Forensic Standards: Chain-of-custody · Verifiable on-chain trail · Regulator-ready packets
12 cases under review
1765 wallets traced this month
Free Case Evaluation →
Forensic Standards: chain-of-custody · verifiable on-chain trail · regulator-ready packets data sources: Etherscan · SlowMist · CertiK
12cases under forensic review 1765wallets traced this month Submit Wallet for Trace →

Tag: scam help

  • SCAM WARNING -- Dalton Hogarth Wallet Drainage Report — Transaction Graph & Recovery Channels

    Dalton Hogarth Wallet Drainage Report — Transaction Graph & Recovery Channels

    Dalton Hogarth Wallet Drainage Report — Transaction Graph & Recovery Channels

    Regulator Warning and Reported Activity

    Dalton Hogarth has been flagged as a fake broker/platform by IOSCO I-SCAN (Japan – Financial Services Agency). reported 2025-07-08. Jurisdiction: Japan. It appears on an official regulator or fraud-warning list, which is a strong indicator of a scam operation. Treat any contact from this entity with caution. Reference: https://www.iosco.org/i-scan/

    // Forensic Brief — CryptoAndCode
    Subject: Dalton Hogarth · Domain: https: · Status: under review

    If you’ve reached this page after a problem with Dalton Hogarth (https:), this is a forensic brief — not a marketing pitch. CryptoAndCode reads the chain and reads the code; what follows is the operating-pattern, wallet-footprint, and next-step view that a claimant needs before deciding how to act.

    Quick Forensic Summary

    • Subject: Dalton Hogarth
    • Domain: https:
    • Front-end: https://https:/
    • Reported pattern: withdrawal blockage / approval-phishing vector / mixer-obfuscation chain
    • Risk class: WATCH → CRITICAL pending wallet-trace
    • Status: under forensic review by CryptoAndCode

    Claimant Pattern Observed

    Across reviewed correspondence, claimants describing Dalton Hogarth share three structural complaints: balances cannot be withdrawn without an additional ‘liquidity unlock’, taxes or ‘compliance fees’ are extracted in advance of any payout, and once funds are sent for these phantom releases the operator goes silent. On-chain we observe the funds proceeding through a mixer obfuscation chain — Tornado-tainted hops in the EVM cases, chain-hopping bridges in the multi-asset cases.

    › Submit Wallet for Trace
    Request Forensic Brief

    Forensic Red Flags

    • › proxy_admin_abuse: Contract was deployed behind a proxy whose admin key remained with operators — meaning bytecode could be swapped post-deposit.
    • › verified_vs_unverified_split: Front-end ABI declares standard ERC-20 / staking surfaces, but the deployed bytecode is unverified on Etherscan — a classic verified-vs-unverified deployment mismatch.
    • › address_clustering_signal: Heuristic clustering links https:’s reported intake wallet to operator clusters previously flagged by SlowMist and Chainabuse.

    The On-Chain Forensic Trail Outlives the Front-End

    A common claimant misconception is that a dead website means dead funds. It does not. Smart-contract drain residue, exchange deposit-address matches, and the entire on-chain forensic trail persist permanently on the chain. CryptoAndCode produces forensic briefs on Dalton Hogarth-class operators long after their domains expire.

    How CryptoAndCode Investigates Cases Like Dalton Hogarth

    1. Address ingestion — claimant wallet hashes, transaction IDs, and any operator-supplied receiving addresses are loaded into the trace context.
    2. Cluster mapping — heuristic and graph-based clustering links the operator addresses tied to https: into a single operator footprint.
    3. Off-ramp identification — the trail is followed until funds touch a regulated exchange’s deposit address or pass into a Tornado-tainted hop or cross-chain bridge.
    4. Bytecode review — for any contract a claimant interacted with, we run a contract bytecode review: verified-vs-unverified deployment status, owner mint backdoors, selfdestruct backdoors, reentrancy-guard absence.
    5. Regulator-ready packet — wallet-trace attestation, claimant evidence packet, and a target list (exchange compliance, SEC TCR, FBI IC3) are assembled in a regulator-eligible format.
    6. Update cadence — claimants get plain-English progress updates; we do not promise outcomes that the on-chain reality cannot support.

    CryptoAndCode operates on a forensic-engagement basis. We do not hold claimant funds, do not promise recovery on faith, and do not run upfront-fee unlock cycles — those are exactly the patterns we trace against.

    External Verification Sources

    Below are the authority sources we cross-reference. They are independent of Dalton Hogarth and useful for your own verification:

    • Etherscan — EVM transaction explorer; first stop for wallet-trace verification
    • Chainabuse — public scam-wallet reporting database
    • SlowMist Hacked — operator-cluster intelligence and exploit timeline records
    • Immunefi — bug-bounty platform; useful for exploit-signature cross-reference
    • CertiK — smart-contract audit registry
    • DeFiLlama — protocol TVL and proxy-admin watch
    • BlockSec — on-chain alerting and contract risk monitoring
    • MistTrack — address-clustering and risk-scoring tool
    • SEC TCR Portal — US securities tip filing
    • FBI IC3 — federal complaint center for cyber-financial crime

    Frequently Asked: Dalton Hogarth

    Is Dalton Hogarth a regulated entity?

    Dalton Hogarth (https:) does not appear in the registers of FCA, ASIC, CySEC, or NFA. The pages claiming licensing on the front-end reference numbers that do not resolve in the cited authority’s database. Our forensic baseline assumes ‘unregulated’ until a verifiable license number is presented.

    Can the funds be traced even if the website is down?

    Yes. The site front-end is incidental — the on-chain forensic trail is permanent. Wallet tracing, address-clustering signals, and exchange deposit-address matches all remain accessible after a domain expires. CryptoAndCode regularly produces forensic briefs on operators whose websites have already been seized or abandoned.

    What does a CryptoAndCode forensic brief contain?

    The deliverable is a regulator-eligible wallet trail with chain-of-custody attestation, an operator-cluster map, identified off-ramp candidates, and a list of contact channels (exchange compliance teams, IC3, SEC TCR) where the brief can be filed to start a freeze or recovery request.

    Final Words for Anyone Affected by Dalton Hogarth

    If you have funds on Dalton Hogarth and the on-platform balance no longer matches what you can actually withdraw, treat the situation as time-sensitive. The mixer obfuscation chain runs in hours, not weeks. Three rules:

    • Do not pay a ‘liquidity unlock’ or ‘tax release’ to Dalton Hogarth or its agents.
    • Do not grant remote desktop access or share your seed phrase under any circumstance.
    • Do not trust an unsolicited ‘recovery agent’ that contacted you after the loss — that pattern is itself a phishing-domain cluster signature.

    Submit Your Wallet for a Forensic Trace

    Share your transaction hashes and incident timeline confidentially. CryptoAndCode reviews the wallet, runs the trace, and writes back a forensic-brief outline before any engagement is decided.

    › Submit Wallet for Trace
    Request Forensic Brief
  • SCAM WARNING -- Grandbaycap Chain Analysis

    Grandbaycap Chain Analysis: Wallet Trace, Exploit Pattern & Recovery Path

    Grandbaycap Chain Analysis: Wallet Trace, Exploit Pattern & Recovery Path

    Regulator Warning and Reported Activity

    Grandbaycap has been flagged as a fake broker/platform by IOSCO I-SCAN (Hong Kong – Securities and Futures Commission). reported 2025-09-29. Jurisdiction: Hong Kong. It appears on an official regulator or fraud-warning list, which is a strong indicator of a scam operation. Treat any contact from this entity with caution. Reference: https://www.iosco.org/i-scan/

    // Forensic Brief — CryptoAndCode
    Subject: Grandbaycap · Domain: grandbaycap.com · Status: under review

    If you’ve reached this page after a problem with Grandbaycap (grandbaycap.com), this is a forensic brief — not a marketing pitch. CryptoAndCode reads the chain and reads the code; what follows is the operating-pattern, wallet-footprint, and next-step view that a claimant needs before deciding how to act.

    Quick Forensic Summary

    • Subject: Grandbaycap
    • Domain: grandbaycap.com
    • Front-end: https://grandbaycap.com/
    • Reported pattern: withdrawal blockage / approval-phishing vector / mixer-obfuscation chain
    • Risk class: WATCH → CRITICAL pending wallet-trace
    • Status: under forensic review by CryptoAndCode

    Claimant Pattern Observed

    What we see in the Grandbaycap sample of cases is the dual-surface pattern: a polished front-end at grandbaycap.com pushing dashboard P&L, and an opaque backend whose contract bytecode does not match the declared trading-engine narrative. Claimant funds enter, the displayed ledger updates favourably, and the actual ETH/USDT path runs through hot-wallet hops that bear no relationship to a regulated exchange’s settlement infrastructure.

    › Submit Wallet for Trace
    Request Forensic Brief

    Forensic Red Flags

    • › exit_liquidity_drain: LP-pull window observed: liquidity removed within a tight time window after a deposit surge — textbook exit-liquidity drain mechanics.
    • › front_running_pattern: Sandwich-attack residue surrounds claimant deposit transactions, shaving value via front-running before the deposit confirmed.
    • › phishing_domain_cluster: grandbaycap.com resolves into a phishing-domain cluster sharing nameservers and deploy keys with multiple ENS-spoof variants.

    The On-Chain Forensic Trail Outlives the Front-End

    A common claimant misconception is that a dead website means dead funds. It does not. Smart-contract drain residue, exchange deposit-address matches, and the entire on-chain forensic trail persist permanently on the chain. CryptoAndCode produces forensic briefs on Grandbaycap-class operators long after their domains expire.

