Category: Case Studies

Illustrative forensic recovery case studies — verifiable-trail dossiers.

  • Scammed Twice: The RevolutionInvest “Fund Recovery” Trap — AUD 24,500

    Trail Audit · CCU-2026-048 · Vector: Recovery Scam · Double Fraud

    Scammed Twice: The RevolutionInvest “Fund Recovery” Trap — AUD 24,500

    After losing money to an earlier scam, a Brisbane retiree was contacted by RevolutionInvest, which promised to “recover” his funds for an upfront fee. It was a second scam targeting the first. Because he acted fast, we returned most of the recovery fee.

    Recovery Brief
    Vector
    Recovery Scam · Double Fraud
    Instrument
    Crypto “recovery fee”
    Reported Loss
    AUD 24,500
    Recovery Route
    Fast trace to exchange off-ramp
    Trail Opened
    within days of payment
    Claimant
    Retiree, 67 — Brisbane, AU
    Status · Recovered
    80% returned

    First Contact

    Months after losing money to a fake trading platform, he was contacted out of the blue by RevolutionInvest, which claimed it could recover his earlier losses. They knew details of his first scam — a hallmark of operators who buy or recycle victim lists.

    They presented “case officers,” official-looking paperwork, and a clear promise: pay a “recovery processing fee,” and his original funds would be returned in full within weeks.

    Where the Trail Went Cold

    The recovery-scam playbook preys on the desperation the first fraud creates. RevolutionInvest asked for an upfront crypto fee to “release” his recovered funds — and then, predictably, for a second fee.

    No legitimate recovery service asks for a large upfront fee to release money it claims to be holding for you. The “recovery” was the scam; the fee was the entire point.

    “They knew exactly what I’d lost before. I thought that meant they were real. It just meant they’d bought the list.”— Claimant statement

    Following the Trail

    01
    hop 01 · stop

    Halt the second payment

    Our first move was to stop him paying the “second fee,” then document the RevolutionInvest correspondence and the single fee he had already sent.

    02
    hop 02 · trace

    Trace the fresh payment

    Because the fee had been paid only days earlier, its trail was short — we followed it from his wallet directly toward an off-ramp.

    03
    hop 03 · locate

    Find the cash-out

    The funds reached a regulated exchange almost intact — recovery scams often cash out quickly and clumsily, which works in the victim’s favour.

    04
    hop 04 · file

    Rapid freeze request

    We filed the labelled address and hashes with the exchange and the Australian authorities within the same week as the payment.

    05
    hop 05 · return

    Freeze and recover

    The exchange froze the balance, and the bulk of the recovery fee was returned. Speed, again, was everything.

    Trail’s End

    Recovered for claimant
    80%

    About AUD 19,600 of the recovery fee was returned — strong, because he reported within days and the funds had barely moved. We could not recover his original loss through RevolutionInvest, because that money was never really being recovered at all.

    Trail Markers

    • An unsolicited “recovery” offer that already knows the details of a scam you suffered.
    • Any service demanding a large upfront fee to “release” funds it claims to be recovering.
    • Official-looking “case officers” and paperwork with pressure to pay quickly.
    • A fee that, once paid, is immediately followed by a request for another.

    Approached by a “recovery” service asking for a fee up front?

    Cryptocule never asks for an upfront fee to release your funds. If you’ve been targeted twice, talk to us first — the review is free and confidential.

    Open a Free Case Eval →
  • A Months-Long Setup: SGD 96,000 Lost Through Xip Capitals Group

    Trail Audit · CCU-2026-047 · Vector: Romance Lure · Fake Staking

    A Months-Long Setup: SGD 96,000 Lost Through Xip Capitals Group

    A Singapore professional met someone online who, over months, introduced her to a “family” ETH-staking opportunity on Xip Capitals Group. It was a pig-butchering scam. We traced the staking deposits and recovered a meaningful slice.

