On 14 October 2026 the Brooklyn District Attorney's office and the FBI shut down a fraud network: 241 websites went offline and 112 servers were seized. What makes this case unusual is the se
On 14 October 2026 the Brooklyn District Attorney's office and the FBI shut down a fraud network: 241 websites went offline and 112 servers were seized. What makes this case unusual is the second stage of the fraud rather than the first. The same operators called their victims again weeks after the loss – this time posing as a recovery service that would get the lost money back. The tactic is known as a recovery scam, and it carries on after the takedown.
For investors in Germany this is not a distant American story. Five days before the Brooklyn announcement, on 9 October 2026, the German regulator BaFin issued a warning about a purported “Vantex Bank” and named the suspicion of recovery fraud explicitly. The method is identical and the target group never changes: people who have already lost money and whose contact details sit in the operators' database.
The figures in the case are modest, which makes them easy to remember. 241 websites were seized or disabled, together with 112 servers held at hosting providers in Eastern Europe and the United States. The investigation ran for three years. Authorities say the operators took several tens of millions of dollars; about $300,000 has been secured so far. There were no arrests.
Victims were recruited through Russian-language ads on Facebook. Supposed investment advisers then telephoned and walked them step by step through buying crypto assets and sending them to a fake trading platform. District Attorney Eric Gonzalez said, according to the report by CoinDesk, that the operators had tried to exploit the victims “a second time with false promises to recover their money”.
The first part follows a sequence that supervisors have been describing for years. The victim sees a portfolio on the platform in which the stake keeps growing. The numbers on the screen are invented, but they work, because they move and because a friendly adviser explains them over the phone. As long as money only flows in, everything runs smoothly.
The break comes with the first withdrawal attempt. The account is frozen, or a demand appears: a tax, an unlocking fee, an administrative charge, a security deposit. Pay it and the next demand arrives. Refuse and the line goes quiet. Either way the money is gone, and the operators hold a complete profile: name, phone number, address, size of the loss, often a copy of an ID document as well.
We showed what a series of such platforms looks like from the outside on 14 October 2026, using the 23 near-identical websites that BaFin had warned about: what to watch on an unlicensed crypto platform. The design repeats itself because it is cheap to copy.
After a few weeks comes the second call. On the line now is no trading platform but a law firm, an IT forensics specialist, an investigation unit, sometimes a bank. The caller knows the case in striking detail, quotes amounts and dates, and that is precisely why the scam works: the details come from the operators' own database.
The promise is that the transfer can be traced on the blockchain and the balance frozen or reversed. Technically it sounds plausible enough to raise hope. The demand that follows is always the same: a payment up front. Sometimes it is billed as expert fees, sometimes as a court cost advance, sometimes as tax on the repayment, sometimes as an activation fee for an escrow account.
BaFin warnings now also describe a variant aimed at people who have lost nothing at all: the story involves a grant or a gift that supposedly only needs to be released. The mechanism stays the same and only the pretext is swapped out.
Stage two almost always opens with a request for a copy of an ID document – the demand for payment comes after that.
Brooklyn's virtual currency unit had already taken some 400 domains out of circulation before this case. The effect lasted only briefly each time: a blocked domain is replaced within hours, and the content sits ready as a copy. So this time the action targeted the servers themselves, which held the sites, the customer database and the dialling software.
That removes not only the website but also the call list. Whether it holds remains to be seen; the infrastructure used IP addresses in Ukraine and other Eastern European countries, and prosecutors have reported no arrests so far. A network taken offline without defendants can be rebuilt somewhere else.
In short, do not rely on a site having disappeared. What decides the matter is who approaches you and what they want from you, not the address in the browser bar.
The German case sits right alongside it in time. On 9 October 2026 BaFin warned about the sites vantex-bank.com and vantex-bank.net, which advertise a credit institution called “Vantex Bank”. No such institution exists in Germany or in France. To back up the supposed authorisation, the operators pointed to an apparently forged register of the European Banking Authority. BaFin sees indications that the purported bank is intended for recovery fraud involving crypto balances. Austria's FMA published its own warning about the same address on the same day.
