European authorities have intensified efforts to break apart large-scale cryptocurrency fraud networks, culminating in a major action targeting a group accused of stealing and laundering more than EUR 700 million. Europol worked with law enforcement teams across multiple countries to shut down key infrastructure, seize assets and uncover a sophisticated cross-border system that blended fake trading platforms, deceptive marketing channels and extensive money laundering mechanisms.
Good to Know
The investigation began years ago with a single fake trading website before expanding into a broader inquiry involving cyber specialists and financial analysts. Authorities said the network built an ecosystem of fraudulent cryptocurrency platforms designed to resemble legitimate investment portals. These sites promoted high returns, used polished charts and dashboards and often reached victims through online ads that copied well-known public figures, media outlets or political leaders.
Investigators reported that several ads appeared to use deepfake video clips. When individuals clicked the ads, their contact details were harvested and routed to call centers. Staff at those centers repeatedly contacted potential victims, encouraged new deposits and displayed fabricated account gains through manipulated trading screens.
Funds sent to the platforms were quickly moved through a maze of blockchains, exchanges and wallets. The process fragmented the money flow into smaller transfers, complicating tracking efforts. Shell companies, crypto channels and outsourced marketing groups helped sustain the long-running operation, officials said.
Police teams carried out raids in Cyprus, Germany and Spain on Oct. 27 following requests from France and Belgium, where many victims had filed complaints. Nine suspects were arrested. Authorities also seized EUR 800,000 from bank accounts, EUR 415,000 in cryptocurrency and EUR 300,000 in cash. Digital devices collected during the raids contained logs, account files and wallet records that later helped analysts map fund movements.
A second phase of coordinated work took place on Nov. 25 and 26 as investigators targeted the marketing infrastructure behind the fraudulent operation. Offices in Belgium, Bulgaria, Germany and Israel were searched. Europol said several marketing companies distributed misleading ads through automated systems and collected user data later forwarded to call center staff. The action cut off tools that had allowed the network to identify and target new victims.
Authorities estimated that the network moved more than EUR 700 million through various exchanges to conceal unlawful proceeds. Analysts used seized devices, bank statements and exchange records to connect wallet activity to the organization. Investigators said large volumes of small, fragmented transfers were a central part of the laundering strategy, designed to avoid detection across multiple jurisdictions.
Through online ads that often mimicked legitimate news brands or public figures, with some using deepfake video clips.
They contacted individuals who submitted details through ads and pressured them to deposit more funds.
Investigators linked more than EUR 700 million to the operation.
Teams in Cyprus, Germany and Spain carried out the first wave, with later searches in Belgium, Bulgaria, Germany and Israel.
Cash, cryptocurrency, banked funds, digital devices and extensive account data used to track the wider network.