    Recovery Brief
    Vector
    Romance Lure · Fake Staking
    Instrument
    Ethereum (ETH) “staking”
    Reported Loss
    SGD 96,000
    Recovery Route
    Two off-ramp branches frozen
    Trail Opened
    ≈4 months of deposits
    Claimant
    Operations lead, 39 — Singapore
    Status · Recovered
    44% returned (partial)

    First Contact

    It began as a warm, patient online friendship. Over weeks it became something that felt like a relationship, and only then did he mention how his “uncle’s” strategy let the family earn steady returns staking ETH on Xip Capitals Group.

    He never asked for money directly. He simply showed his own “returns” and helped her open an account. Small deposits showed gains; she withdrew a token amount successfully early on, which removed her last doubts.

    Where the Trail Went Cold

    Encouraged gently and consistently, she increased her ETH “staking” deposits to SGD 96,000 over four months. When she tried a large withdrawal, Xip Capitals Group required a “staking settlement fee,” and her online partner suddenly went quiet.

    The pattern — long grooming, a trusted introducer, a platform that pays small early withdrawals then walls the big one — is pig-butchering. The staking returns were fabricated; the deposits were swept off-platform as they arrived.

    “He never once asked me for money. He just showed me his returns and helped me set it up. That’s what made it work.”— Claimant statement

    Following the Trail

    01
    hop 01 · intake

    Reconstruct months of activity

    We mapped the full deposit history to Xip Capitals Group, the chat record, and the early test withdrawal that built her trust.

    02
    hop 02 · trace

    Follow the staking deposits

    Her ETH was swept from the platform as it arrived and split across multiple collector wallets over the four-month window.

    03
    hop 03 · branch

    Identify two reachable branches

    Two of the collector branches deposited to centralized exchanges rather than self-custody — both reachable touchpoints.

    04
    hop 04 · file

    Coordinated exchange filings

    We filed labelled evidence with both exchanges and the Singapore authorities, tying the addresses to the Xip Capitals cluster.

    05
    hop 05 · freeze

    Freeze the reachable funds

    Both exchanges froze the balances that remained. The portion already moved into private wallets could not be recovered.

    Trail’s End

    Recovered for claimant
    44%

    About SGD 42,240 was returned across two exchange freezes. The long grooming period meant much of the earliest money was long gone — but tracing every branch recovered more than she expected.

    Trail Markers

    • A new online friend or partner who, over time, introduces a “family” investment opportunity.
    • A platform reached through someone you met online — never one you sought out yourself.
    • A small early withdrawal that succeeds, used to justify much larger deposits.
    • A “settlement” or “staking” fee that appears only when you try to take real money out.

    Someone you met online led you to a “staking” platform?

    These cases are painful and more common than you think. A Cryptocule case review is free, confidential, and judgment-free.

    Open a Free Case Eval →
  • Frozen on Purpose: The $38,900 BetaCapitalX Withdrawal Trap

    Trail Audit · CCU-2026-046 · Vector: Fake Exchange · Frozen Withdrawal

    Frozen on Purpose: The $38,900 BetaCapitalX Withdrawal Trap

    A Houston rideshare driver moved his savings onto BetaCapitalX, a slick “exchange” promising easy USDT staking returns. When he tried to withdraw, the account froze behind a tax wall. Most of the funds had already been swept — this is the honest low.

    Recovery Brief
    Operator
    Vector
    Fake Exchange · Frozen Withdrawal
    Instrument
    Tether (USDT)
    Reported Loss
    $38,900 USD
    Recovery Route
    Single off-ramp branch frozen
    Trail Opened
    ≈12 weeks after first deposit
    Claimant
    Rideshare driver, 37 — Houston, TX
    Status · Recovered
    29% returned (partial)

    First Contact

    An ad for “effortless USDT staking” led him to BetaCapitalX, an exchange-styled platform with a clean app, live “order book,” and a referral bonus. It looked like a smaller version of the big exchanges he already knew.

    He moved his savings across in several deposits over three months, watching a “staking rewards” counter tick up daily. The interface felt legitimate, and a chat agent answered every question.

