DOJ and Europol Dismantle Crypto-Linked Proxy Network SocksEscort
Authorities from the United States Department of Justice and Europol have shut down SocksEscort, a residential proxy network that had been operating since 2009 and was widely used by cybercriminals.
The joint operation resulted in the seizure of 34 domains, the shutdown of 23 servers across seven countries, and the freezing of roughly $3.5 million in cryptocurrency tied to the service.
For years, SocksEscort served as a key piece of infrastructure for online crime. The network allowed criminals to hide their real locations while carrying out attacks, making it harder for investigators and security systems to trace their activity.
Account takeovers, ransomware campaigns, and crypto-related fraud schemes were among the activities that relied on the proxy network to stay hidden.
After more than a decade of operation, authorities say the network has finally been dismantled.
What Authorities Actually Targeted
Investigators say the operation focused on the infrastructure enabling cybercrime, rather than just the individuals behind it.
According to officials, the network had infected more than 369,000 devices across 163 countries. These included routers, IoT devices, and residential internet connections that were compromised using malware known as AVRecon.
Once infected, the devices were turned into proxy nodes and rented out to criminals who needed legitimate-looking IP addresses to bypass fraud detection systems at banks and cryptocurrency exchanges.
The scale of the network continued to grow in recent years. Since early 2024, investigators estimate that around 20,000 new devices were being infected every week.
Over its lifetime, SocksEscort is believed to have generated roughly $5.8 million in revenue.
Authorities also linked the service to several high-profile incidents. In one case, a victim in New York reportedly lost around $1 million in cryptocurrency after attackers accessed their account using a SocksEscort proxy connection.
Operation Lightning: An International Effort
The takedown was carried out as part of Operation Lightning, a coordinated effort involving authorities from eight different countries, including France, Germany, and the Netherlands.
Officials say the strategy behind the operation reflects a broader shift in law enforcement tactics.
Instead of only pursuing individual hackers, investigators are increasingly targeting the infrastructure that enables large-scale cybercrime.
According to Europol’s executive director, services like SocksEscort act as an “anonymity shield” that allows illicit money and attacks to move across borders without detection.
Once that infrastructure is removed, the criminal operations relying on it can quickly collapse.
That appears to be exactly what investigators aimed to accomplish with this takedown.
Pressure Now Shifts to Exchanges and Platforms
The shutdown could have major consequences for the people who used the network.
Authorities estimate that SocksEscort had more than 124,000 registered users, many of whom relied on the service to disguise their traffic as normal residential internet activity.
This technique allowed attackers to bypass security measures on exchanges and other platforms that rely on IP-based fraud detection.
Criminals used the proxies for activities such as:
Credential stuffing attacks
Password spraying
Wash trading
Cryptocurrency account takeovers
Now that the servers have been seized, investigators have access to a large amount of data connected to those operations.
Jason Bilnoski, Deputy Assistant Director at the Federal Bureau of Investigation, confirmed that thousands of users linked to the service may now be identifiable.
Authorities expect the investigation to lead to additional indictments in the coming months.
Growing Regulatory Pressure
The takedown is also likely to increase pressure on cryptocurrency platforms and other online services.
Regulators are increasingly trying to draw a clear distinction between legitimate privacy tools and infrastructure designed specifically to evade law enforcement.
Many compliant exchanges have already begun strengthening their monitoring systems to verify that user traffic comes from legitimate internet providers rather than compromised devices or botnets.
Those that fail to adapt may face increased scrutiny as authorities continue targeting the networks that support cybercrime.
