Eurojust Coordinates Global Crackdown on €600 Million Crypto Investment Fraud Network

This week, Eurojust announced the results of a major international operation dismantling a transnational criminal network behind one of the largest cryptocurrency investment fraud schemes uncovered to date. The coordinated action, conducted across France, Belgium, Cyprus, Germany, and Spain, led to nine arrests, 60 searches, and the seizure of over EUR 1.5 million in cash and crypto assets. Authorities estimate that the fraud network stole and laundered more than EUR 600 million from victims around the world.

Between 2020 and 2023, the suspects allegedly created and managed dozens of fraudulent crypto investment platforms that closely mimicked legitimate exchanges and trading services. Using sophisticated marketing campaigns, fake endorsements, and fabricated online reviews, the perpetrators lured victims with promises of guaranteed profits and low-risk returns. The platforms displayed simulated trading dashboards showing false account growth to build confidence among investors. Once victims transferred funds, they were prevented from withdrawing or asked to pay additional “taxes” or “fees,” after which communication ceased and the platforms disappeared.

Investigators determined that the stolen assets were rapidly converted into stablecoins and moved through complex laundering structures — including over-the-counter brokers, unlicensed exchanges, and nested services — before being cashed out. These flows mirrored typologies seen in other high-volume “pig butchering” and romance-investment scams: schemes built on social engineering rather than technology exploits:

According to TRM Labs, investment scams like these remain among the largest and fastest-growing categories of illicit activity in the crypto ecosystem. Since 2023, TRM has tracked more than USD 53 billion in fraud and scams across the industry — a figure likely underreported given that only 15–20% of victims come forward. Many of these scams share common hallmarks: social contact initiated through messaging apps or dating sites, promises of “guaranteed” returns, and pressure to invest quickly in platforms that cannot be independently verified.

The investigation began after complaints from victims in multiple EU member states and was coordinated by Eurojust, which established a Joint Investigation Team (JIT) between France and Belgium. 

Judicial and law enforcement authorities from Cyprus, Germany, and Spain later joined. In France, the operation was led by the Investigative Judge of the Paris JUNALCO Cybercrime Unit and the Gendarmerie Nationale Cyber Unit. In Belgium, it was directed by the PPO Limburg and the Federal Judicial Police Limburg. In Cyprus, the investigation was managed by the Attorney General’s Office, the Financial Intelligence Unit MOKAS, and the Cyprus Police. In Germany, it was led by the Public Prosecutor’s Office Cologne and the Cologne Criminal Police. In Spain, the Prosecutor’s Office Barcelona, Investigative Court No. 5 in Vilanova i la Geltrú, the Mossos d’Esquadra Cybercrime Central Area, and the Policía Nacional oversaw local enforcement actions.

Eurojust coordinated the timing of arrests and searches, facilitated evidence sharing among the participating jurisdictions, and ensured mutual legal assistance with non-EU countries. Over EUR 800,000 in bank accounts, EUR 415,000 in cryptocurrency, and EUR 300,000 in cash were seized, alongside computers, mobile phones, and other digital infrastructure tied to the fraud.

This operation underscores the convergence of traditional fraud with digital financial systems — large-scale social engineering operations powered by cryptocurrency infrastructure and global laundering channels. It also reflects a growing international consensus that combating these scams requires real-time data sharing, public-private partnerships, and cross-border investigative cooperation.