    Where the Trail Went Cold

    When he requested his first real withdrawal, BetaCapitalX demanded a “regulatory tax” equal to 20% of the balance, payable before release. Pay it, and a new “anti-money-laundering deposit” appeared. The balance was never his to take.

    By the time he stopped paying, his deposits had long since been swept off the platform — the “order book” and “staking counter” were just front-end theatre over an empty account.

    “It looked exactly like a real exchange. The staking number went up every day. Then withdrawing cost a tax I could never finish paying.”— Claimant statement

    Following the Trail

    01
    hop 01 · intake

    Document the platform

    We archived the BetaCapitalX app screens, his deposit transactions, and the “tax” demands before the account could be wiped.

    02
    hop 02 · trace

    Follow the deposits

    His USDT was swept from BetaCapitalX’s wallet shortly after each deposit and consolidated, then largely routed onward through a mixer.

    03
    hop 03 · branch

    Find the reachable slice

    One smaller branch of the consolidated funds went to a centralized exchange rather than the mixer — the only realistically recoverable portion.

    04
    hop 04 · file

    Exchange filing

    We submitted the labelled deposit address and hashes to that exchange’s compliance team with his police report attached.

    05
    hop 05 · partial

    Partial freeze

    The exchange froze the reachable branch. The mixed majority was unrecoverable, and we were clear about that from the outset.

    Trail’s End

    Recovered for claimant
    29%

    About $11,281 was returned — the single branch that reached a regulated exchange. Most of the deposits were swept into a mixer within hours, beyond reach. We took the case knowing the ceiling was low and said so.

    Trail Markers

    • An unfamiliar “exchange” found via an ad promising effortless staking returns.
    • A live-looking order book and a daily “rewards” counter you can’t verify on-chain.
    • A withdrawal blocked by a “regulatory tax” or “AML deposit” payable up front.
    • Each fee you pay simply reveals the next one.

    An “exchange” won’t let you withdraw without paying a tax?

    Speed decides how much is reachable. A Cryptocule case review is free and honest about what can and can’t come back.

    Open a Free Case Eval →
  • A Borrowed Registration: £73,500 and the RichPoint Capital Clone

    Trail Audit · CCU-2026-045 · Vector: Clone of a Regulated Firm

    A Borrowed Registration: £73,500 and the RichPoint Capital Clone

    A Manchester business owner moved savings into what looked like an FCA-regulated brokerage. RichPoint Capital used a real firm’s registration number and a near-identical site — but it was a clone. Combining APP-fraud reimbursement with an on-chain trace returned most of it.

    Recovery Brief
    Vector
    Clone of a Regulated Firm
    Instrument
    Bank transfer → BTC
    Reported Loss
    £73,500 GBP
    Recovery Route
    APP reimbursement + exchange freeze
    Trail Opened
    ≈5 weeks after first transfer
    Claimant
    Business owner, 49 — Manchester, UK
    Status · Recovered
    87% returned

    First Contact

    A cold call led her to a comparison-site lookalike for RichPoint Capital. The “advisor” quoted a genuine FCA registration number and sent a cloned website and branded PDF brochures.

    She did the careful thing and checked the FCA Register — the firm was genuinely listed. Reassured, she agreed to invest, and her first “statement” showed neat, steady growth.

    Where the Trail Went Cold

    The number was real; the people using it were not. RichPoint Capital was a clone firm — fraudsters impersonating an authorised business, quoting its real registration while operating from their own domain, phone and bank details.

    She was persuaded to transfer in tranches to a “segregated client account” that was in fact a money-mule account. The scammers converted each transfer into Bitcoin and moved it on. When she asked to withdraw, a “compliance hold” and a tax demand blocked her.

    “I checked the FCA register and the firm was real. What I didn’t know is the people calling me weren’t that firm.”— Claimant statement

    Following the Trail

    01
    hop 01 · verify

    Confirm the clone

    We showed that the genuine FCA entry’s contact details, domain and bank account did not match the ones RichPoint had given her — the textbook signature of a clone-firm impersonation.

