Ukraine has dismantled a network of fake crypto investment platforms that allegedly drained wallets belonging to people in more than 20 countries, with investigators identifying 62 victims so far.

The National Police of Ukraine said investigators from its Main Investigation Department worked with the Security Service of Ukraine and the Office of the Prosecutor General to uncover the operation, which maintained several offices in Kyiv and the surrounding region.

More than 46 Ukrainians were recruited into the network, while authorities are still identifying other participants, victims and the total amount stolen.

Fake crypto investment platforms targeted more than 20 countries

Investigators said the group created websites designed to look like legitimate investment platforms and used them to offer supposedly profitable cryptocurrency projects.

The Security Service said the scheme began with advertising distributed through Telegram, where potential customers were offered opportunities to invest in crypto projects. Users who registered were instructed to connect a cryptocurrency wallet and transfer funds to the platform.

Behind the websites, developers maintained the infrastructure and worked to keep the platforms accessible when attempts were made to block them. Other members of the group staffed offices, communicated with customers and provided security for the operation.

Once funds were deposited, employees manually simulated investment activity. Customers could see account balances rising inside their dashboards, although investigators said the displayed trading activity was fabricated.

A 25-year-old IT specialist organized the network, according to the Security Service. At its peak, the operation had monthly turnover of up to $1 million.

Authorities have so far identified 62 victims from more than 20 countries. They included citizens of Germany, Poland, Lithuania, Latvia, Spain, France, the UK, Canada and Israel.

The number could rise as investigators continue examining information recovered from the network’s infrastructure and determining how many people transferred cryptocurrency through its websites.

Wallet drainer activated during withdrawal attempts

The alleged theft entered another stage when customers attempted to withdraw their funds.

Operators blocked withdrawal requests and told victims that another verification procedure was required before their money could be released. Users were instructed to connect their primary cryptocurrency wallet and approve a small test transaction to demonstrate that the platform was functioning.

Investigators said the websites contained a wallet drainer that used the authorization to transfer assets from a connected wallet to addresses controlled by the group. After the cryptocurrency had been moved, the victim lost access to the investment platform.

The method relied on the same type of malicious authorization used in wallet drainer attacks, where users can unknowingly give an attacker-controlled contract permission to move their tokens. As crypto.news previously reported in July, approval phishing can involve token approvals, permit signatures and other authorizations that allow assets to be transferred without an attacker obtaining the wallet owner’s private key.

A similar technique surfaced in August when a Hyperliquid user lost roughly 550,000 USDC after interacting with a fraudulent website promoted through a Google advertisement. Security firm Salus later connected the fake Hyperliquid website to infrastructure associated with the Inferno drainer ecosystem.

Salus said that operation included malicious scripts, approval-command generation, automated draining, cross-chain withdrawals and tools for consolidating stolen funds. The Ukrainian case used a different investment pitch, but investigators similarly said victims were induced to authorize a transaction before assets were removed from their wallets.

The fake platforms collected more than cryptocurrency. Registration and verification procedures gathered victims’ passport information, phone numbers, email addresses, account logins, passwords and photographs, according to Ukrainian authorities.

Netherlands servers held records of victims and stolen crypto

Investigators traced server equipment used by the network to the Netherlands and obtained access to a database stored there.

The records contained information about victims, including cryptocurrency wallet addresses and the amounts allegedly stolen from individual users. Authorities said the servers held internal correspondence between members of the group and records describing how the fraudulent platforms operated.

Access to the database helped investigators trace the network across several countries and identify people who had interacted with the websites.

The international element follows several law enforcement operations targeting online investment fraud and crypto-linked social engineering schemes. INTERPOL said in August that Operation Jackal IV resulted in 58 arrests and identified 263 suspects after authorities in 22 countries targeted investment scams, romance fraud and related money laundering networks.

South African authorities seized $2.67 million during that operation and blocked 257 bank accounts, while Romanian police arrested 11 suspects in an investment scheme associated with an estimated €143 million, according to INTERPOL.

A larger INTERPOL crackdown reported in July produced 5,811 arrests across 97 countries and territories. Operation First Light intercepted $293 million in illicit assets, blocked more than 31,000 bank accounts and identified over 142,000 victims while targeting investment fraud, romance scams, impersonation and other forms of social engineering.

