DOJ and Europol Dismantle Crypto-Linked Proxy Network SocksEscort in Joint Action

The DOJ and Europol just took down SocksEscort. A residential proxy network that has been running since 2009.

34 domains seized. 23 servers were knocked offline across 7 countries. $3.5 million in crypto frozen.

SocksEscort was the infrastructure layer cybercriminals used to stay invisible. Account takeovers, ransomware attacks, crypto fraud. All of it ran through this network to mask where the attacks were actually coming from.

It took over a decade. But the operation is done.

What the DOJ-Europol Takedown Actually Targeted

The network had hijacked 369,000 devices across 163 countries. Routers, IoT devices, residential IPs. All were infected with AVRecon malware and rented out to criminals who needed clean addresses to bypass fraud detection at banks and crypto exchanges.

20,000 new devices are infected every week since early 2024. Total revenue is estimated at $5.8 million over the life of the operation. One victim in New York lost roughly $1 million in crypto alone after their account was hit through a SocksEscort proxy.

8 countries were involved in Operation Lightning. France, Germany, and the Netherlands, among them. The coordination was deliberate. Authorities are no longer just chasing individual criminals. They are targeting the infrastructure that makes crypto crime possible in the first place.

Europol’s executive director put it plainly. Proxy services like SocksEscort are the anonymity shield that lets illicit funds move across borders undetected. Remove the shield, and the whole operation falls apart.

That is exactly what happened here.

The Compliance Pressure This Puts on Exchanges and Mixers

The takedown creates an immediate problem for everyone who used the service.

SocksEscort had 124,000 registered users. All of them were masquerading as legitimate residential traffic to defeat IP-based fraud detection at exchanges. Credential stuffing, password spraying, wash trading, and account takeovers. The proxy network was the tool that made all of it invisible.

Now the servers are seized. And they are full of transaction data.

Today the #FBI and @TheJusticeDept announced an international law enforcement operation that took down SocksEscort, a global malicious proxy service, seizing dozens of servers and domains and freezing millions of dollars in cryptocurrency. Criminals infected home and small… pic.twitter.com/B0g8kYD5Wy

— FBI Cyber Division (@FBICyberDiv) March 12, 2026

FBI Deputy Assistant Director Jason Bilnoski confirmed it directly. Thousands of users are now exposed. A wave of downstream indictments is coming.

For exchanges, the pressure is also shifting. Regulators are drawing a harder line between legitimate privacy tools and criminal evasion infrastructure. Compliant platforms are already moving to verify that user traffic comes from legitimate ISPs rather than compromised botnets. Those who do not will be next in the crosshairs.

SocksEscort is gone. But the forensic trail it left behind is just getting started.

Discover: The best new crypto in the world