    02
    hop 02 · bank

    Build the APP-fraud claim

    We assembled an authorised-push-payment reimbursement case for her bank under the UK reimbursement rules and flagged the receiving mule account for recall.

    03
    hop 03 · trace

    Trace the crypto conversion

    From the mule account we obtained the Bitcoin addresses it funded and followed them into a single consolidation wallet.

    04
    hop 04 · off-ramp

    Exchange filing

    The consolidation wallet cashed out through a regulated exchange. We submitted the evidence package and requested a freeze on the destination balance.

    05
    hop 05 · dual

    Dual recovery

    Bank reimbursement for the mule-account tranches combined with the exchange freeze on the crypto branch to return the bulk of her money.

    Trail’s End

    Recovered for claimant
    87%

    About £63,945 was returned — APP reimbursement plus the frozen exchange balance. A small early tranche had already been cashed out before tracing began and was lost. Two routes, run in parallel, made the strong result.

    Trail Markers

    • An “advisor” who quotes a real regulator number but contacts you from a different domain, phone or bank account.
    • Verify a firm only with the contact details published on the regulator’s own register — never the ones the caller gives you.
    • Requests to pay a “segregated client account” whose name doesn’t match the firm.
    • A “compliance hold” or surprise tax demand that suddenly blocks your withdrawal.

    Paid a “regulated” firm that turned out to be a clone?

    Clone-firm cases can move on two fronts at once — your bank and the blockchain. Start with a free, confidential Cryptocule case review to map both.

    Open a Free Case Eval →
  • The Withdrawal Fee That Never Ended: NZD 61,800 at CapitalGates

    Trail Audit · CCU-2026-044 · Vector: Fake-CFD Withdrawal Fee

    The Withdrawal Fee That Never Ended: NZD 61,800 at CapitalGates

    An Auckland nurse was cold-called into a high-leverage “crypto CFD” account at CapitalGates. The platform showed handsome profits — until she tried to withdraw, when a cascade of fees appeared. A mixed bank-and-chain recovery returned most of the reachable funds.

    Recovery Brief
    Operator
    Vector
    Fake-CFD Withdrawal Fee
    Instrument
    BTC + card top-ups
    Reported Loss
    NZD 61,800
    Recovery Route
    Card chargeback + exchange freeze
    Trail Opened
    ≈10 weeks after first deposit
    Claimant
    Nurse, 46 — Auckland, NZ
    Status · Recovered
    61% returned

    First Contact

    The first contact was a cold call about “managed crypto CFDs.” A polished “account manager” walked her through opening an account at CapitalGates and screen-shared while placing her first “winning” trades.

    She funded it partly by card and partly in Bitcoin. The dashboard showed her balance climbing into six figures on high leverage, and the manager encouraged “one more deposit” to unlock a higher tier.

    Where the Trail Went Cold

    When she asked to withdraw, CapitalGates required a “profit-release fee,” then a “liquidity margin,” then a “conversion tax” — each blocking the payout until paid. The displayed profits were never real; they were UI numbers designed to justify more deposits.

    By the time she contacted us she had paid three separate “fees” and the account had been quietly set to read-only.

    “The profits looked incredible. The moment I tried to take any out, there was always one more fee standing in the way.”— Claimant statement

    Following the Trail

    01
    hop 01 · intake

    Separate the rails

    We split her losses into the card-funded portion and the Bitcoin portion — each has a different recovery route, and timing mattered for both.

    02
    hop 02 · chargeback

    Build the card dispute

    For the card deposits, we assembled a chargeback case documenting the misrepresentation and the blocked withdrawals for her bank’s dispute team.

    03
    hop 03 · trace

    Trace the Bitcoin

    The BTC deposits were traced from CapitalGates’ receiving wallet to a consolidation address that fed a regulated exchange.

