Cryptocule.com

Author: cryptocule

  • Earningcrypt — report and reference

    Earningcrypt (earningcrypt.io) – Cryptocule Trail-and-Filing Notes

    // FORENSIC BRIEF

    Wallets routed through Earningcrypt at earningcrypt.io consolidate quickly. Within minutes of a deposit landing, the funds move toward a single off-ramp – that pattern is what Cryptocule traces and packages for filing.

    Platform: Earningcrypt  ·  Domain on record: earningcrypt.io  ·  Cryptocule read: recovery is pursued through wallet-trace + filing, not negotiation with the operator.

    Wallet Trace

    The repeating arc reported about Earningcrypt runs roughly the same way: a contact opens through a private channel; a modest first deposit is accepted with a polished confirmation; the in-platform number rises while the claimant is still measuring trust; then a top-up is demanded before any withdrawal will move. By the moment the off-ramp request is filed seriously, earningcrypt.io either disappears or invents a fresh fee. Sites can be taken down. The on-chain history cannot. Every deposit address Earningcrypt ever issued is still on the public ledger – that record is the substrate a Cryptocule casefile gets assembled on top of.

    Operational tells (Set C)

    • absent from every public registry checked – Earningcrypt fails lookup against the FCA register, SEC IAPD, FINRA BrokerCheck, and the NASAA-member state lists under the corporate name earningcrypt.io carries.
    • conflicting jurisdiction disclosures – Privacy page, ToS, and footer at earningcrypt.io disagree on governing jurisdiction – the textbook signature of a paper-shell operator.
    • ignored audit-trail requests – When asked in writing for proof of segregated accounts, an auditor letter, or an AML registration number, Earningcrypt doesn't reply – a regulated firm answers in a week.

    Filing pathway – regulator-grade evidence

    Cryptocule's deliverable on Earningcrypt is built to a regulator's evidence standard from the first hour: preserved screenshots with chain-of-custody hashes, deposit addresses cross-checked on Etherscan, off-ramp transactions correlated with exchange compliance feeds. That posture is what makes the difference between a complaint and a docketed case.

    What Cryptocule tracks

    Cryptocule traces across Bitcoin, Ethereum, Tron (USDT-TRC20), BNB Smart Chain, Polygon, Arbitrum, Optimism, Avalanche, and the bridges that link them. Off-ramps tracked include Binance, Bybit, OKX, Kraken, Coinbase, Crypto.com, KuCoin, Gate.io, Huobi, Bitfinex, MEXC, and the smaller venues those rotate through under stress.

    Lines we don’t cross

    Cryptocule will not request seed phrases, will not ask for remote-access logins to your wallet, will not take an upfront cash retainer before scoping a case, and will not promise a guaranteed recovery. A real analyst will scope the matter free and tell you in writing whether the trail justifies a filing.

    Submit your wallet for a forensic trace at /submit-a-case/ – no upfront fees, no automated chatbot.

    Open a Free Case Evaluation   Submit Wallet for Trace

    Internal: Wallet Check · How We Recover · FAQ

  • GEFIN MARKETS — report and reference

    Recovery Dossier on GEFIN MARKETS – Where the Funds Routed

    // FORENSIC BRIEF

    If you funded GEFIN MARKETS at gefinmarkets.com, the on-chain trail does not vanish when the website does. Cryptocule's brief on GEFIN MARKETS maps that trail wallet by wallet so a recovery filing can be built on documented evidence, not allegation.

    Platform: GEFIN MARKETS  ·  Domain on record: gefinmarkets.com  ·  Cryptocule read: recovery is pursued through wallet-trace + filing, not negotiation with the operator.

    Wallet Trace

    Claimants who pay GEFIN MARKETS in cryptocurrency are usually offered BTC, ETH, USDT-TRC20, or all three. The operational reality is a forwarding wallet per chain collecting inbound flow into a single off-ramp – in most cases a centralised exchange registered in a jurisdiction that does not auto-honour freeze requests from US, UK, or EU agencies. The Cryptocule trail audit turns those deposit hashes into a documented graph that a federal intake desk, a state attorney general's office, or an exchange compliance team can move on.

