Brooklyn prosecutors seize 112 servers from a crypto scam network that took tens of millions

Start with the ratio. The 241 domains ran on 112 servers, about 2.2 domains per machine ^[17]. Domains are the layer a scammer can replace fastest, in our view, and domains are what the Virtual Currency Unit had mostly been taking: not counting last week's operation, it has taken down or disrupted 400 of them ^[13]. Servers are different. The Brooklyn DA's office says seizing them stripped the scammers of access to victim records, the content driving their domains and the tools that ran the operation ^[8]. Assistant District Attorney Alona Katz, who leads the unit, said, according to Bloomberg, "we disabled the back end of the operation" ^[9].

That matters most for the second half of the scheme. District Attorney Eric Gonzalez said the criminals stole from Russian-speaking victims "through an elaborate investment scheme, then tried to exploit them again with false promises to recover their money" ^[6]. A recovery pitch needs a list of people who have already been robbed, and victim records are what the DA says the operators lost ^[8]. We think the server seizure therefore hits the second pitch harder than another 241 domains would have. The link is our inference, because the sources do not say the recovery calls ran from these particular servers. Cointelegraph's narrower report is that the seizure cut the scammers' ability to create new websites and contact victims ^[10].

The money recovered so far is small. The DA estimates that tens of millions of dollars were stolen ^[4] and has seized about $300,000 ^[5]. Taking $20 million as the low end of "tens of millions" (our assumption), that is 1.5% ^[18]. The FBI figure cited by Bloomberg for reported US crypto fraud losses in 2025 is $11.4 billion, up 22% on the year ^[14]. A $20 million scheme is 0.18% of that total ^[20].

Three outcomes would change our view. Russian-language ads and recovery calls with the same script surfacing on new hosts within weeks would mean the operators kept their records and tools elsewhere, and the seizure cost them little. A next Brooklyn action that again counts only domains would make the server seizure a one-off. Arrests would make the case stronger than the equipment count suggests. The operation was carried out the week before the Wednesday announcement ^[7], so the first of those tests has barely started.