    04
    hop 04 · file

    Exchange freeze request

    We filed the labelled addresses and transaction hashes with the receiving exchange’s compliance team alongside her police report.

    05
    hop 05 · combine

    Dual recovery

    The card chargeback plus the frozen exchange balance combined to return the bulk of the reachable funds.

    Trail’s End

    Recovered for claimant
    61%

    About NZD 37,698 was returned — successful card chargebacks plus the frozen exchange balance. The earliest BTC tranche had already been cashed out before tracing began and was lost.

    Trail Markers

    • A cold call offering “managed” high-leverage crypto CFDs with a personal account manager.
    • Screen-shared “winning” trades used to push larger and larger deposits.
    • Withdrawals blocked by a chain of fees — “release,” “margin,” “conversion tax.”
    • An account quietly switched to read-only once you push to cash out.

    A “CFD” platform keeps inventing fees to block your withdrawal?

    If you funded by card or crypto, there may be more than one route back. A Cryptocule case review is free and maps every option honestly.

    Open a Free Case Eval →
  • Pumped and Dumped: Tracing CAD 52,400 from a GlobeTrend Invest Signal Group

    Trail Audit · CCU-2026-043 · Vector: Telegram Signal Group

    Pumped and Dumped: Tracing CAD 52,400 from a GlobeTrend Invest Signal Group

    A Toronto contractor joined a free Telegram “signals” channel that funneled members onto GlobeTrend Invest. The “VIP calls” were a coordinated pump-and-dump, and the platform’s withdrawals never opened. This is the honest, partial result.

    Recovery Brief
    Vector
    Telegram Signal Group
    Instrument
    Ethereum (ETH)
    Reported Loss
    CAD 52,400
    Recovery Route
    Partial freeze at one off-ramp branch
    Trail Opened
    ≈7 weeks after deposits
    Claimant
    IT contractor, 41 — Toronto, CA
    Status · Recovered
    38% returned (partial)

    First Contact

    A free Telegram channel posted screenshots of “VIP signal” wins all day. After a few small public calls appeared to land, the admins steered members to deposit on GlobeTrend Invest to “act on the premium calls in time.”

    He funded the account with ETH in three tranches. The channel’s “calls” were timed around tokens the operators already held — classic pump-and-dump — and GlobeTrend’s dashboard showed his balance soaring as he “followed” them.

    Where the Trail Went Cold

    When the headline “call” collapsed, his GlobeTrend balance was suddenly locked behind a “liquidity verification” deposit. The signal channel went quiet, then deleted its history.

    The funds he had deposited were never traded on his behalf. They were swept off the platform almost immediately, split across wallets, and a large branch routed into a mixer before we were engaged.

    “The free calls really did win at first. By the time the big one tanked, the channel was gone and so was the withdrawal button.”— Claimant statement

    Following the Trail

    01
    hop 01 · intake

    Capture the channel & deposits

    We archived the Telegram channel, the call timestamps, and his three ETH deposit transactions to GlobeTrend before more evidence disappeared.

    02
    hop 02 · trace

    Follow the sweep

    His deposits were swept from GlobeTrend’s wallet within hours and split across several addresses — one dormant branch, one heading toward a mixer.

    03
    hop 03 · branch

    Separate reachable from lost

    We mapped which branch still touched a centralized exchange and which entered the mixer. Only the exchange-bound branch was realistically recoverable.

    04
    hop 04 · file

    Exchange touchpoint filing

    We submitted the labelled deposit address and transaction hashes to the receiving exchange and to chain-analytics partners flagging the GlobeTrend cluster.

    05
    hop 05 · partial

    Partial freeze

    The exchange froze the portion that had not yet been withdrawn. The mixed branch is, realistically, gone — we set that expectation early.

    Trail’s End

    Recovered for claimant
    38%

    About CAD 19,912 was returned — only the branch that touched a regulated exchange was reachable. Pump-and-dump proceeds that reach a mixer rarely come back, and we don’t pretend otherwise.

