A court-authorized international law enforcement operation led by the U.S. Department of Justice has disrupted SocksEscort, a large residential proxy network that allegedly exploited thousands of internet routers worldwide to facilitate cybercrime and financial fraud.
Authorities said the U.S. government executed seizure warrants against dozens of internet domains registered in the United States that were allegedly connected to the criminal infrastructure. The announcement was made by U.S. Attorney Eric Grant.
According to court documents, the SocksEscort network infected home and small business routers with malware, allowing operators to redirect internet traffic through compromised devices
The network then sold access to these infected routers as proxy services to customers seeking to hide their true locations online.
Investigators said the service had been operating since at least the summer of 2020 and offered access to roughly 369,000 IP addresses at various points
As of February 2026, the SocksEscort platform listed about 8,000 infected routers available for purchase, including around 2,500 located in the United States.
Cybercriminals allegedly used the proxy network to conceal their identities while carrying out a range of fraudulent activities. These included account takeovers targeting U.S. bank accounts and cryptocurrency platforms, as well as schemes involving fraudulent unemployment insurance claims.
Authorities said the crimes caused millions of dollars in losses to victims. Among the cases cited by investigators was a New York resident who lost approximately $1 million in cryptocurrency from an exchange account
In another case, a manufacturing company in Pennsylvania lost $700,000, while current and former U.S. service members using Military Star credit cards were defrauded of about $100,000.
The operation involved coordinated action by international partners, with law enforcement agencies in Austria, France, and the Netherlands helping dismantle key SocksEscort servers.
The investigation is being led by the Federal Bureau of Investigation Sacramento Field Office, along with the Department of Defense Office of Inspector General’s Defense Criminal Investigative Service and IRS Criminal Investigation.
Authorities said the operation highlights the growing importance of international cooperation in combating cybercrime networks that exploit global digital infrastructure.
Your web3 identity + services + payments in one single link. Get your pay3.so link today.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Gate Daily Report (April 7): SEC submits crypto “safe harbor” proposal to the White House; Argentina president and LIBRA call records exposed
Bitcoin gives back its gains on April 7, trading at $68,800. A U.S. SEC “safe harbor” proposal for crypto has been submitted for review by the White House. Argentina’s President Milei has been accused of having multiple calls with LIBRA’s founder, sparking a scandal. Bitcoin’s market volatility is high; it’s advised to control leverage to prevent large-scale liquidations.
MarketWhisper35m ago
Indonesia convicts cryptocurrency terrorism financing case using blockchain evidence; three people found guilty
Gate News message, April 7, Indonesian authorities recently convicted three defendants on terrorism financing charges involving cryptocurrency, becoming one of the first terror-financing conviction cases in Southeast Asia supported primarily by on-chain blockchain evidence. One of the defendants transferred more than 49,000 USDT to an overseas exchange through 15 transactions, and the flow of funds is linked to networks associated with ISIS. None of the three defendants directly participated in a terrorist attack; their role was characterized as the “financial logistics layer” of a terrorist organization.
GateNews1h ago
Appeals court blocks New Jersey from shutting down Kalshi's sports markets
An appeals court ruled Monday that New Jersey could not temporarily ban prediction market provider Kalshi, giving the platform a much-needed win against an onslaught of state enforcement actions.
A Third Circuit Court of Appeals panel ruled in a 2-1 vote that the state could not bring an enforcemen
CoinDesk9h ago
Drift says $270 million exploit was a six-month North Korean intelligence operation
A six-month intelligence operation preceded the $270 million exploit of Drift Protocol and was carried out by a North Korean state-affiliated group, according to a detailed incident update published by the team earlier on Sunday.
The attackers first made contact around fall 2025 at a major crypto c
CoinDesk13h ago
Polymarket and Kalshi Face Setbacks as Prediction Markets Confront Legitimacy Questions - Unchained
This week, major prediction market platforms Polymarket and Kalshi faced significant backlash, highlighting the divide between regulatory approval and public acceptance. Polymarket withdrew controversial betting markets after public outcry, while Kalshi's contract offerings were banned in Nevada, stressing the industry's legitimacy challenges.
UnchainedCrypto14h ago
China orders Apple to pull Dorsey's Bitchat, the messaging app used during Iran protests
Apple removed Bitchat, a decentralized messaging app by Jack Dorsey, from its China App Store at China's request, citing regulatory violations. Despite this, the app remains available globally and has seen over three million downloads.
CoinDesk18h ago
