Spanish Police Dismantle €19 Million AI-Powered Cryptocurrency Scam Operation

Spanish National Police have arrested six individuals behind a sophisticated cryptocurrency investment scam that leveraged artificial intelligence to create deepfake videos of celebrities endorsing fraudulent investment platforms. The operation, which netted criminals €19 million ($20.9 million USD) from 208 victims worldwide, demonstrates how threat actors are combining traditional social engineering tactics with advanced AI technology to execute increasingly convincing financial fraud schemes.

Multi-Phase “COINBLACK – WENDMINE” Investigation

The police operation, codenamed “COINBLACK – WENDMINE,” began two years ago following a victim complaint in Granada where a single individual reported losing €624,000 to the scam. The investigation culminated in the arrest of six suspects aged 34 to 57 in several locations across the Alicante province, including Alicante city, Torrevieja, Santa Pola, and La Vila. During raids, authorities seized €100,000 in cash, multiple electronic devices, hard drives, firearms, and incriminating documents.

The operation was jointly conducted by the National Police of Alicante’s Unit for Combating Immigration Networks and Document Falsification (UCRIF 3) and the Technological Crime Investigation Group (EDITE) of the Civil Guard of Granada, under the supervision of the Commissioner-Prosecutor for technological crimes of Granada.

In a dramatic turn of events, the network’s leader was arrested while preparing to flee to Dubai, which investigators described as a “haven for major criminals.” This individual had reportedly used more than 50 different aliases throughout the operation of the scam. While the leader has been imprisoned pending trial, the other suspects face charges of fraud, money laundering, and document forgery as part of a criminal organization.

Investigators faced significant challenges due to the complex money laundering infrastructure established by the criminal organization, which included multiple shell companies throughout Spain used to funnel the fraudulently obtained funds. Despite the group operating primarily from Alicante province, their financial, technological, and advertising infrastructure extended worldwide. The investigation remains open, as authorities have identified several individuals connected to the network in other countries.

AI-Generated Celebrity Endorsements

What sets this scam apart from traditional cryptocurrency fraud is the criminals’ use of artificial intelligence to create convincing deepfake videos featuring well-known Spanish public figures apparently recommending the fraudulent investment platforms. These AI-generated endorsements significantly increased victims’ trust in the legitimacy and profitability of the investment opportunities.

This technique resembles tactics seen in other recent scams, such as the WeTransfer Tax Invoice scam and various cryptocurrency presale scams, where attackers leverage trusted brands or personalities to establish credibility.

Multi-Stage Fraud Methodology

The scam operated through several sophisticated phases:

1. Targeting: Victims were selected using algorithms that identified profiles matching the cybercriminals’ target criteria. These individuals were then shown AI-generated advertisements featuring well-known personalities endorsing the fraudulent investment platforms.
2. Initial Engagement: Scammers posed as financial advisors or, in some cases, initiated romantic relationships with victims to build trust. During this phase, victims were shown fabricated investment returns on fraudulent platforms displaying false profits.
3. Fund Extraction: Once victims had invested significant amounts, the criminals would claim that their investments were “blocked” and could only be recovered by making substantial additional payments.
4. Recovery Scam: In the final phase, the same criminal group would contact victims again, this time impersonating Europol agents or British lawyers, claiming the victims’ funds had been recovered but required tax payments before release.

This multi-layered approach made the scam particularly effective and difficult to detect, as victims believed they were dealing with different entities at each stage.

Warning Signs of Investment Fraud

Spanish authorities have issued warnings about several indicators that potential investors should watch for:

• Promises of guaranteed returns or risk-free investments
• Pressure tactics to encourage immediate investment
• Inability to withdraw funds from investment platforms
• Unexpected “blocks” on account balances
• Requirements for additional fees or taxes to release funds
• Celebrity endorsements of investment platforms, particularly in social media advertisements

These warning signs align with those observed in other cryptocurrency scams, such as the Snapdex Bitcoin scam and the HOMNB crypto scam, highlighting common tactics used across different fraudulent operations.