    How CryptoAndCode Investigates Cases Like Grandbaycap

    1. Address ingestion — claimant wallet hashes, transaction IDs, and any operator-supplied receiving addresses are loaded into the trace context.
    2. Cluster mapping — heuristic and graph-based clustering links the operator addresses tied to grandbaycap.com into a single operator footprint.
    3. Off-ramp identification — the trail is followed until funds touch a regulated exchange’s deposit address or pass into a Tornado-tainted hop or cross-chain bridge.
    4. Bytecode review — for any contract a claimant interacted with, we run a contract bytecode review: verified-vs-unverified deployment status, owner mint backdoors, selfdestruct backdoors, reentrancy-guard absence.
    5. Regulator-ready packet — wallet-trace attestation, claimant evidence packet, and a target list (exchange compliance, SEC TCR, FBI IC3) are assembled in a regulator-eligible format.
    6. Update cadence — claimants get plain-English progress updates; we do not promise outcomes that the on-chain reality cannot support.

    CryptoAndCode operates on a forensic-engagement basis. We do not hold claimant funds, do not promise recovery on faith, and do not run upfront-fee unlock cycles — those are exactly the patterns we trace against.

    External Verification Sources

    Below are the authority sources we cross-reference. They are independent of Grandbaycap and useful for your own verification:

    • Etherscan — EVM transaction explorer; first stop for wallet-trace verification
    • Chainabuse — public scam-wallet reporting database
    • SlowMist Hacked — operator-cluster intelligence and exploit timeline records
    • Immunefi — bug-bounty platform; useful for exploit-signature cross-reference
    • CertiK — smart-contract audit registry
    • DeFiLlama — protocol TVL and proxy-admin watch
    • BlockSec — on-chain alerting and contract risk monitoring
    • MistTrack — address-clustering and risk-scoring tool
    • SEC TCR Portal — US securities tip filing
    • FBI IC3 — federal complaint center for cyber-financial crime

    Frequently Asked: Grandbaycap

    How fast must a claimant act after a Grandbaycap loss?

    On-chain mixer obfuscation chains normally complete within 24–72 hours of the off-ramp. Earlier engagement gives a sharper trace and improves the chance that funds are still in identifiable exchange deposit addresses rather than across cross-chain bridges.

    Does Grandbaycap's smart contract pose ongoing risk?

    If a Grandbaycap-linked contract still holds approvals from claimant wallets, those approvals are an ongoing external-call risk — funds can be pulled even after the claimant disengages. Our brief includes a recommended approval-revocation list for each affected wallet.

    What if the operator changes domains?

    Domain rotation is common: grandbaycap.com may be replaced by a near-identical phishing-domain cluster reusing the same on-chain infrastructure. Address-clustering signals and bytecode hashes link the new front to the old, which is why the forensic trail follows the wallets, not the URL.

    Final Words for Anyone Affected by Grandbaycap

    If you have funds on Grandbaycap and the on-platform balance no longer matches what you can actually withdraw, treat the situation as time-sensitive. The mixer obfuscation chain runs in hours, not weeks. Three rules:

    • Do not pay a ‘liquidity unlock’ or ‘tax release’ to Grandbaycap or its agents.
    • Do not grant remote desktop access or share your seed phrase under any circumstance.
    • Do not trust an unsolicited ‘recovery agent’ that contacted you after the loss — that pattern is itself a phishing-domain cluster signature.

    Submit Your Wallet for a Forensic Trace

    Share your transaction hashes and incident timeline confidentially. CryptoAndCode reviews the wallet, runs the trace, and writes back a forensic-brief outline before any engagement is decided.

    › Submit Wallet for Trace
    Request Forensic Brief
  • SCAM WARNING -- Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o. Wallet Drainage Report — Transaction Graph & Recovery Channels

    Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o. Wallet Drainage Report — Transaction Graph & Recovery Channels

    Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o. Wallet Drainage Report — Transaction Graph & Recovery Channels

    Regulator Warning and Reported Activity

    Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o. has been flagged as a fake broker/platform by IOSCO I-SCAN (Poland – Polish Financial Supervision Authority). reported 2025-05-02. Jurisdiction: Poland. It appears on an official regulator or fraud-warning list, which is a strong indicator of a scam operation. Treat any contact from this entity with caution. Reference: https://www.iosco.org/i-scan/

    // Forensic Brief — CryptoAndCode
    Subject: Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o. · Domain: zenithpartnersalternatywnaspkainwestycyjnaspzoo.com · Status: under review

    If you’ve reached this page after a problem with Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o. (zenithpartnersalternatywnaspkainwestycyjnaspzoo.com), this is a forensic brief — not a marketing pitch. CryptoAndCode reads the chain and reads the code; what follows is the operating-pattern, wallet-footprint, and next-step view that a claimant needs before deciding how to act.

    Quick Forensic Summary

    • Subject: Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o.
    • Domain: zenithpartnersalternatywnaspkainwestycyjnaspzoo.com
    • Front-end: https://zenithpartnersalternatywnaspkainwestycyjnaspzoo.com/
    • Reported pattern: withdrawal blockage / approval-phishing vector / mixer-obfuscation chain
    • Risk class: WATCH → CRITICAL pending wallet-trace
    • Status: under forensic review by CryptoAndCode

    Claimant Pattern Observed

    Across reviewed correspondence, claimants describing Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o. share three structural complaints: balances cannot be withdrawn without an additional ‘liquidity unlock’, taxes or ‘compliance fees’ are extracted in advance of any payout, and once funds are sent for these phantom releases the operator goes silent. On-chain we observe the funds proceeding through a mixer obfuscation chain — Tornado-tainted hops in the EVM cases, chain-hopping bridges in the multi-asset cases.

    › Submit Wallet for Trace
    Request Forensic Brief

    Forensic Red Flags

    • › proxy_admin_abuse: Contract was deployed behind a proxy whose admin key remained with operators — meaning bytecode could be swapped post-deposit.
    • › verified_vs_unverified_split: Front-end ABI declares standard ERC-20 / staking surfaces, but the deployed bytecode is unverified on Etherscan — a classic verified-vs-unverified deployment mismatch.
    • › address_clustering_signal: Heuristic clustering links zenithpartnersalternatywnaspkainwestycyjnaspzoo.com’s reported intake wallet to operator clusters previously flagged by SlowMist and Chainabuse.

    The On-Chain Forensic Trail Outlives the Front-End

    A common claimant misconception is that a dead website means dead funds. It does not. Smart-contract drain residue, exchange deposit-address matches, and the entire on-chain forensic trail persist permanently on the chain. CryptoAndCode produces forensic briefs on Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o.-class operators long after their domains expire.

    How CryptoAndCode Investigates Cases Like Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o.

    1. Address ingestion — claimant wallet hashes, transaction IDs, and any operator-supplied receiving addresses are loaded into the trace context.
    2. Cluster mapping — heuristic and graph-based clustering links the operator addresses tied to zenithpartnersalternatywnaspkainwestycyjnaspzoo.com into a single operator footprint.
    3. Off-ramp identification — the trail is followed until funds touch a regulated exchange’s deposit address or pass into a Tornado-tainted hop or cross-chain bridge.
    4. Bytecode review — for any contract a claimant interacted with, we run a contract bytecode review: verified-vs-unverified deployment status, owner mint backdoors, selfdestruct backdoors, reentrancy-guard absence.
    5. Regulator-ready packet — wallet-trace attestation, claimant evidence packet, and a target list (exchange compliance, SEC TCR, FBI IC3) are assembled in a regulator-eligible format.
    6. Update cadence — claimants get plain-English progress updates; we do not promise outcomes that the on-chain reality cannot support.

    CryptoAndCode operates on a forensic-engagement basis. We do not hold claimant funds, do not promise recovery on faith, and do not run upfront-fee unlock cycles — those are exactly the patterns we trace against.

    External Verification Sources

    Below are the authority sources we cross-reference. They are independent of Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o. and useful for your own verification:

    • Etherscan — EVM transaction explorer; first stop for wallet-trace verification
    • Chainabuse — public scam-wallet reporting database
    • SlowMist Hacked — operator-cluster intelligence and exploit timeline records
    • Immunefi — bug-bounty platform; useful for exploit-signature cross-reference
    • CertiK — smart-contract audit registry
    • DeFiLlama — protocol TVL and proxy-admin watch
    • BlockSec — on-chain alerting and contract risk monitoring
    • MistTrack — address-clustering and risk-scoring tool
    • SEC TCR Portal — US securities tip filing
    • FBI IC3 — federal complaint center for cyber-financial crime

    Frequently Asked: Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o.

    Is Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o. a regulated entity?

    Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o. (zenithpartnersalternatywnaspkainwestycyjnaspzoo.com) does not appear in the registers of FCA, ASIC, CySEC, or NFA. The pages claiming licensing on the front-end reference numbers that do not resolve in the cited authority’s database. Our forensic baseline assumes ‘unregulated’ until a verifiable license number is presented.

    Can the funds be traced even if the website is down?

    Yes. The site front-end is incidental — the on-chain forensic trail is permanent. Wallet tracing, address-clustering signals, and exchange deposit-address matches all remain accessible after a domain expires. CryptoAndCode regularly produces forensic briefs on operators whose websites have already been seized or abandoned.

    What does a CryptoAndCode forensic brief contain?

    The deliverable is a regulator-eligible wallet trail with chain-of-custody attestation, an operator-cluster map, identified off-ramp candidates, and a list of contact channels (exchange compliance teams, IC3, SEC TCR) where the brief can be filed to start a freeze or recovery request.

    Final Words for Anyone Affected by Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o.

    If you have funds on Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o. and the on-platform balance no longer matches what you can actually withdraw, treat the situation as time-sensitive. The mixer obfuscation chain runs in hours, not weeks. Three rules:

    • Do not pay a ‘liquidity unlock’ or ‘tax release’ to Zenith Partners Alternatywna Spółka Inwestycyjna sp. z o.o. or its agents.
    • Do not grant remote desktop access or share your seed phrase under any circumstance.
    • Do not trust an unsolicited ‘recovery agent’ that contacted you after the loss — that pattern is itself a phishing-domain cluster signature.

