1. Crypto scam takedown: Brooklyn seizes 241 domains and 112 servers
The Brooklyn District Attorney's Virtual Currency Unit, working with the FBI's New York field office, seized or disrupted 241 scam domains and 112 servers on October 14, 2026, a crypto scam takedown that ended a three-year investigation into an international crypto investment scam. The unit is led by Assistant District Attorney Alona Katz. Investigators estimate that the scheme cost victims tens of millions of dollars, and about $300,000 has been recovered so far.
The action lands against a stark national backdrop. The FBI's Internet Crime Complaint Center, known as IC3, counted $11.366 billion in crypto fraud losses among Americans in 2025. The Brooklyn case is a small slice of that total, but it shows how one local prosecutor's office is trying to disrupt the infrastructure that makes such scams possible.
2. What did investigators actually take down?
The operation covered two kinds of infrastructure: web domains and servers. Domains are the addresses victims see, such as the fake investment platforms they are urged to trust. Servers are the machines behind those addresses that host the sites and keep them running. Taking down both is meant to remove the scam's visible face and its working core at once.
The 112 servers were located in Eastern Europe and in the United States. Investigators traced links to the operators of the network in Eastern Europe, particularly Ukraine. The probe lasted three years before the October action, a timeline that reflects how slowly cross-border cases advance when evidence sits with hosting companies in several countries.
No arrests have been reported. The announcement did not name the network, any suspects or the individual investigators, so the public picture so far consists of infrastructure seizures and the recovery of a small share of the money.
Each of these steps leaves a record, which is why a long investigation can eventually connect a visible advertisement to the machines that served it.
3. How did the scam reach its victims?
The network targeted Russian-speaking communities. It began with Russian-language advertisements on Facebook that promoted investment opportunities and directed viewers to fake crypto investment platforms. Placing ads in one language, where a specific community spends its time, made the pitch look familiar and credible to the people who saw it.
A second phase followed. Seized data pointed to a recovery scam, in which people who had already lost money were approached again, weeks later, with offers to retrieve their funds. Such offers prey on the hope of getting money back, and they turn a one-time loss into repeated losses. Investigators said some victims lost their entire life savings.
This two-stage structure is worth understanding for ordinary users. A stranger who contacts a victim after a loss, promises to recover stolen crypto and asks for fees upfront is a warning sign in its own right, whatever the credentials claimed.
4. How do fake investment platforms work?
A fake investment platform imitates a legitimate trading service. It shows an account balance, charts and apparent profits, but the figures are invented and the deposits go straight to the operators. Because the victim can see a growing balance, the deception can last for weeks or months, and the pressure to deposit more usually grows as the displayed gains rise.
Withdrawals are where the illusion breaks. Victims who try to take money out are typically told they must first pay fees, taxes or a verification deposit. Each payment is another loss, and the platform never releases the funds. The pattern is consistent with the recovery-scam follow-up that Brooklyn investigators identified, in which the same people are approached again after they have lost money.
Targeting a single language group makes this model more efficient. Messages written in a reader's own language, placed on a platform they already use, require little extra effort to look trustworthy, and word of mouth inside a community can spread a scam further than any advertisement.
5. Why does Brooklyn have a dedicated crypto unit?
The Virtual Currency Unit launched in 2023 in response to rising crypto fraud affecting Brooklyn's large Russian-speaking population. Its tools include blockchain tracing, which follows funds from wallet to wallet on a public ledger, and server takedowns that knock scam websites offline.
Since it began, the unit has disrupted more than 400 fraud-linked domains. The 241 domains in the October action account for a large share of that cumulative total. In an earlier action in June 2024, the unit seized domains tied to at least $5 million in losses.
The shift from individual domains to servers reflects a practical problem. Scam operators can register new domains within hours, so seizing websites one at a time rarely holds. Going after the servers behind them is a way to raise the cost of rebuilding.
6. Why is tracing crypto useful, and where does it stop?
Public blockchains record every transaction permanently. That gives investigators a trail they would not have with cash: they can follow a payment from a victim's wallet through the addresses an operator controls until it reaches an exchange or another point where an identity may be attached. This is the technique the Virtual Currency Unit uses alongside server takedowns.
The limits are practical. Scammers split funds across many addresses, move them quickly and convert them at services outside the reach of United States authorities. A trace can show where money went without being able to freeze it, and recovery generally needs the cooperation of an exchange or a court order in the country where the funds landed.
That helps explain the modest recovery figure. Following the money is often possible; getting it back before it is moved on is the hard part, and speed matters more than almost any other factor.
7. How big is crypto fraud nationally?
According to the IC3's 2025 report, crypto-related fraud losses reached $11.366 billion, a 22% increase from the previous year. Crypto accounted for more than half of all internet crime losses documented that year.
Investment scams made up $7.228 billion of the total. That category includes the pattern Brooklyn investigators disrupted, in which an advertisement leads to a fake platform that shows fabricated gains while the victim's money is taken.
Older Americans were hit hardest. Victims aged 60 and older reported nearly $4.4 billion in losses. These national figures are context and are not attributed to the Brooklyn network; the local case involves losses in the tens of millions, a different scale from the national total.
8. Why did the crackdown focus on servers rather than websites?
Seizing a domain removes one address, but the same content can be hosted again under a new name within hours if the servers behind it survive. By the time the Brooklyn unit had disrupted roughly 400 domains, new sites were still appearing. Reaching the backend machines in Europe and the United States addresses the supply of replacement sites at its source.
Hosting providers also hold records that can identify customers, payment details and activity logs. Evidence obtained from seized servers can reveal how victims were handled, which is how investigators identified the recovery scheme as a second phase of the same operation.
Server seizures depend on cooperation across borders, since the machines sat in more than one region. That cooperation, together with the FBI's involvement, made it possible to act on a three-year investigation in a single coordinated step.
9. Where does enforcement fall short?
The numbers show a wide gap. About $300,000 has been recovered against losses in the tens of millions of dollars, and no one has been charged in public. The fraud itself can be run from servers abroad, while the money moves through crypto networks that can be hard to follow across borders.
That gap helps explain why Katz has pushed for state legislation to strengthen the prosecution of crypto scams affecting her community. Domain seizures and tracing help, but they do not by themselves produce convictions, and cases that cross into Eastern Europe are difficult to bring to court.
For people targeted by these schemes, the practical lessons are simple. Treat advertisements promising investment returns with suspicion, verify any platform independently before sending funds, and be wary of anyone offering to recover lost crypto for a fee.
Together these constraints explain why prosecutors pair technical takedowns with calls for stronger laws, rather than relying on either approach alone.
10. What happens next?
Three questions remain open. The first is whether the October operation leads to criminal charges against the people behind the network. The second is whether New York lawmakers act on the legislation Katz has advocated. The third is whether additional funds can be returned to victims beyond the roughly $300,000 recovered so far.
Until those answers arrive, the takedown stands as a significant disruption of scam infrastructure rather than a finished prosecution, and a sign that local prosecutors are building blockchain-focused capacity of their own.
The case also tests a broader idea: that local prosecutors, not only federal agencies, can build the technical skills to confront crypto crime. The Virtual Currency Unit's work since 2023 suggests that a small team focused on one community's problem can disrupt infrastructure at a scale that individual complaints rarely reach. Whether that approach is copied elsewhere, and whether it ever translates into a conviction, will determine how much weight it carries beyond Brooklyn.
Readers who believe they have been targeted can report the activity to the FBI's Internet Crime Complaint Center, the same body whose annual report supplied the national loss figures cited here. Reporting quickly matters, because investigators can only follow funds that have not yet been fully moved or converted.