A court-authorized international law enforcement operation led by the U.S. Department of Justice has disrupted SocksEscort, a large residential proxy network that allegedly exploited thousands of internet routers worldwide to facilitate cybercrime and financial fraud.
Authorities said the U.S. government executed seizure warrants against dozens of internet domains registered in the United States that were allegedly connected to the criminal infrastructure. The announcement was made by U.S. Attorney Eric Grant.
According to court documents, the SocksEscort network infected home and small business routers with malware, allowing operators to redirect internet traffic through compromised devices
The network then sold access to these infected routers as proxy services to customers seeking to hide their true locations online.
Investigators said the service had been operating since at least the summer of 2020 and offered access to roughly 369,000 IP addresses at various points
As of February 2026, the SocksEscort platform listed about 8,000 infected routers available for purchase, including around 2,500 located in the United States.
Cybercriminals allegedly used the proxy network to conceal their identities while carrying out a range of fraudulent activities. These included account takeovers targeting U.S. bank accounts and cryptocurrency platforms, as well as schemes involving fraudulent unemployment insurance claims.
Authorities said the crimes caused millions of dollars in losses to victims. Among the cases cited by investigators was a New York resident who lost approximately $1 million in cryptocurrency from an exchange account
In another case, a manufacturing company in Pennsylvania lost $700,000, while current and former U.S. service members using Military Star credit cards were defrauded of about $100,000.
The operation involved coordinated action by international partners, with law enforcement agencies in Austria, France, and the Netherlands helping dismantle key SocksEscort servers.
The investigation is being led by the Federal Bureau of Investigation Sacramento Field Office, along with the Department of Defense Office of Inspector General’s Defense Criminal Investigative Service and IRS Criminal Investigation.
Authorities said the operation highlights the growing importance of international cooperation in combating cybercrime networks that exploit global digital infrastructure.
Your web3 identity + services + payments in one single link. Get your pay3.so link today.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Samourai Wallet Domain Taken Over by Scammers After FBI Seizure, Used to Build Phishing Website
Bitcoin privacy wallet Samourai Wallet's official domain was seized by the FBI and subsequently taken over by scammers, who are now using it to set up phishing websites to lure users into downloading malware. The domain registrar is NameCheap, and users have complained without receiving a response. Samourai Wallet launched in 2015 and was prosecuted by the U.S. Department of Justice for alleged money laundering.
GateNews13m ago
Spain arrests suspect in 2025 kidnapping of Ledger co-founder
Spanish authorities have arrested a suspect in the 2025 kidnapping of Ledger co-founder David Balland, marking a cross-border breakthrough in one of Europe’s most high-profile crypto-linked abduction cases.
Spain’s Civil Guard said the suspect was detained in Benalmádena, in the southern province o
Cointelegraph15m ago
Polymarket Tightens Rules Across the Board, Insider Trading Concerns Force Regulatory Upgrade
Prediction trading platform Polymarket announced updates to its market integrity rules to enhance market design standards, settlement clarity, and suspicious trading monitoring, in response to regulatory criticism. In a recent incident, six new accounts made accurate bets on a U.S.-Iran war event, raising insider trading concerns. This update aims to strengthen compliance and advance the legalization process for prediction markets.
MarketWhisper16m ago
Sam Bankman-Fried Suspected of Forging "Mysterious Letter," Retrial Prospects Shift
FTX founder Sam Bankman-Fried's retrial request has faced a new obstacle, particularly due to a suspicious letter that has raised prosecutors' questions about its authenticity. The judge has required him to submit an affidavit by April 15 clarifying the document's source and whether any attorneys were involved. This incident has intensified scrutiny of the legal proceedings and could delay the retrial process.
MarketWhisper23m ago
TradeAI/Stakx Ponzi Scheme Case Dismissal Request Rejected, Involving $440 Million
The U.S. District Court for the Southern District of New York rejected the defendants' motion to dismiss in the TradeAI/Stakx case, and the case will proceed. The case was brought by Burwick Law, alleging that multiple defendants operated a Ponzi scheme causing losses exceeding $20 million, with a total scheme value of approximately $440 million. The judge ordered the defendants to disclose their addresses, or they will face a default judgment.
GateNews27m ago
US Senator Warren Requests MrBeast to Disclose Plans for Teen Financial and Cryptocurrency Business
U.S. Senator Elizabeth Warren sent a letter to prominent YouTuber MrBeast and his company, inquiring about their future plans in adolescent financial services and the cryptocurrency sector, emphasizing the need to comply with laws and address financial risks and consumer protection issues.
GateNews2h ago
