International Sting Dismantles Cyprus-Based Crypto Fraud Hub Targeting Benelux Investors

Three suspects have been arrested in Cyprus over an alleged crypto investment fraud network targeting investors in Belgium and the Netherlands, according to the Cyprus Mail. The operation was coordinated with support from Europol.

Authorities say the group operated a professional call center-style business that used fake celebrity endorsements, social engineering and remote-access software to steal tens of millions of euros from retail investors.

The investigation involved police in Cyprus, Belgium and Greece. Losses reportedly run into tens of millions of euros.

During the raids, police seized hardware wallets, high-end computers and €50,000 in cash. Those devices may help investigators trace the wider laundering network and identify additional participants.

The Call Centre Model

The group allegedly used fake advertisements on major social platforms featuring well-known public figures from the Benelux region. Those ads generated leads, which were then passed to “investment advisers” and “account managers” operating from Cyprus.

According to investigators, the suspects used remote-access software to take control of victims’ devices. They would guide clients through account setup, gain access to their screens and then move funds into a chain of crypto wallets.

The withdrawal process followed a familiar scam-broker pattern. When victims tried to recover their money, they were asked to pay additional “taxes,” “guarantees” or other fees before funds could supposedly be released.

Cyprus Remains a Sensitive Hub

The operation also fits a broader enforcement trend. Europol and national authorities have increasingly shifted from taking down fraudulent websites to dismantling the organisations behind them.

In 2025, investigations uncovered a crypto fraud and money-laundering network that allegedly processed more than €700 million and led to nine arrests, while another joint operation removed more than 1,400 fraudulent investment websites linked to fake broker networks.

The latest investigation follows the same pattern. Rather than focusing on websites or crypto wallets, investigators targeted the operational infrastructure, including call centres, account managers and the people coordinating investor contact.