241 scam sites taken offline, the recovery scam lives on: what to check now

On 14 October 2026 the Brooklyn District Attorney's office and the FBI shut down a fraud network: 241 websites went offline and 112 servers were seized. What makes this case unusual is the second stage of the fraud rather than the first. The same operators called their victims again weeks after the loss – this time posing as a recovery service that would get the lost money back. The tactic is known as a recovery scam, and it carries on after the takedown.

For investors in Germany this is not a distant American story. Five days before the Brooklyn announcement, on 9 October 2026, the German regulator BaFin issued a warning about a purported “Vantex Bank” and named the suspicion of recovery fraud explicitly. The method is identical and the target group never changes: people who have already lost money and whose contact details sit in the operators' database.

What the Brooklyn District Attorney and the FBI shut down

The figures in the case are modest, which makes them easy to remember. 241 websites were seized or disabled, together with 112 servers held at hosting providers in Eastern Europe and the United States. The investigation ran for three years. Authorities say the operators took several tens of millions of dollars; about $300,000 has been secured so far. There were no arrests.

Victims were recruited through Russian-language ads on Facebook. Supposed investment advisers then telephoned and walked them step by step through buying crypto assets and sending them to a fake trading platform. District Attorney Eric Gonzalez said, according to the report by CoinDesk, that the operators had tried to exploit the victims “a second time with false promises to recover their money”.

Stage one: a fake trading platform and a blocked withdrawal

The first part follows a sequence that supervisors have been describing for years. The victim sees a portfolio on the platform in which the stake keeps growing. The numbers on the screen are invented, but they work, because they move and because a friendly adviser explains them over the phone. As long as money only flows in, everything runs smoothly.

The break comes with the first withdrawal attempt. The account is frozen, or a demand appears: a tax, an unlocking fee, an administrative charge, a security deposit. Pay it and the next demand arrives. Refuse and the line goes quiet. Either way the money is gone, and the operators hold a complete profile: name, phone number, address, size of the loss, often a copy of an ID document as well.

We showed what a series of such platforms looks like from the outside on 14 October 2026, using the 23 near-identical websites that BaFin had warned about: what to watch on an unlicensed crypto platform. The design repeats itself because it is cheap to copy.

Stage two: the recovery service calls back weeks later

After a few weeks comes the second call. On the line now is no trading platform but a law firm, an IT forensics specialist, an investigation unit, sometimes a bank. The caller knows the case in striking detail, quotes amounts and dates, and that is precisely why the scam works: the details come from the operators' own database.

The promise is that the transfer can be traced on the blockchain and the balance frozen or reversed. Technically it sounds plausible enough to raise hope. The demand that follows is always the same: a payment up front. Sometimes it is billed as expert fees, sometimes as a court cost advance, sometimes as tax on the repayment, sometimes as an activation fee for an escrow account.

BaFin warnings now also describe a variant aimed at people who have lost nothing at all: the story involves a grant or a gift that supposedly only needs to be released. The mechanism stays the same and only the pretext is swapped out.

Why 112 seized servers achieve more than 400 deleted domains

Brooklyn's virtual currency unit had already taken some 400 domains out of circulation before this case. The effect lasted only briefly each time: a blocked domain is replaced within hours, and the content sits ready as a copy. So this time the action targeted the servers themselves, which held the sites, the customer database and the dialling software.

That removes not only the website but also the call list. Whether it holds remains to be seen; the infrastructure used IP addresses in Ukraine and other Eastern European countries, and prosecutors have reported no arrests so far. A network taken offline without defendants can be rebuilt somewhere else.

In short, do not rely on a site having disappeared. What decides the matter is who approaches you and what they want from you, not the address in the browser bar.

BaFin warning of 9 October 2026: the fake Vantex bank and the forged EBA register

The German case sits right alongside it in time. On 9 October 2026 BaFin warned about the sites vantex-bank.com and vantex-bank.net, which advertise a credit institution called “Vantex Bank”. No such institution exists in Germany or in France. To back up the supposed authorisation, the operators pointed to an apparently forged register of the European Banking Authority. BaFin sees indications that the purported bank is intended for recovery fraud involving crypto balances. Austria's FMA published its own warning about the same address on the same day.

The forged register is the most elaborate part of the scam, because it is meant to neutralise the obvious cross-check. Our analysis of 9 October sets out what such a forgery looks like and how to spot it: forged EBA register: how to check a crypto licence. The supervisor publishes its current warnings itself under BaFin news and warnings.

Five features that give the recovery scam away

The features recur across every known case, from the Brooklyn network to the BaFin warnings of recent weeks.

