The final actions in a sweeping international operation have successfully dismantled a large-scale cryptocurrency fraud and money laundering network that had laundered over EUR 700 million.
Coordinated across multiple jurisdictions, these actions, carried out last month and earlier this week, mark the culmination of years of investigation and the effective disruption of a criminal operation that spanned Europe and beyond.
What began as an investigation into a single fraudulent cryptocurrency platform gradually unfolded into a complex, far-reaching operation, revealing a vast network of deceit and money laundering.
The criminal network operated numerous fake cryptocurrency investment platforms, luring thousands of victims with sophisticated advertisements promising high returns. The victims were then repeatedly contacted by criminal call centres, where callers used social engineering to pressure victims into making further payments by showing them inflated returns on fake trading platforms.
Once victims had transferred their cryptocurrency, the funds were stolen and laundered across various blockchains and cryptocurrency exchanges. As investigators peeled back the layers of the operation, it became clear that the network had grown far beyond a single fraud scheme, involving multiple fraudulent platforms and sophisticated financial infrastructure spanning Europe and beyond.
A coordinated disruption across multiple countries
On 27 October 2025, the first phase of the operation was executed, with coordinated police raids across Cyprus, Germany and Spain at the request of French and Belgian authorities. These initial actions led to the arrest of nine individuals suspected of laundering illicit funds generated by fraudulent cryptocurrency platforms.
Authorities seized millions of euros in assets, including:
- EUR 800 000 in bank accounts
- EUR 415 000 in cryptocurrencies
- EUR 300 000 in cash
- Digital devices
- High-value watches
The operation was carried out in close collaboration with national authorities from France, Belgium, Germany, Spain, Malta, Cyprus and other countries. Europol and Eurojust supported this first phase of the investigation.
Second phase targets affiliate marketing infrastructure
The second phase, targeting another key pillar of the investment fraud ecosystem, took place on 25 and 26 November 2025. It focused on the affiliate marketing infrastructure that supports these online scams.
Coordinated actions were taken against the companies and suspects behind fraudulent advertising campaigns on social media platforms. In recent years, deceptive advertisements impersonating renowned media outlets, celebrities and politicians – often using deepfake videos – have posed a significant global challenge. The data of potential investors obtained through manipulated advertising, even on reputable platforms, is crucial to the functioning of the crypto-scam industry as a whole.
During the action days, law enforcement teams in Belgium, Bulgaria, Germany and Israel carried out searches and additional operational measures with Europol’s support. Targets included companies that had previously offered affiliate marketing services.
Significant infrastructure dismantled
The joint measures taken in October and November represent a coordinated strike against the various pillars of the online crypto fraud industry.
The scale of this criminal operation is vast. The investigation uncovered more than EUR 700 million laundered through a labyrinth of cryptocurrency exchanges, exploiting digital anonymity to conceal illicit flows. Following these two coordinated actions and multiple arrests and seizures, investigative authorities will continue to track the criminal organisation’s assets in the countries where it operates and resides.
Europol’s support in coordinating this investigation
Europol played a central role in facilitating the cross-border coordination of the operation, providing both operational and analytical support to ensure its success.
Key contributions from Europol included:
- Operational meetings involving law enforcement agencies from all participating countries to coordinate operational strategy and intelligence.
- Logistical support for the action days, assisting with operational arrangements and resources.
- Deployment of dedicated case specialists and analysts to cross-check data, develop intelligence and ensure key insights were shared among partners.
- Deployment of a cryptocurrency specialist to support efforts in identifying and seizing illicit cryptocurrency.
- Operational and crypto-analysis intelligence products, which provided crucial insights into the movement of illicit funds and the structure of the fraud network.
Participating authorities
- Belgium: Federal Judicial Police Limburg (Police Judiciaire Fédérale Limburg)
- Bulgaria: Bulgarian Cybercrime Directorate, General Directorate Combating Organized Crime
- Cyprus: Cyprus Police
- France: National Gendarmerie (Gendarmerie Nationale)
- Germany: Bavarian Central Office for the Prosecution of Cybercrime, Police Headquarters Chemnitz (Polizeidirektion Chemnitz), Police Headquarters Görlitz (Polizeidirektion Görlitz), Criminal Investigation Department Würzburg, Police Headquarters Düsseldorf (and others)
- Israel: National Cybercrime Unit, Intelligence Division
- Malta: Malta Police
- Spain: National Police (Policía Nacional), Spanish Regional Police of Catalonia-Mossos d’Esquadra (Mossos d’Esquadra)