    Trail Markers

    • A free “signals” channel whose public wins are used to push you onto one specific platform.
    • “VIP” or “premium” calls that require depositing on a broker the channel recommends.
    • A platform balance that locks behind a “liquidity” or “verification” deposit when a call fails.
    • Channels that delete their history the moment a trade goes wrong.

    A “signals” group led you to a platform that won’t pay out?

    The faster we map the sweep, the more of it stays reachable. Start with a free, confidential Cryptocule case review.

    Open a Free Case Eval →
  • The Mentor in the Group Chat: €68,500 Routed to ApexPrime Investment

    Trail Audit · CCU-2026-042 · Vector: WhatsApp Investment Club

    The Mentor in the Group Chat: €68,500 Routed to ApexPrime Investment

    Added to a WhatsApp “wealth circle,” a Dublin marketing manager followed a charismatic mentor’s daily calls into a managed USDT account on ApexPrime Investment. The gains were real on screen and fabricated on-chain. Reporting in days, not weeks, changed everything.

    Recovery Brief
    Vector
    WhatsApp Investment Club
    Instrument
    Tether (USDT-TRC20)
    Reported Loss
    €68,500 EUR
    Recovery Route
    Traced-funds freeze at receiving VASP
    Trail Opened
    ≈9 days after withdrawal block
    Claimant
    Marketing manager, 34 — Dublin, IE
    Status · Recovered
    71% returned

    First Contact

    A wrong-number text turned into friendly conversation, and within a week “Emma” had added her to a buzzing WhatsApp group where forty members thanked their mentor for his daily trade calls.

    The first “signal” was free and appeared to pay off. Then the mentor opened a “circle pool” on ApexPrime Investment — members deposited USDT into a managed account he traded for them. Watching the group celebrate, she moved in stages until €68,500 sat in the ApexPrime dashboard, compounding nicely.

    Where the Trail Went Cold

    When she requested a withdrawal, ApexPrime demanded a “15% performance tax,” payable up front before any funds could be released. When she paused, her account was “locked for verification” and the mentor grew impatient.

    The group was the product. Most of those forty cheering “members” were the same operation — a manufactured crowd built to make a managed account she could never independently verify feel safe and ordinary.

    “It didn’t feel like a scam — forty real people in the chat were cheering each other on. Most of them turned out to be the same operator.”— Claimant statement

    Following the Trail

    01
    hop 01 · preserve

    Lock down the evidence

    Before the group could vanish, we exported the full WhatsApp thread, every ApexPrime deposit receipt, and the TRC20 addresses she had funded.

    02
    hop 02 · trace

    Map the USDT flow

    Her Tether transfers were traced from her wallet through two intermediary hop wallets used to break the obvious link to the destination.

    03
    hop 03 · locate

    Find the collection point

    Within 48 hours of her last transfer, the hops consolidated into a single deposit address at a regulated virtual-asset exchange — a reachable touchpoint.

    04
    hop 04 · escalate

    Rapid compliance escalation

    Because she reported in days, the funds were still on-platform. We filed a traced-funds freeze request with the exchange and a report with the Irish authorities.

    05
    hop 05 · release

    Freeze and return

    The exchange froze the residual balance against the police reference and, after review, released the majority back to the claimant.

    Trail’s End

    Recovered for claimant
    71%

    About €48,635 was returned. Speed was decisive — the funds were still on a regulated platform when our freeze request arrived. A small fraction already pushed through a mixer could not be recovered.

    Trail Markers

    • Being “added” to a high-energy group chat full of strangers posting non-stop profits.
    • A “mentor” who manages your money on a platform whose balances you cannot verify on-chain.
    • A withdrawal “tax,” “fee,” or “deposit” demanded before you can take profits out.
    • Urgency and verification “locks” the moment you try to cash out.

    Stuck behind a “performance tax” to withdraw?

    If a group-chat mentor is blocking your funds, the first 72 hours matter most. Cryptocule case reviews are free and confidential — reach out before the trail cools.

