3 days ago2 min readSummaryUkrainian authorities said a network of fake investment platforms targeted crypto users in more than 20 countries.Investigators have identified 62 victims so far and say more than 46 Ukrainians took part in the operation.The sites used hidden wallet-draining software that could move crypto after users approved what looked like a small test transaction.The balances on the screen kept climbing.For users of a group of websites now under investigation in Ukraine, they took that to mean their investments were growing.Their climbing balances, however, were just building up a false sense of security. When it came time to withdraw, things changed.According to Ukrainian authorities, when the would-be investors attempted to withdraw their money, these platforms asked users to connect their main crypto wallets. When that access came, they were used to approve what appeared to be a small test transaction.Suddenly, their money was gone.Ukrainian authorities said the operation leveraged a crypto “drainer” hidden inside the websites, so access to the users’ wallets automatically moved their funds to wallets under the operators’ control.Once the funds were transferred, the victim was locked out of the platform. Ukrainian police said they shut down the network, which allegedly targeted people in over 20 countries. Investigators have so far identified 62 victims and the Security Service of Ukraine (SBU) said the operation’s turnover could reach $1 million a month.The fake gains displayed before the theft were part of the scheme. Police said operators manually created transactions and adjusted users’ account balances to make it appear that their investments were growing.The platforms weren’t just after crypto. During registration and identity checks, the operators collected passport information, phone numbers, email addresses, login details, passwords and photographs, police said.That gave the alleged scheme access to digital assets and personal information that could potentially be used in other forms of fraud.Investigators say the lead organizer, a 25-year-old IT specialist, recruited more than 46 Ukrainian citizens and operated several offices in Kyiv and the surrounding region. Technical workers built and maintained the fake sites and worked to keep them online. Other staff contacted potential victims, managed the offices or provided security.Police said victims came from Germany, Poland, Lithuania, Latvia, Spain, France, the U.K., Canada, Israel and other countries.Infrastructure cluesA major break in the investigation came from infrastructure outside Ukraine.Authorities traced server equipment used by the group to the Netherlands and obtained access to a database stored there. The records included lists of victims, crypto wallet addresses, amounts allegedly stolen, internal communications and information about how the fake platforms operated.Investigators said those records helped them reconstruct the scheme and identify victims.Ukrainian police and the SBU later carried out 34 searches in Kyiv and the surrounding region. Authorities seized more than 100 computers, more than 100 phones, 79 SIM cards, documents, cash and 15 vehicles.The investigation remains open under Ukraine’s fraud laws.Police are still trying to identify other people involved, find additional victims and determine how much cryptocurrency the network allegedly stole.12345678910