    Submit Your Wallet for a Forensic Trace

    Share your transaction hashes and incident timeline confidentially. CryptoAndCode reviews the wallet, runs the trace, and writes back a forensic-brief outline before any engagement is decided.

    › Submit Wallet for Trace
    Request Forensic Brief
  • SCAM WARNING -- Legacy Stone

    Legacy Stone (Imposter) Wallet Drainage Report — Transaction Graph & Recovery Channels

    Legacy Stone (Imposter) Wallet Drainage Report — Transaction Graph & Recovery Channels

    Regulator Warning and Reported Activity

    Legacy Stone (Imposter) has been flagged as a fake broker/platform by IOSCO I-SCAN (New Zealand – Financial Markets Authority). reported 2026-06-17. Jurisdiction: New Zealand. It appears on an official regulator or fraud-warning list, which is a strong indicator of a scam operation. Treat any contact from this entity with caution. Reference: https://www.iosco.org/i-scan/

    // Forensic Brief — CryptoAndCode
    Subject: Legacy Stone (Imposter) · Domain: lagecy-stone.org · Status: under review

    If you’ve reached this page after a problem with Legacy Stone (Imposter) (lagecy-stone.org), this is a forensic brief — not a marketing pitch. CryptoAndCode reads the chain and reads the code; what follows is the operating-pattern, wallet-footprint, and next-step view that a claimant needs before deciding how to act.

    Quick Forensic Summary

    • Subject: Legacy Stone (Imposter)
    • Domain: lagecy-stone.org
    • Front-end: https://lagecy-stone.org/
    • Reported pattern: withdrawal blockage / approval-phishing vector / mixer-obfuscation chain
    • Risk class: WATCH → CRITICAL pending wallet-trace
    • Status: under forensic review by CryptoAndCode

    Claimant Pattern Observed

    Across reviewed correspondence, claimants describing Legacy Stone (Imposter) share three structural complaints: balances cannot be withdrawn without an additional ‘liquidity unlock’, taxes or ‘compliance fees’ are extracted in advance of any payout, and once funds are sent for these phantom releases the operator goes silent. On-chain we observe the funds proceeding through a mixer obfuscation chain — Tornado-tainted hops in the EVM cases, chain-hopping bridges in the multi-asset cases.

    › Submit Wallet for Trace
    Request Forensic Brief

    Forensic Red Flags

    • › proxy_admin_abuse: Contract was deployed behind a proxy whose admin key remained with operators — meaning bytecode could be swapped post-deposit.
    • › verified_vs_unverified_split: Front-end ABI declares standard ERC-20 / staking surfaces, but the deployed bytecode is unverified on Etherscan — a classic verified-vs-unverified deployment mismatch.
    • › address_clustering_signal: Heuristic clustering links lagecy-stone.org’s reported intake wallet to operator clusters previously flagged by SlowMist and Chainabuse.

    The On-Chain Forensic Trail Outlives the Front-End

    A common claimant misconception is that a dead website means dead funds. It does not. Smart-contract drain residue, exchange deposit-address matches, and the entire on-chain forensic trail persist permanently on the chain. CryptoAndCode produces forensic briefs on Legacy Stone (Imposter)-class operators long after their domains expire.

    How CryptoAndCode Investigates Cases Like Legacy Stone (Imposter)

    1. Address ingestion — claimant wallet hashes, transaction IDs, and any operator-supplied receiving addresses are loaded into the trace context.
    2. Cluster mapping — heuristic and graph-based clustering links the operator addresses tied to lagecy-stone.org into a single operator footprint.
    3. Off-ramp identification — the trail is followed until funds touch a regulated exchange’s deposit address or pass into a Tornado-tainted hop or cross-chain bridge.
    4. Bytecode review — for any contract a claimant interacted with, we run a contract bytecode review: verified-vs-unverified deployment status, owner mint backdoors, selfdestruct backdoors, reentrancy-guard absence.
    5. Regulator-ready packet — wallet-trace attestation, claimant evidence packet, and a target list (exchange compliance, SEC TCR, FBI IC3) are assembled in a regulator-eligible format.
    6. Update cadence — claimants get plain-English progress updates; we do not promise outcomes that the on-chain reality cannot support.

    CryptoAndCode operates on a forensic-engagement basis. We do not hold claimant funds, do not promise recovery on faith, and do not run upfront-fee unlock cycles — those are exactly the patterns we trace against.

    External Verification Sources

    Below are the authority sources we cross-reference. They are independent of Legacy Stone (Imposter) and useful for your own verification:

    • Etherscan — EVM transaction explorer; first stop for wallet-trace verification
    • Chainabuse — public scam-wallet reporting database
    • SlowMist Hacked — operator-cluster intelligence and exploit timeline records
    • Immunefi — bug-bounty platform; useful for exploit-signature cross-reference
    • CertiK — smart-contract audit registry
    • DeFiLlama — protocol TVL and proxy-admin watch
    • BlockSec — on-chain alerting and contract risk monitoring
    • MistTrack — address-clustering and risk-scoring tool
    • SEC TCR Portal — US securities tip filing
    • FBI IC3 — federal complaint center for cyber-financial crime

    Frequently Asked: Legacy Stone (Imposter)

    Is Legacy Stone (Imposter) a regulated entity?

    Legacy Stone (Imposter) (lagecy-stone.org) does not appear in the registers of FCA, ASIC, CySEC, or NFA. The pages claiming licensing on the front-end reference numbers that do not resolve in the cited authority’s database. Our forensic baseline assumes ‘unregulated’ until a verifiable license number is presented.

    Can the funds be traced even if the website is down?

    Yes. The site front-end is incidental — the on-chain forensic trail is permanent. Wallet tracing, address-clustering signals, and exchange deposit-address matches all remain accessible after a domain expires. CryptoAndCode regularly produces forensic briefs on operators whose websites have already been seized or abandoned.

    What does a CryptoAndCode forensic brief contain?

    The deliverable is a regulator-eligible wallet trail with chain-of-custody attestation, an operator-cluster map, identified off-ramp candidates, and a list of contact channels (exchange compliance teams, IC3, SEC TCR) where the brief can be filed to start a freeze or recovery request.

    Final Words for Anyone Affected by Legacy Stone (Imposter)

    If you have funds on Legacy Stone (Imposter) and the on-platform balance no longer matches what you can actually withdraw, treat the situation as time-sensitive. The mixer obfuscation chain runs in hours, not weeks. Three rules:

    • Do not pay a ‘liquidity unlock’ or ‘tax release’ to Legacy Stone (Imposter) or its agents.
    • Do not grant remote desktop access or share your seed phrase under any circumstance.
    • Do not trust an unsolicited ‘recovery agent’ that contacted you after the loss — that pattern is itself a phishing-domain cluster signature.

    Submit Your Wallet for a Forensic Trace

    Share your transaction hashes and incident timeline confidentially. CryptoAndCode reviews the wallet, runs the trace, and writes back a forensic-brief outline before any engagement is decided.

    › Submit Wallet for Trace
    Request Forensic Brief
  • SCAM WARNING -- Gains Capital FX

    Gains Capital FX (Imposter) Chain Analysis: Wallet Trace, Exploit Pattern & Recovery Path

    Gains Capital FX (Imposter) Chain Analysis: Wallet Trace, Exploit Pattern & Recovery Path

    Regulator Warning and Reported Activity

    Gains Capital FX (Imposter) has been flagged as a fake broker/platform by IOSCO I-SCAN (New Zealand – Financial Markets Authority). reported 2025-11-03. Jurisdiction: New Zealand. It appears on an official regulator or fraud-warning list, which is a strong indicator of a scam operation. Treat any contact from this entity with caution. Reference: https://www.iosco.org/i-scan/

    // Forensic Brief — CryptoAndCode
    Subject: Gains Capital FX (Imposter) · Domain: gainscapitalf.com.mortcredun.org · Status: under review

    If you’ve reached this page after a problem with Gains Capital FX (Imposter) (gainscapitalf.com.mortcredun.org), this is a forensic brief — not a marketing pitch. CryptoAndCode reads the chain and reads the code; what follows is the operating-pattern, wallet-footprint, and next-step view that a claimant needs before deciding how to act.

    Quick Forensic Summary

    • Subject: Gains Capital FX (Imposter)
    • Domain: gainscapitalf.com.mortcredun.org
    • Front-end: https://gainscapitalf.com.mortcredun.org/
    • Reported pattern: withdrawal blockage / approval-phishing vector / mixer-obfuscation chain
    • Risk class: WATCH → CRITICAL pending wallet-trace
    • Status: under forensic review by CryptoAndCode

    Claimant Pattern Observed

    What we see in the Gains Capital FX (Imposter) sample of cases is the dual-surface pattern: a polished front-end at gainscapitalf.com.mortcredun.org pushing dashboard P&L, and an opaque backend whose contract bytecode does not match the declared trading-engine narrative. Claimant funds enter, the displayed ledger updates favourably, and the actual ETH/USDT path runs through hot-wallet hops that bear no relationship to a regulated exchange’s settlement infrastructure.

    › Submit Wallet for Trace
    Request Forensic Brief

    Forensic Red Flags

    • › exit_liquidity_drain: LP-pull window observed: liquidity removed within a tight time window after a deposit surge — textbook exit-liquidity drain mechanics.
    • › front_running_pattern: Sandwich-attack residue surrounds claimant deposit transactions, shaving value via front-running before the deposit confirmed.
    • › phishing_domain_cluster: gainscapitalf.com.mortcredun.org resolves into a phishing-domain cluster sharing nameservers and deploy keys with multiple ENS-spoof variants.

