Crypto Investment Scammers Launder Over $540 Million, Spanish Authorities Arrest Five

Red Dog Security

05 Jul 2025 — 2 min read

Spanish police have arrested five suspects accused of laundering more than $540 million through fraudulent cryptocurrency investment schemes that defrauded over 5,000 victims worldwide. The case, supported by Europol and law enforcement agencies in Estonia, France, and the United States, highlights the growing scale and sophistication of crypto-enabled financial crime.

Key Details of the Operation

Operation Borrelli, led by Spanish authorities, uncovered a vast international network of fraudsters who used deceptive tactics to lure victims into fake crypto investments.

Scam Tactics: The "Pig Butchering" Method

The criminals employed a well-known social engineering tactic known as "pig butchering"—a form of romance scam that involves:

Building fake relationships through social media and dating platforms
Gaining victims’ trust and persuading them to invest in seemingly legitimate cryptocurrency platforms
Stealing the funds once invested and laundering them through a complex web of financial intermediaries

How the Money Was Laundered

Once the funds were stolen, the money was funneled through Asian financial institutions, with shell companies in Hong Kong used to obscure the origin and destination of transactions. The laundering process involved multiple bank accounts and cryptocurrency exchanges, complicating efforts to trace the assets.

AI’s Expanding Role in Financial Fraud

Europol emphasized that AI tools are making scams more convincing and harder to detect, noting the use of:

AI-generated personas to impersonate trusted contacts or romantic interests
Automated fake investment platforms with highly realistic user interfaces to deceive victims

This technological edge allows scammers to scale their operations and manipulate victims with increased precision.

Ongoing Investigation

Authorities are still actively tracing the stolen funds and working to identify additional accomplices and financial conduits involved in the scheme.
A cryptocurrency forensic specialist has been deployed to Spain to assist in analyzing blockchain transactions and supporting digital evidence collection.

Why It Matters

This bust underscores two key trends:

Organized cybercriminals are increasingly exploiting the anonymity and speed of cryptocurrency to carry out and conceal fraud at scale.
International cooperation is essential, as such operations often span multiple countries and legal jurisdictions.

As financial criminals become more tech-savvy, law enforcement agencies must evolve their tools, training, and partnerships to keep pace.

Follow for updates as the investigation progresses and authorities work to recover funds and prosecute those responsible.

352 Android Apps Infected with IconAds Adware

Security researchers at Human Security have uncovered a massive ad fraud operation dubbed IconAds, involving 352 malicious Android apps previously available on the Google Play Store. At its peak, the campaign generated over 1.2 billion ad requests per day, primarily targeting users in Brazil, Mexico, and the United States.

AI Chatbots Like ChatGPT Are Providing Fake URLs for Major Companies

Cybersecurity analysts at Netcraft have uncovered a troubling trend: AI chatbots frequently generate incorrect or misleading URLs when asked to provide official website links for major brands. According to researchers, this flaw opens a dangerous new vector for phishing and domain hijacking attacks. Key Findings from Netcraft’s Study The

Hackers Leak Allegedly Stolen Telefónica Data

A hacker is threatening to release 106 GB of data allegedly stolen from Spanish telecommunications giant Telefónica, though the company firmly denies any recent breach or data compromise. The threat actor, operating under the alias “Rey,” claims the intrusion occurred on May 30, during which over 12 hours of data

.es Domains Become 19 Times More Popular Among Phishers

Cybersecurity researchers at Cofense report a dramatic rise in phishing campaigns leveraging .es domains, which are officially reserved for Spanish-language websites or entities based in Spain. The use of these domains by cybercriminals has surged 19-fold since the beginning of 2025, making .es the third most exploited top-level domain (TLD)