§ — Crypto scams · Fake exchanges

The platform was never an exchange The deposits were real.

A fake exchange is a website or an app that accepts deposits, displays a balance that grows, and then does not let the money out — usually by requiring a tax, a fee or a verification payment first. There is no market behind the screen and there never was: the trades, the chart and the profit are entries in a database controlled by the people who took your money. This page explains how the operation is built, what the first successful withdrawal is actually for, where the deposits go, and what decides whether they can be traced back.
Last updated: 1 August 2026Figures as of: 30 July 2026First response: within 2 business hours
Types of crypto theft4 pages
Type 01
Type 04
Fake exchanges
You are here
§ 01 — What it is

What you were actually using.

Building a convincing exchange is not difficult. The order book, the price chart, the portfolio page and the profit figure are all rendered from values the operator sets; the support agent is a person on a salary; the licence certificate on the About page is an image. The only part of the system connected to reality is the deposit address, and it belongs to the operator.

Some of these platforms are clones of a real brand, differing by a character in the domain. Others are invented outright, with a corporate identity assembled from a registry entry in a jurisdiction that does not supervise the activity. Both work the same way, because the deception is not in the branding — it is in the fact that no market exists on the other side of your trades.

The consequence people find hardest. Your balance was never held in an account: it was a number written next to your name. The money that existed is the money you sent, and it left the moment it arrived. Everything the platform tells you about releasing the balance is a request for more of the first kind of money in exchange for more of the second.

§ 02 — The pattern

The pattern, from first deposit to the fee that never ends.

Introduction.

An advertisement, a messaging group, a trading community, or — most often in the cases we handle — a person you have been talking to for weeks.

See romance and long-con investment scams

A small first deposit.

Everything works. The interface is responsive, the position appears, the balance moves in the right direction.

Days

A withdrawal that succeeds.

Small, fast, and paid out of your own deposit. This is the most expensive moment of the whole scheme for the operator, and the best investment they make.

This is what makes the next step feel safe

The large deposits.

Often with encouragement to add funds during a moment of apparent opportunity, sometimes with borrowed money or a released pension.

Weeks to months

The withdrawal is blocked.

A tax, a commission, an anti-money-laundering fee, a verification deposit, an account upgrade, an insurance payment — the reason varies and the structure does not: pay from outside to release what is inside.

Each payment produces a new requirement

Silence.

The account is frozen for a compliance review, the manager stops replying, the domain expires or is replaced by an identical one under a new name.

And the evidence goes with it

Why the fees keep arriving. There is no balance to release, so every demand is simply the next sale. Some operations produce official-looking letters from a regulator or a bank to support the request; those are made in the same place the trading screen was. No genuine exchange has ever needed an external payment to let you withdraw your own funds.

§ 03 — The tells

What was checkable from the outside.

Not advice on where to trade — we are investigators, not advisers. These are the checks that would have failed in the cases we have worked, and every one of them is done away from the platform's own website.

The licence exists only on their site.

A regulator's register is public and searchable; a number that returns nothing there, or returns a different company, is the end of the conversation.

The app did not come from an app store.

Install links, test-build invitations and direct downloads bypass the only review step in the chain.

Support lives entirely in a messenger.

A personal account manager writing to you privately is a sales structure, not a compliance one.

The deposit address changes each time.

Convenient for laundering, unnecessary for an exchange with real custody.

Withdrawal terms appear only when you try to withdraw.

Fees invented at the exit are the scheme's business model.

The corporate entity is thin.

A recent registration in a jurisdiction that does not supervise this activity, an address shared with hundreds of companies, no verifiable people.

The same test applies to us. Our registry entries — trade licence 1135542, register No. 1876962, Dubai Chamber of Commerce & Industry 439332 — are published in full on credentials, and the ten-point check on our verification page is written so that it can be used against any firm, including this one.

§ 04 — The money

Where the deposits actually went.

This is the part that decides your case, and it is the reason fake-platform cases are more workable than a rug pull. The operation has to collect money from many people and turn it into spendable funds, which means the proceeds pass through infrastructure that belongs to somebody.

Collection.

Deposits arrive at addresses the platform controls, often a fresh one per customer so that the total is not visible to any single victim.

Every one of those transfers is permanent and public

Consolidation.

The individual deposits are swept together, which is the moment the scale of the operation becomes visible on-chain — and the moment separate victims turn out to be one case.

Hours to days

Layering.

Swaps, bridges between networks, sometimes a mixing service, sometimes nothing more than a chain of intermediate addresses.

This is what the trace has to survive

Cash-out.

Exchange accounts, payment processors, over-the-counter desks — parties with compliance obligations and a customer behind the account.

The point where a freeze becomes possible

We follow this on Ethereum, Bitcoin, Tron, BSC, Polygon and Solana, where every movement is permanently recorded. We do not work with Monero, because it cannot be traced, and we say so at the first call rather than accepting the case and billing the attempt.

§ 05 — Recovery

Can it be recovered? The honest version.

Recovery in this category depends on two things, in this order: whether the funds reached a service with an operator and an identified customer, and whether they are still there.

