Croatian Ministry of Interior Dismantles Cryptocurrency Fraud Ring

Between December 19 and 23, 2024, Cybersecurity Officers within the Croatian Ministry of Interior (MUP) began tracking and investigating what would become a complex cryptocurrency fraud and money-laundering scheme. Using a combination of blockchain intelligence and traditional investigative methods, the MUP identified two primary suspects—a 42-year-old Croatian citizen and a 45-year-old Austrian—who ultimately defrauded at least twelve victims of more than $500,000 in digital assets. 

TRM Labs is proud to have supported the MUP in this investigation and in its broader mission to prevent, detect, and investigate cyber-enabled crime.

The Investigation

According to investigative findings, the scheme began when the suspects approached a 39-year-old Croatian victim with what appeared to be a legitimate opportunity to purchase Bitcoin below market value. The victim, who had prior experience trading cryptocurrency, was persuaded that he could achieve favorable returns. After establishing trust, the 42-year-old arranged an in-person meeting in the Zadar region, where he claimed he would demonstrate blockchain transaction workflows. During this meeting, he covertly photographed the victim’s 24-word seed phrase, granting full access to the victim’s cryptocurrency wallet.

On December 23, 2024, using the stolen seed phrase, the Austrian suspect unlawfully accessed the victim’s digital wallet and transferred all available Bitcoin to his own wallet. At the moment of the theft, the stolen cryptocurrency was valued at €154,525.71.

From the end of December 2024 through January 14, 2025, the Austrian suspect undertook deliberate steps to conceal the illicit origins of the funds. He fragmented the stolen cryptocurrency into numerous smaller transactions, moved them across multiple blockchain addresses, and attempted to create barriers for forensic tracing. In January 2025, he consolidated a portion of the funds, traveled abroad, and transferred assets to the crypto wallet of a third party and to the account of a foreign national at an international cryptocurrency exchange. Investigators believe he received cash in exchange for these transfers, which he later shared with his Croatian accomplice.

Throughout the investigation, MUP investigators used TRM’s advanced forensic capabilities including UTXO-based tracing, transaction-pattern fingerprinting, address-behavior analysis, change-of-ownership indicators, and multisignature-related structural detection across multiple chains. These tools allowed the team to reconstruct the laundering architecture, identify off-ramps, and map the full movement of illicit funds with precision. 

The lead investigator publicly thanked cryptocurrency forensics expert Nick Furneaux and TRM Labs, noting that early guidance helped establish investigative direction and accelerate progress.

Once investigators identified key cash-out points, the MUP submitted Chainabuse.com complaints on addresses associated with the scheme. This alert notified the broader cryptocurrency and Beacon communities that the wallets were tied to illicit activity. An exchange performing additional due diligence provided further evidence, strengthening the case.

The Result

Following the investigative findings, the MUP conducted searches at the suspects’ residences, seizing phones, computers, hardware wallets, and other digital evidence. The 45-year-old Austrian suspect was delivered to a detention supervisor, and a judge of the County Court in Zadar ordered investigative custody. A criminal complaint was also filed against the 42-year-old Croatian suspect. The MUP continues tracing funds to determine whether additional victims were targeted and whether additional assets can be recovered.

Conclusion

This case demonstrates how modern financial crime operates across multiple blockchains, borders, and platforms—and why successful investigations require an integrated approach that blends digital forensics with traditional police work. The MUP’s actions reflect the growing sophistication of global law-enforcement agencies adapting to the realities of cyber-enabled crime. The investigation also underscores the importance of collaboration among investigators, forensic specialists, exchanges, and the broader crypto-safety community. As digital asset usage expands, cases like this illustrate that well-equipped and well-trained cyber units can effectively confront emerging threats and bring offenders to justice.