Investigators in that operation uncovered crypto laundering activity that used several digital assets and cross-chain swaps. INTERPOL said one wallet linked to a Thai investigation had processed more than $122.5 million over a 10-month period.

Approval phishing has drawn separate enforcement attention. A UK-led operation involving authorities in the United States and Canada froze more than $12 million in suspected scam proceeds earlier this year and identified more than 20,000 potential victims.

The operation focused on schemes in which victims were persuaded to sign malicious blockchain authorizations that gave scammers permission to move cryptocurrency from their wallets.

Police seized more than 200 computers and phones

Ukrainian officers carried out 34 searches at homes, offices and vehicles across Kyiv and the surrounding region as part of the investigation.

More than 100 computers and other pieces of computer equipment were seized along with over 100 mobile phones, 79 SIM cards and a GSM gateway. Police recovered cash and records connected with the operation, while 15 vehicles were taken during the searches.

Some cars and real estate used by members of the network had been registered in the names of suspects’ wives and other relatives, investigators said. The alleged organizer traveled with armed guards.

The criminal proceedings are being conducted under Part 5 of Article 190 of Ukraine’s Criminal Code, which covers fraud. Authorities have not disclosed a final loss figure because they are continuing to identify suspected members of the network and additional victims.

Ukraine has separately been developing procedures for handling cryptocurrency recovered through criminal cases. Authorities transferred more than $8.3 million in seized USDT to a state-managed wallet in June, the first time confiscated cryptocurrency had been placed under direct state management.

The Royal United Services Institute has estimated that stronger rules for tracing, seizing and managing illicit cryptocurrency could help Ukraine recover at least $10 billion in stolen funds and lost tax revenue.

Police said investigators are continuing to identify everyone involved in the fake investment network, locate further victims and determine the total value of cryptocurrency stolen through the platforms.

Hyperliquid opened its HIP-4 outcome-market infrastructure to outside venues on Aug. 29, and daily trading volume nearly tripled within three days, according to research published Sept. 3.

Daily volume increased from an August average of approximately $545,000 to $1.97 million on Aug. 31, the Hyperliquid Research Collective reported. The trailing daily figure subsequently reached approximately $2.75 million.

Two outside venues, Outcome and Skew, posted 500,000 HYPE bonds and began deploying markets through seven templates approved by Hyperliquid validators. However, the early volume was heavily concentrated in Outcome and supported by trading incentives.

The rollout makes market deployment permissionless at the protocol level. It does not automatically authorize HIP-4 operators to serve U.S. customers or offer every category of event contract.

Hyperliquid HIP-4 opens deployment to outside venues

HIP-4 supports fully collateralized outcome contracts that settle within a fixed range, usually zero or one. Prices can represent the market’s assessment of whether a specified event will occur.

Unlike perpetual futures, these contracts do not use leverage, funding payments or liquidations. Traders must provide the full collateral required for their positions.

As crypto.news previously explained, HIP-4 introduced outcome contracts alongside Hyperliquid’s builder-deployed perpetual markets. The first HIP-4 products reached mainnet in May but remained controlled by validators and selected operators.

The Aug. 29 upgrade opened deployment to outside builders. Each operator must bond 500,000 HYPE for at least six months. The bond can be slashed if validators determine that a deployer created an invalid market, settled it incorrectly or failed to complete settlement within the permitted period.

Permissionless deployment also remains limited by templates. Validators approve standard market formats and their permitted language. Builders can then launch markets that follow those specifications without seeking separate approval for every contract.

This design separates market creation from template governance. Outside operators gain control over individual listings, while validators retain influence over the categories and settlement structures that the protocol supports.

Incentives drove most of the early volume

Outcome accounted for approximately 85% of reported HIP-4 volume after third-party deployment opened. Skew produced roughly 1%, leaving the remaining activity with existing validator-deployed markets.

Outcome introduced a $1 million rebate campaign that paid users approximately one cent for every dollar traded, according to the research. The incentive means the initial increase should not be treated entirely as evidence of lasting demand.

