Dutch police dismantled a crypto investment fraud ring that allegedly generated more than €100 million a month, operating across two dozen call centers in multiple countries since at least 2021 and defrauding tens of thousands of victims worldwide.
Dutch authorities have dismantled a large international investment fraud network that allegedly deceived tens of thousands of victims worldwide into pouring money into fictitious cryptocurrency trading platforms, police announced Wednesday.
The criminal organization operated as many as two dozen call centers across multiple countries, employing more than 700 people who posed as professional financial advisers, according to authorities. The network had been running since at least 2021 and allegedly generated more than €100 million — roughly $114 million — per month at its peak.
At the center of the investigation is a 46-year-old man holding both Israeli and Polish citizenship, whom Dutch police describe as a "well-known hacker" who is "no stranger to the cyber world." Authorities arrested him in May at a Polish airport after he arrived from Dubai. He has since been extradited to the Netherlands, where a judge ordered him held in pretrial detention. Dutch police have declined to disclose his name.
Beyond the alleged ringleader, authorities also arrested two Dutch nationals and one Belgian national living in Cyprus, an additional suspect in Belgium, and a Dutch national in Greece. Police said the investigation remains ongoing and further arrests are possible.
Investigators said the operation was deliberately structured to evade detection. Employees worked under false names, masked their locations, and used technical tools to conceal their identities. The main suspect's technical expertise, police said, was central to keeping the network hidden from law enforcement for years.
The scheme worked by first building trust with potential victims over weeks or even months through phone and online contact. Targets were initially encouraged to invest small amounts through what appeared to be credible cryptocurrency trading platforms. Those early positions appeared to generate strong returns, prompting victims to commit progressively larger sums.
The returns, however, were entirely fictitious. Investigators said the money was never actually invested and instead flowed directly to the organization, frequently routed through cryptocurrency payments.
Dutch police estimate that victims in the Netherlands alone lost nearly €25 million — approximately $28.6 million — with tens of thousands more defrauded internationally.
The human cost described by victims was severe. "All contact suddenly stopped," said one Dutch victim identified only as Alex, in testimony released by police. "That's when I realized I'd been completely scammed. I was incredibly angry and could have kicked myself. I thought, 'I fell for it.' The life I had imagined for myself collapsed."
Other victims described consequences that extended beyond financial ruin. One told local media that his losses left him unable to afford food for his family, while another said losing his life savings drove him to consider suicide.
Investigators said that in several cases, authorities were able to contact victims before they transferred additional funds, preventing further losses — underscoring the scale of the network's reach and the ongoing nature of the operation at the time of its dismantling.
The takedown highlights a continued pattern of sophisticated, internationally organized crypto fraud that law enforcement agencies across Europe have been working to counter, and signals that transnational cooperation remains central to pursuing criminal networks that deliberately fragment their operations across jurisdictions to complicate detection.
Marc Sabatini is a staff writer at TechEchelon covering enterprise software, cybersecurity, and the regulatory beats that shape both. He focuses on the deal flow and policy decisions that move markets.
More from Marc →Microsoft's July 2026 Patch Tuesday fixes a record 570 vulnerabilities, including two actively exploited zero-days in Active Directory Federation Services and SharePoint Server, alongside a Windows 10 extended security update carrying the same patches.
Australia's cyber agency has warned of a global campaign targeting CMS platforms including WordPress and Craft CMS, while Group-IB researchers have detailed a new RedHook Android malware variant that abuses Wireless ADB to gain shell-level device access without requiring root.
The European Parliament voted to reinstate a law allowing companies like Google, Microsoft, and Meta to voluntarily scan user messages for child sexual abuse material, extending the authorization through 2028 despite more present members voting against it than for it.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.