Spain’s Guardia Civil has dismantled an international criminal network behind large-scale cryptocurrency investment scams after a resident of Oropesa del Mar, in Castellón province, reported losing nearly €340,000. Officers arrested three people and seized electronic devices during coordinated raids in Barcelona and Pontevedra. Investigators found that the operation used more than 100 bank accounts to move and conceal illicit funds.
The investigation began when the resident, who believed he was investing through a promising crypto platform, realized he had been defrauded. The Guardia Civil said the group lured victims with promises of high returns on fraudulent websites designed to resemble legitimate investment services. The platforms displayed fabricated account activity and apparent trading gains, creating the impression of successful investments and encouraging users to deposit more money.
When victims tried to withdraw their supposed earnings, the organization demanded further payments, labeling them commissions or taxes and claiming accounts needed to be unlocked. Such demands recur in investment scams: fabricated balances make the supposed profits look real, then victims are told they must pay to access them. Being asked to pay to release supposed earnings is a clear warning sign. Those extra charges do not prove the displayed profits exist.
Authorities uncovered a structured network in which some members recruited victims and stayed in contact with them, while others handled the movement of funds. Money passed through numerous accounts before being converted into cryptoassets. Investigators said the operation followed instructions from leaders based abroad, whom they have identified.
Tracing the funds was complicated by the network’s financial setup. The group used international money-transfer services and peer-to-peer transactions, while cycling through foreign bank accounts. Accounts remained active for short periods before being replaced, obscuring the money trail and complicating recovery efforts. Crypto transactions can also be difficult to reverse once confirmed, so a prompt response matters.
The operation, known as Tossit, was led by the Technological Investigation Team (EDITE) of the Judicial Police Unit in Castellón. Investigating Court No. 2 of Castellón is supervising the case. During the raids, officers seized electronic devices and other materials that may help identify additional victims or collaborators.
The Guardia Civil has stressed the need to check whether an investment platform is legitimate and to treat requests for extra payments to release funds or complete administrative steps with caution. Spain’s Comisión Nacional del Mercado de Valores (CNMV) maintains registers of authorized firms and warnings about entities that may be operating without authorization. Before sending money, investors are advised to check both a provider’s legal name and its website area. A polished website or persuasive sales representative does not prove that a firm is authorized. Guaranteed returns and pressure to deposit quickly are also warning signs.
Anyone who believes they have been targeted should stop contact with the suspected operators and make no further payments. They should notify their bank or payment provider promptly, since pending transfers or card transactions may still be stoppable. They should also preserve digital evidence, such as screenshots and messages, alongside financial records including payment receipts, wallet addresses and transaction hashes. Reports can be made to the Policía Nacional, the Guardia Civil or the CNMV. Spain’s regulator also advises checking crypto-asset service providers against its registers and the European Securities and Markets Authority’s register.
The Castellón case shows how fraudulent online investment schemes use fabricated returns and escalating withdrawal charges, while routing money through multiple financial channels to prolong a scam and make funds harder to trace. Crypto-related fraud has become a wider concern in Europe. The case highlights the risks of dealing with unauthorized platforms and the need to act quickly when an investment provider demands new payments to release supposed profits.
