Four suspects are in custody after a Ukrainian investigation into call centers that allegedly used fake investments to take more than €4.3 million from 135 German victims. BleepingComputer’s November 9, 2026 report, citing Ukraine’s Cyber Police, describes a scheme that guided people through cryptocurrency purchases before directing their assets into accounts controlled by the group.
The alleged operation sought targets throughout the European Union, offering supposed opportunities in cryptocurrency, shares and other financial instruments. Police said the suspects cultivated trust over phone calls and messaging apps, then steered victims toward fraudulent online trading platforms. Some victims also had their online banking accounts accessed.
How the money reached the suspects
The accounts opened for victims were part of the route into the fraud. Cyber Police said suspects helped people register with cryptocurrency exchanges—services for buying and selling digital assets—and purchase cryptocurrency. They then instructed victims to transfer those assets to accounts under the organization’s control.
That process meant a victim could complete a cryptocurrency purchase before the transfer put the assets in the suspects’ hands. The promised investment was the lure.
Investigators said the group moved the proceeds among bank accounts, cryptocurrency exchanges and transit wallets, intermediate wallets through which funds passed. The money was then converted and divided among members of the alleged organization.
BleepingComputer places the case within the broader fraud model commonly called romance baiting or “pig butchering.” Such schemes use contact through social media, dating services and messaging apps to build a relationship before introducing fake investments; money sent by victims is stolen instead of invested as promised.
Searches and criminal proceedings
The investigation brought together German law enforcement, Ukraine’s Cyber Police Department and the Main Investigation Department of the National Police of Ukraine. Two rounds of searches took place in August and September across four Ukrainian regions: Kyiv, Vinnytsia, Zaporizhzhia and Ivano-Frankivsk. Police detained the suspected leader and three alleged accomplices.
Officers recovered more than $90,000 and nearly 600,000 Ukrainian hryvnia, approximately $13,000. They also seized physical devices used to store cryptocurrency, known as hardware wallets, along with phones, SIM cards, computer equipment and other evidence.
Other enforcement actions described by BleepingComputer include European authorities’ dismantling in December of a Ukraine-based call-center network linked to more than €10 million in losses, and Ukrainian authorities’ closure in August of 94 fraudulent call centers pursuing investment fraud or access to bank accounts.
The four suspects remain in pre-trial detention. A conviction on charges concerning fraud and establishing, directing or participating in a criminal organization could bring prison sentences of up to 12 years.
