 |
| An officer of the Carabinieri Anti-Counterfeiting Unit (Currency) of the Carabinieri analysing a digital map of Europe during an investigation briefing |
Operation Domino Exposes a Europe-Wide Crypto Counterfeit Network on Telegram Using Bitcoin, OSINT Investigations, and Human Behaviour Analysis.
NAPLES - A long and complex investigative operation, conducted between 2022 and 2026 by the Naples Public Prosecutor’s Office, has led to the dismantling of a suspected criminal group specialising in the international distribution of counterfeit banknotes via Telegram channels and cryptocurrency payments. The investigation, codenamed “Domino”, uncovered a structured transnational network capable of moving large sums and exploiting digital techniques to remain in the shadows. With 12 arrests, dozens of suspects, and over half a million euros traced through illicit flows, the case reveals the evolution of financial crime in the era of blockchain. But what is truly striking is the investigative method: no wiretaps, only OSINT and insight into the human factor.
Cryptocurrency payments
On Monday 25 May 2026, following the complex and extensive investigative activity known as “Domino” and coordinated by the Public Prosecutor’s Office of Naples, led by Nicola Gratteri, officers of the Cryptocurrency Section of the Anti-Counterfeiting Monetary Command, supported by local units of the Carabinieri, executed a precautionary custody order involving personal and property measures issued by the Preliminary Investigations Judge of the Naples Court against 12 individuals seriously suspected of criminal association aimed at the purchase and transnational distribution of large quantities of counterfeit banknotes circulated via the social network “Telegram” in exchange for cryptocurrency payments and money laundering. In particular, the following measures were executed: 3 orders of pre-trial detention in prison; 5 orders of house arrest; 2 orders of obligation to remain in their municipality of residence; 2 orders of obligation to report to the Judicial Police.
The organisation exploited the encrypted Telegram channel called “ELREAL SHOP”
The investigation, launched in July 2022 and continuing until 2026, established the existence of an organisation engaged not only in the purchase and subsequent sale of counterfeit banknotes of various denominations, but also in the systematic laundering of illicit proceeds, structuring an extremely insidious business model. While maintaining its operational base in the Spanish Quarters of Naples, the organisation exploited the encrypted Telegram channel called “ELREAL SHOP” to advertise the sale of counterfeit banknotes in Italy and abroad. The sales network was based on blockchain technology, accepting payments exclusively in Bitcoin for the distribution of counterfeit currency (20, 50 and 100 euro denominations), using a dropshipping model to ensure anonymity in domestic and international shipments. The international scope of the investigation involved the participation and cooperation of the French, German, Spanish and Belgian authorities, with the support of Europol in liaising with the relevant foreign police forces.
Criminal association, money counterfeiting and self-laundering
Technical analyses carried out by the European Central Bank classified the counterfeit currency as “common class” forgery, as it was circulating in several European countries including France, Switzerland, Ireland, Spain and Germany. The conclusion of the operation, reached in April 2026, recorded the following results: 12 arrests (10 in flagrante with the support of local Carabinieri units as operational feedback and 2 abroad); 61 individuals reported at liberty for criminal association, currency counterfeiting and self-laundering. Seizure of over 106,000 euros in counterfeit banknotes hidden in dozens of parcels ready for distribution.
DON'T MISS THIS WEEK:
The investigation stands out for an extraordinary fact: the dismantling of the group was achieved in the total absence of telephone or environmental wiretaps. The Judicial Police combined traditional methods (surveillance and tracking) with sophisticated operational OSINT (Open Source Intelligence) activity and financial forensic analysis.
The organisation’s “Achilles’ heel” was the human factor
This technical capability enabled the tracking of over 410 Bitcoin wallets, reconstructing a turnover exceeding half a million euros between July 2022 and December 2023. At the same time as the execution of the orders, searches are underway aimed at enforcing the preventive seizure, both direct and “by equivalent”, ordered by the Naples GIP: a) of the means and IT tools, as well as the digital channels used to commit the offences; b) of money, real estate and movable property belonging to the suspects up to the amount of 536,880 euros. In this context, the organisation’s “Achilles’ heel” was the human factor: social media vanity and the criminals’ everyday interests allowed investigators to bypass digital encryption through different investigative techniques. Indeed, a “Game Over” of the digital identities of the individuals under investigation was achieved, as well as of the online markets linked to the accounts “El REAL SHOP” and “@Eldiablo0301”, active in the sale of drugs and counterfeit currency.
Accounts linked to the individuals behind the “ELREAL SHOP” vendor channel
The identification of some of the suspects was made possible despite attempts to anonymise their connections and communications, thanks to their passion for gaming (e.g. invitations to online games on well-known consoles, providing their personal nickname or carrying out “open” communications) and their social media activity, including the publication of images relating to domestic environments and places where they stored the body of the crime, enabling their identification. In other cases, the “Ink Investigation” proved decisive in linking accounts to the individuals behind the “ELREAL SHOP” vendor channel; indeed, in some promotional videos of newly listed counterfeit banknote batches, tattoos and other distinctive marks found on the suspects and in their homes were clearly visible. The measures executed constitute precautionary measures ordered during the preliminary investigation phase. Remedies may be lodged against them. The recipients of the measures are persons under investigation and therefore presumed innocent until a final judgment – reports the press release of the Carabinieri.
CINQUEW NEWS CONSIGLIA: