← back to the index
HS-012 Cloud mining fraud · Europe (Germany / Switzerland / Austria) 2020

The EUR 113M Crypto Machine Scheme — Europe’s Biggest Mining-Lease Pyramid Dismantled

cloud-miningarresteddefi-era
Operation
Unnamed crypto machine leasing scheme
Investor Losses
Up to EUR 113 million
Contracts Sold
Leasing and subleasing of crypto mining and exchange machines
Status
Arrested

Summary

On June 11, 2024, law enforcement agencies from Germany, Switzerland, Austria, Czechia, Lithuania, and Liechtenstein — coordinated by Eurojust and supported by Europol — arrested six individuals and executed 29 search warrants in connection with a multi-country cryptocurrency machine leasing pyramid that caused losses of up to EUR 113 million to thousands of victims across Europe. The organised crime group had operated a scheme based on the leasing and subleasing of cryptocurrency machines, including mining hardware and crypto exchange kiosks, promising investors returns of 70 percent before tax. The central fraud was that the leased equipment and systems that investors paid for did not exist. The scheme's revenue for earlier participants came not from any actual equipment output but from the investment funds of newer entrants — a structure that Eurojust's press release explicitly characterised as pyramidal.

The operation was led by German and Swiss prosecutorial authorities, who established a joint investigation team (JIT) with Eurojust support. Two coordination meetings at Eurojust preceded the June 11 action day, at which more than 280 officers participated across the six participating countries. Assets belonging to the suspects were frozen on the action day. The platform name and suspect identities were not disclosed in the Eurojust press release; operator names and charges had not entered public court record as of this filing.

The EUR 113 million loss figure places this scheme among the largest documented cloud mining and crypto machine fraud cases in European history — comparable in scale to multinational cases like MiningCity, which raised approximately $300 million globally before SEC charges in 2022, but within a specifically European jurisdictional footprint. The joint investigation team structure and the Eurojust coordination model employed in this case have become the standard architecture for European crypto fraud enforcement, with this action representing one of its largest single-day results.

The case illustrates how the structural template of cloud mining fraud — phantom hardware, guaranteed returns, subleasing layers — was adapted into a multi-country European operation targeting retail investors who believed they were acquiring stakes in physical crypto infrastructure.

Timeline

Approximate 2020–2021
Scheme launches
The organised crime group begins marketing cryptocurrency machine leasing and subleasing contracts to investors across Germany, Switzerland, Austria, and neighbouring European countries, promising 70% annual returns before tax.
2021–2023
Expansion and victim accumulation
The scheme spreads across at least six countries via referral networks and promotional materials. Investors are told they are acquiring stakes in operating crypto mining hardware and exchange kiosks, with returns generated by machine output.
2022–2023
Investigation begins
German and Swiss prosecutorial authorities, having received victim complaints and identified the pan-European scope of the scheme, initiate a joint investigation. Eurojust is engaged to coordinate cross-border legal assistance and evidence sharing.
Late 2023–early 2024
Joint investigation team formed
A formal JIT between German and Swiss authorities is established under Eurojust auspices. Two coordination meetings are held at Eurojust headquarters in The Hague. Europol provides analytical and operational support.
June 11, 2024
Action day
More than 280 officers across six countries simultaneously execute the operation: six arrests are made, 29 search warrants are executed, and suspect assets are frozen. Eurojust issues a press release confirming losses of up to EUR 113 million and the pyramidal nature of the scheme.
June 12, 2024
Public confirmation
Eurojust publishes its official press statement confirming the operation's scope, loss figure, mechanism, and the involvement of Germany, Switzerland, Austria, Czechia, Lithuania, and Liechtenstein.
2024–present
Post-arrest proceedings
Criminal proceedings against the six arrested individuals are ongoing across the participating jurisdictions. No convictions had been confirmed as of this filing. Suspect identities and platform name remain undisclosed in official communications.

