In a sweeping anti-cryptocurrency fraud operation, Argentine authorities have detained 24 individuals and confiscated digital assets valued at more than 8 million USDT across the country. Prosecutors describe the investigation, which targeted various regions, as one of Argentina’s most extensive crypto operations to date.
Initial findings from the operation
Officials reported that, under the operation dubbed “Fake Coin,” coordinated raids were carried out at 90 different locations simultaneously on May 31. At the core of the case are three separate networks that targeted citizens with bogus investment opportunities distributed via WhatsApp and WhatsApp Business. Investigators identified approximately 3 billion Argentine pesos in damages. Authorities also seized 60 million pesos in cash and 80 technology devices.
According to official statements, these networks engineered fake apps and platforms that posed as legitimate financial institutions, luring users with promises of high returns. Individuals were led to believe they were investing, but every step of the process was part of the scam orchestrated by the suspects.
Fraud schemes and three distinct criminal structures
The investigation revealed three different types of fraud, each using distinct technical methods. The first group attracted investors with a fake investment app listed in the Google Play Store. The app, run by unlicensed advisors, received regular “investment” payments from users who believed they were participating in legitimate opportunities.
The second ring focused on hijacking WhatsApp accounts to impersonate victims and engage in phishing attacks. Funds obtained through this method were exchanged into USDT using Binance’s peer-to-peer (P2P) market, then funneled to overseas wallets, mainly in Venezuela.
During the operation, authorities traced more than 100 WhatsApp activation codes, noting these codes were critical to helping fraudsters contact and communicate with their victims.
The largest haul of digital assets occurred with the third group, based in San Isidro. Prosecutors reported that this network relied on malicious software known as “infostealers,” which is covertly installed on victims’ systems to steal bank credentials and passwords.
Glossary: Infostealer is a type of malware that, once it infects a computer, harvests user passwords and banking information. It is often used in fraud operations to access victims’ digital assets.
Legal process and data compiled
As part of the probe, authorities seized more than 8 million USDT in cryptocurrencies—an amount surpassing even the sum confiscated in the high-profile RainbowEx case earlier in 2024. During this phase, crypto asset service providers cooperated with law enforcement, playing a crucial role in the seizure of digital funds, though officials have not disclosed the list of collaborating firms.
Suspects now face charges including aggravated fraud, money laundering, membership in a criminal organization and violation of intellectual property rights. Court proceedings continue. Whether confiscated assets will be used to compensate victims remains subject to judicial decisions.
“Through digital surveillance and blockchain analysis during the operation, every transfer of stolen funds to recipient addresses was traced step by step. The data show that all three networks made efforts to conceal their tracks by employing different crypto wallets.”
