of €4.3M
ler a análise desta fonte ocultar
Ukrainian police arrested four members of a cryptocurrency investment scam ring, including its organizer, after an investigation run by the Cyber Police Department of the National Police with the Main Investigation Department and German law enforcement. The group allegedly took more than €4.3 million from 135 German victims by posing as brokers and luring them into fraudulent online trading platforms. Its operators worked by phone and messaging apps and, in some cases, reached victims' online banking accounts. The suspects are in pre-trial detention and face up to 12 years in prison if convicted. The threat is financial fraud against individuals rather than a software flaw, so the takedown weakens one ring but does not remove the wider call-center scam market.
Technical Details
- Lure and social engineering: victims are approached through social media, dating sites and messaging apps, then steered into fake investments (article). The operators presented themselves as brokers and financial advisers and used controlled pseudo-broker platforms over IP telephony (incrypted.com).
- Account and asset takeover: after building trust, the group helped victims open accounts on cryptocurrency exchanges, buy digital assets and send them to addresses it controlled (article, incrypted.com).
- Laundering: the proceeds moved through bank accounts, cryptocurrency exchanges and transit wallets, were converted and were split among members (article).
- Investigation: the case is called Operation "Trade" and was run by a joint investigation team with German authorities (incrypted.com, 112.ua). The first stage in August 2026 involved 39 searches in Kyiv and in the Kyiv, Vinnytsia, Zaporizhzhia and Ivano-Frankivsk regions; the September stage added 17 searches (incrypted.com).
- Seizures: nearly 600,000 UAH (roughly $13,000), more than $90,000, mobile phones, hardware crypto wallets, SIM cards and computer equipment (article).
- Charges: fraud by a criminal organization and creating, leading or joining such an organization, under Part 4 of Article 28, Part 4 of Article 190 and Parts 1 and 2 of Article 255 of the Criminal Code of Ukraine (incrypted.com). The pre-trial investigation continues and police are looking for further victims (incrypted.com).
- Conflicting detail: the article says all four detainees are in pre-trial detention. incrypted.com reports that the court ordered pre-trial detention for the organizer and three accomplices, while a fifth co-organizer was placed under house arrest (incrypted.com). The article's account is the more recent one, but the court-level detail comes only from incrypted.com, and no Cyber Police primary release was available to check it.
Remediation
No vendor or authority guidance on defensive measures was found in the research. For defenders, the practical points are to warn customers about impersonated brokers and fake trading platforms, and to watch for crypto purchases followed by transfers to new wallets and for remote access to online banking.