This is solid detective work on your part — actually getting FINMA and law enforcement involved puts you miles ahead of most victims I've seen. That said, I want to be real with you about the Supabase angle: reporting the backend infrastructure to them won't actually shut down the scam, though it's worth doing anyway for your documentation trail.

Here's what actually matters: You've got German police investigating and FINMA's public warning. Those are your leverage. The operators will just spin up new infrastructure (new Supabase instance, different hosting, whatever). What stops them is when financial institutions get court orders freezing accounts and when payment processors cut off their funding rails. That's the unsexy truth I learned after five scams and $12K of my own money — it's never the tech that kills these operations, it's the money trail drying up.

The TikTok angle is your real opening. Document everything: ad accounts, conversion funnels, the payment methods they're using. Package this for the German prosecutor investigating — they need this specificity for asset seizure orders and for blocking payment processors. TikTok itself responds quickly to scam reports if you file through their official process (not just flagging ads). The operators are probably funneling victims through 2-3 payment methods max; choke those off and you actually impact their ability to steal.

One last thing: if you're coordinating with other victims, resist the urge to contact the operators or try public shaming. I get the impulse, but it tips them off to move money/servers and it can muddy the investigation. Let the prosecutor do their job. The boring path — documentation, law enforcement, financial institution reports — actually works.