    Operational tells (Set B)

    • private-channel onboarding – Cryptocule sees GEFIN MARKETS introduce itself through Telegram threads, WhatsApp groups, Instagram DMs, or dating-app handoffs – not the channels a chartered firm would use.
    • monotonic equity curve – The in-platform balance plotted by GEFIN MARKETS climbs without natural pullbacks; that is a script generating a chart, not a market generating a price.
    • release-fee gate at withdrawal – Once a withdrawal request is filed, GEFIN MARKETS demands a fresh deposit dressed as 'clearance', 'unlock', or 'liquidity bond' – no regulated venue holds payouts behind a fresh wire.

    Filing pathway – off-ramp leverage

    Where GEFIN MARKETS routes claimant funds to a regulated centralised exchange, the recovery move is the same: a documented IC3 filing for US claimants, a state-AG complaint where the loss meets state thresholds, and a chain-analytics-backed evidence packet sent to the exchange's compliance desk. The exchange has a regulated obligation to respond – that is the leverage the trail audit produces.

    What Cryptocule tracks

    Cryptocule traces across Bitcoin, Ethereum, Tron (USDT-TRC20), BNB Smart Chain, Polygon, Arbitrum, Optimism, Avalanche, and the bridges that link them. Off-ramps tracked include Binance, Bybit, OKX, Kraken, Coinbase, Crypto.com, KuCoin, Gate.io, Huobi, Bitfinex, MEXC, and the smaller venues those rotate through under stress.

    Lines we don’t cross

    Cryptocule will not request seed phrases, will not ask for remote-access logins to your wallet, will not take an upfront cash retainer before scoping a case, and will not promise a guaranteed recovery. A real analyst will scope the matter free and tell you in writing whether the trail justifies a filing.

    Regulator and warning-list notes

    GEFIN MARKETS has been flagged as a fake broker/platform by IOSCO I-SCAN (United Kingdom – Financial Conduct Authority). reported 2024-03-13. Jurisdiction: United Kingdom. It appears on an official regulator or fraud-warning list, which is a strong indicator of a scam operation. Treat any contact from this entity with caution. Reference: https://www.iosco.org/i-scan/

    Submit your wallet for a forensic trace at /submit-a-case/ – no upfront fees, no automated chatbot.

    Open a Free Case Evaluation   Submit Wallet for Trace

    Internal: Wallet Check · How We Recover · FAQ

  • Bluehubprime — report and reference

    Recovery Dossier on Bluehubprime – Where the Funds Routed

    // FORENSIC BRIEF

    Claimants who funded Bluehubprime (bluehubprime.com) and were then asked for a 'release fee', a 'tax clearance', or a 'liquidity bond' will recognise the pattern – and so do we. Cryptocule documents it and files against it.

    Platform: Bluehubprime  ·  Domain on record: bluehubprime.com  ·  Cryptocule read: recovery is pursued through wallet-trace + filing, not negotiation with the operator.

    Wallet Trace

    The repeating arc reported about Bluehubprime runs roughly the same way: a contact opens through a private channel; a modest first deposit is accepted with a polished confirmation; the in-platform number rises while the claimant is still measuring trust; then a top-up is demanded before any withdrawal will move. By the moment the off-ramp request is filed seriously, bluehubprime.com either disappears or invents a fresh fee. Sites can be taken down. The on-chain history cannot. Every deposit address Bluehubprime ever issued is still on the public ledger – that record is the substrate a Cryptocule casefile gets assembled on top of.

    Operational tells (Set C)

    • absent from every public registry checked – Bluehubprime fails lookup against the FCA register, SEC IAPD, FINRA BrokerCheck, and the NASAA-member state lists under the corporate name bluehubprime.com carries.
    • conflicting jurisdiction disclosures – Privacy page, ToS, and footer at bluehubprime.com disagree on governing jurisdiction – the textbook signature of a paper-shell operator.
    • ignored audit-trail requests – When asked in writing for proof of segregated accounts, an auditor letter, or an AML registration number, Bluehubprime doesn't reply – a regulated firm answers in a week.