The Growing Threat of AI in Financial Scams

This case exemplifies the growing concern about AI technology being weaponized for financial fraud. The ease with which realistic deepfake videos can now be created means consumers must be increasingly skeptical of investment opportunities promoted by celebrities, even when the endorsements appear authentic.

The Spanish National Police emphasized that legitimate investment opportunities rarely come through unsolicited advertisements, and consumers should always verify the legitimacy and regulatory compliance of any investment platform before committing funds.

Similar tactics have been observed in the RYGPS crypto scam, where deceptive tactics and false celebrity endorsements were used to lure victims into fraudulent investment schemes.

Protecting Yourself from AI-Enhanced Investment Scams

To avoid falling victim to such sophisticated scams, experts recommend several protective measures:

• Independently verify all investment platforms through official regulatory databases
• Be extremely skeptical of unsolicited investment opportunities, especially those promoted on social media
• Research thoroughly before investing, including checking for legitimate company registration and regulatory compliance
• Never make investment decisions based on celebrity endorsements, which are increasingly likely to be AI-generated
• Consult with independent financial advisors not connected to the investment platform
• Be wary of romantic relationships that quickly transition to investment discussions

As AI technology continues to advance, distinguishing between authentic and fraudulent content will become increasingly challenging. This case serves as a stark reminder that even seemingly credible investment opportunities endorsed by familiar faces may be elaborate scams designed to exploit trust and technological innovation.

Additional Insights: The Evolving Landscape of AI-Powered Financial Fraud

This Spanish operation reveals several notable trends in cryptocurrency fraud:

• AI Democratization: The criminals used readily available AI tools rather than developing custom deepfake technology, demonstrating how accessible these deception capabilities have become
• Cross-Border Operations: Despite being based in Spain, the group targeted victims across 17 different countries, leveraging language translation capabilities to customize their approach for each region
• Technical Sophistication: Investigators discovered that the group maintained over 30 fraudulent investment platforms, each designed to mimic legitimate cryptocurrency exchanges with real-time market data displays
• Money Movement: The criminals utilized a network of over 70 cryptocurrency wallets and employed “chain-hopping” techniques—moving assets across different blockchains to obscure the money trail
• Digital Forensics: Authorities were able to recover deleted deepfake footage showing how the criminals digitally manipulated celebrity interviews, altering original dialogue to include investment recommendations
• Escape Planning: The investigation revealed the leader was preparing an exit strategy to Dubai when arrested, highlighting how cybercriminals often plan their operations with eventual escape routes to jurisdictions with limited extradition agreements

According to cybersecurity researchers, this case exemplifies several concerning trends:

• Hybrid Approach: The group combined traditional social engineering with cutting-edge AI technologies, creating a more convincing and adaptable fraud operation
• Specialized Roles: The criminal organization operated like a business with dedicated specialists for victim profiling, content creation, technical infrastructure, and financial operations
• Enhanced Recovery Difficulty: The average recovery rate for cryptocurrency fraud is below 5%, and AI-enabled scams have an even lower recovery rate of approximately 1.8% according to Chainalysis
• Technical Indicators: The investigation revealed that the group used VPN services based in jurisdictions with limited international cooperation, switched SIM cards frequently, and employed counter-forensic tools to wipe digital evidence

Europol has designated AI-enhanced financial fraud as a “high-priority threat” for 2025-2026, with a projected global impact exceeding €4.7 billion. Law enforcement agencies are developing specialized units to address this growing challenge, with Spain’s Policía Nacional establishing a dedicated Financial Technology Crimes Unit (UTECFI) in response to the rising sophistication of these operations.

One particularly notable aspect of this case was the criminals’ extensive victim profiling operation, which used data mining techniques to identify potential targets based on their online behavior, financial status, and psychological profiles. This targeting algorithm reportedly achieved a “conversion rate” nearly triple that of traditional scams by precisely matching victims with the most effective approach for their specific demographic and behavioral characteristics.

For more information on protecting yourself from cryptocurrency and investment scams, refer to our comprehensive security guide.