Law enforcement in Ukraine uncovered a criminal group that used fake websites and Telegram channels to obtain access to users’ crypto wallets.

How the scheme worked

Victims were offered supposed assistance with trading, after which operators sent links directing them to counterfeit trading platforms and services.

Connecting a wallet to these fraudulent platforms granted attackers effective control over the assets, enabling immediate withdrawal or transfer of funds.

• Fraudsters recruited victims through Telegram channels and impersonated web pages mimicking legitimate exchanges and services.
• Users received links and guidance prompting wallet connection, which created an authorization vector for the attackers.
• Once connected, the malicious sites executed transfers, effectively emptying wallets and moving assets to attacker-controlled addresses.

Scale of losses and legal response

The reported financial damage amounts to millions of hryvnias, including a case exceeding 95 000 USDT taken from a single victim.

Investigators have identified multiple suspects; 4 suspects have been formally notified of suspicion and face criminal charges.

If convicted, the accused may receive sentences of up to 12 years in prison, according to the authorities’ statement.

Law enforcement said the investigation continues, with additional procedural steps planned to trace stolen funds and identify other participants.