Ukraine’s Security Service (SBU) and National Police shut down a Kyiv-based network of several dozen people who allegedly used fake cryptocurrency investment platforms and malicious code to steal digital assets from citizens of EU countries, the SBU said on 1 September.

Investigators identified the alleged organizer as a 25-year-old Kyiv IT specialist, according to the SBU. The case reaches beyond Ukraine because the agency says the alleged victims were EU citizens. The agency said the network’s monthly turnover from funds obtained illegally could reach $1 million during its most lucrative periods.

The SBU said investigators had documented alleged crimes by every member of the group. However, its statement did not specify how long the network had operated, how many EU citizens were affected, which countries they lived in, or the total amount allegedly stolen.

The agency did not name any foreign law enforcement partners involved.

How the crypto ring operated

The alleged organizer of the crypto ring recruited other tech workers in the capital, the SBU said. Posing as cryptocurrency-platform representatives, they offered targets seemingly profitable ways to invest in digital assets.

The network found victims by posting about supposedly lucrative crypto projects in popular Telegram channels, then showed them fabricated trading results and fake profits to make the operation look legitimate, investigators said.

Engaged targets were sent a link to a counterfeit site that mimicked a real crypto service and were persuaded to connect their wallets and approve a transaction, the SBU said. The site carried malicious code called a “drainer” that, the agency said, let the operators withdraw the victims’ assets to addresses they controlled—emptying the wallets.

During 23 searches of the suspects’ offices and homes, officers seized phones, computers, money believed to be criminal proceeds, and 16 high-end cars, including Porsche, BMW, and Mercedes-Benz models, the SBU said.

Authorities were still deciding whether to serve notices of suspicion, while the investigation continued under the Prosecutor General’s Office, the SBU said. Those involved could face up to 12 years in prison with confiscation of property.

Ukraine’s role in combating cross-border cybercrime

Ukraine has previously joined with foreign agencies to pursue cross-border cyber threats. In April, the SBU said it worked with the FBI, EU law enforcement, and Polish counterintelligence to disrupt Russian military-intelligence spying through hacked routers. The operation blocked more than 100 servers and removed hundreds of routers in Ukraine from Russian control.

A Ukrainian court sentenced three Russian agents to 15 years each for guiding Russian strikes on Donetsk Oblast, the Security Service of Ukraine (SBU) said on 26 August. Each had been recruited to mark Ukrainian military sites or civilian targets in the east, and counterintelligence exposed them between spring 2025 and March this year. The court found all three guilty of treason committed under martial law. The SBU did not name the court or say which specific strikes the men enabled.

The informer inside the armor repair base

One of the convicted men worked at a Defense Forces repair base, and the SBU detained him in the Kramatorsk sector in April 2025. Russian services noticed him through his brother, who lives in Russia and works for the Federal Security Service (FSB), the investigation established. Recruitment through relatives in Russia or the occupied territories is a method Ukrainian counterintelligence has documented before, including inside a marine brigade on the active front.

During his own shifts at the defense enterprise, he recorded the geolocations of repair shops used to restore heavy armored vehicles for Ukraine's Armed Forces. He tried to pass the photographs and building coordinates to his Russian handler through an anonymous chat in a messenger.

Explore further

SBU arrests suspected Russian spies, foils sabotage plots in Lyman, Chernihiv, Kirovohrad, Vinnytsia

The Dobropillia man who aimed 1.5-ton bombs near Pokrovsk

The second man was an unemployed resident of Dobropillia and an agent of Russian military intelligence, which noticed him through anti-Ukrainian comments in Telegram channel chats, the SBU said. The agency's counterintelligence detained him near Pokrovsk in March this year. Investigators established that he directed 1.5-ton guided aerial bombs at fortified areas and at artillery positions that keep Russian assault groups under fire control on the Pokrovsk axis. Russian forces have leaned more heavily on heavy glide bombs across this stretch of front this year, hitting fortifications and reducing towns to rubble their infantry then uses as cover.

The Kostiantynivka resident who marked his own city

The third man, recruited by the FSB, lived in Kostiantynivka, and SBU military counterintelligence exposed him in August 2025, according to the report. He approached Russian services through pro-Kremlin Telegram channels and offered them his help.

He directed Russian guided aerial bombs and small first-person-view drones at the civilian infrastructure of the front-line city, according to the case materials. He also tracked the positions of Ukrainian drone units carrying out combat tasks on the Kramatorsk axis. Russian strikes on that axis have repeatedly hit residential blocks, with prosecutors opening war-crimes investigations.