Western Authorities Dismantle SocksEscort Malicious Proxy Network, Freeze 3.5 Million USD in Crypto Assets

Mars Finance reports that, according to market sources, Europol and the U.S. Department of Justice, among other agencies, have jointly announced the takedown of a malicious proxy service network called “SocksEscort” and frozen $3.5 million in related cryptocurrency. The network is said to have infiltrated over 369,000 routers and IoT devices across 163 countries, providing more than 35,000 proxies to users in recent years. Europol stated that during the operation, 34 domains and 23 servers across seven countries were seized, and the associated payment platforms are estimated to have received over $5.7 million in cryptocurrency. The investigation began in June 2025 and found that infected devices were mainly used to facilitate crimes such as ransomware and DDoS attacks. The U.S. Department of Justice accused the criminals of using the proxy service to hide their locations and carry out frauds including bank and crypto account takeovers, citing multiple victim cases, including a client of a New York-based crypto exchange who lost $1 million to scams.