The Leasing Architecture: Engineering the Appearance of Tangible Assets

Cloud mining fraud typically relies on the abstraction of digital hashrate — invisible, unverifiable, self-reported. The scheme documented in the June 2024 Eurojust action refined this model by anchoring the promise in physical hardware: cryptocurrency mining machines and exchange kiosks that investors could ostensibly own a share of through leasing and subleasing agreements. A machine-leasing arrangement implies a specific, inventoriable object with a location, a serial number, and a market value — more concrete, and therefore more credible, than a hashrate contract.

The Eurojust press release states plainly: "the leased equipment and systems allegedly did not exist." Whatever returns investors received came from newer entrants' capital, not from machine output. The 70% annual return promise was calibrated to the 2021 bull market, when investors had seen Bitcoin rise tenfold and such figures felt less implausible than they should have.

The subleasing layer introduced a second dimension of deception: investors who re-rented their contracted capacity to others received fees, creating the appearance of a secondary market in machine capacity. That market was also premised on hardware that did not exist. Each subleasing transaction layered additional fictional value onto the primary fictional asset, producing a pyramid of paper claims that required continuous new entrants to sustain the fee income flowing to earlier participants.

The Cross-Border Operation: Eurojust Coordination as Enforcement Infrastructure

The June 11, 2024 action day was the product of a joint investigation that took at least a year to build. The scheme's multi-country structure — with operators, investors, and presumably corporate entities spread across Germany, Switzerland, Austria, Czechia, Lithuania, and Liechtenstein — was designed to exploit the differences in national criminal procedure and evidence-sharing protocols that have historically slowed European crypto fraud enforcement. A fraudster operating from one country with investors in another can rely on mutual legal assistance treaty delays to create months or years of enforcement lag.

The joint investigation team structure, enabled by Eurojust's coordination mandate, collapses this lag. German and Swiss investigators aligned evidence and arrest timing without the friction of MLAT requests. The two Eurojust coordination meetings established the legal basis for simultaneous warrant execution across multiple countries — 29 searches in six nations on a single day, 280 officers participating. The EUR 113 million loss figure attracted the JIT mechanism and multi-agency mobilisation typically reserved for organised crime with identified leadership. In scale and coordination complexity, the June 2024 action represents one of the most significant European cloud mining enforcement operations on record.

The Pyramid Mechanism: Why 70% Returns Cannot Be Sustained

A 70 percent annual return on cryptocurrency machine leasing is structurally impossible from genuine equipment output. At the time the scheme operated, the most efficient Bitcoin mining facilities in the world — running near-zero electricity costs with the newest ASIC hardware — achieved annual yields measured in the low double digits at best, and often lower after hardware depreciation and network difficulty increases. When a promised return cannot be generated by the stated underlying activity, there is only one mechanism capable of producing it: recycling new investor capital to pay earlier investors. That is what the Eurojust operation confirmed.

The subleasing structure accelerated growth by converting investors into recruiters. An investor who believed their machine was generating 70% annually had a direct financial incentive to recruit family and colleagues who would lease capacity from them, generating subleasing fees. This multi-level incentive structure — where the return from recruitment equals or exceeds the return from the underlying asset — is the defining characteristic of a pyramid scheme. The scheme's own victims became its distribution network, expanding the investor pool faster than any independent marketing campaign could have achieved.