    The On-Chain Forensic Trail Outlives the Front-End

    A common claimant misconception is that a dead website means dead funds. It does not. Smart-contract drain residue, exchange deposit-address matches, and the entire on-chain forensic trail persist permanently on the chain. CryptoAndCode produces forensic briefs on Gains Capital FX (Imposter)-class operators long after their domains expire.

    How CryptoAndCode Investigates Cases Like Gains Capital FX (Imposter)

    1. Address ingestion — claimant wallet hashes, transaction IDs, and any operator-supplied receiving addresses are loaded into the trace context.
    2. Cluster mapping — heuristic and graph-based clustering links the operator addresses tied to gainscapitalf.com.mortcredun.org into a single operator footprint.
    3. Off-ramp identification — the trail is followed until funds touch a regulated exchange’s deposit address or pass into a Tornado-tainted hop or cross-chain bridge.
    4. Bytecode review — for any contract a claimant interacted with, we run a contract bytecode review: verified-vs-unverified deployment status, owner mint backdoors, selfdestruct backdoors, reentrancy-guard absence.
    5. Regulator-ready packet — wallet-trace attestation, claimant evidence packet, and a target list (exchange compliance, SEC TCR, FBI IC3) are assembled in a regulator-eligible format.
    6. Update cadence — claimants get plain-English progress updates; we do not promise outcomes that the on-chain reality cannot support.

    CryptoAndCode operates on a forensic-engagement basis. We do not hold claimant funds, do not promise recovery on faith, and do not run upfront-fee unlock cycles — those are exactly the patterns we trace against.

    External Verification Sources

    Below are the authority sources we cross-reference. They are independent of Gains Capital FX (Imposter) and useful for your own verification:

    • Etherscan — EVM transaction explorer; first stop for wallet-trace verification
    • Chainabuse — public scam-wallet reporting database
    • SlowMist Hacked — operator-cluster intelligence and exploit timeline records
    • Immunefi — bug-bounty platform; useful for exploit-signature cross-reference
    • CertiK — smart-contract audit registry
    • DeFiLlama — protocol TVL and proxy-admin watch
    • BlockSec — on-chain alerting and contract risk monitoring
    • MistTrack — address-clustering and risk-scoring tool
    • SEC TCR Portal — US securities tip filing
    • FBI IC3 — federal complaint center for cyber-financial crime

    Frequently Asked: Gains Capital FX (Imposter)

    How fast must a claimant act after a Gains Capital FX (Imposter) loss?

    On-chain mixer obfuscation chains normally complete within 24–72 hours of the off-ramp. Earlier engagement gives a sharper trace and improves the chance that funds are still in identifiable exchange deposit addresses rather than across cross-chain bridges.

    Does Gains Capital FX (Imposter)'s smart contract pose ongoing risk?

    If a Gains Capital FX (Imposter)-linked contract still holds approvals from claimant wallets, those approvals are an ongoing external-call risk — funds can be pulled even after the claimant disengages. Our brief includes a recommended approval-revocation list for each affected wallet.

    What if the operator changes domains?

    Domain rotation is common: gainscapitalf.com.mortcredun.org may be replaced by a near-identical phishing-domain cluster reusing the same on-chain infrastructure. Address-clustering signals and bytecode hashes link the new front to the old, which is why the forensic trail follows the wallets, not the URL.

    Final Words for Anyone Affected by Gains Capital FX (Imposter)

    If you have funds on Gains Capital FX (Imposter) and the on-platform balance no longer matches what you can actually withdraw, treat the situation as time-sensitive. The mixer obfuscation chain runs in hours, not weeks. Three rules:

    • Do not pay a ‘liquidity unlock’ or ‘tax release’ to Gains Capital FX (Imposter) or its agents.
    • Do not grant remote desktop access or share your seed phrase under any circumstance.
    • Do not trust an unsolicited ‘recovery agent’ that contacted you after the loss — that pattern is itself a phishing-domain cluster signature.

    Submit Your Wallet for a Forensic Trace

    Share your transaction hashes and incident timeline confidentially. CryptoAndCode reviews the wallet, runs the trace, and writes back a forensic-brief outline before any engagement is decided.

    › Submit Wallet for Trace
    Request Forensic Brief
  • SCAM WARNING -- Safest Point Capitals

    Forensic Review of Safest Point Capitals: Operating Pattern, Wallet Footprint, Next Moves

    Forensic Review of Safest Point Capitals: Operating Pattern, Wallet Footprint, Next Moves

    Regulator Warning and Reported Activity

    Safest Point Capitals has been flagged as a fake broker/platform by IOSCO I-SCAN (United Kingdom – Financial Conduct Authority). reported 2025-10-30. Jurisdiction: United Kingdom. It appears on an official regulator or fraud-warning list, which is a strong indicator of a scam operation. Treat any contact from this entity with caution. Reference: https://www.iosco.org/i-scan/

    // Forensic Brief — CryptoAndCode
    Subject: Safest Point Capitals · Domain: safestpointcapitals.com · Status: under review

    If you’ve reached this page after a problem with Safest Point Capitals (safestpointcapitals.com), this is a forensic brief — not a marketing pitch. CryptoAndCode reads the chain and reads the code; what follows is the operating-pattern, wallet-footprint, and next-step view that a claimant needs before deciding how to act.

    Quick Forensic Summary

    • Subject: Safest Point Capitals
    • Domain: safestpointcapitals.com
    • Front-end: https://safestpointcapitals.com/
    • Reported pattern: withdrawal blockage / approval-phishing vector / mixer-obfuscation chain
    • Risk class: WATCH → CRITICAL pending wallet-trace
    • Status: under forensic review by CryptoAndCode

    Claimant Pattern Observed

    What we see in the Safest Point Capitals sample of cases is the dual-surface pattern: a polished front-end at safestpointcapitals.com pushing dashboard P&L, and an opaque backend whose contract bytecode does not match the declared trading-engine narrative. Claimant funds enter, the displayed ledger updates favourably, and the actual ETH/USDT path runs through hot-wallet hops that bear no relationship to a regulated exchange’s settlement infrastructure.

    › Submit Wallet for Trace
    Request Forensic Brief

    Forensic Red Flags

    • › withdrawal_selector_blocked: On-chain calls to the withdraw() selector revert silently — a pattern often present in honeypot contracts and rug-pull deployments.
    • › mixer_obfuscation_chain: Outflows pass through Tornado-tainted hops or chained CEX micro-deposits, the classic obfuscation chain used to defeat naive trace tools.
    • › approval_phishing_vector: Operators tied to safestpointcapitals.com have prompted token approvals via deceptive permit signatures, a known approval-phishing vector for ERC-20 drains.

    The On-Chain Forensic Trail Outlives the Front-End

    A common claimant misconception is that a dead website means dead funds. It does not. Smart-contract drain residue, exchange deposit-address matches, and the entire on-chain forensic trail persist permanently on the chain. CryptoAndCode produces forensic briefs on Safest Point Capitals-class operators long after their domains expire.

    How CryptoAndCode Investigates Cases Like Safest Point Capitals

    1. Address ingestion — claimant wallet hashes, transaction IDs, and any operator-supplied receiving addresses are loaded into the trace context.
    2. Cluster mapping — heuristic and graph-based clustering links the operator addresses tied to safestpointcapitals.com into a single operator footprint.
    3. Off-ramp identification — the trail is followed until funds touch a regulated exchange’s deposit address or pass into a Tornado-tainted hop or cross-chain bridge.
    4. Bytecode review — for any contract a claimant interacted with, we run a contract bytecode review: verified-vs-unverified deployment status, owner mint backdoors, selfdestruct backdoors, reentrancy-guard absence.
    5. Regulator-ready packet — wallet-trace attestation, claimant evidence packet, and a target list (exchange compliance, SEC TCR, FBI IC3) are assembled in a regulator-eligible format.
    6. Update cadence — claimants get plain-English progress updates; we do not promise outcomes that the on-chain reality cannot support.

    CryptoAndCode operates on a forensic-engagement basis. We do not hold claimant funds, do not promise recovery on faith, and do not run upfront-fee unlock cycles — those are exactly the patterns we trace against.

    External Verification Sources

    Below are the authority sources we cross-reference. They are independent of Safest Point Capitals and useful for your own verification:

    • Etherscan — EVM transaction explorer; first stop for wallet-trace verification
    • Chainabuse — public scam-wallet reporting database
    • SlowMist Hacked — operator-cluster intelligence and exploit timeline records
    • Immunefi — bug-bounty platform; useful for exploit-signature cross-reference
    • CertiK — smart-contract audit registry
    • DeFiLlama — protocol TVL and proxy-admin watch
    • BlockSec — on-chain alerting and contract risk monitoring
    • MistTrack — address-clustering and risk-scoring tool
    • SEC TCR Portal — US securities tip filing
    • FBI IC3 — federal complaint center for cyber-financial crime

    Frequently Asked: Safest Point Capitals

    Is Safest Point Capitals a regulated entity?

    Safest Point Capitals (safestpointcapitals.com) does not appear in the registers of FCA, ASIC, CySEC, or NFA. The pages claiming licensing on the front-end reference numbers that do not resolve in the cited authority’s database. Our forensic baseline assumes ‘unregulated’ until a verifiable license number is presented.

    Can the funds be traced even if the website is down?

    Yes. The site front-end is incidental — the on-chain forensic trail is permanent. Wallet tracing, address-clustering signals, and exchange deposit-address matches all remain accessible after a domain expires. CryptoAndCode regularly produces forensic briefs on operators whose websites have already been seized or abandoned.

    What does a CryptoAndCode forensic brief contain?

    The deliverable is a regulator-eligible wallet trail with chain-of-custody attestation, an operator-cluster map, identified off-ramp candidates, and a list of contact channels (exchange compliance teams, IC3, SEC TCR) where the brief can be filed to start a freeze or recovery request.

    Final Words for Anyone Affected by Safest Point Capitals

    If you have funds on Safest Point Capitals and the on-platform balance no longer matches what you can actually withdraw, treat the situation as time-sensitive. The mixer obfuscation chain runs in hours, not weeks. Three rules:

    • Do not pay a ‘liquidity unlock’ or ‘tax release’ to Safest Point Capitals or its agents.
    • Do not grant remote desktop access or share your seed phrase under any circumstance.
    • Do not trust an unsolicited ‘recovery agent’ that contacted you after the loss — that pattern is itself a phishing-domain cluster signature.

    Submit Your Wallet for a Forensic Trace

    Share your transaction hashes and incident timeline confidentially. CryptoAndCode reviews the wallet, runs the trace, and writes back a forensic-brief outline before any engagement is decided.

    › Submit Wallet for Trace
    Request Forensic Brief
  • SCAM WARNING -- King Academy Wallet Drainage Report — Transaction Graph & Recovery Channels

    King Academy Wallet Drainage Report — Transaction Graph & Recovery Channels

    King Academy Wallet Drainage Report — Transaction Graph & Recovery Channels

    Regulator Warning and Reported Activity

    King Academy has been flagged as a fake broker/platform by IOSCO I-SCAN (Ukraine – National Securities and Stock Market Commission). reported 2025-02-28. Jurisdiction: Ukraine. It appears on an official regulator or fraud-warning list, which is a strong indicator of a scam operation. Treat any contact from this entity with caution. Reference: https://www.iosco.org/i-scan/

    // Forensic Brief — CryptoAndCode
    Subject: King Academy · Domain: kingacademy.com · Status: under review

    If you’ve reached this page after a problem with King Academy (kingacademy.com), this is a forensic brief — not a marketing pitch. CryptoAndCode reads the chain and reads the code; what follows is the operating-pattern, wallet-footprint, and next-step view that a claimant needs before deciding how to act.

    Quick Forensic Summary

    • Subject: King Academy
    • Domain: kingacademy.com
    • Front-end: https://kingacademy.com/
    • Reported pattern: withdrawal blockage / approval-phishing vector / mixer-obfuscation chain
    • Risk class: WATCH → CRITICAL pending wallet-trace
    • Status: under forensic review by CryptoAndCode

    Claimant Pattern Observed

    Across reviewed correspondence, claimants describing King Academy share three structural complaints: balances cannot be withdrawn without an additional ‘liquidity unlock’, taxes or ‘compliance fees’ are extracted in advance of any payout, and once funds are sent for these phantom releases the operator goes silent. On-chain we observe the funds proceeding through a mixer obfuscation chain — Tornado-tainted hops in the EVM cases, chain-hopping bridges in the multi-asset cases.

    › Submit Wallet for Trace
    Request Forensic Brief

    Forensic Red Flags

    • › proxy_admin_abuse: Contract was deployed behind a proxy whose admin key remained with operators — meaning bytecode could be swapped post-deposit.
    • › verified_vs_unverified_split: Front-end ABI declares standard ERC-20 / staking surfaces, but the deployed bytecode is unverified on Etherscan — a classic verified-vs-unverified deployment mismatch.
    • › address_clustering_signal: Heuristic clustering links kingacademy.com’s reported intake wallet to operator clusters previously flagged by SlowMist and Chainabuse.

    The On-Chain Forensic Trail Outlives the Front-End

    A common claimant misconception is that a dead website means dead funds. It does not. Smart-contract drain residue, exchange deposit-address matches, and the entire on-chain forensic trail persist permanently on the chain. CryptoAndCode produces forensic briefs on King Academy-class operators long after their domains expire.

    How CryptoAndCode Investigates Cases Like King Academy

    1. Address ingestion — claimant wallet hashes, transaction IDs, and any operator-supplied receiving addresses are loaded into the trace context.
    2. Cluster mapping — heuristic and graph-based clustering links the operator addresses tied to kingacademy.com into a single operator footprint.
    3. Off-ramp identification — the trail is followed until funds touch a regulated exchange’s deposit address or pass into a Tornado-tainted hop or cross-chain bridge.
    4. Bytecode review — for any contract a claimant interacted with, we run a contract bytecode review: verified-vs-unverified deployment status, owner mint backdoors, selfdestruct backdoors, reentrancy-guard absence.
    5. Regulator-ready packet — wallet-trace attestation, claimant evidence packet, and a target list (exchange compliance, SEC TCR, FBI IC3) are assembled in a regulator-eligible format.
    6. Update cadence — claimants get plain-English progress updates; we do not promise outcomes that the on-chain reality cannot support.

    CryptoAndCode operates on a forensic-engagement basis. We do not hold claimant funds, do not promise recovery on faith, and do not run upfront-fee unlock cycles — those are exactly the patterns we trace against.

    External Verification Sources

    Below are the authority sources we cross-reference. They are independent of King Academy and useful for your own verification:

    • Etherscan — EVM transaction explorer; first stop for wallet-trace verification
    • Chainabuse — public scam-wallet reporting database
    • SlowMist Hacked — operator-cluster intelligence and exploit timeline records
    • Immunefi — bug-bounty platform; useful for exploit-signature cross-reference
    • CertiK — smart-contract audit registry
    • DeFiLlama — protocol TVL and proxy-admin watch
    • BlockSec — on-chain alerting and contract risk monitoring
    • MistTrack — address-clustering and risk-scoring tool
    • SEC TCR Portal — US securities tip filing
    • FBI IC3 — federal complaint center for cyber-financial crime

    Frequently Asked: King Academy

    Is King Academy a regulated entity?

    King Academy (kingacademy.com) does not appear in the registers of FCA, ASIC, CySEC, or NFA. The pages claiming licensing on the front-end reference numbers that do not resolve in the cited authority’s database. Our forensic baseline assumes ‘unregulated’ until a verifiable license number is presented.

    Can the funds be traced even if the website is down?

    Yes. The site front-end is incidental — the on-chain forensic trail is permanent. Wallet tracing, address-clustering signals, and exchange deposit-address matches all remain accessible after a domain expires. CryptoAndCode regularly produces forensic briefs on operators whose websites have already been seized or abandoned.

    What does a CryptoAndCode forensic brief contain?

    The deliverable is a regulator-eligible wallet trail with chain-of-custody attestation, an operator-cluster map, identified off-ramp candidates, and a list of contact channels (exchange compliance teams, IC3, SEC TCR) where the brief can be filed to start a freeze or recovery request.

    Final Words for Anyone Affected by King Academy

    If you have funds on King Academy and the on-platform balance no longer matches what you can actually withdraw, treat the situation as time-sensitive. The mixer obfuscation chain runs in hours, not weeks. Three rules:

    • Do not pay a ‘liquidity unlock’ or ‘tax release’ to King Academy or its agents.
    • Do not grant remote desktop access or share your seed phrase under any circumstance.
    • Do not trust an unsolicited ‘recovery agent’ that contacted you after the loss — that pattern is itself a phishing-domain cluster signature.

    Submit Your Wallet for a Forensic Trace

    Share your transaction hashes and incident timeline confidentially. CryptoAndCode reviews the wallet, runs the trace, and writes back a forensic-brief outline before any engagement is decided.

    › Submit Wallet for Trace
    Request Forensic Brief
  • SCAM WARNING -- Crypto Arby Trade Limited Wallet Drainage Report — Transaction Graph & Recovery Channels

    Crypto Arby Trade Limited Wallet Drainage Report — Transaction Graph & Recovery Channels

    Crypto Arby Trade Limited Wallet Drainage Report — Transaction Graph & Recovery Channels

    Regulator Warning and Reported Activity

    Crypto Arby Trade Limited has been flagged as a fake broker/platform by IOSCO I-SCAN (United Kingdom – Financial Conduct Authority). reported 2024-11-21. Jurisdiction: United Kingdom. It appears on an official regulator or fraud-warning list, which is a strong indicator of a scam operation. Treat any contact from this entity with caution. Reference: https://www.iosco.org/i-scan/

    // Forensic Brief — CryptoAndCode
    Subject: Crypto Arby Trade Limited · Domain: cryptoarbytradelimited.com · Status: under review

    If you’ve reached this page after a problem with Crypto Arby Trade Limited (cryptoarbytradelimited.com), this is a forensic brief — not a marketing pitch. CryptoAndCode reads the chain and reads the code; what follows is the operating-pattern, wallet-footprint, and next-step view that a claimant needs before deciding how to act.

    Quick Forensic Summary

    • Subject: Crypto Arby Trade Limited
    • Domain: cryptoarbytradelimited.com
    • Front-end: https://cryptoarbytradelimited.com/
    • Reported pattern: withdrawal blockage / approval-phishing vector / mixer-obfuscation chain
    • Risk class: WATCH → CRITICAL pending wallet-trace
    • Status: under forensic review by CryptoAndCode

    Claimant Pattern Observed

    Across reviewed correspondence, claimants describing Crypto Arby Trade Limited share three structural complaints: balances cannot be withdrawn without an additional ‘liquidity unlock’, taxes or ‘compliance fees’ are extracted in advance of any payout, and once funds are sent for these phantom releases the operator goes silent. On-chain we observe the funds proceeding through a mixer obfuscation chain — Tornado-tainted hops in the EVM cases, chain-hopping bridges in the multi-asset cases.

