In April 2022, only a few months after Russia's invasion, an ominous black McLaren Coupe with Ukrainian plate appeared in a central district of Budapest. Amid the battered vehicles arriving from the front lines, this pristine sports car quickly drew the attention of luxury brand enthusiasts. Images of the car soon went viral, igniting a storm across social media.
"Ukrainian refugee in Budapest, at Bakáts Square..." – with this comment, the Facebook page Híreim.ma, boasting 120,000 followers, published the photo on May 11, 2022. The post was shared more than four thousand times, and comments suggested that the image served as evidence that financial aid to Ukraine was being misallocated due to corruption, implying that the refugees did not actually need support from either the Hungarian government or the European Union.
The meme has continued to spread across social media in various languages and waves, especially during periods when the EU approved larger aid packages for Ukraine (most recently in early February).
The Bronisław Geremek Center Foundation's 2023 study on propaganda against the Ukrainian minority in Poland also included a photograph of the car. The author points out that "many in Polish society are upset by the sight of wealthy Ukrainians," with some even suggesting that the war is just an excuse for Ukrainians to take advantage of Polish social benefits.
Having encountered discrediting campaigns that question immigrants’ genuine need for financial aid by pointing to their possession of 'expensive goods',' 'branded clothing', or 'the latest iPhone models', we decided to investigate the post targeting the Ukrainian refugee.
We discovered that the luxury car belonged not to a Ukrainian, but to a Middle Eastern man settled in Ukraine. He had brought the McLaren through Budapest to Warsaw, fleeing the devastation caused by the Russian military. However, our investigation also concluded that the car may have come into the possession of its then-owner through illicit activities.
At the time the photos were taken, the sports car was owned by a member of the criminal network known as the Milton Group. The Middle Eastern man operated under the alias William Bradley at the group’s Kyiv call centre, where he defrauded victims out of significant sums through false cryptocurrency investment schemes.
"Bradley" fled the war through Budapest to Warsaw, where he is still at large. He now flaunts his lavish lifestyle weekly on YouTube, starting a new life in Poland as a musician and content creator.
In this article, we will explore:
The Milton Group operates as a criminal organization specializing in financial fraud. It manages online platforms under various brand names that mimic the trading of securities on financial markets, while also maintaining call centers in Eastern European and Balkan countries. These call centers target less financially savvy clients, persuading them to make investments. Since 2016, brokers associated with the Milton Group have defrauded hundreds of thousands of people annually, mostly retirees, seizing amounts that exceed 50 million euros per quarter.
The group’s illegal activities came to light in 2018, prompting legal action in seven countries, with three additional nations joining later based on reports. An unprecedented level of international cooperation, coordinated by Eurojust, is currently underway to uncover these abuses in Germany, Finland, and Georgia. The investigation has seen the search of 15 call centers (six in Albania, five in Georgia, three in Ukraine, and one in North Macedonia), the seizure of 500 electronic devices, approximately 50 individuals questioned, and five arrests (four in Albania and one in Georgia). In Georgia, the investigation has reached political levels: in September of this year, Davit Kezerashvili, former head of the financial police and defense minister under Mikheil Saakashvili, was placed under investigation.
Hungarian victims have also suffered from these ongoing frauds, with their losses reported in a two-partseries by Direkt36. The case has been monitored worldwide by 26 media outlets in cooperation with authorities, including a documentary titled "The Billion Dollar Scam" produced by the BBC. However, no cases connected to the Milton Group have been investigated in Hungary, as the Hungarian police have not received any reports regarding these incidents—an ORFK spokesperson confirmed in response to our inquiry. According to Direkt36, among the Hungarian victims, "no one believed that the police or the courts would help recover their lost money, and they felt ashamed for having been deceived."
In the months following the outbreak of the war, there were approximately 10,000 border crossings daily between Ukraine and Hungary, according to measurements by Hungarian authorities. One of these crossings may have involved a black McLaren in April 2022, which made its way from Kyiv to Budapest via Uzhhorod. We were able to trace the car's route precisely through its licence plate, as "carspotter" communities on Instagram use these unique identifiers as hashtags. High-end cars imported into Ukraine get a lot of attention, leading several Instagram accounts to share photos of the sports car we were looking for at its latest location.
