The network behind a wave of hacks on European platforms

Demonstration article. The platforms, people, documents and figures cited are fictional.

• Fourteen European platforms were hacked in twelve months, for almost 144 million euros.
• In at least ten cases, initial access came through a fake recruiter and a booby-trapped “technical test”.
• The funds follow the same laundering routes, and no platform was warned by another before being hit.

The first incident went almost unnoticed. In November 2025, a mid-sized Lithuanian platform reported a loss of 4.1 million euros after a transit wallet was compromised. The press release referred to “a failure at a technical provider”. The story did not go beyond the local specialist press.

Eleven months later, in October 2026, monthly losses at the targeted European platforms reached 26.1 million euros. Between those two dates, fourteen platforms were hit in nine countries. The total comes to almost 144 million euros.

A common signature

Cross-checking published incident reports, documents from two court cases and flow analyses by three specialist firms reveals a recurring pattern. In at least ten of the fourteen cases, initial access came through a fake recruiter who contacted one of the platform’s engineers and had them run a “technical test” containing malware.