Europol Busts $539M Crypto Investment Scam Ring Spanning Spain, US, and EU

Journalist

Hassan Shittu

Journalist

Hassan Shittu

About Author

Hassan, a Cryptonews.com journalist with 6+ years of experience in Web3 journalism, brings deep knowledge across Crypto, Web3 Gaming, NFTs, and Play-to-Earn sectors. His work has appeared in…

Last updated: 

Why Trust Cryptonews

Cryptonews has covered the cryptocurrency industry topics since 2017, aiming to provide informative insights to our readers. Our journalists and analysts have extensive experience in market analysis and blockchain technologies. We strive to maintain high editorial standards, focusing on factual accuracy and balanced reporting across all areas – from cryptocurrencies and blockchain projects to industry events, products, and technological developments. Our ongoing presence in the industry reflects our commitment to delivering relevant information in the evolving world of digital assets. Read more about Cryptonews

Spanish authorities arrested five individuals on June 25 in connection with a massive cryptocurrency investment fraud worth $539 million (€460 million).

According to a press release by Europol, the organization began its involvement in 2023, contributing intelligence, financial analysis, and coordination between agencies. On the day of the arrests, Europol deployed a cryptocurrency specialist to Spain to assist with on-the-ground investigations.

Notably, three suspects were arrested in the Canary Islands and two in Madrid, with simultaneous searches carried out in these same locations.

Europol Details Crypto Fraud Bust: Spain Raids Uncover Global Scam Network

The suspects allegedly operated a worldwide network of sales representatives who promoted fraudulent cryptocurrency investment opportunities. These agents collected funds from unsuspecting victims through cash deposits, bank transfers, and crypto wallets.

Investigators believe the group created a sophisticated financial structure based in Hong Kong. This network used various payment gateways and multiple crypto exchange accounts, often registered under false identities, to receive and move the stolen funds.

Authorities confirmed that the criminal ring was able to move large sums of money across borders by exploiting weaknesses in cryptocurrency platforms and leveraging anonymity.

Furthermore, the investigation remains active, with authorities now analyzing digital evidence and tracing the movement of funds across jurisdictions. Officials have not ruled out additional arrests as inquiries continue.

Meanwhile, this investment scam is not isolated in Spain. In April, Spanish police arrested six people linked to a €19 million ($21.5 million) cryptocurrency scam. The scammers used AI-generated deepfake videos of celebrities to lure over 200 victims into fake investment schemes.

The investigation began after a Granada resident lost €624,000 ($700,000) and led to the discovery of a wider network that convinced victims to make additional payments under false pretenses. Interestingly, the alleged leader was caught while trying to flee to Dubai.

Online Fraud Becomes A Growing Threat

Meanwhile, Europol has identified online fraud as one of the fastest-growing threats to internal EU security.

In its 2025 Serious and Organised Crime Threat Assessment (SOCTA), Europol warned that internet-based scams, especially those involving cryptocurrencies, are increasing in scale and complexity.

The report also noted the growing use of artificial intelligence to enhance fraudulent schemes. These technologies are used to conduct social engineering attacks and gain unauthorized access to sensitive financial data.

Earlier this month, Europol dismantled Archetyp Market, a major darknet platform linked to over €250 million ($287 million) in illegal transactions, primarily involving drugs like fentanyl and MDMA. The site’s alleged German administrator was arrested in Spain, with additional arrests in Germany and Sweden.

Despite seizing the platform’s servers in the Netherlands, experts at TRM Labs warn the disruption may be temporary. TRM cited darknet operators increasingly turning to encrypted peer-to-peer channels like Telegram and Signal, making future enforcement more difficult, as the reason.