Telegram, fakes, and drainers: how Ukrainians were scammed out of cryptocurrency

In Ukraine, authorities uncovered a large-scale crypto fraud scheme involving so-called “drainers” – malicious tools that allow attackers to completely empty users’ crypto wallets. The damage caused by the group is already estimated in the millions of hryvnias, and the scheme itself followed a well-rehearsed сценарий, resembling a classic “trust-based trap” rather than a high-tech hacking attack.

According to investigators, the group operated through Telegram channels and communities, presenting themselves as “helpers” in crypto trading. Users were offered консультации, advice, and even “profitable opportunities,” creating the illusion of a legitimate service. In reality, it was a carefully designed social engineering scheme in which the victim’s trust became the key element of the attack.

From there, the process followed a familiar but still highly effective pattern. Potential victims were sent links to fake websites that visually and functionally mimicked popular crypto platforms. It was difficult to distinguish the fake at a glance – interfaces, logos, and even site behavior looked convincing. But beneath the polished surface were crypto drainers – malicious scripts that gained access to connected wallets.

Once a user connected their crypto wallet, they were essentially opening the door to the attackers themselves. After that, assets were automatically withdrawn without additional confirmation. In the crypto world, this is особенно painful – there is no support service that can say “wait, we’ll reverse the transaction.” Everything happens quickly and irreversibly.

Investigators documented several cases involving significant losses. In one case, more than 95,000 USDT were stolen – nearly 4 million hryvnias. In another, over 1,000 USDT were taken. And these are only the identified incidents, while the real масштабы may be larger.

The stolen funds were not kept in one place. The participants attempted to максимально complicate tracking by using typical crypto laundering techniques: transferring funds between multiple wallets, splitting amounts, converting into other assets, and cashing out. This chain of operations helped disguise the origin of the funds and made recovery more difficult.

The operation to expose the group was carried out jointly by investigators from the Main Investigation Department of the National Police, the cyber police, and the Cybersecurity Department of the Security Service of Ukraine. As part of the investigation, 20 searches were conducted, during which computer equipment, mobile devices, cash, and documents potentially confirming the suspects’ involvement were seized.

At this stage, four members of the group, including an alleged organizer, have been formally charged. They are accused of large-scale fraud and money laundering. The maximum penalty under these charges предусматривает up to 12 years of imprisonment with confiscation of property.

This story, in classic terms, once again highlights a simple rule – “not everything that glitters is gold,” especially in crypto. And if someone promises easy money and quick profits, it is better to verify first and only then “connect your wallet” – otherwise, instead of profit, you may quickly gain an experience no one intended to buy.