Carspotters are enthusiastic amateurs who have a passion for cars, particularly unique models. They photograph and share images online whenever they see a rare, vintage, or modified vehicle parked or driving through the city. The largest online collection platform is Autogespot, where users can search for individual cars based on brand, license plate, and country. In Ukraine, carspotters tend to utilize Instagram, where several pages specifically track unique brands such as Bentley and McLaren found within the country. Users can search for specific cars by their license plates (designated as hashtags) and also indicate their locations.
The McLaren 570S Coupé with the KA6666KA license-plate, has been tracked by the McLaren of Ukraine Instagram account since the car first appeared in the country in 2021. The initial photograph, taken in Odessa, features the vehicle still with its Georgian license plate. Later, the car was captured on camera in front of a modern residential complex in Kyiv, where it remained parked until early April 2022, even amid the ongoing Russian offensive in the city.
The sleek car, easily recognizable by its satanic license plate, likely left the Ukrainian capital not long after, as it was photographed in front of an apartment building in Uzhhorod by Uzhorodcars on Instagram by mid-April.
Five days later, the McLaren arrived in Budapest. The first to report this was Autogespot on April 20, and thanks to the church visible in the image, the location—Bakáts Square—was easily identifiable. Ukrainian sites quickly picked up the photos, accompanying them with the caption, "Our boys in Budapest."
It was in the ninth district that the infamous image was captured, which later became part of an anti-refugee campaign; however, the McLaren’s journey was far from over.
In a series of photographs taken in May 2022, the car appears prominently in front of the InterContinental Hotel in downtown Warsaw, as captured by Warsaw Cars Spott. The post notes that "since the outbreak of full-scale war, over 7.5 million people have left Ukraine according to official UN data, with the primary escape route heading into our brotherly Poland." The country also proved to be the McLaren's final destination, as Autogespot reported that it was spotted in the Polish capital even months later.
In Warsaw, images emerged not only of the Ukrainian-registered sports car but also, presumably, of its owner. This captured by a car photographer known as Minipizza in July 2022 at a historical landmark in Warsaw, the Markiewicz Viaduct.
The man in the photo reveals little about himself, aside from his affinity for luxury vehicles and branded clothing; he is dressed head to toe in Givenchy. However, his face is obscured by sunglasses and a baseball cap, leaving us with no further information about him.
Yet, there was a lead that propelled the investigation forward: a personal Instagram profile (@xwilamarx), which has been referenced in several posts, one of which—by Uzhgorodcars—identifies the account directly as belonging to the car's owner.
Unfortunately, the account was no longer accessible on Instagram at the time of writing. However, a search of the username on Meta's other platform, Facebook, yielded a result.
This is a video that, according to the post's metadata, was uploaded on January 24, 2022, featuring footage taken at a nightclub in Kyiv called Fifty Club. The caption reads: "new job @xwilamarx and DNGWAY." A quick internet search revealed that DNGWAY serves as a label for a local drill community, whose members frequently partied at the aforementioned club up until the outbreak of the war. (Drill is a musical genre, a substyle of hip-hop that musically resembles trap and lyrically aligns with gangsta rap.) On the official Facebook page of Fifty Club, we also found several photos in which the same man appears, who was featured both in the music video and in the images with the McLaren.
Interestingly, Fifty Club was the venue that last year became the subject of several viral posts mistakenly claiming it remained open amid the wartime emergency, even operating with Western aid. A France24 article, which conducted fact-checking on the matter, reached out to the club’s owner, Jay Fokin, whom we also contacted. Our messages to him and the administrators of the carspotter pages eventually reached their destination: in early March, we received a message on Instagram from a user named Mad Major: "Hello, you recently contacted one of my friends regarding the McLaren."
During our conversation, this user claimed to be the owner of the McLaren.
"My car came to Hungary three months after I left Ukraine. There were issues with the engine, so it was parked on the side of the road. I had to get it repaired before I could sell it. I never thought I would stir up such a scandal just by bringing my car," wrote a man introducing himself as David in our chat.