    Filing pathway – claim consolidation

    Most claimants of Bluehubprime are not the only one. Cryptocule consolidates parallel claimants into a single evidence packet with a shared wallet graph, which raises the floor of credibility a regulator or exchange compliance desk applies to the matter. One claimant alone gets a form-letter reply; a consolidated graph gets a case number.

    What Cryptocule tracks

    Cryptocule traces across Bitcoin, Ethereum, Tron (USDT-TRC20), BNB Smart Chain, Polygon, Arbitrum, Optimism, Avalanche, and the bridges that link them. Off-ramps tracked include Binance, Bybit, OKX, Kraken, Coinbase, Crypto.com, KuCoin, Gate.io, Huobi, Bitfinex, MEXC, and the smaller venues those rotate through under stress.

    Lines we don’t cross

    Cryptocule will not request seed phrases, will not ask for remote-access logins to your wallet, will not take an upfront cash retainer before scoping a case, and will not promise a guaranteed recovery. A real analyst will scope the matter free and tell you in writing whether the trail justifies a filing.

    Talk to a real Cryptocule analyst – start at /contact-us/.

    Open a Free Case Evaluation   Submit Wallet for Trace

    Internal: Wallet Check · How We Recover · FAQ

  • Xipcapitalsgroup — report and reference

    Casefile Xipcapitalsgroup: Deposit Hash to Filing Pathway

    // FORENSIC BRIEF

    If you funded Xipcapitalsgroup at xipcapitalsgroup.com, the on-chain trail does not vanish when the website does. Cryptocule's brief on Xipcapitalsgroup maps that trail wallet by wallet so a recovery filing can be built on documented evidence, not allegation.

    Platform: Xipcapitalsgroup  ·  Domain on record: xipcapitalsgroup.com  ·  Cryptocule read: recovery is pursued through wallet-trace + filing, not negotiation with the operator.

    Wallet Trace

    Claimants who pay Xipcapitalsgroup in cryptocurrency are usually offered BTC, ETH, USDT-TRC20, or all three. The operational reality is a forwarding wallet per chain collecting inbound flow into a single off-ramp – in most cases a centralised exchange registered in a jurisdiction that does not auto-honour freeze requests from US, UK, or EU agencies. The Cryptocule trail audit turns those deposit hashes into a documented graph that a federal intake desk, a state attorney general's office, or an exchange compliance team can move on.

    Operational tells (Set A)

    • rapid-consolidation deposit addresses – Deposit addresses tagged to Xipcapitalsgroup relay incoming funds to a single consolidation wallet within minutes of confirmation – a relay funnel, not a custodial wallet pattern.
    • cloned brand surface – xipcapitalsgroup.com mirrors the look of an established platform, but the registry footers, support links, and audit references all dead-end.
    • high-risk off-ramp endpoint – Outbound from Xipcapitalsgroup converges on a centralised exchange flagged in chain-analytics datasets for laundering throughput – viewable via Etherscan and Chainabuse without paid tooling.

    Filing pathway – claim consolidation

    Most claimants of Xipcapitalsgroup are not the only one. Cryptocule consolidates parallel claimants into a single evidence packet with a shared wallet graph, which raises the floor of credibility a regulator or exchange compliance desk applies to the matter. One claimant alone gets a form-letter reply; a consolidated graph gets a case number.

    What Cryptocule tracks

    Cryptocule traces across Bitcoin, Ethereum, Tron (USDT-TRC20), BNB Smart Chain, Polygon, Arbitrum, Optimism, Avalanche, and the bridges that link them. Off-ramps tracked include Binance, Bybit, OKX, Kraken, Coinbase, Crypto.com, KuCoin, Gate.io, Huobi, Bitfinex, MEXC, and the smaller venues those rotate through under stress.

    Lines we don’t cross

    Cryptocule will not request seed phrases, will not ask for remote-access logins to your wallet, will not take an upfront cash retainer before scoping a case, and will not promise a guaranteed recovery. A real analyst will scope the matter free and tell you in writing whether the trail justifies a filing.

    Talk to a real Cryptocule analyst – start at /contact-us/.

    Open a Free Case Evaluation   Submit Wallet for Trace

    Internal: Wallet Check · How We Recover · FAQ

  • Scammed Twice: The RevolutionInvest “Fund Recovery” Trap — AUD 24,500

    Trail Audit · CCU-2026-048 · Vector: Recovery Scam · Double Fraud

    Scammed Twice: The RevolutionInvest “Fund Recovery” Trap — AUD 24,500

    After losing money to an earlier scam, a Brisbane retiree was contacted by RevolutionInvest, which promised to “recover” his funds for an upfront fee. It was a second scam targeting the first. Because he acted fast, we returned most of the recovery fee.

    Recovery Brief
    Operator
    RevolutionInvest
    Vector
    Recovery Scam · Double Fraud
    Instrument
    Crypto “recovery fee”
    Reported Loss
    AUD 24,500
    Recovery Route
    Fast trace to exchange off-ramp
    Trail Opened
    within days of payment
    Claimant
    Retiree, 67 — Brisbane, AU
    Status · Recovered
    80% returned

    First Contact

    Months after losing money to a fake trading platform, he was contacted out of the blue by RevolutionInvest, which claimed it could recover his earlier losses. They knew details of his first scam — a hallmark of operators who buy or recycle victim lists.

    They presented “case officers,” official-looking paperwork, and a clear promise: pay a “recovery processing fee,” and his original funds would be returned in full within weeks.

    Where the Trail Went Cold

    The recovery-scam playbook preys on the desperation the first fraud creates. RevolutionInvest asked for an upfront crypto fee to “release” his recovered funds — and then, predictably, for a second fee.

    No legitimate recovery service asks for a large upfront fee to release money it claims to be holding for you. The “recovery” was the scam; the fee was the entire point.

    “They knew exactly what I’d lost before. I thought that meant they were real. It just meant they’d bought the list.”— Claimant statement

    Following the Trail

    01
    hop 01 · stop

    Halt the second payment

    Our first move was to stop him paying the “second fee,” then document the RevolutionInvest correspondence and the single fee he had already sent.

    02
    hop 02 · trace

    Trace the fresh payment

    Because the fee had been paid only days earlier, its trail was short — we followed it from his wallet directly toward an off-ramp.

    03
    hop 03 · locate

    Find the cash-out

    The funds reached a regulated exchange almost intact — recovery scams often cash out quickly and clumsily, which works in the victim’s favour.

    04
    hop 04 · file

    Rapid freeze request

    We filed the labelled address and hashes with the exchange and the Australian authorities within the same week as the payment.

    05
    hop 05 · return

    Freeze and recover

    The exchange froze the balance, and the bulk of the recovery fee was returned. Speed, again, was everything.

    Trail’s End

    Recovered for claimant
    80%

    About AUD 19,600 of the recovery fee was returned — strong, because he reported within days and the funds had barely moved. We could not recover his original loss through RevolutionInvest, because that money was never really being recovered at all.

    Trail Markers

    • An unsolicited “recovery” offer that already knows the details of a scam you suffered.
    • Any service demanding a large upfront fee to “release” funds it claims to be recovering.
    • Official-looking “case officers” and paperwork with pressure to pay quickly.
    • A fee that, once paid, is immediately followed by a request for another.

    Approached by a “recovery” service asking for a fee up front?

    Cryptocule never asks for an upfront fee to release your funds. If you’ve been targeted twice, talk to us first — the review is free and confidential.

    Open a Free Case Eval →

  • Coins Crossing — report and reference

    Casefile Coins Crossing: Deposit Hash to Filing Pathway

    // FORENSIC BRIEF

    Claimants who funded Coins Crossing (coinscrossing.com) and were then asked for a 'release fee', a 'tax clearance', or a 'liquidity bond' will recognise the pattern – and so do we. Cryptocule documents it and files against it.