• The contact comes from outside. You have not hired anyone. The call, messenger note or email arrives unsolicited, often from a foreign number.
• The caller knows your loss. Amount, date, platform name: how would an unknown law firm have that? The data comes from stage one.
• There is a guarantee of success. Serious legal action never promises an outcome. An assurance that the money will be recovered “100 percent” is on its own enough to rule the offer out.
• The ID copy first, the money second. The identity check looks official and serves identity theft at the same time.
• At the end stands a payment up front. Whatever it is called, it is the real purpose of the entire conversation.

A sixth feature appears less often but is the most dangerous: the request for access to the wallet in order to “prepare the reversal technically”. Anyone using a hardware wallet who has never recorded their recovery words digitally is protected at this point. Which devices do the job and what they cost is set out in our hardware wallet comparison.

Authorisation under MiCA: which registers give an answer

Anyone offering crypto asset services commercially in Germany has needed authorisation since the European MiCA regulation took effect. That authorisation is publicly verifiable, and at a place the supervisor runs itself: BaFin's company database at portal.mvp.bafin.de. It shows whether a provider is licensed and for what. A second source is ESMA's MiCA register.

The detour matters: you look the provider up in the database instead of following the link somebody sends you. A forged register like the one in the Vantex case only works as long as the recipient clicks the link in the email. We have collected the obligations behind a genuine authorisation in our overview of the MiCA licence.

Recovering stolen crypto assets, incidentally, falls into none of these categories. Anyone offering it is either providing legal services – which fall under Germany's Legal Services Act, and a lawyer is listed in the federal register of attorneys – or offering nothing they can actually deliver.

Advance payment, tax, fee: the demand for money is the giveaway

Every variant of the scam converges on the same point. At some stage money is supposed to move before anything happens. The justification changes, the mechanism does not.

A simple line of reasoning from German law helps here. Tax on a repayment is paid to the tax office, not to a service provider. Court costs are collected by a court, on the basis of a costs order with a file number. A bank that unblocks your account does not ask for a transfer to an account abroad. As soon as the payment route departs from that pattern, the matter is settled, however convincing the conversation was.

Investment fraud with fictitious gains also raises a tax question that catches many victims off guard. What the tax office makes of invented profits, and how losses are treated, is a separate matter worth clarifying before the next tax return.

Seed phrase and remote access: where a loss of money becomes a loss of wallet

Stage two does not always aim at a transfer. In some cases it is after credentials. The supposed forensics specialist asks you to install remote maintenance software in order to “analyse the transaction”. Or he asks for the twelve or twenty-four recovery words, the seed phrase, supposedly to set the wallet up again in a secure environment.

There is no room for manoeuvre here. The recovery words are the key to the holdings. Hand them over and you transfer the balance; afterwards no body exists that can undo it. No authority, no court, no custodian and no service provider ever asks for them. The same goes for screen sharing during access to a wallet.

If remote maintenance software is already installed, disconnect the device from the network and move the holdings from a clean environment to a freshly set up wallet with a new seed phrase. The old one counts as burned from then on, even if nothing has left yet.

Report, bank, evidence: the route after money has left in Germany

Once money has gone, the order of steps counts. First the bank or the payment service provider, and immediately: where a transfer has not yet been executed or not yet passed on, there is a small chance of a recall. Card payments allow a chargeback procedure depending on the case. Both run to deadlines measured in days.

Then the criminal complaint with the police, which is also possible through the online stations of the federal states. What is useful for the file: bank statements, transaction IDs of the blockchain transfers, recipient addresses, the chat history, the phone numbers and screenshots of the platform while it is still reachable. Gather these records before you break off contact, because access disappears quickly afterwards.

In parallel, BaFin accepts tips about unauthorised business; the public warnings that help other investors grow out of them. Consumer advice centres and victim support organisations advise free of charge or for a small fee. What does not exist is a body that recovers money against payment up front.

Recovery services: no authority asks for money up front

The Brooklyn takedown shows both things: that investigations can bite, and that they come late. Three years of work, 241 sites, 112 servers, around $300,000 secured out of several tens of millions of dollars in damage. Prevention is far more effective in this field than clearing up afterwards. Three steps that change something today:

1. Check the licence before you deposit. Look the provider up in BaFin's company database, not in the register the website links to. An overview of licensed venues is available under regulated crypto exchanges compared.
2. Keep holdings off the trading platform. Whatever you are not actively trading belongs in your own custody; a frozen platform account then reaches into thin air. The devices for it are listed in the hardware wallet comparison.
3. Hang up on the second call. Any unsolicited recovery offer after a loss is stage two of the same scam until proven otherwise. For the obligations a genuine provider has to meet, read the overview of MiCA duties.

(As of 15 October 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)