"They threw eggs at it and scratched the car because of the Ukrainian license plate," he continued. "It’s just a cheap sports car that you could get for a good price back then. A Georgian guy brought it in from the U.S., drove it to Ukraine, and I picked it up in Odessa. Many Ukrainians brought their cars with them, but nobody hated them for it. As for me, I’ve faced nothing but HATE," he added.
David also explained that coming to Budapest wasn’t his intention, but after the outbreak of war, the Polish-Ukrainian border was too crowded, making it easier for him to drive through Hungary. He mentioned that he is an Iranian citizen, but has lived and worked in Ukraine for eight years. He claimed to have graduated as a software developer from an "elite university" in Kyiv, and after finishing his studies, he started a business with friends. In one message, he said that before the war he was "running a crab farm," while in another he stated he was involved in the import-export of marine goods.
Our conversation took a strange turn when David asked if I was an influential journalist and if I would promote his music in a dedicated article, as he aspires to make a name for himself in that field. He said he could be my "whistleblower" in return, given his good connections with Ukrainian émigrés, including "big businessmen and artists." However, he requested that I not reveal his face or his "real name" in the article. (In the chat, he introduced himself as Dawood Karimi, which he claimed he uses in English-speaking contexts as David.)
"I wouldn’t want my face to be revealed in this way. My plan is to unveil myself at a concert, in front of my many followers. That’s my dream," he wrote. He then provided information for his artistic profile, noting that he posts rap and drill-style music and videos on Instagram under the handle Madder/DNGWAY.
David subsequently confirmed in writing that he is indeed the person seen in the photos taken in Warsaw and at the Kyiv nightclub. He further provided his own images as proof that the car was genuinely his at the time the scandal erupted. (However, in the wake of the wave of hate, he later parted ways with it. Ironically, the McLaren has since returned to Budapest, albeit with a different license plate.)
The story might have ended there, but before publishing the article, we decided to run one last facial recognition search, just to be sure. It was at this point that we realized we were not conversing with an ordinary McLaren owner.
The PimEyes facial recognition program operates similarly to a traditional search engine, except instead of inputting keywords, we upload images of faces into the browser. When we used David's profile picture for our search, we instantly received multiple hits, primarily investigative articles exposing perpetrators of an international financial fraud. David appears in a hidden camera recording made in a call center operated by a company known as the Milton Group in Kyiv. The footage shows one of the brokers swindling an amount equivalent to 50 million Hungarian forints from an unsuspecting victim over the phone.
The fraudulent activities of the Milton Group were brought to light by an international team of investigative journalists in 2020, coordinated by the OCCRP, an organization dedicated to uncovering organized crime and corruption. The findings of the investigation were published in a series titled "Fraud Factory."
The journalists relied on information leaked by a former employee of the Milton Group. This whistleblower provided dozens of documents and hidden camera footage to the Swedish newspaper Dagens Nyheter and law enforcement after realizing that their workplace was engaged in illegal activities. Based on the leaked materials, investigations were launched in ten countries against the perpetrators for massive investment fraud, coordinated by Eurojust.
During the course of the investigation, Jakub Keselman, the CEO, and David Todua, the "silent owner and father" of the Milton Group, were identified, along with one of the firm's top fraudsters, who operated under the anglicized name William Bradley.
This William Bradley is the same individual who introduced himself to us as David, the (former) owner of the McLaren at Bakáts Square.
This was confirmed by the former employee who had leaked information about the Milton Group when we reached out and showed him recent photographs of the man. Although authorities were unable to uncover the man’s true identity during the investigation, they determined that he is of Iranian descent, was 21 years old at the time of the fraudulent activities, and operated on social media under the name Javid Hamze.
According to the former employee who leaked information about the Milton Group, William Bradley/Javid Hamze was one of the company's "most productive and successful fraudsters." He earned between $240,000 and $500,000 per month, and according to the latest corporate documents obtained by the police, he defrauded his victims of approximately $4 million (equivalent to 1.5 billion Hungarian forints) in a single year. For his exceptional performance, he received a housing voucher at the company's New Year’s Eve party, as reported by the Czech outlet, Investigace.
