DOJ and Europol Dismantle SocksEscort Network Linked to Crypto Fraud

SocksEscort was a residential proxy service that used malware to compromise home routers and Internet of Things devices. It rented victims’ IP addresses to criminals, allowing them to conceal their origins and evade risk controls at banks and cryptocurrency platforms. Since 2020, the network had controlled more than 369,000 nodes across 163 countries and was linked to account takeovers, banking and crypto-asset fraud, ransomware and distributed denial-of-service attacks.

On March 11, 2026, the U.S. Justice Department, FBI, Europol and other authorities took coordinated enforcement action under “Operation Lightning.” They seized 34 domain names, shut down 23 servers across seven countries and froze about $3.5 million in crypto assets. Europol announced the results on March 12. Officials also said a customer of a cryptocurrency exchange in New York had lost about $1 million.