Rebate programs can encourage participants to trade more frequently or execute transactions that would be less attractive without rewards. The reported volume remains genuine trading activity, but its durability will become clearer after incentives decline or expire.

The concentration also creates an early test for HIP-4’s permissionless model. Two operators have posted bonds, yet one venue controls most of the new activity. More deployers, market templates and liquidity sources would be needed to establish a broader competitive market.

Hyperliquid previously announced plans for permissionless HIP-4 deployment in July. At the time, crypto.news reported that outside builders would need substantial HYPE stakes and could face slashing.

The current 500,000 HYPE requirement provides an economic penalty for misconduct. However, its dollar value also creates a high entry barrier. Only operators controlling or borrowing large HYPE positions can deploy markets directly.

No verified market data showed that the permissionless rollout alone caused a distinct change in HYPE’s price. Wider crypto-market conditions and other activity on Hyperliquid also affect the token.

Shared settlement connects outcomes with perpetuals

HIP-4 contracts settle using prices published by Hyperliquid validators every three seconds, according to the collective. The outcome positions use the same account environment supporting Hyperliquid’s perpetual markets.

This architecture can allow a trader to hedge a binary outcome with a perpetual contract referencing the same mark price. Because both positions use the same underlying price source, the hedge avoids differences created when separate venues use different indexes or settlement times.

For example, a contract paying one dollar if Bitcoin closes above a specified level could be paired with a Bitcoin perpetual position. Both instruments would respond to a common Hyperliquid mark rather than independent external references.

The arrangement does not remove every risk. Traders still face liquidity, execution and settlement risks. Validators also play a central role in publishing the prices used for settlement.

The collective argued that neither Kalshi nor Polymarket can offer an identical hedge because their event contracts do not share Hyperliquid’s perpetual account and mark-price system. That comparison concerns technical market structure, not liquidity quality, regulatory protection or overall platform risk.

Kalshi operates as a regulated U.S. designated contract market. Polymarket has used blockchain settlement and external resolution systems. Hyperliquid instead places matching, collateral and validator-directed settlement within its own network.

That tighter structure may reduce basis differences between instruments. It also concentrates operational dependencies within Hyperliquid’s validator and trading systems.

U.S. access remains a separate challenge

None of the current HIP-4 templates reportedly covers sports, elections or other categories commonly associated with federal event-contract disputes. Existing listings instead focus on prices, economic figures and other objectively measurable results.

Avoiding sports does not by itself make the markets lawful for U.S. customers. A platform offering commodity derivatives to U.S. persons generally requires an appropriate regulatory framework, regardless of whether its software permits permissionless deployment.

The Commodity Exchange Act allows registered entities to submit new contracts to the Commodity Futures Trading Commission. Federal law also allows the CFTC to review event contracts involving gaming, terrorism, assassination, war, unlawful activity or similar subjects considered contrary to the public interest.

Current CFTC rules establish a review process for contracts involving those categories. The regulator can request a trading suspension during a 90-day review before approving or rejecting a contract.

Sports would therefore add another legal question. The research collective found that sports accounted for 91% of HIP-4’s largest historical trading session. Opening third-party sports markets could increase demand, but it could also trigger scrutiny under the gaming provision.

The collective described regulatory “permission” as the remaining constraint, but no regulator has confirmed that registration alone would authorize every HIP-4 structure or market category.

The legal status could also depend on who operates the interface, controls market parameters, receives fees and makes the platform available to U.S. users. A protocol’s decentralized architecture does not settle those questions automatically.

What happens next for HIP-4

The clearest test will be whether volume remains above its August average after Outcome’s rebate campaign ends. Activity will also need to spread beyond a single operator to demonstrate that permissionless deployment has produced durable competition.

Additional builders may enter after posting the required HYPE bonds. Hyperliquid validators could approve more templates, expanding the range of economic, crypto and financial outcomes available for deployment.

U.S. access would require a separate compliance path. Any operator seeking American users would need to determine whether its contracts require CFTC registration, submission or other authorization.

Sports markets would face an added review question because federal law specifically identifies gaming as an event-contract category that may be examined under the public-interest standard.

FAQs