The Ukrainian Cyber Police, in collaboration with German law enforcement, have dismantled a sophisticated international fraudulent network that defrauded at least 135 German citizens of more than €4.3 million. The investigation, codenamed “Operation Trade,” targeted a syndicate that operated fake cryptocurrency investment platforms supported by specialized call centers.
Ukrainian authorities confirmed the detention of four primary suspects, including the lead organizer, along with three key accomplices. The Joint Investigation Team (JIT) established between the two nations tracked the cross-border flow of assets that the group moved through complex digital layers to evade detection.
The criminal network utilized “pig butchering” and social engineering tactics, primarily reaching victims through messaging apps like WhatsApp and Telegram. Scammers posing as financial brokers lured individuals to fraudulent platforms that simulated realistic investment growth and high returns. Once victims were invested, the “brokers” used intense psychological pressure to encourage larger deposits or to prevent victims from attempting to withdraw their funds.
The final phase of the operation followed multiple stages of raids conducted in August and September 2026. Law enforcement executed searches across several Ukrainian regions, including Kyiv, Vinnytsia, Zaporizhzhia, and Ivano-Frankivsk. During these raids, authorities seized:
- Hardware cryptocurrency wallets containing significant offline assets.
- Computer equipment and SIM cards used to manage the fraudulent platforms.
- Approximately $90,000 in cash and 600,000 Ukrainian Hryvnia.
The seizure of hardware wallets is a critical development for potential victim restitution, as it indicates the suspects kept a portion of the stolen cryptocurrency in “cold storage” rather than moving it through exchanges where it might have been immediately liquidated.
The suspects face charges related to large-scale fraud. German authorities are continuing to investigate whether additional members of the network are operating within other European Union jurisdictions.
