Operation “Operator” was launched following intelligence shared by German law enforcement (BKA) through the 24/7 network under the Convention on Cybercrime (Budapest Convention). This triggered a Joint Investigation Team (JIT) coordinated by Germany, Europol, and Eurojust, involving Serbia, Bulgaria, and Cyprus. The investigation targeted an organised criminal network running fraudulent cryptocurrency investment schemes through call centres operating across the three countries. Victims were recruited via online advertisements and phone calls, mainly in German-speaking countries, and directed to fake investment platforms that initially showed fabricated profits to encourage higher deposits.
The operation led to confirmed losses of over EUR 2 million for victims, while broader illegal gains are believed to reach hundreds of millions of euros due to underreporting. The network affected victims across several countries, including Germany, Switzerland, Austria, Australia, and Canada.
The coordinated action days in January 2023 resulted in 15 arrests (14 in Serbia and 1 in Germany), more than 250 individuals questioned, and 22 premises searched. Authorities seized around USD 1 million in cryptocurrency, EUR 50,000 in cash, 3 vehicles, and significant electronic evidence. Europol and Eurojust supported the operation through intelligence analysis, coordination, and real-time operational assistance.
Operation “Operator” is one of the clearest examples of direct reliance on the Convention on Cybercrime (Budapest Convention), as the investigation was reportedly initiated on the basis of intelligence transmitted through the Convention’s 24/7 network under Article 35. This enabled the rapid exchange of information and appears to have supported the subsequent establishment of a Joint Investigation Team. The investigation itself likely involved a combination of preservation requests, production orders, and search and seizure measures under Articles 16 to 19 in order to secure evidence relating to the fraudulent cryptocurrency platforms, user communications, wallet data, and associated devices. The multi-jurisdictional character of the operation also reflects the practical significance of the Convention’s provisions on international co-operation and mutual assistance, including Articles 25, 29 and 31.
Read more:
Council of Europe: 24/7 Network established under the Convention on Cybercrime
Europol: Press release
Eurojust: Newsroom