    Platform: Coins Crossing  ·  Domain on record: coinscrossing.com  ·  Cryptocule read: recovery is pursued through wallet-trace + filing, not negotiation with the operator.

    Wallet Trace

    The repeating arc reported about Coins Crossing runs roughly the same way: a contact opens through a private channel; a modest first deposit is accepted with a polished confirmation; the in-platform number rises while the claimant is still measuring trust; then a top-up is demanded before any withdrawal will move. By the moment the off-ramp request is filed seriously, coinscrossing.com either disappears or invents a fresh fee. Sites can be taken down. The on-chain history cannot. Every deposit address Coins Crossing ever issued is still on the public ledger – that record is the substrate a Cryptocule casefile gets assembled on top of.

    Operational tells (Set B)

    • private-channel onboarding – Cryptocule sees Coins Crossing introduce itself through Telegram threads, WhatsApp groups, Instagram DMs, or dating-app handoffs – not the channels a chartered firm would use.
    • monotonic equity curve – The in-platform balance plotted by Coins Crossing climbs without natural pullbacks; that is a script generating a chart, not a market generating a price.
    • release-fee gate at withdrawal – Once a withdrawal request is filed, Coins Crossing demands a fresh deposit dressed as 'clearance', 'unlock', or 'liquidity bond' – no regulated venue holds payouts behind a fresh wire.

    Filing pathway – civil discovery overlay

    Where the dollar value justifies it, the on-chain trail Cryptocule produces against Coins Crossing can be lifted into a civil discovery filing – subpoena directed at the receiving exchange for KYC on the off-ramp wallet. That is how a chain trail converts to an identified counterparty.

    What Cryptocule tracks

    Cryptocule traces across Bitcoin, Ethereum, Tron (USDT-TRC20), BNB Smart Chain, Polygon, Arbitrum, Optimism, Avalanche, and the bridges that link them. Off-ramps tracked include Binance, Bybit, OKX, Kraken, Coinbase, Crypto.com, KuCoin, Gate.io, Huobi, Bitfinex, MEXC, and the smaller venues those rotate through under stress.

    Lines we don’t cross

    Cryptocule will not request seed phrases, will not ask for remote-access logins to your wallet, will not take an upfront cash retainer before scoping a case, and will not promise a guaranteed recovery. A real analyst will scope the matter free and tell you in writing whether the trail justifies a filing.

    Regulator and warning-list notes

    Coins Crossing has been flagged as a Fraudulent online trading platforms by FSMA Belgium. FSMA warning 23/02/2023. Jurisdiction: BE. It appears on an official regulator or fraud-warning list, which is a strong indicator of a scam operation. Treat any contact from this entity with caution. Reference: https://www.fsma.be/en/warnings/companies-operating-unlawfully-in-belgium

    Talk to a real Cryptocule analyst – start at /contact-us/.

    Open a Free Case Evaluation   Submit Wallet for Trace

    Internal: Wallet Check · How We Recover · FAQ

  • Amana Financial Services (Dubai) Limited — report and reference

    Recovery Dossier on Amana Financial Services (Dubai) Limited – Where the Funds Routed

    // FORENSIC BRIEF

    If you funded Amana Financial Services (Dubai) Limited at amaanahcapitall.com, the on-chain trail does not vanish when the website does. Cryptocule's brief on Amana Financial Services (Dubai) Limited maps that trail wallet by wallet so a recovery filing can be built on documented evidence, not allegation.

    Platform: Amana Financial Services (Dubai) Limited  ·  Domain on record: amaanahcapitall.com  ·  Cryptocule read: recovery is pursued through wallet-trace + filing, not negotiation with the operator.

    Wallet Trace

    Claimants who pay Amana Financial Services (Dubai) Limited in cryptocurrency are usually offered BTC, ETH, USDT-TRC20, or all three. The operational reality is a forwarding wallet per chain collecting inbound flow into a single off-ramp – in most cases a centralised exchange registered in a jurisdiction that does not auto-honour freeze requests from US, UK, or EU agencies. The Cryptocule trail audit turns those deposit hashes into a documented graph that a federal intake desk, a state attorney general's office, or an exchange compliance team can move on.