The Five Factors

01
Physical-Asset Framing to Bypass Abstract-Product Skepticism
Investors who are skeptical of digital tokens or speculative assets may be less skeptical of a leased machine. The scheme's deployment of cryptocurrency exchange kiosks and mining hardware as the underlying "asset" was a deliberate design choice that targeted retail investors who understood tangible objects — appliances, vehicles, equipment — better than they understood blockchain derivatives. Anchoring fraud in a physical asset that "doesn't exist" is counterintuitive but effective: the more concrete the promised asset, the less abstract the fraud feels, and the more embarrassed investors may be to report losses on what they assumed was a straightforward equipment-leasing arrangement.
02
Subleasing as a Pyramid Incentive Layer
The ability for investors to sublet contracted machine capacity to other investors converted every victim into a potential recruiter. This is the structural hallmark of a pyramid scheme: the return from recruitment exceeds, or equals, the return from the underlying investment. In a crypto machine leasing context, the subleasing fee creates a direct financial reward for bringing in new investors, which serves the same function as the referral bonuses in more traditional pyramid designs. It also distributes legal and reputational liability across a wide base of participants, each of whom recruited others in good faith.
03
Multi-Country Structure as Enforcement Delay
Operating across six European countries was not incidental; it was deliberate. Different national fraud statutes, mutual legal assistance timelines, and arrest-authority standards mean that a scheme investigated sequentially by six agencies benefits from years of enforcement lag. The joint investigation team mechanism directly counters this strategy by collapsing parallel investigations into a single coordinated action — the most important enforcement innovation the Eurojust model provides.
04
Bull Market Context as a Return Normaliser
The scheme recruited most actively during 2021–2022, when cryptocurrency markets were at or near all-time highs and retail investor appetite for crypto-adjacent products was at its peak. In that environment, a 70% annual return — implausible in any normal market — was within the range of returns that unsophisticated investors had seen in actual crypto holdings during the previous 12 months. The bull market did not cause the fraud, but it provided the psychological context in which the promised return was less likely to trigger the skepticism it deserved. Frauds that operate during market peaks benefit from a credibility subsidy generated by genuine market performance.
05
Asset Freeze at Action Day as the Key Recovery Mechanism
The June 11, 2024 action day included simultaneous asset freezes alongside the arrests and searches. The timing is critical: any gap between when suspects learn of the investigation and when assets are restrained creates an opportunity for asset flight. In the HashFlare case, the same-day coordination of arrests and indictment unsealing in Tallinn and Seattle was explicitly designed to prevent this. The Eurojust coordination framework serves the same purpose at the European level: by executing arrests, searches, and freezes on a single day across six jurisdictions simultaneously, investigators minimise the window available for suspects to move funds into inaccessible accounts or jurisdictions.

Aftermath

The six individuals arrested on June 11, 2024, remained subject to ongoing criminal proceedings as of this filing. The specific charges, the jurisdictions in which proceedings are being pursued, and the identities of the suspects had not been publicly disclosed in Eurojust or national press materials available at the time of writing. Asset freezes were executed on the action day; the extent of frozen assets relative to the EUR 113 million in estimated losses was not detailed in the Eurojust press release.

Thousands of victims across the six participating countries faced uncertain recovery timelines. In European crypto fraud cases of this type, victim restitution depends on the outcome of criminal proceedings in each country, the volume of assets successfully frozen before dissipation, and the administrative capacity of national compensation or restitution mechanisms. No centralised recovery process for this specific scheme had been announced as of this filing.

The June 2024 action contributes to a body of Eurojust case law establishing that crypto machine leasing pyramids, like cloud mining contract frauds, fall within existing fraud statutes regardless of crypto-specific terminology. The EUR 113 million scale and the JIT architecture are likely to be cited in future cross-border crypto fraud coordination as a model for multinational simultaneous action.

Lessons

  1. A promised annual return of 70 percent on any hardware leasing arrangement — crypto or otherwise — is structurally impossible to sustain from genuine equipment output; investors should benchmark any stated return against publicly available mining economics before committing capital, and treat any figure exceeding plausible operating yields as a signal of a Ponzi payment structure.
  2. Subleasing arrangements that reward investors for recruiting additional participants replicate the economics of a pyramid scheme regardless of the underlying asset; when recruiting returns equal or exceed machine output returns, the investment's value is recruitment-dependent and collapses when new investor inflows slow.
  3. A promise tied to physical hardware — a specific machine with a serial number and a location — provides no more assurance of legitimacy than a promise tied to digital hashrate if the investor has no independent means of verifying the hardware's existence; physical-asset framing is a credibility performance, not a verification mechanism.
  4. Multi-country corporate structures and investor bases are not evidence of legitimacy; they are evidence that an operator has deliberately distributed legal exposure across jurisdictions to slow enforcement response; investors in pan-European platforms should ask which national regulator has primary oversight responsibility before investing.
  5. Simultaneous asset freezing at the moment of arrest is the most effective protection against post-arrest asset dissipation; investors who suspect fraud should file complaints immediately and request emergency asset preservation measures rather than waiting for formal prosecution timelines.

References