Europol and Latvian police have dismantled a crypto phishing network that created 49 million fake accounts using 40,000 SIM cards to defraud victims across Europe, seizing $330,000 in cryptocurrencies and identifying at least $5.7 million in verified losses.
The operation, announced October 7, disrupted a sophisticated ring that operated five servers and 1,200 SIM box devices to impersonate businesses, law enforcement, and family members in over 3,200 confirmed fraud cases.
According to Europol’s official statement, the crypto phishing ring ran an intricate system involving five servers and 1,200 SIM box devices, which controlled more than 40,000 active SIM cards. The group allegedly created over 49 million fake accounts to impersonate businesses and individuals, leading to an estimated $5.7 million in verified losses with the real total likely much higher.
“This operation shows our determination to dismantle organized cybercrime that exploits cryptocurrencies and digital technologies to steal from citizens,” Europol spokesperson, in an official release.
Massive network behind thousands of fraud cases
The crypto phishing ring operated a web of deception that spanned multiple countries. Investigators confirmed at least 1,700 fraud cases in Austria and 1,500 in Latvia, though officials believe thousands more victims remain unreported. Many targeted individuals were Russian-speaking, limiting cross-border cooperation since Russia is not a Europol member state.
Authorities explained that the network relied heavily on digital impersonation and social engineering tactics. The criminals posed as law enforcement agents, company representatives, and even family members to convince victims to share personal data or transfer funds.
“Cybercriminals are constantly evolving, blending old scams with new technology to trick people faster than ever before,” Janis Reimanis, Head of Latvia’s Cybercrime Division. “The size of this crypto phishing ring highlights the urgent need for coordinated European enforcement.”
Fake identities, SIM farms, and intimidation tactics
Investigators discovered that the crypto phishing ring used SIM farms to automate calls and messages, allowing them to scale operations quickly across different jurisdictions. Europol said the group also ran a “SIM farm-for-hire,” providing access to their telecom infrastructure to other cybercriminals for a fee.
Beyond phishing websites and emails, the group employed intimidation methods, including blackmail and emotional manipulation. Some scams reportedly threatened victims with false criminal accusations or extortion using fabricated child abuse material. This mix of financial and psychological pressure increased the scam’s reach and success rate.
The criminals’ network also relied on automated systems to create fake business profiles, social media accounts, and websites. These identities gave the appearance of legitimacy, making the crypto phishing ring particularly hard to detect until large-scale losses were reported.
Seized crypto assets and ongoing investigations
During coordinated raids in Latvia, Europol and national police confiscated over $330,000 in cryptocurrencies, including Bitcoin and USDT, alongside luxury cars and computer equipment. While this represents only a fraction of the estimated total stolen funds, it underscores how digital assets have become a central tool in organized financial crimes.
The crypto phishing ring’s use of blockchain-based payments also complicated tracing efforts. Authorities are now analyzing wallet data and exchange records in partnership with Europol’s European Cybercrime Centre (EC3) to identify more culprits and freeze additional assets.
“The recovery of crypto assets is a major milestone, but we expect more arrests as forensic tracing continues,” Laila Dambis, Latvian Police Cybercrime Investigator.
Part of Europol’s wider crackdown on crypto fraud
This bust is part of Europol’s expanding campaign against crypto-related scams across Europe. The agency recently reported that crypto phishing incidents exceeded $12 million in August 2025 alone more than double the losses reported earlier in the year.
Experts warn that as tools like AI-generated voices and deepfake videos become more accessible, phishing networks will only become more convincing. These technologies allow cybercriminals to mimic real people or institutions with alarming precision.
Europol said the operation demonstrates progress but emphasized that digital crime remains a growing threat. Law enforcement agencies are strengthening international cooperation to disrupt infrastructure supporting these networks and improve public awareness.
The successful dismantling of this crypto phishing ring marks a significant victory in Europe’s fight against online financial crime but also a reminder that the digital frontier remains a contested battleground between innovation and exploitation.