Ukraine Busts Kyiv Crypto Drainer Ring Moving Up to $1M Monthly

In brief

• Ukraine’s National Police and Security Service said Tuesday they had shut down a network of fake investment platforms run from Kyiv.
• Investigators have identified 62 victims across more than 20 countries, including Germany, Poland, France, the UK, Canada and Israel.
• Withdrawals were blocked, then victims were asked to approve a small “test” transaction that handed over their wallets.

Ukraine’s National Police and Security Service have shut down a network of fake investment platforms that drained crypto wallets belonging to people in more than 20 countries, the agencies said on Tuesday.

Investigators have identified 62 victims so far, among them citizens of Germany, Poland, Lithuania, Latvia, Spain, France, the UK, Canada and Israel. The organizer recruited more than 46 Ukrainians and ran several offices in Kyiv and the surrounding region. Developers built the fake platforms and kept them online against blocking attempts, while others staffed the offices, worked the phones and handled security.

Поліцейські припинили діяльність мережі фейкових інвестиційних платформ, через які шахраї викрадали криптовалюту у громадян понад 20 країн

Наразі поліцейські встановили 62 потерпілих.

🔗 Деталі: https://t.co/e4OZtqg0gB pic.twitter.com/QblK1EWXi8

— Національна поліція України (@NPU_GOV_UA) September 1, 2026

The Security Service described the organizer as a 25-year-old IT specialist and put the operation’s turnover at up to $1 million a month at its peak. Its account reported that the pitch began on Telegram, where the group advertised supposedly profitable crypto projects.

Users who signed up connected a walletand sent funds for what they were told were investment projects. Staff then faked the trading by hand, showing balances climbing in each customer’s dashboard.

Myriad: Crude oil’s next move? Click to make your prediction.

Where the money went

Withdrawal requests were blocked. To verify the platform was working, victims were told, they needed to connect their main wallet and approve a small test transaction. That approval fed a drainer built into the site, which moved the assets to wallets the group controlled and locked the victim out.

Investigators traced server equipment in the Netherlands holding the group’s database, and got into it. It listed victims, their wallet addresses, the sums taken, internal correspondence and records of how the platforms ran. Registration and verification had also harvested passport details, phone numbers, email addresses, logins, passwords and photographs.

Officers conducted 34 searches across Kyiv and the region, seizing more than 100 computers, more than 100 phones, 79 SIM cards, a GSM gateway, cash and 15 cars. Some vehicles and property were registered to suspects’ wives and relatives. The organizer moved with armed guards.

The case is proceeding under Part 5 of Article 190 of Ukraine’s criminal code. Police say they are still identifying everyone involved, further victims and the total sum stolen.

Ukraine moved more than $8.3 million in seized USDT into a state-run wallet in June, the first time confiscated crypto had been placed under state management. The Royal United Services Institute has estimated that tighter rules could recover at least $10 billion in stolen funds and lost tax revenue for the country.

Source