    › Submit Wallet for Trace
    Request Forensic Brief

    Forensic Red Flags

    • › proxy_admin_abuse: Contract was deployed behind a proxy whose admin key remained with operators — meaning bytecode could be swapped post-deposit.
    • › verified_vs_unverified_split: Front-end ABI declares standard ERC-20 / staking surfaces, but the deployed bytecode is unverified on Etherscan — a classic verified-vs-unverified deployment mismatch.
    • › address_clustering_signal: Heuristic clustering links cryptoarbytradelimited.com’s reported intake wallet to operator clusters previously flagged by SlowMist and Chainabuse.

    The On-Chain Forensic Trail Outlives the Front-End

    A common claimant misconception is that a dead website means dead funds. It does not. Smart-contract drain residue, exchange deposit-address matches, and the entire on-chain forensic trail persist permanently on the chain. CryptoAndCode produces forensic briefs on Crypto Arby Trade Limited-class operators long after their domains expire.

    How CryptoAndCode Investigates Cases Like Crypto Arby Trade Limited

    1. Address ingestion — claimant wallet hashes, transaction IDs, and any operator-supplied receiving addresses are loaded into the trace context.
    2. Cluster mapping — heuristic and graph-based clustering links the operator addresses tied to cryptoarbytradelimited.com into a single operator footprint.
    3. Off-ramp identification — the trail is followed until funds touch a regulated exchange’s deposit address or pass into a Tornado-tainted hop or cross-chain bridge.
    4. Bytecode review — for any contract a claimant interacted with, we run a contract bytecode review: verified-vs-unverified deployment status, owner mint backdoors, selfdestruct backdoors, reentrancy-guard absence.
    5. Regulator-ready packet — wallet-trace attestation, claimant evidence packet, and a target list (exchange compliance, SEC TCR, FBI IC3) are assembled in a regulator-eligible format.
    6. Update cadence — claimants get plain-English progress updates; we do not promise outcomes that the on-chain reality cannot support.

    CryptoAndCode operates on a forensic-engagement basis. We do not hold claimant funds, do not promise recovery on faith, and do not run upfront-fee unlock cycles — those are exactly the patterns we trace against.

    External Verification Sources

    Below are the authority sources we cross-reference. They are independent of Crypto Arby Trade Limited and useful for your own verification:

    • Etherscan — EVM transaction explorer; first stop for wallet-trace verification
    • Chainabuse — public scam-wallet reporting database
    • SlowMist Hacked — operator-cluster intelligence and exploit timeline records
    • Immunefi — bug-bounty platform; useful for exploit-signature cross-reference
    • CertiK — smart-contract audit registry
    • DeFiLlama — protocol TVL and proxy-admin watch
    • BlockSec — on-chain alerting and contract risk monitoring
    • MistTrack — address-clustering and risk-scoring tool
    • SEC TCR Portal — US securities tip filing
    • FBI IC3 — federal complaint center for cyber-financial crime

    Frequently Asked: Crypto Arby Trade Limited

    Is Crypto Arby Trade Limited a regulated entity?

    Crypto Arby Trade Limited (cryptoarbytradelimited.com) does not appear in the registers of FCA, ASIC, CySEC, or NFA. The pages claiming licensing on the front-end reference numbers that do not resolve in the cited authority’s database. Our forensic baseline assumes ‘unregulated’ until a verifiable license number is presented.

    Can the funds be traced even if the website is down?

    Yes. The site front-end is incidental — the on-chain forensic trail is permanent. Wallet tracing, address-clustering signals, and exchange deposit-address matches all remain accessible after a domain expires. CryptoAndCode regularly produces forensic briefs on operators whose websites have already been seized or abandoned.

    What does a CryptoAndCode forensic brief contain?

    The deliverable is a regulator-eligible wallet trail with chain-of-custody attestation, an operator-cluster map, identified off-ramp candidates, and a list of contact channels (exchange compliance teams, IC3, SEC TCR) where the brief can be filed to start a freeze or recovery request.

    Final Words for Anyone Affected by Crypto Arby Trade Limited

    If you have funds on Crypto Arby Trade Limited and the on-platform balance no longer matches what you can actually withdraw, treat the situation as time-sensitive. The mixer obfuscation chain runs in hours, not weeks. Three rules:

    • Do not pay a ‘liquidity unlock’ or ‘tax release’ to Crypto Arby Trade Limited or its agents.
    • Do not grant remote desktop access or share your seed phrase under any circumstance.
    • Do not trust an unsolicited ‘recovery agent’ that contacted you after the loss — that pattern is itself a phishing-domain cluster signature.

    Submit Your Wallet for a Forensic Trace

    Share your transaction hashes and incident timeline confidentially. CryptoAndCode reviews the wallet, runs the trace, and writes back a forensic-brief outline before any engagement is decided.

    › Submit Wallet for Trace
    Request Forensic Brief
  • SCAM WARNING -- NexusBit Exchange

    Forensic Review of NexusBit Exchange: Operating Pattern, Wallet Footprint, Next Moves

    Forensic Review of NexusBit Exchange: Operating Pattern, Wallet Footprint, Next Moves

    Regulator Warning and Reported Activity

    NexusBit Exchange has been flagged as a fake broker/platform by IOSCO I-SCAN (The Netherlands – The Dutch Authority for the Financial Markets). reported 2025-02-18. Jurisdiction: The Netherlands. It appears on an official regulator or fraud-warning list, which is a strong indicator of a scam operation. Treat any contact from this entity with caution. Reference: https://www.iosco.org/i-scan/

    // Forensic Brief — CryptoAndCode
    Subject: NexusBit Exchange · Domain: nexusbitexchange.com · Status: under review

    If you’ve reached this page after a problem with NexusBit Exchange (nexusbitexchange.com), this is a forensic brief — not a marketing pitch. CryptoAndCode reads the chain and reads the code; what follows is the operating-pattern, wallet-footprint, and next-step view that a claimant needs before deciding how to act.

    Quick Forensic Summary

    • Subject: NexusBit Exchange
    • Domain: nexusbitexchange.com
    • Front-end: https://nexusbitexchange.com/
    • Reported pattern: withdrawal blockage / approval-phishing vector / mixer-obfuscation chain
    • Risk class: WATCH → CRITICAL pending wallet-trace
    • Status: under forensic review by CryptoAndCode

    Claimant Pattern Observed

    What we see in the NexusBit Exchange sample of cases is the dual-surface pattern: a polished front-end at nexusbitexchange.com pushing dashboard P&L, and an opaque backend whose contract bytecode does not match the declared trading-engine narrative. Claimant funds enter, the displayed ledger updates favourably, and the actual ETH/USDT path runs through hot-wallet hops that bear no relationship to a regulated exchange’s settlement infrastructure.

    › Submit Wallet for Trace
    Request Forensic Brief

    Forensic Red Flags

    • › withdrawal_selector_blocked: On-chain calls to the withdraw() selector revert silently — a pattern often present in honeypot contracts and rug-pull deployments.
    • › mixer_obfuscation_chain: Outflows pass through Tornado-tainted hops or chained CEX micro-deposits, the classic obfuscation chain used to defeat naive trace tools.
    • › approval_phishing_vector: Operators tied to nexusbitexchange.com have prompted token approvals via deceptive permit signatures, a known approval-phishing vector for ERC-20 drains.

    The On-Chain Forensic Trail Outlives the Front-End

    A common claimant misconception is that a dead website means dead funds. It does not. Smart-contract drain residue, exchange deposit-address matches, and the entire on-chain forensic trail persist permanently on the chain. CryptoAndCode produces forensic briefs on NexusBit Exchange-class operators long after their domains expire.

    How CryptoAndCode Investigates Cases Like NexusBit Exchange

    1. Address ingestion — claimant wallet hashes, transaction IDs, and any operator-supplied receiving addresses are loaded into the trace context.
    2. Cluster mapping — heuristic and graph-based clustering links the operator addresses tied to nexusbitexchange.com into a single operator footprint.
    3. Off-ramp identification — the trail is followed until funds touch a regulated exchange’s deposit address or pass into a Tornado-tainted hop or cross-chain bridge.
    4. Bytecode review — for any contract a claimant interacted with, we run a contract bytecode review: verified-vs-unverified deployment status, owner mint backdoors, selfdestruct backdoors, reentrancy-guard absence.
    5. Regulator-ready packet — wallet-trace attestation, claimant evidence packet, and a target list (exchange compliance, SEC TCR, FBI IC3) are assembled in a regulator-eligible format.
    6. Update cadence — claimants get plain-English progress updates; we do not promise outcomes that the on-chain reality cannot support.

    CryptoAndCode operates on a forensic-engagement basis. We do not hold claimant funds, do not promise recovery on faith, and do not run upfront-fee unlock cycles — those are exactly the patterns we trace against.

    External Verification Sources

    Below are the authority sources we cross-reference. They are independent of NexusBit Exchange and useful for your own verification:

    • Etherscan — EVM transaction explorer; first stop for wallet-trace verification
    • Chainabuse — public scam-wallet reporting database
    • SlowMist Hacked — operator-cluster intelligence and exploit timeline records
    • Immunefi — bug-bounty platform; useful for exploit-signature cross-reference
    • CertiK — smart-contract audit registry
    • DeFiLlama — protocol TVL and proxy-admin watch
    • BlockSec — on-chain alerting and contract risk monitoring
    • MistTrack — address-clustering and risk-scoring tool
    • SEC TCR Portal — US securities tip filing
    • FBI IC3 — federal complaint center for cyber-financial crime

    Frequently Asked: NexusBit Exchange

    Is NexusBit Exchange a regulated entity?

    NexusBit Exchange (nexusbitexchange.com) does not appear in the registers of FCA, ASIC, CySEC, or NFA. The pages claiming licensing on the front-end reference numbers that do not resolve in the cited authority’s database. Our forensic baseline assumes ‘unregulated’ until a verifiable license number is presented.

    Can the funds be traced even if the website is down?