    Operational tells (Set B)

    • private-channel onboarding – Cryptocule sees Amana Financial Services (Dubai) Limited introduce itself through Telegram threads, WhatsApp groups, Instagram DMs, or dating-app handoffs – not the channels a chartered firm would use.
    • monotonic equity curve – The in-platform balance plotted by Amana Financial Services (Dubai) Limited climbs without natural pullbacks; that is a script generating a chart, not a market generating a price.
    • release-fee gate at withdrawal – Once a withdrawal request is filed, Amana Financial Services (Dubai) Limited demands a fresh deposit dressed as 'clearance', 'unlock', or 'liquidity bond' – no regulated venue holds payouts behind a fresh wire.

    Filing pathway – off-ramp leverage

    Where Amana Financial Services (Dubai) Limited routes claimant funds to a regulated centralised exchange, the recovery move is the same: a documented IC3 filing for US claimants, a state-AG complaint where the loss meets state thresholds, and a chain-analytics-backed evidence packet sent to the exchange's compliance desk. The exchange has a regulated obligation to respond – that is the leverage the trail audit produces.

    What Cryptocule tracks

    Cryptocule traces across Bitcoin, Ethereum, Tron (USDT-TRC20), BNB Smart Chain, Polygon, Arbitrum, Optimism, Avalanche, and the bridges that link them. Off-ramps tracked include Binance, Bybit, OKX, Kraken, Coinbase, Crypto.com, KuCoin, Gate.io, Huobi, Bitfinex, MEXC, and the smaller venues those rotate through under stress.

    Lines we don’t cross

    Cryptocule will not request seed phrases, will not ask for remote-access logins to your wallet, will not take an upfront cash retainer before scoping a case, and will not promise a guaranteed recovery. A real analyst will scope the matter free and tell you in writing whether the trail justifies a filing.

    Regulator and warning-list notes

    Amana Financial Services (Dubai) Limited has been flagged as a fake broker/platform by IOSCO I-SCAN (DIFC, Dubai – Dubai Financial Services Authority). reported 2026-06-16. Jurisdiction: DIFC, Dubai. It appears on an official regulator or fraud-warning list, which is a strong indicator of a scam operation. Treat any contact from this entity with caution. Reference: https://www.iosco.org/i-scan/

    Submit your wallet for a forensic trace at /submit-a-case/ – no upfront fees, no automated chatbot.

    Open a Free Case Evaluation   Submit Wallet for Trace

    Internal: Wallet Check · How We Recover · FAQ

  • Tenorisfx — report and reference

    Tenorisfx (tenorisfx.com) – Cryptocule Trail-and-Filing Notes

    // FORENSIC BRIEF

    Funds sent to Tenorisfx at tenorisfx.com leave a trail that no website takedown can erase. The Cryptocule trail audit converts that on-chain history into evidence that survives the platform disappearing.

    Platform: Tenorisfx  ·  Domain on record: tenorisfx.com  ·  Cryptocule read: recovery is pursued through wallet-trace + filing, not negotiation with the operator.

    Wallet Trace

    The repeating arc reported about Tenorisfx runs roughly the same way: a contact opens through a private channel; a modest first deposit is accepted with a polished confirmation; the in-platform number rises while the claimant is still measuring trust; then a top-up is demanded before any withdrawal will move. By the moment the off-ramp request is filed seriously, tenorisfx.com either disappears or invents a fresh fee. Sites can be taken down. The on-chain history cannot. Every deposit address Tenorisfx ever issued is still on the public ledger – that record is the substrate a Cryptocule casefile gets assembled on top of.

