Ukraine busts Kyiv crypto drainer ring, with the capital-based network shutting down after investigators found it had drained cryptocurrency wallets belonging to people in more than 20 countries and targeted victims across multiple jurisdictions. Authorities have identified 62 victims so far, recording linked wallet addresses and victim counts as part of ongoing inquiries. Investigators report the operation reached a monthly turnover of up to $1 million at its peak, a figure cited while authorities continue to assess the full scope of accounts and funds involved, and investigations remain ongoing now.
Investigators say the scheme began on Telegram with advertisements for supposedly profitable crypto projects and fake investment platforms. Prospective victims were invited to connect a cryptocurrency wallet and to send funds to the lookalike services. To verify the platform appeared to work, users were instructed to connect their main wallet and approve a small test transaction; that approval fed the drainer. After funds were in the platform, staff manually faked trading and showed rising balances on customers’ dashboards to create the appearance of profit. When victims requested withdrawals, those requests were blocked.
Authorities found the operation’s organizer recruited more than 46 Ukrainians and ran several offices in Kyiv and the surrounding region to staff the scheme. The group’s staff carried out the staged trading and customer-facing communications that sustained the fraud. Investigators traced server equipment holding the group’s database to the Netherlands. The seized database recorded victims, their wallet addresses and the sums taken, along with internal correspondence and operational records. Registration and verification processes on the platforms harvested passport details, phone numbers, emails, logins, passwords and photographs from users.
Those records were used by investigators as part of the ongoing criminal case. Police continue to identify everyone involved and further victims. The case is proceeding under Part 5 of Article 190 of Ukraine’s criminal code.
Law enforcement carried out 34 searches across Kyiv and the surrounding region, seizing more than 100 computers, more than 100 phones, 79 SIM cards, a GSM gateway, cash and 15 cars. Some vehicles and property were registered to suspects’ wives and relatives. Authorities recovered electronic devices and communications equipment used in the operation. The seizures were conducted as part of coordinated searches of offices and residences linked to the network.
Investigators found the organizer recruited more than 46 Ukrainians and ran several offices in Kyiv and the surrounding region, and reports indicate the organizer moved with armed guards. The case is proceeding under Part 5 of Article 190 of Ukraine’s criminal code. Police say they are still identifying everyone involved, additional victims and the total sum stolen. In June, Ukraine moved more than $8.3 million in seized USDT into a state-run wallet, and the Royal United Services Institute estimated that tighter rules could recover at least $10 billion in stolen funds and lost tax revenue for the country.
The investigation remains active and authorities continue to process seized evidence and identify further victims. Legal proceedings and asset-tracing efforts are ongoing under the cited criminal provisions.
Ukrainian authorities dismantled a Kyiv-based crypto drainer ring that investigators say drained wallets belonging to people in more than 20 countries, with 62 victims identified so far and an organizer who recruited more than 46 Ukrainians to staff multiple offices in Kyiv and the surrounding region. The operation reportedly reached turnover of up to $1 million a month at its peak, and investigators say they are still identifying everyone involved and further victims as criminal proceedings continue.