What works in your favour. Unlike a rug pull, there is usually a counterparty somewhere: the operation needs banking, payment rails or exchange accounts to convert deposits into money it can use. Multiple victims of the same platform also make one stronger case rather than several weak ones — the addresses overlap, and so does the evidence. We flag stolen transactions to AML providers within four hours of intake, a freeze request to an exchange takes 2–4 days once filed, and the formal block that follows a police report adds 2–3 days. Where a stablecoin issuer is involved, the response to a freeze request typically arrives in 24–62 hours.

What works against you. Time, and the fee stage. These schemes are built to keep the victim paying for months, and every month of that is a month in which the deposits are being cashed out. Cases that arrive while the platform is still asking for a release fee are in a much better position than cases that arrive after it goes silent.

Return, when it comes, follows the ordinary timetable: 6–9 months from an exchange; for USDT through the issuer, a first payout at 12–20 months including a three-month lock, with full repayment around 24 months in quarterly instalments; 6–36 months for complex or multi-jurisdictional cases. A freeze is measured in days and a repayment is not — anyone answering this question in days is describing the freeze. Full timings are on our data page.

Our published figure is 68% success rate on accepted cases · measured over the past 24 months. We decline cases where we see no realistic prospect of recovery, which in this category usually means the deposits were cashed out long ago. That answer is free and comes on the first call.

§ 06 — What to do now

What to do now, in this order.

Stop paying. Completely.

No tax, no fee, no verification deposit, no partial settlement, no matter how close the release appears to be.

There is no version of this where the next payment is the last one

Save the platform before it disappears.

The exact web address, screenshots of the account with balance and dates visible, the app or install link, the terms page, and the full chat history with support and your account manager.

Screenshots with visible dates; export chats where you can

Collect the money trail.

Transaction hashes, the deposit addresses you sent to, and any bank or card details used at either end.

Hashes matter most — they are what we trace

Report it to the police.

The formal block at an exchange rests on a police report, and the court order that returns money rests on the file behind it. If bank or card payments were involved, contact the bank the same day.

Where and how, by country: our reporting guide

Find the other victims.

Platforms of this kind operate at scale, and a group of people with a shared address set is a materially stronger case than one person.

Do not organise it through a link somebody sends you

Get the addresses flagged.

Send us the hashes. Flagging happens within four hours of intake, the assessment call is free, and it may end with us telling you not to proceed.

[email protected] · +971 56 182 9077 · reply within 2 business hours
§ 07 — The second scam

The people who will contact you next.

Victims of a collapsed platform are easy to find: they gather in the same groups, complain in the same forums, and appear on lists that circulate and are sold. Approaches offering recovery follow, sometimes within days, and sometimes from the same operation under a new name — including offers to release the balance you can still see on the screen.

The FBI's Internet Crime Complaint Center has issued repeated advisories about fictitious law firms contacting crypto scam victims and offering to recover funds for an up-front fee. Between February 2023 and February 2024 alone, victims re-targeted this way reported losses of more than $9.9 million. Both advisories are public: PSA240624 and PSA250813.

This applies to us too. We do not cold-message victims, we are not affiliated with any government agency, and no agency refers cases to us. If someone approaches you in our name, it is not us — report it to IC3. Before engaging anyone, including us, run the ten-point check on our verification page.

§ 08 — Our limits

What we do not do.

Recover a balance from the platform.

There is nothing there to recover. What can be worked is the money that left your wallet or account.

Reverse transactions.

Nobody can. What exists is a freeze after the funds reach a service with an operator, and a return after that.

Non-crypto assets.

Card and bank losses run through your bank and the police; that is not our field and we will say so rather than take the case.

Monero.

It cannot be traced, so we decline rather than bill the attempt.

Chinese OTC channels.

Outside what we can work effectively.

Cases where the source of the funds cannot be confirmed.

Non-negotiable.

Cases with no realistic prospect of recovery.

Declined on the first call.

Legal practice.

Forensics and the evidence base are ours; police reports, freeze filings and court applications are carried out by partner law firms in the relevant jurisdiction.

Guarantees.

Recovery is decided by courts, exchanges and token issuers.

Related: all six types of crypto theft and their recoverability · romance and long-con investment scams · wallet drainers · how a recovery case runs end to end.

§ 09 — FAQ

Fake platforms — the questions we are asked.

The checks that work are outside the platform, not inside it. A real venue is licensed somewhere, and the licence number can be looked up in the regulator's own register rather than on the company's website; its corporate identity matches that entry; and its app comes from the ordinary app stores rather than from a link somebody sent you. Inside the platform, everything can be drawn: balances, order books, charts, support staff, even a certificate. If the only evidence that a firm is regulated is published by that firm, there is no evidence.

§ 10 — Authorship

Who wrote this, and who checked it.

Taras Podhorodetskyi

Founder and CEO, StarCompliance · blockchain investigations since 2022 · speaker, WOW Summit 2024 · interviewed by ForkLog, 23 July 2024

Reviewed by: compliance reviewer — name and role published with the next update of this page.

Disclaimer. This page is informational and is not legal or investment advice. It describes how these schemes generally operate; no assessment of any individual case can be made from a general description, and nothing here identifies any particular platform. Recovery decisions rest with courts, exchanges and token issuers, and no outcome is guaranteed. Company figures are stated as of 30 July 2026.
§ — Engage

Have a case?
Start an intake.

Response within two business hours. Confidential. Success-fee terms on recovery work.