    Operational tells (Set A)

    • rapid-consolidation deposit addresses – Deposit addresses tagged to Tenorisfx relay incoming funds to a single consolidation wallet within minutes of confirmation – a relay funnel, not a custodial wallet pattern.
    • cloned brand surface – tenorisfx.com mirrors the look of an established platform, but the registry footers, support links, and audit references all dead-end.
    • high-risk off-ramp endpoint – Outbound from Tenorisfx converges on a centralised exchange flagged in chain-analytics datasets for laundering throughput – viewable via Etherscan and Chainabuse without paid tooling.

    Filing pathway – civil discovery overlay

    Where the dollar value justifies it, the on-chain trail Cryptocule produces against Tenorisfx can be lifted into a civil discovery filing – subpoena directed at the receiving exchange for KYC on the off-ramp wallet. That is how a chain trail converts to an identified counterparty.

    What Cryptocule tracks

    Cryptocule traces across Bitcoin, Ethereum, Tron (USDT-TRC20), BNB Smart Chain, Polygon, Arbitrum, Optimism, Avalanche, and the bridges that link them. Off-ramps tracked include Binance, Bybit, OKX, Kraken, Coinbase, Crypto.com, KuCoin, Gate.io, Huobi, Bitfinex, MEXC, and the smaller venues those rotate through under stress.

    Lines we don’t cross

    Cryptocule will not request seed phrases, will not ask for remote-access logins to your wallet, will not take an upfront cash retainer before scoping a case, and will not promise a guaranteed recovery. A real analyst will scope the matter free and tell you in writing whether the trail justifies a filing.

    Submit your wallet for a forensic trace at /submit-a-case/ – no upfront fees, no automated chatbot.

    Open a Free Case Evaluation   Submit Wallet for Trace

    Internal: Wallet Check · How We Recover · FAQ

  • A Months-Long Setup: SGD 96,000 Lost Through Xip Capitals Group

    Trail Audit · CCU-2026-047 · Vector: Romance Lure · Fake Staking

    A Months-Long Setup: SGD 96,000 Lost Through Xip Capitals Group

    A Singapore professional met someone online who, over months, introduced her to a “family” ETH-staking opportunity on Xip Capitals Group. It was a pig-butchering scam. We traced the staking deposits and recovered a meaningful slice.

    Recovery Brief
    Operator
    Xip Capitals Group
    Vector
    Romance Lure · Fake Staking
    Instrument
    Ethereum (ETH) “staking”
    Reported Loss
    SGD 96,000
    Recovery Route
    Two off-ramp branches frozen
    Trail Opened
    ≈4 months of deposits
    Claimant
    Operations lead, 39 — Singapore
    Status · Recovered
    44% returned (partial)

    First Contact

    It began as a warm, patient online friendship. Over weeks it became something that felt like a relationship, and only then did he mention how his “uncle’s” strategy let the family earn steady returns staking ETH on Xip Capitals Group.

    He never asked for money directly. He simply showed his own “returns” and helped her open an account. Small deposits showed gains; she withdrew a token amount successfully early on, which removed her last doubts.

    Where the Trail Went Cold

    Encouraged gently and consistently, she increased her ETH “staking” deposits to SGD 96,000 over four months. When she tried a large withdrawal, Xip Capitals Group required a “staking settlement fee,” and her online partner suddenly went quiet.

    The pattern — long grooming, a trusted introducer, a platform that pays small early withdrawals then walls the big one — is pig-butchering. The staking returns were fabricated; the deposits were swept off-platform as they arrived.

    “He never once asked me for money. He just showed me his returns and helped me set it up. That’s what made it work.”— Claimant statement

    Following the Trail

    01
    hop 01 · intake

    Reconstruct months of activity

    We mapped the full deposit history to Xip Capitals Group, the chat record, and the early test withdrawal that built her trust.

    02
    hop 02 · trace

    Follow the staking deposits

    Her ETH was swept from the platform as it arrived and split across multiple collector wallets over the four-month window.

    03
    hop 03 · branch

    Identify two reachable branches

    Two of the collector branches deposited to centralized exchanges rather than self-custody — both reachable touchpoints.

    04
    hop 04 · file

    Coordinated exchange filings

    We filed labelled evidence with both exchanges and the Singapore authorities, tying the addresses to the Xip Capitals cluster.

