TLDR
US and European authorities have taken down a long running proxy network that helped criminals hide while stealing crypto and other funds.
- The operation, targeting the SocksEscort residential proxy service, seized 34 domains, took servers offline in seven countries, and froze about $3.5 million in crypto.
- SocksEscort hijacked around 369,000 devices to rent out clean home IP addresses, helping criminals bypass fraud checks at banks and crypto exchanges and steal millions.
- With the infrastructure seized, investigators now have logs that could lead to many prosecutions, and exchanges are likely to tighten traffic and VPN/proxy controls further.
Deep Dive
1. What Was Dismantled
Authorities from the US, Europol and several EU states ran Operation Lightning against SocksEscort, a for hire residential proxy network that had operated since 2009.
According to investigators, SocksEscort infected about 369,000 routers and IoT devices in 163 countries, then rented those IPs to paying users via AVRecon malware, generating roughly $5.8 million in revenue. Law enforcement seized 34 domains, took around 23 servers offline, and froze about $3.5 million in crypto linked to the service, as reported in a detailed residential proxy network breakdown.
One New York victim reportedly lost nearly $1 million in crypto through an account takeover routed via this network, underlining the real world damage from the proxy service, which Bitcoinist highlighted in its dismantled SocksEscort coverage.
2. How It Powered Crypto Fraud
Residential proxies like SocksEscort make malicious traffic look like it is coming from normal home connections rather than from obvious data centers or VPN endpoints.
Criminals paid for access in cryptocurrency to stay anonymous, then used these IPs for credential stuffing, password spraying, and session hijacking against banks and crypto exchanges, helping them bypass automated fraud and geolocation checks.
Investigators link the network to both traditional bank fraud and cryptocurrency account takeovers, including wash trading and illicit withdrawals from compromised exchange accounts.
Even if your own device was secure, your accounts could be attacked using someone elses hijacked router that looks benign to an exchanges risk engine.
3. What Changes Next
Authorities now control logs and payment records from SocksEscorts infrastructure, exposing up to 124,000 registered users and setting up a wave of follow on investigations and prosecutions.
Regulators and law enforcement are already signaling tighter expectations on exchanges to distinguish legitimate ISP traffic from botnet or proxy networks, which likely means more aggressive screening of IP reputations and VPN or proxy use.
For everyday users, this can translate into more frequent security challenges, occasional blocked connections from certain VPNs or residential proxy ranges, and slower onboarding or withdrawals when risk signals fire.
Conclusion
Taking down SocksEscort removes a key layer of anonymity that cybercriminals relied on to drain bank and crypto accounts while hiding behind hijacked home IPs. Going forward, crypto platforms are likely to raise the bar on network level risk checks, which should reduce some types of fraud over time but also increase friction for users who connect through VPNs or obscure networks.
CoinsKid.Com