    Open a Free Case Eval →
  • The Hashrate That Never Hashed: Recovering $47,300 from CloudMiningCity

    Trail Audit · CCU-2026-041 · Vector: Cloud-Mining Contract

    The Hashrate That Never Hashed: Recovering $47,300 from CloudMiningCity

    A retired electrician was sold a “managed Bitcoin mining” contract by CloudMiningCity, complete with a daily-yield dashboard. The hashrate was never real, and every withdrawal triggered another fee. We traced the cash-out and returned just over half.

    Recovery Brief
    Vector
    Cloud-Mining Contract
    Instrument
    Bitcoin (BTC)
    Reported Loss
    $47,300 USD
    Recovery Route
    Exchange freeze on cash-out wallet
    Trail Opened
    ≈16 weeks after first deposit
    Claimant
    Retired tradesman, 58 — Phoenix, AZ
    Status · Recovered
    53% returned

    First Contact

    It began in a Facebook “passive income” group, where a representative for CloudMiningCity explained that he could rent a slice of an industrial Bitcoin-mining farm and earn a fixed daily yield — no hardware, no power bills, just a dashboard ticking upward each morning.

    The onboarding looked professional: a signed “hashrate contract,” a branded portal, and a support agent who replied within minutes. When he requested a small $400 withdrawal early on, it landed the next day. That single honoured payout turned caution into confidence — and a test deposit into his retirement savings.

    Where the Trail Went Cold

    The dashboard showed steady daily BTC accrual climbing past $47,000. When he tried to withdraw the balance, the portal returned an error: a “pool maintenance fee” had to be cleared first, payable only in fresh Bitcoin.

    He paid it. Then came a “hashrate upgrade fee,” then a “tax clearance deposit,” each larger than the last and each blocking the withdrawal until paid. This is the advance-fee wall — the displayed balance is just a number in a database CloudMiningCity controls, and every “fee” is another deposit into their wallet.

    “Every time I got close to my money, there was one more small fee. I’d already paid so much that stopping felt insane.”— Claimant statement, intake call

    Following the Trail

    01
    hop 01 · intake

    Reconstruct the timeline

    We logged every deposit, captured the dashboard screenshots, and listed each Bitcoin address he had sent funds to — the raw material for an on-chain trace.

    02
    hop 02 · trace

    Follow the deposits on-chain

    Each payment was traced from his exchange withdrawals into CloudMiningCity’s receiving wallets. The “fees” all flowed one direction — toward a single consolidation address.

    03
    hop 03 · cluster

    Cluster the operator wallets

    That consolidation address batched victim deposits and forwarded them in regular sweeps — a behavioural fingerprint we could follow rather than guess at.

    04
    hop 04 · off-ramp

    Identify the cash-out point

    The sweeps deposited into the hot wallet of a regulated exchange. Matching amounts and timestamps tied CloudMiningCity’s cash-out to a specific platform and account.

    05
    hop 05 · freeze

    Evidence package & freeze request

    We delivered a labelled evidence file to the exchange’s compliance team and filed reports with IC3 and local police. The balance still resident on the platform was frozen against the case reference.

    Trail’s End

    Recovered for claimant
    53%

    About $25,069 was returned — the portion still on the exchange when the freeze landed. Funds CloudMiningCity had already swept into private self-custody were beyond reach, and we said so from day one.

    Trail Markers

    • “Guaranteed” fixed daily mining returns — real mining yield swings with network difficulty and price; it is never a flat daily figure.
    • A withdrawal that unlocks only after new, ever-larger fees payable in fresh crypto.
    • A small early withdrawal that “works,” used to justify a far larger deposit.
    • No verifiable facility, pool address, or audited hashrate — only a dashboard the operator alone controls.

    Sold a “mining contract” you can’t withdraw from?

    If a yield dashboard is demanding fees before it releases your funds, the trail is still warm. A Cryptocule case review is free and confidential.

    Open a Free Case Eval →