The forged register is the most elaborate part of the scam, because it is meant to neutralise the obvious cross-check. Our analysis of 9 October sets out what such a forgery looks like and how to spot it: forged EBA register: how to check a crypto licence. The supervisor publishes its current warnings itself under BaFin news and warnings.
The features recur across every known case, from the Brooklyn network to the BaFin warnings of recent weeks.
A sixth feature appears less often but is the most dangerous: the request for access to the wallet in order to “prepare the reversal technically”. Anyone using a hardware wallet who has never recorded their recovery words digitally is protected at this point. Which devices do the job and what they cost is set out in our hardware wallet comparison.
Anyone offering crypto asset services commercially in Germany has needed authorisation since the European MiCA regulation took effect. That authorisation is publicly verifiable, and at a place the supervisor runs itself: BaFin's company database at portal.mvp.bafin.de. It shows whether a provider is licensed and for what. A second source is ESMA's MiCA register.
The detour matters: you look the provider up in the database instead of following the link somebody sends you. A forged register like the one in the Vantex case only works as long as the recipient clicks the link in the email. We have collected the obligations behind a genuine authorisation in our overview of the MiCA licence.
Recovering stolen crypto assets, incidentally, falls into none of these categories. Anyone offering it is either providing legal services – which fall under Germany's Legal Services Act, and a lawyer is listed in the federal register of attorneys – or offering nothing they can actually deliver.
Three years of investigative work went into the Brooklyn case; prosecutors have reported no arrests so far.
Every variant of the scam converges on the same point. At some stage money is supposed to move before anything happens. The justification changes, the mechanism does not.
A simple line of reasoning from German law helps here. Tax on a repayment is paid to the tax office, not to a service provider. Court costs are collected by a court, on the basis of a costs order with a file number. A bank that unblocks your account does not ask for a transfer to an account abroad. As soon as the payment route departs from that pattern, the matter is settled, however convincing the conversation was.
Investment fraud with fictitious gains also raises a tax question that catches many victims off guard. What the tax office makes of invented profits, and how losses are treated, is a separate matter worth clarifying before the next tax return.
Stage two does not always aim at a transfer. In some cases it is after credentials. The supposed forensics specialist asks you to install remote maintenance software in order to “analyse the transaction”. Or he asks for the twelve or twenty-four recovery words, the seed phrase, supposedly to set the wallet up again in a secure environment.
There is no room for manoeuvre here. The recovery words are the key to the holdings. Hand them over and you transfer the balance; afterwards no body exists that can undo it. No authority, no court, no custodian and no service provider ever asks for them. The same goes for screen sharing during access to a wallet.
If remote maintenance software is already installed, disconnect the device from the network and move the holdings from a clean environment to a freshly set up wallet with a new seed phrase. The old one counts as burned from then on, even if nothing has left yet.
Once money has gone, the order of steps counts. First the bank or the payment service provider, and immediately: where a transfer has not yet been executed or not yet passed on, there is a small chance of a recall. Card payments allow a chargeback procedure depending on the case. Both run to deadlines measured in days.
Then the criminal complaint with the police, which is also possible through the online stations of the federal states. What is useful for the file: bank statements, transaction IDs of the blockchain transfers, recipient addresses, the chat history, the phone numbers and screenshots of the platform while it is still reachable. Gather these records before you break off contact, because access disappears quickly afterwards.
In parallel, BaFin accepts tips about unauthorised business; the public warnings that help other investors grow out of them. Consumer advice centres and victim support organisations advise free of charge or for a small fee. What does not exist is a body that recovers money against payment up front.
The Brooklyn takedown shows both things: that investigations can bite, and that they come late. Three years of work, 241 sites, 112 servers, around $300,000 secured out of several tens of millions of dollars in damage. Prevention is far more effective in this field than clearing up afterwards. Three steps that change something today:
(As of 15 October 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
