€700 million Crypto Scam Using Deepfakes Dismantled in Europe

Europol and police authorities across Europe have dismantled a cryptocurrency fraud and money-laundering network that inflicted €700 million in damages and used deepfakes to trick victims.

The operation involved several phases, multiple countries and a wide range of technical and financial infrastructure that supported the criminal activity.

The investigation uncovers a criminal network

Authorities initially discovered the network while investigating a seemingly fraudulent cryptocurrency investment platform.

In fact, fake cryptocurrency investment platforms are an extremely common tool of fraudsters in recent years, so it’s no surprise that authorities are finally cracking down.

As investigators analyzed activity linked to that particular platform, they also discovered other malicious actors, websites and an entire organized system that had a simple purpose: to funnel victims into fake investment schemes.

This structure included coordinated outreach, communication channels in multiple languages and access to exchanges needed to move illicit funds.

It’s also worth noting that the operation made use of deepfakes in all sorts of media, which were used to give more credence to their claims and promises.

 “In recent years, deceptive advertisements impersonating renowned media outlets, celebrities and politicians – often using deepfake videos - have posed a significant global challenge. The data of potential investors obtained through manipulated advertising, even on reputable platforms, is crucial to the functioning of the crypto-scam industry as a whole,” said Europol in their press release.

The criminal group, spread across multiple countries, used dedicated infrastructure specifically designed to obscure the fraudulent financial activity. The schemes went after users who believed they were actually talking with real platforms, but the returns displayed inside the platforms did not reflect reality.

First phase: arrests and seizures

The first coordinated action took place on 27 October 2023 in Cyprus, Germany, and Spain. Police carried out searches at several locations, arrested multiple people, and secured evidence connected to the fraud network.

Law enforcement authorities seized the following:

• More than €800,000 held in bank accounts
• €415,000 in cryptocurrency
• €300,000 in cash
• Digital devices and high-value items like expensive watches

Second phase targeted the affiliate infrastructure

Like many criminal infrastructures, the fake investment platforms work through many, many affiliates who are usually the backbone of their operations.  

Further investigation found that the network was heavily reliant on affiliate marketing. Criminal operators used promotional channels, call-center activity, hosting environments and real advertising systems to trick their victims and build credibility.

On 23 and 25 November 2023, authorities began the second wave of searches that targeted the promotional ecosystems used in the fraud. The law enforcement actions disrupted the network’s ability to find new victims, removed access to hosted content and gave investigators evidence that linked people and companies to the investigated platforms.

The investigation involved coordinated actions across Belgium, Bulgaria, Cyprus, France, Germany, Israel, Latvia, the Netherlands, and Spain. Investigators traced more than €200 million laundered through cryptocurrency channels during this period and conducted additional searches, interviews and evidence collection.

How users can stay safe from similar frauds

Criminal groups using fraudulent crypto platforms often rely on convincing graphical interfaces and claims of guaranteed returns.

Users should always verify whether an investment service has regulatory authorization, publishes transparent ownership information and has verifiable customer support.

People who receive unsolicited investment offers or experience pressure to make rapid deposits should stop communication immediately.

Users who suspect they interacted with a fraudulent platform should report the case to authorities and avoid sending further funds.

Bitdefender recently launched “They Wear Our Faces,” a national awareness campaign exposing how scammers exploit trust and relationships by using AI to deceive and impersonate.

FAQ

Which countries took part in the operation?

Belgium, Bulgaria, Cyprus, France, Germany, Israel, Latvia, the Netherlands, and Spain participated, coordinated by Europol.

How much money did the network handle?

Authorities linked the network to more than €700 million in criminal transactions.

What did police seize during the operation?

Investigators seized over €1.5 million in bank accounts, €1.9 million in cryptocurrency, €50,000 in cash, and numerous digital devices and high-value items.