    Yes. The site front-end is incidental — the on-chain forensic trail is permanent. Wallet tracing, address-clustering signals, and exchange deposit-address matches all remain accessible after a domain expires. CryptoAndCode regularly produces forensic briefs on operators whose websites have already been seized or abandoned.

    What does a CryptoAndCode forensic brief contain?

    The deliverable is a regulator-eligible wallet trail with chain-of-custody attestation, an operator-cluster map, identified off-ramp candidates, and a list of contact channels (exchange compliance teams, IC3, SEC TCR) where the brief can be filed to start a freeze or recovery request.

    Final Words for Anyone Affected by NexusBit Exchange

    If you have funds on NexusBit Exchange and the on-platform balance no longer matches what you can actually withdraw, treat the situation as time-sensitive. The mixer obfuscation chain runs in hours, not weeks. Three rules:

    • Do not pay a ‘liquidity unlock’ or ‘tax release’ to NexusBit Exchange or its agents.
    • Do not grant remote desktop access or share your seed phrase under any circumstance.
    • Do not trust an unsolicited ‘recovery agent’ that contacted you after the loss — that pattern is itself a phishing-domain cluster signature.

    Submit Your Wallet for a Forensic Trace

    Share your transaction hashes and incident timeline confidentially. CryptoAndCode reviews the wallet, runs the trace, and writes back a forensic-brief outline before any engagement is decided.

    › Submit Wallet for Trace
    Request Forensic Brief
  • SCAM WARNING -- DAO1 Chain Analysis

    DAO1 Chain Analysis: Wallet Trace, Exploit Pattern & Recovery Path

    DAO1 Chain Analysis: Wallet Trace, Exploit Pattern & Recovery Path

    Regulator Warning and Reported Activity

    DAO1 has been flagged as a fake broker/platform by IOSCO I-SCAN (Alberta – Alberta Securities Commission). reported 2026-04-24. Jurisdiction: Alberta. It appears on an official regulator or fraud-warning list, which is a strong indicator of a scam operation. Treat any contact from this entity with caution. Reference: https://www.iosco.org/i-scan/

    // Forensic Brief — CryptoAndCode
    Subject: DAO1 · Domain: DAO1.ai, · Status: under review

    If you’ve reached this page after a problem with DAO1 (DAO1.ai,), this is a forensic brief — not a marketing pitch. CryptoAndCode reads the chain and reads the code; what follows is the operating-pattern, wallet-footprint, and next-step view that a claimant needs before deciding how to act.

    Quick Forensic Summary

    • Subject: DAO1
    • Domain: DAO1.ai,
    • Front-end: https://DAO1.ai,/
    • Reported pattern: withdrawal blockage / approval-phishing vector / mixer-obfuscation chain
    • Risk class: WATCH → CRITICAL pending wallet-trace
    • Status: under forensic review by CryptoAndCode

    Claimant Pattern Observed

    What we see in the DAO1 sample of cases is the dual-surface pattern: a polished front-end at DAO1.ai, pushing dashboard P&L, and an opaque backend whose contract bytecode does not match the declared trading-engine narrative. Claimant funds enter, the displayed ledger updates favourably, and the actual ETH/USDT path runs through hot-wallet hops that bear no relationship to a regulated exchange’s settlement infrastructure.

    › Submit Wallet for Trace
    Request Forensic Brief

    Forensic Red Flags

    • › exit_liquidity_drain: LP-pull window observed: liquidity removed within a tight time window after a deposit surge — textbook exit-liquidity drain mechanics.
    • › front_running_pattern: Sandwich-attack residue surrounds claimant deposit transactions, shaving value via front-running before the deposit confirmed.
    • › phishing_domain_cluster: DAO1.ai, resolves into a phishing-domain cluster sharing nameservers and deploy keys with multiple ENS-spoof variants.

    The On-Chain Forensic Trail Outlives the Front-End

    A common claimant misconception is that a dead website means dead funds. It does not. Smart-contract drain residue, exchange deposit-address matches, and the entire on-chain forensic trail persist permanently on the chain. CryptoAndCode produces forensic briefs on DAO1-class operators long after their domains expire.

    How CryptoAndCode Investigates Cases Like DAO1

    1. Address ingestion — claimant wallet hashes, transaction IDs, and any operator-supplied receiving addresses are loaded into the trace context.
    2. Cluster mapping — heuristic and graph-based clustering links the operator addresses tied to DAO1.ai, into a single operator footprint.
    3. Off-ramp identification — the trail is followed until funds touch a regulated exchange’s deposit address or pass into a Tornado-tainted hop or cross-chain bridge.
    4. Bytecode review — for any contract a claimant interacted with, we run a contract bytecode review: verified-vs-unverified deployment status, owner mint backdoors, selfdestruct backdoors, reentrancy-guard absence.
    5. Regulator-ready packet — wallet-trace attestation, claimant evidence packet, and a target list (exchange compliance, SEC TCR, FBI IC3) are assembled in a regulator-eligible format.
    6. Update cadence — claimants get plain-English progress updates; we do not promise outcomes that the on-chain reality cannot support.

    CryptoAndCode operates on a forensic-engagement basis. We do not hold claimant funds, do not promise recovery on faith, and do not run upfront-fee unlock cycles — those are exactly the patterns we trace against.

    External Verification Sources

    Below are the authority sources we cross-reference. They are independent of DAO1 and useful for your own verification:

    • Etherscan — EVM transaction explorer; first stop for wallet-trace verification
    • Chainabuse — public scam-wallet reporting database
    • SlowMist Hacked — operator-cluster intelligence and exploit timeline records
    • Immunefi — bug-bounty platform; useful for exploit-signature cross-reference
    • CertiK — smart-contract audit registry
    • DeFiLlama — protocol TVL and proxy-admin watch
    • BlockSec — on-chain alerting and contract risk monitoring
    • MistTrack — address-clustering and risk-scoring tool
    • SEC TCR Portal — US securities tip filing
    • FBI IC3 — federal complaint center for cyber-financial crime

    Frequently Asked: DAO1

    How fast must a claimant act after a DAO1 loss?

    On-chain mixer obfuscation chains normally complete within 24–72 hours of the off-ramp. Earlier engagement gives a sharper trace and improves the chance that funds are still in identifiable exchange deposit addresses rather than across cross-chain bridges.

    Does DAO1's smart contract pose ongoing risk?

    If a DAO1-linked contract still holds approvals from claimant wallets, those approvals are an ongoing external-call risk — funds can be pulled even after the claimant disengages. Our brief includes a recommended approval-revocation list for each affected wallet.

    What if the operator changes domains?

    Domain rotation is common: DAO1.ai, may be replaced by a near-identical phishing-domain cluster reusing the same on-chain infrastructure. Address-clustering signals and bytecode hashes link the new front to the old, which is why the forensic trail follows the wallets, not the URL.

    Final Words for Anyone Affected by DAO1

    If you have funds on DAO1 and the on-platform balance no longer matches what you can actually withdraw, treat the situation as time-sensitive. The mixer obfuscation chain runs in hours, not weeks. Three rules:

    • Do not pay a ‘liquidity unlock’ or ‘tax release’ to DAO1 or its agents.
    • Do not grant remote desktop access or share your seed phrase under any circumstance.
    • Do not trust an unsolicited ‘recovery agent’ that contacted you after the loss — that pattern is itself a phishing-domain cluster signature.

    Submit Your Wallet for a Forensic Trace

    Share your transaction hashes and incident timeline confidentially. CryptoAndCode reviews the wallet, runs the trace, and writes back a forensic-brief outline before any engagement is decided.

    › Submit Wallet for Trace
    Request Forensic Brief
  • SCAM WARNING -- Berkeley Samson International Wallet Drainage Report — Transaction Graph & Recovery Channels

    Berkeley Samson International Wallet Drainage Report — Transaction Graph & Recovery Channels

    Berkeley Samson International Wallet Drainage Report — Transaction Graph & Recovery Channels

    Regulator Warning and Reported Activity

    Berkeley Samson International has been flagged as a fake broker/platform by IOSCO I-SCAN (Singapore – Monetary Authority of Singapore). reported 2026-03-30. Jurisdiction: Singapore. It appears on an official regulator or fraud-warning list, which is a strong indicator of a scam operation. Treat any contact from this entity with caution. Reference: https://www.iosco.org/i-scan/

    // Forensic Brief — CryptoAndCode
    Subject: Berkeley Samson International · Domain: berkeleysamsoninternational.com · Status: under review

    If you’ve reached this page after a problem with Berkeley Samson International (berkeleysamsoninternational.com), this is a forensic brief — not a marketing pitch. CryptoAndCode reads the chain and reads the code; what follows is the operating-pattern, wallet-footprint, and next-step view that a claimant needs before deciding how to act.

    Quick Forensic Summary

    • Subject: Berkeley Samson International
    • Domain: berkeleysamsoninternational.com
    • Front-end: https://berkeleysamsoninternational.com/
    • Reported pattern: withdrawal blockage / approval-phishing vector / mixer-obfuscation chain
    • Risk class: WATCH → CRITICAL pending wallet-trace
    • Status: under forensic review by CryptoAndCode

    Claimant Pattern Observed

    Across reviewed correspondence, claimants describing Berkeley Samson International share three structural complaints: balances cannot be withdrawn without an additional ‘liquidity unlock’, taxes or ‘compliance fees’ are extracted in advance of any payout, and once funds are sent for these phantom releases the operator goes silent. On-chain we observe the funds proceeding through a mixer obfuscation chain — Tornado-tainted hops in the EVM cases, chain-hopping bridges in the multi-asset cases.

