Ukraine arrests four suspected of guiding 135 Germans through crypto purchases, then draining over €4.3 million

Ukrainian police have arrested four people accused of running call centres that allegedly took more than €4.3 million (about $4.8 million) from 135 German victims through fake crypto and share-trading schemes, the Cyber Police Department of Ukraine said on November 6, 2026. Investigators say the suspects posed as brokers and, in some cases, gained access to victims’ online banking.

How the investment scam won victims’ trust

According to the Cyber Police, the suspects contacted potential investors while presenting themselves as professionals capable of helping them profit from cryptocurrency, shares and other financial instruments. They allegedly used internet-based telephone services, messaging applications and social engineering techniques to build relationships with victims before directing them to pseudo-brokerage platforms.

Once trust had been established, the suspects reportedly guided victims through opening accounts on cryptocurrency exchanges, purchasing digital assets and transferring the funds to accounts controlled by the organisation.

In some cases, investigators said, the suspects went further by obtaining access to victims’ online banking systems. This gave the alleged criminals additional ways to move money without the account holders’ authorisation.

The funds were subsequently channelled through bank accounts, cryptocurrency exchanges and intermediary wallets before being converted and distributed among members of the group, according to the police statement.

The scale of the alleged investment scam became clearer as investigators identified 135 German citizens who had collectively lost more than €4.3 million. Authorities have not disclosed the identities of the victims or provided a breakdown of individual losses.

Ukraine and Germany coordinate raids

The investigation was conducted through an international cooperation framework, with Ukrainian and German authorities establishing a Joint Investigation Team (JIT) to coordinate evidence gathering and investigative activities.

The first phase took place in August 2026, when law enforcement officers carried out 39 searches across Kyiv and the Kyiv, Vinnytsia, Zaporizhzhia and Ivano-Frankivsk regions. Searches covered suspects’ homes, vehicles and office premises.

The operation involved other National Police units, including special police teams supporting the searches. Investigators subsequently analysed material collected during the raids before launching a second phase in September.

During the follow-up operation, officers conducted another 17 searches in Kyiv and the surrounding region. They seized nearly UAH 600,000, more than $90,000, mobile phones, hardware cryptocurrency wallets, SIM cards, computer equipment, documents and other potential evidence.

The seized devices and records are expected to support investigators as they trace the movement of funds and establish the roles of individuals suspected of participating in the investment scam.

Four suspects detained as investigation continues

Police said four alleged members of the criminal organisation had been detained, including the suspected organiser and three other participants. A fifth person, described as an accomplice, was also notified of suspicion under provisions of Ukraine’s Criminal Code covering fraud and the creation, management or participation in a criminal organisation.

The charges cited by investigators include Part 4 of Article 28, Part 4 of Article 190, and Parts 1 and 2 of Article 255 of the Criminal Code of Ukraine. The offences carry potential prison sentences of up to 12 years, alongside confiscation of property.

A court ordered the suspected organiser and three other detainees to remain in pre-trial detention. Another alleged co-organiser was placed under house arrest.

The investment scam investigation remains open, with authorities working to identify other people who may have been involved and determine whether additional victims were targeted. The police have not said whether further arrests are expected or whether assets linked to the alleged operation have been recovered.

The case highlights how fraudulent investment operations can combine conventional deception with cryptocurrency transactions to move proceeds across multiple financial channels. It also demonstrates the importance of cross-border cooperation when suspects, victims and financial transfers are spread across different jurisdictions.

Ukrainian authorities stressed that the investigation is ongoing. Under Article 62 of Ukraine’s Constitution, anyone suspected of an offence is presumed innocent until guilt is established by a final court conviction.