The Brooklyn District Attorney's Virtual Currency Unit, working with the FBI, seized or disrupted 112 servers and 241 web domains tied to a Russian-language crypto investment scam, District Attorney Eric Gonzalez announced on Wednesday.

Prosecutors estimate the operation stole tens of millions of dollars from victims across the U.S., many of them Russian-speaking Brooklyn residents who answered Russian-language Facebook ads. The office has recovered about $300,000 so far and is pursuing additional clawbacks, according to a press release.

"These criminals stole many millions of dollars from Russian-speaking victims through an elaborate investment scheme, then tried to exploit them again with false promises to recover their money," Gonzalez said.

How did the scheme reach victims?

The fraud followed a repeatable script, according to investigators:

• Victims clicked a Russian-language Facebook ad pitching crypto investment opportunities.
• A caller posing as an "investment advisor" coached them through opening an account on a custom-built investment website.
• They purchased crypto and sent it to wallet addresses tied to the platform.
• After weeks or months, withdrawals were blocked or victims were told to pay additional fees and taxes.

Data from the seized infrastructure also revealed a secondary "recovery" scam. Operators contacted victims weeks after the initial theft, offering to retrieve their lost assets in exchange for further payments, the office said.

How large was the infrastructure footprint?

The unit executed search warrants and other enforcement actions across three time zones last week. Servers were hosted by Eastern European and American providers, and operators relied on IP addresses and infrastructure based in Ukraine and other Eastern European countries, prosecutors said.

The Virtual Currency Unit had tracked the network for three years. Before last week's operation, it had already seized or disrupted 400 domains linked to the fraud, but new scam sites kept appearing. Disabling the underlying servers, rather than individual domains, removes the operators' ability to spin up replacements and re-contact existing victims.

What is the prior record of the unit?

The takedown follows the August sentencing of a Brooklyn man who stole $16 million from nearly 100 Coinbase users through a phishing scheme to up to 12 years in prison. That case was prosecuted separately by the same office and signals the unit's growing focus on crypto-specific fraud.

What remains unresolved?

The infrastructure takedown cuts off the scammers' current communication channels, but stolen funds remain dispersed across on-chain addresses prosecutors are tracing. The DA's office has not named any suspects and did not announce arrests tied to last week's operation, leaving open whether any of the network's controllers sit within U.S. reach.

Recovery efforts now turn to wallet attribution and potential cooperation with Eastern European counterparts, as prosecutors weigh whether the server seizure yields enough evidence to file charges against identified operators within the six-month statute-of-limitations window for federal wire-fraud counts tied to each victim's loss.