VULNpocalypse
InformationalBreach / campaignMonitoring

Ukraine Cyber Police says it dismantled crypto scam call centers

Ukraine’s Cyber Police says it detained four suspects in a crypto investment scam network; be wary of unsolicited investment offers.

Published
Exploitation
No, no software vulnerability is mentioned in the sources; the scheme is described as social engineering fraud by Ukraine’s Cyber Police

What happened

According to Ukraine’s Cyber Police, a criminal network that ran fraudulent call centers in Ukraine and targeted people across the European Union has been dismantled in an international operation called “Trade” (Cyber Police of Ukraine). BleepingComputer reports the same case and says Ukrainian law enforcement arrested four suspects (BleepingComputer). These are the police’s allegations. The suspects have not been convicted, and the Cyber Police itself notes the presumption of innocence.

What the Cyber Police says about the scheme:

  • The suspects posed as brokers and financial advisers. They used social engineering, IP telephony and messaging apps to persuade victims to invest in cryptocurrencies, shares and other instruments through fraudulent online trading platforms.
  • They helped victims open accounts on crypto exchanges, buy digital assets and send them to accounts controlled by the group. In some cases they also gained access to victims’ online banking accounts.
  • The proceeds were moved through bank accounts, crypto exchanges and transit wallets, then converted and shared among members of the group.
  • The police identified 135 German victims with losses of more than EUR 4.3 million. BleepingComputer describes the scheme as a pig butchering or romance baiting scam.

What the Cyber Police says about the operation:

  • A joint investigation team was set up with German law enforcement.
  • The first stage, in August 2026, involved 39 searches in Kyiv and the Kyiv, Vinnytsia, Zaporizhzhia and Ivano-Frankivsk regions.
  • A second stage, in September 2026, involved 17 searches in Kyiv and the Kyiv region. Officers seized nearly UAH 600,000, more than USD 90,000, hardware crypto wallets, mobile phones, SIM cards and computer equipment.
  • Four members were detained: the alleged organiser and three participants. One more accomplice was also notified of suspicion.
  • The court ordered the organiser and three accomplices held in pre-trial detention. Another alleged co-organiser was placed under house arrest.
  • The charges relate to fraud and to creating, leading and taking part in a criminal organization, with penalties of up to 12 years’ imprisonment.
  • The pre-trial investigation is ongoing, and police say they are still identifying everyone involved and additional victims.

Not confirmed in the sources: the names of the suspects, the names of the fake trading platforms, whether victims will recover funds, and the total number of victims beyond the 135 German citizens.

Am I affected?

The sources describe no software vulnerability and no product to patch. Exposure is through contact with the scheme itself. The Cyber Police says victims were targeted across the European Union, and the 135 victims it identified are German citizens. It says additional victims are still being identified.

You may be affected if you dealt with someone presenting as a broker or adviser and transferred crypto or other funds to a platform they pointed you to. The sources do not name the platforms, so they cannot be checked against a list.

What to do now

  1. If you suspect you dealt with such a scheme, stop sending further funds and report it to your local police. The sources do not say how victims should contact the investigators.
  2. If you gave anyone access to your online banking, contact your bank. The Cyber Police says access to victims’ online banking accounts occurred in some cases.
  3. Treat unsolicited investment offers that arrive through social media, dating sites or messaging apps with caution. BleepingComputer describes these as the usual entry points for this kind of scam. This step comes from the described method, not from a recommendation in the sources.
  4. Watch the Ukrainian Cyber Police announcements for updates. The investigation is described as ongoing.

Sources