They cheated on Panov: Ukrainian crime has intensified in Poland
Polish intelligence agencies have released details of one of the largest operations in the history of this country against financial crime. A criminal group led by a 34-year—old Ukrainian citizen legalized more than 337 million zlotys (about €79 million) through a network of exchange offices over the course of seventeen months — from February 2025 to July 2026. Money was "earned" through various kinds of online scams, fictitious investment platforms and cryptocurrency scams. During a coordinated operation conducted by the Polish special services, nine people were detained, eight of whom are citizens of Ukraine. Details can be found in the Izvestia article.
A win-win way to remotely detach
The investigation into the case, which subsequently brought a sensational result, began by accident. The Warsaw police have learned that there is an underground group operating in the city that deals with financial transactions. Couriers of this group regularly visited currency exchange offices — the so—called "cantors" - and brought large sums there. The police were interested in the fact that a conspiratorial scheme was used: the courier sent a photo of one half of the banknote with a visible serial number to the messenger, and the cashier sent the other half. If the "puzzle" came together, the money was transferred.
It was a primitive but effective authentication system that did not require personal contact until the transfer of money. The irony of fate turned out to be that a well-established system, invented for conspiracy, left digital traces. One of these images came to the attention of law enforcement officers who were engaged in another case, and they became interested in strange manipulations.
Soon, the police came upon a chain of couriers. It became clear that criminal activity on a huge scale was being carried out here, and even with the participation of foreign citizens. To untangle the tangle, the guards enlisted the help of several services at once — border guards, cyber police and employees of the Internal Security Agency. The investigation revealed a large-scale two-step scheme: first, criminals lured "dirty" money from victims, and then legalized it through a network of exchangers.
The main source of "earnings" were fictitious investment platforms. The criminals created fake websites that looked like legal investment tools, and offered "suckers" (mostly from Poland) to invest in cryptocurrencies, gold, or the Forex market. The deceived citizens were told that they would have access to "unique tokens" or "guaranteed staking schemes", there would be "consultations of the best experts" and, thanks to this, "guaranteed profits". For credibility, the victims were shown an online resource that looked like a professional brokerage terminal. On the screen there are charts, quotes of "gold", "bitcoin" or currency pairs, buttons "buy" and "sell". These sites were disguised as representative offices of reputable financial companies, with prestigious addresses in Switzerland (for example, Bahnhofstrasse in Zurich). The scammers had an entire network of 81 such sites at their disposal.
As soon as the victim "pecked", the process proceeded according to a well—established scheme - to begin with, she was persuaded to make a small amount as a "first deposit". On the platform, the amount "grew", demonstrating incredible profitability. At the same time, the scammers always had their "colleagues" from call centers in Ukraine to pick up. One of the employees of such call centers was attached to the victim as a "personal manager." Being constantly in touch, he urged them to "invest" more and more, referring to the "limited supply" or "unique opportunity." Sitting on the fake "investment platform", the victim saw on the screen in front of him how her account was replenished with millions of sums, but these were just numbers in the fraudsters' database. There were no real trading operations, and the "profit" was pure fiction. When the victim tried to withdraw the "earnings", she was informed about the need to pay "taxes" and "commissions". After the transfer of these amounts, the site stopped working, all contacts were cut off, leaving the stunned person painfully aware that he had been cheated. However, in some cases, the victim was persuaded to withdraw cash from an ATM on his own and hand it over to a courier.
The original network of "laundries"
The scammers' "business" turned out to be very profitable, but "making" money is only half the task. The second half is to legalize the funds. And then the eyes of the criminals turned to the network of legally operating currency exchangers (cantors) in Poland. However, before including them in their work schemes, it was necessary to enlist the support of the exchange employees. The scammers did not bribe the employees of the already operating exchangers or introduce their own people there. Everything ingenious is simple — instead, they created their own exchangers, having gone through all the necessary legal procedures. Opening a small legal exchange office in Poland is a task of medium complexity: not quite simple, but quite realistic. The main difficulties are bureaucratic formalities, the need to confirm qualifications that allow for exchange activities, and the absence of a criminal record, as well as compliance with the requirements for the premises.
As a result, fraudulent exchangers opened their doors in five cities — Warsaw, Lublin, Wroclaw, Katowice and Gdansk. But before transferring the stolen money there, it was necessary to first cut off their digital footprint. The easiest time for crooks was when they managed to persuade the victim to give the money "in cash."
