Case europol-700m-deepfake-crypto-adsDeepfake fraudWorldwide
Europol takedown of 700M euro crypto fraud network fed by deepfake celebrity ads
A two-phase Europol and Eurojust operation dismantled a network that laundered over 700 million euros from crypto fraud promoted via social ads with deepfake videos of celebrities; nine arrested in phase one.
CriticalAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Dec 4, 2025
- Location
- Worldwide
- Target
- Retail investors across Europe
- Severity
- Critical
- Triggered by
- Transnational crypto investment fraud and money-laundering network
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
A two-phase Europol and Eurojust operation dismantled a network that laundered over 700 million euros from crypto fraud promoted via social ads with deepfake videos of celebrities; nine arrested in phase one.
Impact: Over 700 million euros laundered; about 800,000 euros in bank accounts, 415,000 euros in crypto and 300,000 euros cash seized plus luxury watches and devices
Who triggered it
Actor: Transnational crypto investment fraud and money-laundering network
Attribution: Europol and Eurojust with police from Belgium, Bulgaria, Cyprus, France, Germany, Israel, Malta and Spain
Motive: Financial gain through fake crypto investment platforms and call-centre pressure
How it happened
Attack vector: Affiliate-marketing ads with deepfake endorsements driving victims to fake platforms, followed by call-centre pressure to invest more; layered laundering
Root cause: Ad networks and affiliate marketers monetised synthetic celebrity endorsements; laundering across many jurisdictions hid proceeds
Timeline
- Phase one raids in Cyprus, Germany and Spain at French and Belgian request; nine arrests, about 1.5M euros seized
- Phase two targets advertising and affiliate infrastructure in Belgium, Bulgaria, Germany and Israel
- Europol announces the takedown
Response
Arrests, seizures and continuing investigations to trace assets and remaining members
Current status: Ongoing
Sources (open in a new tab)
- Europol europol.europa.eu
- Breached.company breached.company
- TechRadar techradar.com
Cite this case
Europol takedown of 700M euro crypto fraud network fed by deepfake celebrity ads. AI Threat Watch, case europol-700m-deepfake-crypto-ads, Dec 4, 2025. https://aithreat.io/cases/europol-700m-deepfake-crypto-ads/
Permanent link: https://aithreat.io/cases/europol-700m-deepfake-crypto-ads/