Freeze and Seize of BTC Wallets by Canadian & US Law Enforcement in Sophisticated Financial Scam

Some information has been redacted so as not to jeopardise and ongoing investigation.

The brief:

The victim “Paul”, was tricked into believing his initial, small investments were returning massive gains. The scammers used sophisticated, make-believe trading platform which was almost indistinguishable from legitimate trading platforms, except to expert forensics code analysts.

Between the 3rd of March, 2021 and 9 June, 2021, Paul invested a total of USD323,000.00 with of Bitcoin and Ethereum into the platform, through numerous transactions.

The case submission brief, as submitted by Paul cane be read, verbatim, at the bottom of this page.

The Process:

Rexxfield accepted the case and began work on 26 January, 2022.

Within 48 hours we were able to:

  1. Untangle the scammer’s laundering attempts, just in time to catch large crypto balances in wallets held by a large exchange.
  2. Request a temporary freeze on the crypto assets, pending an official request from law enforcement or a prosecutor’s office
  3. Engage the scammers directly, using a pretext that our investigator was a potential victim and then:
  4. Counter-groom the scammers into revealing additional wallets under their control
  5. Capture digital artefacts about the devices used by the low-level scammer who victimised Paul
  6. Capture geolocation information about the scammers as follows:
  7. The scam syndicate’s administrator is based at an address in Canada
  8. The low-level scam operators who contact and groom victims, is based in Lagos Nigeria.

Rexxfield established 3 different crime Nexuses:

  1. A West Coast US State where the victim Paul is domiciled
  2. A Canadian Province where the scam boss in domiciled
  3. Lagos Nigeria where the high volume operators are domiciled.

On 27 January, 2022, at 16:59 AM EST, Rexxfield’s team lead on this case provided an affidavit to a Canadian cyber-crime unit. This document outlined the social-engineering engagements, and evidence capture techniques used to justify “probable cause” and Canadian jurisdiction.

On 28 January, 202, at 8:38 AM EST, Rexxfield’s team lead on this case participated in a MS Team’s meeting with a Special Agent with a US Federal Law Enforcement agency, and a cyber-crime investigator with a Canadian Provincial police agency. In that call Rexxfield clarified findings, and transferred the full case file, including a comprehensive blockchain analysis, toe the two agencies.

The Outcome:

Shortly thereafter the temporary wallet freezes were extended by the US agency, pending a court ordered asset seizure and recovery, and the Canadian’s physical address was uncovered by the Canadian police investigator.

Original client submission (redacted):

Explain how the Crypto-Crime Happened?

In late February 2021 I responded to a social media (youTube) creator (mark Moss) or at least I thought it was him. Unbeknown to me, someone impersonated Mark Moss using his image and his name, asking me to contact them on What’s App if I wanted to get more BTC quickly.

I did make the contact and the person introduced me to REDACTED which appeared to be authentic. The only thing that was suspicious was the high returns they were “guaranteeing”. The dates of my deposit into my account are listed below in chronological order. I have an account at Gemini in New York where the Btc was sent from.

03-03-2021 Transfer to: 1L3aREDACTED .5 Btc
03-03-2021 Transfer to: 1L3aREDACTED .5 Btc

I have reported this to the FTC on the web but have not heard anything from them. No reply to my submission of the complaint.

03-04-2021 Transfer to: 0x72eREDACTED 10 Eth
03-05-2021 Transfer to: 1L3aREDACTED 1.0 Btc
03-16-2021 Transfer to: 1P7gvREDACTED .5 Btc
04-10-2021 Transfer to: 14WquREDACTED 1.5 Btc

My account was accessible on the web at REDACTED.IO and was growing dramatically. It was nearly worth 2 million dollars in mid to late May. I was suspicious because it was growing so fast.

Then on May 30, 2021 I received an email letter from REDACTED.IO stating that I needed to:

“pay a signal fee debt of 3 BTC in your account in order to receive your debit card, activate wallet to wallet withdrawals and also put your traders back to work as your traders have been put on hold until your signal fee is cleared.”

While I thought this was very unusual and I asked them to take the “signal fee debt of 3 Btc from my account” the company REDACTED.IO refused to do so as it had to be paid to an external wallet. So as you can see I transferred 3 Btc to REDACTED.IO’s external wallet, not into my account at REDACTED.IO from my account at Gemini.

06-09-2021 Transfer to: 158dREDACTED – 3.0 Btc

I did pay the Signal Fee debt of 3 Btc on June 9,2021 as requested but my account was not returned to full status. Traders were put back on my account but I was not allowed to withdraw according to an email I received later on June 9. The email stated that I need to pay an additional 2 BTC and that the 3 Btc was only partial payment. This is in direct conflict with the email I received on May 30 indicating that my account would be restored and that I could do withdrawals. I told my manager that my intent was to withdraw funds going forward as soon as I had paid the 3 Btc fee and he said I should do so. He acted surprised every time I received a notice from REDACTED.IO like he was unaware of procedure.

Now this past week based on the emails I have been receiving the manager withdrew, my account has a penalty of over 2 million and my account has been frozen and I have been locked out of my account. This is certainly looking like a scam to me. All I want is my 7.0 BTC back and my 10 Eth back. I have no additional money to purchase BTC and even if I did I could not send it to a company that does not do what it states it will do (see May 30 email).

I have no options left. Just send my BTC and ETH back to me. The amount of money that I have invested with them with the BTC purchases at various prices is $342,000 including 10 Eth.

When did the first crime occur?

Wednesday, March 3, 2021

When did the last crime occur?

Wednesday, June 9, 2021

IMPORTANT Are you still able to communicate with the scammer?

*Yes

When was the last communication with the scammer?

July 7 2021

What was the monetary value of the loss at the time of the crime?

US $323,000.00

Scammer’s Links, profiles and Websites:

REDACTED.io

List all phone numbers, email addresses, WhatsApp or other messenger app identifiers used by scammers:

REDACTED Whats App messaging number
REDACTED@gmail.com

List all of YOUR wallet addresses that were effected by the scam, and the type of crypto

1Lwi REDACTED BTC
0x0REDACTED ETH

List all of THE SCAMMERS wallet addresses that received your scammed crypto

Transfer to:

REDACTED

If you have specific questions for us, to list them line by line below:

What is the probability that you or your company could be successful in getting some of my crypto back from this Ponzi scheme? Or are your services limited to the investigation of this crime and then turned over to the FBI for prosecution. Since the perpetrators of this Ponzi scheme are located in England doesn’t the prosecution have to occur in England? (CORRECTION: England was false pretence be scammers)

If you do not understand, or accept these condition, you must seek the advice of a suitably qualified attorney before seeking Rexxfield’s assistance.

Do you understand this legal disclaimer?

*YES