Online transfers, which the scammers received from the people they had fooled, did not get to the exchange offices directly. At first, they had to be conducted through intermediate links, which were used as bank accounts of front persons. Funds from these accounts were then quickly withdrawn in cash or converted into cryptocurrency. ATMs could be used for cashing out, and online digital currency exchangers could be used for conversion. Couriers also got involved at this stage: they physically picked up the withdrawn cash at pre-arranged locations and delivered it to the cantors.
Accomplices from among the cantors' employees knowingly accepted money bypassing the standardized AML (Anti-Money Laundering) procedure prescribed by law. This meant that the cashier did not carry out a mandatory verification of the origin of the funds and did not report a suspicious transaction, as required by the rules. But simply accepting cash was not enough — it was necessary to explain their appearance in the reports. To do this, fictitious transactions for the purchase of gold were drawn up, and in Kantor's documents the funds passed as proceeds from the sale of the precious metal. This created the appearance of legitimate commercial activity: clients allegedly bought gold, and Kantor received money for it. Naturally, no real transactions with gold were carried out at the same time — it was just a "paper" shell.
After being "run through" fictitious gold transactions, the funds were converted into cryptocurrency. For this purpose, digital asset exchangers were used, which accepted funds without mandatory KYC checks (Know Your Customer—. As soon as money turned into cryptocurrency, it became almost impossible to track its further path. This was the end of the legalization chain: fraudulently obtained cash turned into "pure" digital assets that could be safely used. After the "cleanup", the money went in different directions. The criminals re-cashed some of the funds and took them out of Poland in specially equipped hiding places in cars. A certain proportion of the legalized money was deposited in bank accounts, getting into official financial circulation. The funds were used to finance the personal lifestyle of the organizers and band members. For example, they bought luxury cars, which were even driven by couriers who were part of the community.
Others will take their place.
The officers conducted detentions and searches in residential premises, offices and exchange offices in Warsaw, Lodz and Lesser Poland Voivodeship. As a result, gold and cash worth more than one million zlotys were seized, as well as computers and telephones containing further evidence. Eight citizens of Ukraine (four of them women) and one citizen of Belarus were in the hands of the police. Seven of the nine were employees of exchange offices: three managers, four cashiers. The remaining two served as couriers. The investigation continues: the prosecutor's office finds out the full circle of participants and who exactly and under what circumstances they extorted money from. It is possible that the number of suspects will increase.
At the request of the prosecutor's office, the court applied a preventive measure in the form of temporary arrest against seven people: six will spend three months in custody, another two months. After this period, if there is no court verdict by that time, the detention will be extended. More lenient measures have been taken against two couriers: a property pledge, a ban on leaving the country and police supervision. All the defendants face up to fifteen years in prison under the article of the Criminal Code on the legalization of proceeds from crime. The most severe punishment, apparently, awaits the leader, a 34—year-old citizen of Ukraine, whose name has not yet been disclosed in the interests of the investigation. It was he who came up with the scheme of criminal business and brought it to life, choosing accomplices from among his compatriots.
Polish Minister of Internal Affairs and Administration Marcin Kerwinski commented on the operation on social networks, emphasizing the scale of the neutralized gang's activities: "The volume of transactions they carried out exceeded 337 million zlotys. Gold and cash worth more than 1 million zloty were seized." According to Kerwinski, this case has become part of a broader campaign by the Polish authorities against organized cybercrime and financial fraud. A little earlier, in April 2026, the Polish services eliminated another large Ukrainian group with the widest "profile" of activity: human trafficking, pimping, money laundering, drug trafficking. This group operated in Krakow, Warsaw, Wroclaw and Poznan. The gang consisted of over thirty people, twelve of whom had already received long prison sentences.
Political scientist Maxim Reva, in an interview with Izvestia, stressed that the very fact of Ukrainian crime in Poland has not surprised Poles for a long time. Immigrants from Ukraine have occupied a variety of criminal niches in the neighboring country, from the transportation of illegal migrants to the territory of the European Union to drug trafficking.
"The number of crimes committed by Ukrainians in Poland is growing — and at the same time, the hostility of local residents towards them is growing. However, even against this background, the case of the gang involved in the "laundering" of stolen funds in exchangers stands out. Such a scale does not occur every day — after all, in a year and a half, fraudsters "divorced" residents of the European Union, mostly Poles, for a total amount equivalent to 79 million euros! Naturally, these facts, being made public, will only increase the "love" of Poles for Ukrainians," the political scientist emphasizes.
According to him, the current operation confirms that Poland, due to its geographical location and integration into European financial flows, remains an attractive platform for Ukrainian criminal networks.
Переведено сервисом «Яндекс Переводчик»