The Milton Group’s customer service collected personal information about potential victims from various sources, whom call center employees—including William Bradley—sought to persuade over the phone to invest in nonexistent opportunities. Sometimes, leaked corporate databases were purchased on the black market, while at other times, clients willingly provided their details on registration forms associated with ads promising quick riches. One common method of data collection involved social media advertisements that highlighted scandals involving well-known figures, followed by recommendations for investment platforms that "banks are trying to keep secret."
Despite the enormous media attention surrounding the Kyiv call center case, an analyst from Emerging Europe lamented 18 months after the scandal broke that the Milton Group—operating under various names— continues to function unimpeded right in the heart of the Ukrainian capital.
"Although the Swedish government has implored Ukrainian authorities to take action, no meaningful measures have occurred. The police release photos once or twice a month, showcasing armed operations to dismantle the call centers, mostly in the suburbs of Kyiv. However, many believe these are merely superficial measures," wrote Emerging Europe.
The article also featured a representative from the Ukrainian Anti-Corruption Human Rights Council, who noted that the authorities are sluggish in their response because proving the culpability of perpetrators in such cases is challenging. "They cannot just enter and investigate without a court order. The Ukrainian constitution protects private property and business activities from state interference. Even with a warrant, such operations can be easily concealed, making them difficult to track," the expert told Emerging Europe.
Moreover, according to OCCRP, several similar investigations were temporarily suspended in Ukraine following the Russian invasion.
A Norwegian investigator from Okokrim, which is working on the Milton case, also mentioned the challenge posed by the frauds extending across multiple countries, as uncovering these operations demands vast resources. "In such cases, the perpetrators operate from one country while their clients are in another, their products in a third, payments received in a fourth, and then spent in a fifth," the investigator stated to Norway's VG portal.
While the case involving William Bradley/Javid Hamze, who primarily defrauded Swedish victims, made it to court in Sweden, Dagens Nyheter reported it was ultimately closed without any investigation, citing that "the crime is untraceable."
As evidenced above, successful conclusions to investigations into such extensive online frauds are rare, and it is even less common to trace where illegally obtained money disappears.
However, in the case of the Milton Group scammers, we were able to map this out precisely.
This required that Bradley/Hamze actively seek publicity even at a time when revealing his identity could be risky. The Iranian man has presented himself to the public in two key ways over the past eight months:
In the videos, he takes care to obscure his face—sometimes with a balaclava, other times through digital editing. (We have no information on whether any legal proceedings are currently underway against him; authorities have refrained from disclosing this information, citing the protection of personal rights. Nonetheless, his obsessive masking of his face could suggest some implications regarding ongoing legal issues.)
The prank videos, much like the drill music videos, lean heavily on themes of flaunting wealth and lavish spending: Rolls-Royces race past the camera, stacks of cash are flashed, diamond grills glint in the light, and no one bats an eye if a new Kawasaki gets wrecked or if $20,000 is blown in a casino. There’s drifting, partying, and a general embrace of a high-rolling lifestyle.
However, the videos also made their temporary residence identifiable.
Until recently, the seven-member gang spent their days in a 650-square-meter mansion in the suburban greenbelt of Warsaw, in Podkowa Lesná. The property was visited by a journalist from Gazeta Wyborcza, Lakmusz's Polish partner, in early September, and we also stopped by when we were in Warsaw. One neighbor noted that the group communicated in Polish amongst themselves, while another claimed they spoke in Russian, but both were struck by the amount of money these young individuals possessed. The team, including Bradley/Hamze, likely left the property in mid-June, yet based on their video updates, they still appear to be in Poland.
This article was written in the framework of The Eastern Frontier Initiative (TEFI) project. TEFI is a collaboration of independent publishers from Central and Eastern Europe, to foster common thinking and cooperation on European security issues in the region. The project aims to promote knowledge sharing in the European press and contribute to a more resilient European democracy.
Members of the consortium are 444 (Hungary), Gazeta Wyborcza (Poland), SME (Slovakia), PressOne (Romania), and Bellingcat (The Netherlands).
The TEFI project is co-financed by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Education and Culture Executive Agency (EACEA). Neither the European Union nor EACEA can be held responsible for them.
Dzisiejsza gazeta (e-wydanie)
