Skip to content

Secure IT

Stay Secure. Stay Informed.

Primary Menu
  • Home
  • Sources
    • Krebs On Security
    • Security Week
    • The Hacker News
    • Schneier On Security
  • Home
  • The Hacker News
  • Europol Dismantles $540 Million Cryptocurrency Fraud Network, Arrests Five Suspects
  • The Hacker News

Europol Dismantles $540 Million Cryptocurrency Fraud Network, Arrests Five Suspects

[email protected] The Hacker News Published: June 30, 2025 | Updated: June 30, 2025 4 min read
0 views
Cryptocurrency Fraud Network

Europol on Monday announced the takedown of a cryptocurrency investment fraud ring that laundered €460 million ($540 million) from more than 5,000 victims across the world.

The operation, the agency said, was carried out by the Spanish Guardia Civil, along with support from law enforcement authorities from Estonia, France, and the United States. Europol said the investigation into the syndicate started in 2023.

In addition, the five alleged suspects behind the cryptocurrency scam were arrested on June 25, 2025. Three of the arrests took place in the Canary Islands, while two others were apprehended from Madrid.

“To carry out their fraudulent activities, the leaders of the criminal network allegedly used a net of associates spread around the world to raise funds through cash withdrawals, bank transfers, and crypto-transfers,” Europol said.

These types of scams often follow a pattern known as cryptocurrency confidence or romance baiting (formerly “pig butchering”), where scammers slowly build trust with victims over weeks or months—often through dating apps or friendly chats—before convincing them to invest in fake crypto platforms. Behind the scenes, fraudsters use social engineering tricks, like fake trading dashboards and scripted conversations, to keep the illusion going. Once money is deposited, it’s moved across multiple accounts in a process called layering, making it harder for authorities to trace.

The cybercriminals are believed to have set up a corporate and banking network based in Hong Kong, with the illicitly obtained funds routed through a maze of payment gateways and user accounts in the names of different people and in different exchanges.

Cybersecurity

The development comes shortly after the U.S. Department of Justice (DoJ) filed a civil forfeiture complaint seeking to recover over $225 million in cryptocurrency linked to cryptocurrency confidence (aka romance baiting) scams running out of Vietnam and the Philippines.

Europol described the “scale, variety, sophistication, and reach” of these online fraud schemes as “unprecedented,” and that they’re on track to surpass serious and organized crime, thanks to the increased adoption of artificial intelligence (AI) technologies.

“The integration of generative artificial intelligence by transnational criminal groups involved in cyber-enabled fraud is a complex and alarming trend observed in Southeast Asia, and one that represents a powerful force multiplier for criminal activities,” said UNODC Regional Analyst, John Wojcik, late last year.

According to a report from INTERPOL last week, cybercrime reports account for more than 30% of all reported crimes in Western and Eastern Africa. This included online scams, ransomware, business email compromise (BEC), and digital sextortion.

“Cybercrime continues to outpace the legal systems designed to stop it,” INTERPOL said, adding, “75% of countries surveyed said their legal frameworks and prosecution capacity needed improvement.”

Part of what makes this kind of fraud so hard to fight is how criminals exploit legal loopholes and fragmented international laws. Many scammers now use synthetic identities—fake personas built with stolen or AI-generated data—to register accounts or rent bank access. They also recruit financial mules to move money, often without them realizing they’re part of a crime.

To pull off such investment fraud schemes, unwitting people from Asia and Africa are lured into Southeast Asia with lucrative job opportunities, and forcefully detaining them inside “scam compounds” run by transnational organized crime groups originating from China.

As many as 53 scam compounds have been identified in Cambodia, per Amnesty International, where the non-profit said “human rights abuses have taken place or continue to occur, including human trafficking, torture and other ill-treatment, forced labour, child labour, deprivation of liberty and slavery.”

Many of the people forced into these scam compounds were originally promised tech or sales jobs abroad. Once they arrive, their passports are taken and they’re forced to scam others under threats of violence or debt.

Cybersecurity

Last year, the United States Institute of Peace revealed that the return on cyber scamming is estimated to exceed $12.5 billion annually in Cambodia, which amounts to half the country’s formal gross domestic product (GDP).

The illegal operation has had such an impact that the Indian Embassy in Cambodia has a prominent warning on its website urging citizens to be vigilant against falling into the hands of human traffickers under the pretext of high-paying jobs, stating job seekers are coerced to undertake online financial scams and other illegal activities.

Adding more context to the criminal activity is a recent report from ProPublica that Chinese-language Telegram channels and groups are advertising to scammers the ability to rent U.S. bank accounts at Bank of America, Chase, Citibank, and PNC, who then use these accounts to launder the proceeds. Telegram has begun to take action on some of these channels.