    05
    hop 05 · freeze

    Freeze the reachable funds

    Both exchanges froze the balances that remained. The portion already moved into private wallets could not be recovered.

    Trail’s End

    Recovered for claimant
    44%

    About SGD 42,240 was returned across two exchange freezes. The long grooming period meant much of the earliest money was long gone — but tracing every branch recovered more than she expected.

    Trail Markers

    • A new online friend or partner who, over time, introduces a “family” investment opportunity.
    • A platform reached through someone you met online — never one you sought out yourself.
    • A small early withdrawal that succeeds, used to justify much larger deposits.
    • A “settlement” or “staking” fee that appears only when you try to take real money out.

    Someone you met online led you to a “staking” platform?

    These cases are painful and more common than you think. A Cryptocule case review is free, confidential, and judgment-free.

    Open a Free Case Eval →

  • SQB — report and reference

    Forensic Brief: SQB – Cryptocule Casefile

    // FORENSIC BRIEF

    Funds sent to SQB at sqb.com leave a trail that no website takedown can erase. The Cryptocule trail audit converts that on-chain history into evidence that survives the platform disappearing.

    Platform: SQB  ·  Domain on record: sqb.com  ·  Cryptocule read: recovery is pursued through wallet-trace + filing, not negotiation with the operator.

    Wallet Trace

    The repeating arc reported about SQB runs roughly the same way: a contact opens through a private channel; a modest first deposit is accepted with a polished confirmation; the in-platform number rises while the claimant is still measuring trust; then a top-up is demanded before any withdrawal will move. By the moment the off-ramp request is filed seriously, sqb.com either disappears or invents a fresh fee. Sites can be taken down. The on-chain history cannot. Every deposit address SQB ever issued is still on the public ledger – that record is the substrate a Cryptocule casefile gets assembled on top of.

    Operational tells (Set B)

    • private-channel onboarding – Cryptocule sees SQB introduce itself through Telegram threads, WhatsApp groups, Instagram DMs, or dating-app handoffs – not the channels a chartered firm would use.
    • monotonic equity curve – The in-platform balance plotted by SQB climbs without natural pullbacks; that is a script generating a chart, not a market generating a price.
    • release-fee gate at withdrawal – Once a withdrawal request is filed, SQB demands a fresh deposit dressed as 'clearance', 'unlock', or 'liquidity bond' – no regulated venue holds payouts behind a fresh wire.

    Filing pathway – civil discovery overlay

    Where the dollar value justifies it, the on-chain trail Cryptocule produces against SQB can be lifted into a civil discovery filing – subpoena directed at the receiving exchange for KYC on the off-ramp wallet. That is how a chain trail converts to an identified counterparty.

    What Cryptocule tracks

    Cryptocule traces across Bitcoin, Ethereum, Tron (USDT-TRC20), BNB Smart Chain, Polygon, Arbitrum, Optimism, Avalanche, and the bridges that link them. Off-ramps tracked include Binance, Bybit, OKX, Kraken, Coinbase, Crypto.com, KuCoin, Gate.io, Huobi, Bitfinex, MEXC, and the smaller venues those rotate through under stress.

    Lines we don’t cross

    Cryptocule will not request seed phrases, will not ask for remote-access logins to your wallet, will not take an upfront cash retainer before scoping a case, and will not promise a guaranteed recovery. A real analyst will scope the matter free and tell you in writing whether the trail justifies a filing.

    Regulator and warning-list notes

    SQB has been flagged as a fake broker/platform by IOSCO I-SCAN (Ontario – Ontario Securities Commission). reported 2023-06-06. Jurisdiction: Ontario. It appears on an official regulator or fraud-warning list, which is a strong indicator of a scam operation. Treat any contact from this entity with caution. Reference: https://www.iosco.org/i-scan/

    If you funded SQB, the trail can still be mapped. Open a free case evaluation now.

    Open a Free Case Evaluation   Submit Wallet for Trace

    Internal: Wallet Check · How We Recover · FAQ