Brooklyn DA seizes 241 domains in crypto investment scam

Prosecutors in New York City, working with the FBI, have taken down 241 web domains and 112 servers linked to a cryptocurrency investment fraud scheme that targeted Russian speakers in Brooklyn.

The action was announced by Brooklyn District Attorney Eric Gonzalez. In the US, a district attorney is the local public prosecutor for a county, and the Brooklyn office handles criminal cases in that borough. According to Gonzalez, the seized infrastructure was used to steal millions of dollars from victims.

Facebook ads in Russian

The case goes back three years. At that point, a large number of Russian-speaking residents of Brooklyn came to prosecutors with similar stories. Each had responded to a Russian-language Facebook ad that promised investment opportunities.

After responding, victims got a phone call from someone presenting himself as an investment adviser. This person guided them through opening cryptocurrency accounts and moving money onto investment platforms.

Problems started when victims tried to withdraw their funds. They found themselves locked out of their accounts and were told they first had to pay extra fees and taxes before they could get their money back.

The DA's office said the losses likely run into the millions. Authorities have recovered about $300,000 of the stolen funds so far.

Fake platforms and famous names

Several of the seized websites were built to look like real investment platforms. Some referred to US government agencies or to wealthy figures such as Elon Musk, which gave them an appearance of credibility.

Investigators traced the operation to IP addresses and infrastructure in Ukraine and several other Eastern European countries. Search warrants were carried out in multiple countries, which allowed law enforcement to take control of the domains and servers.

The servers held victim information, website data and the software used to run the scheme.

A second scam aimed at the same victims

The seized data also uncovered a follow-up operation. Weeks after the original fraud, the scammers would contact victims again and offer to recover their stolen cryptocurrency - for a fee.

"These criminals stole many millions of dollars from Russian-speaking victims through an elaborate investment scheme, then tried to exploit them again with false promises to recover their money," Gonzalez said.

Going after the backend

This is not the first action of its kind from the Brooklyn DA's office. Gonzalez said that over the last two years his office has disrupted and seized about 400 domains connected to cryptocurrency investment fraud.

Those efforts had limited lasting effect, as new scam sites kept appearing soon after older ones were removed. That pattern led investigators to focus on the European backend servers that powered the websites, rather than only the domains themselves.

Cryptocurrency investment fraud remains one of the most expensive scams affecting people in the US. A Treasury Department report released last month found that between September 2023 and December 2025, more than $12.7 billion was stolen from Americans through these scams, with victims in all 50 states and US territories.

Our Take

The most interesting detail here is the shift in strategy. Seizing domains is a familiar tactic, and we have seen it used recently against Chinese phishing platforms. But the Brooklyn DA's own experience shows the limits of that approach: domains are cheap, and the sites came back quickly. Taking servers that hold the software, site data and victim records suggests a more serious attempt to disrupt the operation itself, not just its storefront.

The case also shows how these schemes are tailored to specific language communities, using native-language ads and personal phone calls to build trust. The follow-up "recovery" offers are a reminder that victims often get targeted twice. Anyone who has lost money should treat unsolicited recovery offers with suspicion, and tools that check suspicious links can help before money is sent.

It is worth watching whether the server seizures lead to identified suspects or arrests, and whether the operators simply rebuild elsewhere. Given the $12.7 billion figure from Treasury, the recovered $300,000 also shows how hard it remains to get stolen crypto back.