Meta is said to have detected and taken down no less than seven million Facebook accounts associated with scam centers in Asia and the Middle East since the start of 2024, per a statement shared by the company to the investigative journalism organization.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.

About The Author

[email protected] The Hacker News

See author's posts

Original post here

What do you feel about this?

  • The Hacker News

Post navigation

Previous: Blind Eagle Uses Proton66 Hosting for Phishing, RAT Deployment on Colombian Banks
Next: U.S. Agencies Warn of Rising Iranian Cyberattacks on Defense, OT Networks, and Critical Infrastructure

Author's Other Posts

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims grinex.jpg

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims

April 19, 2026 0 0
Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet botnet-ddos.jpg

Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

April 19, 2026 0 0
Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched defender.jpg

Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

April 19, 2026 0 0
Google Blocks 8.3B Policy-Violating Ads in 2025, Launches Android 17 Privacy Overhaul google-ads-android.jpg

Google Blocks 8.3B Policy-Violating Ads in 2025, Launches Android 17 Privacy Overhaul

April 19, 2026 0 0

Related Stories

grinex.jpg
  • The Hacker News

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims

[email protected] The Hacker News April 19, 2026 0 0
botnet-ddos.jpg
  • The Hacker News

Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

[email protected] The Hacker News April 19, 2026 0 0
defender.jpg
  • The Hacker News

Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

[email protected] The Hacker News April 19, 2026 0 0
google-ads-android.jpg
  • The Hacker News

Google Blocks 8.3B Policy-Violating Ads in 2025, Launches Android 17 Privacy Overhaul

[email protected] The Hacker News April 19, 2026 0 0
nist-cve.jpg
  • The Hacker News

NIST Limits CVE Enrichment After 263% Surge in Vulnerability Submissions

[email protected] The Hacker News April 17, 2026 0 1
europol.jpg
  • The Hacker News

Operation PowerOFF Seizes 53 DDoS Domains, Exposes 3 Million Criminal Accounts

[email protected] The Hacker News April 17, 2026 0 0

Trending Now

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims grinex.jpg 1

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims

April 19, 2026 0 0
Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet botnet-ddos.jpg 2

Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

April 19, 2026 0 0
Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched defender.jpg 3

Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

April 19, 2026 0 0
Google Blocks 8.3B Policy-Violating Ads in 2025, Launches Android 17 Privacy Overhaul google-ads-android.jpg 4

Google Blocks 8.3B Policy-Violating Ads in 2025, Launches Android 17 Privacy Overhaul

April 19, 2026 0 0

Connect with Us

Social menu is not set. You need to create menu and assign it to Social Menu on Menu Settings.

Trending News

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims grinex.jpg 1
  • The Hacker News

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims

April 19, 2026 0 0
Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet botnet-ddos.jpg 2
  • The Hacker News

Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

April 19, 2026 0 0
Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched defender.jpg 3
  • The Hacker News

Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

April 19, 2026 0 0
Google Blocks 8.3B Policy-Violating Ads in 2025, Launches Android 17 Privacy Overhaul google-ads-android.jpg 4
  • The Hacker News

Google Blocks 8.3B Policy-Violating Ads in 2025, Launches Android 17 Privacy Overhaul

April 19, 2026 0 0
NIST Limits CVE Enrichment After 263% Surge in Vulnerability Submissions nist-cve.jpg 5
  • The Hacker News

NIST Limits CVE Enrichment After 263% Surge in Vulnerability Submissions

April 17, 2026 0 1
Operation PowerOFF Seizes 53 DDoS Domains, Exposes 3 Million Criminal Accounts europol.jpg 6
  • The Hacker News

Operation PowerOFF Seizes 53 DDoS Domains, Exposes 3 Million Criminal Accounts

April 17, 2026 0 0
Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation apachemq.jpg 7
  • The Hacker News

Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation

April 17, 2026 0 0

You may have missed

grinex.jpg
  • The Hacker News

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims

[email protected] The Hacker News April 19, 2026 0 0
botnet-ddos.jpg
  • The Hacker News

Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

[email protected] The Hacker News April 19, 2026 0 0
defender.jpg
  • The Hacker News

Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched

[email protected] The Hacker News April 19, 2026 0 0
google-ads-android.jpg
  • The Hacker News

Google Blocks 8.3B Policy-Violating Ads in 2025, Launches Android 17 Privacy Overhaul

[email protected] The Hacker News April 19, 2026 0 0
Copyright © 2026 All rights reserved. | MoreNews by AF themes.