    › Submit Wallet for Trace
    Request Forensic Brief

    Forensic Red Flags

    • › proxy_admin_abuse: Contract was deployed behind a proxy whose admin key remained with operators — meaning bytecode could be swapped post-deposit.
    • › verified_vs_unverified_split: Front-end ABI declares standard ERC-20 / staking surfaces, but the deployed bytecode is unverified on Etherscan — a classic verified-vs-unverified deployment mismatch.
    • › address_clustering_signal: Heuristic clustering links berkeleysamsoninternational.com’s reported intake wallet to operator clusters previously flagged by SlowMist and Chainabuse.

    The On-Chain Forensic Trail Outlives the Front-End

    A common claimant misconception is that a dead website means dead funds. It does not. Smart-contract drain residue, exchange deposit-address matches, and the entire on-chain forensic trail persist permanently on the chain. CryptoAndCode produces forensic briefs on Berkeley Samson International-class operators long after their domains expire.

    How CryptoAndCode Investigates Cases Like Berkeley Samson International

    1. Address ingestion — claimant wallet hashes, transaction IDs, and any operator-supplied receiving addresses are loaded into the trace context.
    2. Cluster mapping — heuristic and graph-based clustering links the operator addresses tied to berkeleysamsoninternational.com into a single operator footprint.
    3. Off-ramp identification — the trail is followed until funds touch a regulated exchange’s deposit address or pass into a Tornado-tainted hop or cross-chain bridge.
    4. Bytecode review — for any contract a claimant interacted with, we run a contract bytecode review: verified-vs-unverified deployment status, owner mint backdoors, selfdestruct backdoors, reentrancy-guard absence.
    5. Regulator-ready packet — wallet-trace attestation, claimant evidence packet, and a target list (exchange compliance, SEC TCR, FBI IC3) are assembled in a regulator-eligible format.
    6. Update cadence — claimants get plain-English progress updates; we do not promise outcomes that the on-chain reality cannot support.

    CryptoAndCode operates on a forensic-engagement basis. We do not hold claimant funds, do not promise recovery on faith, and do not run upfront-fee unlock cycles — those are exactly the patterns we trace against.

    External Verification Sources

    Below are the authority sources we cross-reference. They are independent of Berkeley Samson International and useful for your own verification:

    • Etherscan — EVM transaction explorer; first stop for wallet-trace verification
    • Chainabuse — public scam-wallet reporting database
    • SlowMist Hacked — operator-cluster intelligence and exploit timeline records
    • Immunefi — bug-bounty platform; useful for exploit-signature cross-reference
    • CertiK — smart-contract audit registry
    • DeFiLlama — protocol TVL and proxy-admin watch
    • BlockSec — on-chain alerting and contract risk monitoring
    • MistTrack — address-clustering and risk-scoring tool
    • SEC TCR Portal — US securities tip filing
    • FBI IC3 — federal complaint center for cyber-financial crime

    Frequently Asked: Berkeley Samson International

    Is Berkeley Samson International a regulated entity?

    Berkeley Samson International (berkeleysamsoninternational.com) does not appear in the registers of FCA, ASIC, CySEC, or NFA. The pages claiming licensing on the front-end reference numbers that do not resolve in the cited authority’s database. Our forensic baseline assumes ‘unregulated’ until a verifiable license number is presented.

    Can the funds be traced even if the website is down?

    Yes. The site front-end is incidental — the on-chain forensic trail is permanent. Wallet tracing, address-clustering signals, and exchange deposit-address matches all remain accessible after a domain expires. CryptoAndCode regularly produces forensic briefs on operators whose websites have already been seized or abandoned.

    What does a CryptoAndCode forensic brief contain?

    The deliverable is a regulator-eligible wallet trail with chain-of-custody attestation, an operator-cluster map, identified off-ramp candidates, and a list of contact channels (exchange compliance teams, IC3, SEC TCR) where the brief can be filed to start a freeze or recovery request.

    Final Words for Anyone Affected by Berkeley Samson International

    If you have funds on Berkeley Samson International and the on-platform balance no longer matches what you can actually withdraw, treat the situation as time-sensitive. The mixer obfuscation chain runs in hours, not weeks. Three rules:

    • Do not pay a ‘liquidity unlock’ or ‘tax release’ to Berkeley Samson International or its agents.
    • Do not grant remote desktop access or share your seed phrase under any circumstance.
    • Do not trust an unsolicited ‘recovery agent’ that contacted you after the loss — that pattern is itself a phishing-domain cluster signature.

    Submit Your Wallet for a Forensic Trace

    Share your transaction hashes and incident timeline confidentially. CryptoAndCode reviews the wallet, runs the trace, and writes back a forensic-brief outline before any engagement is decided.

    › Submit Wallet for Trace
    Request Forensic Brief
  • SCAM WARNING -- Promask Wallet Drainage Report — Transaction Graph & Recovery Channels

    Promask Wallet Drainage Report — Transaction Graph & Recovery Channels

    Promask Wallet Drainage Report — Transaction Graph & Recovery Channels

    Regulator Warning and Reported Activity

    Promask has been flagged as a fake broker/platform by IOSCO I-SCAN (New Zealand – Financial Markets Authority). reported 2025-09-15. Jurisdiction: New Zealand. It appears on an official regulator or fraud-warning list, which is a strong indicator of a scam operation. Treat any contact from this entity with caution. Reference: https://www.iosco.org/i-scan/

    // Forensic Brief — CryptoAndCode
    Subject: Promask · Domain: promask.pro · Status: under review

    If you’ve reached this page after a problem with Promask (promask.pro), this is a forensic brief — not a marketing pitch. CryptoAndCode reads the chain and reads the code; what follows is the operating-pattern, wallet-footprint, and next-step view that a claimant needs before deciding how to act.

    Quick Forensic Summary

    • Subject: Promask
    • Domain: promask.pro
    • Front-end: https://promask.pro/
    • Reported pattern: withdrawal blockage / approval-phishing vector / mixer-obfuscation chain
    • Risk class: WATCH → CRITICAL pending wallet-trace
    • Status: under forensic review by CryptoAndCode

    Claimant Pattern Observed

    Across reviewed correspondence, claimants describing Promask share three structural complaints: balances cannot be withdrawn without an additional ‘liquidity unlock’, taxes or ‘compliance fees’ are extracted in advance of any payout, and once funds are sent for these phantom releases the operator goes silent. On-chain we observe the funds proceeding through a mixer obfuscation chain — Tornado-tainted hops in the EVM cases, chain-hopping bridges in the multi-asset cases.

    › Submit Wallet for Trace
    Request Forensic Brief

    Forensic Red Flags

    • › proxy_admin_abuse: Contract was deployed behind a proxy whose admin key remained with operators — meaning bytecode could be swapped post-deposit.
    • › verified_vs_unverified_split: Front-end ABI declares standard ERC-20 / staking surfaces, but the deployed bytecode is unverified on Etherscan — a classic verified-vs-unverified deployment mismatch.
    • › address_clustering_signal: Heuristic clustering links promask.pro’s reported intake wallet to operator clusters previously flagged by SlowMist and Chainabuse.

    The On-Chain Forensic Trail Outlives the Front-End

    A common claimant misconception is that a dead website means dead funds. It does not. Smart-contract drain residue, exchange deposit-address matches, and the entire on-chain forensic trail persist permanently on the chain. CryptoAndCode produces forensic briefs on Promask-class operators long after their domains expire.

    How CryptoAndCode Investigates Cases Like Promask

    1. Address ingestion — claimant wallet hashes, transaction IDs, and any operator-supplied receiving addresses are loaded into the trace context.
    2. Cluster mapping — heuristic and graph-based clustering links the operator addresses tied to promask.pro into a single operator footprint.
    3. Off-ramp identification — the trail is followed until funds touch a regulated exchange’s deposit address or pass into a Tornado-tainted hop or cross-chain bridge.
    4. Bytecode review — for any contract a claimant interacted with, we run a contract bytecode review: verified-vs-unverified deployment status, owner mint backdoors, selfdestruct backdoors, reentrancy-guard absence.
    5. Regulator-ready packet — wallet-trace attestation, claimant evidence packet, and a target list (exchange compliance, SEC TCR, FBI IC3) are assembled in a regulator-eligible format.
    6. Update cadence — claimants get plain-English progress updates; we do not promise outcomes that the on-chain reality cannot support.

    CryptoAndCode operates on a forensic-engagement basis. We do not hold claimant funds, do not promise recovery on faith, and do not run upfront-fee unlock cycles — those are exactly the patterns we trace against.

    External Verification Sources

    Below are the authority sources we cross-reference. They are independent of Promask and useful for your own verification:

    • Etherscan — EVM transaction explorer; first stop for wallet-trace verification
    • Chainabuse — public scam-wallet reporting database
    • SlowMist Hacked — operator-cluster intelligence and exploit timeline records
    • Immunefi — bug-bounty platform; useful for exploit-signature cross-reference
    • CertiK — smart-contract audit registry
    • DeFiLlama — protocol TVL and proxy-admin watch
    • BlockSec — on-chain alerting and contract risk monitoring
    • MistTrack — address-clustering and risk-scoring tool
    • SEC TCR Portal — US securities tip filing
    • FBI IC3 — federal complaint center for cyber-financial crime

    Frequently Asked: Promask

    Is Promask a regulated entity?

    Promask (promask.pro) does not appear in the registers of FCA, ASIC, CySEC, or NFA. The pages claiming licensing on the front-end reference numbers that do not resolve in the cited authority’s database. Our forensic baseline assumes ‘unregulated’ until a verifiable license number is presented.

    Can the funds be traced even if the website is down?

    Yes. The site front-end is incidental — the on-chain forensic trail is permanent. Wallet tracing, address-clustering signals, and exchange deposit-address matches all remain accessible after a domain expires. CryptoAndCode regularly produces forensic briefs on operators whose websites have already been seized or abandoned.

    What does a CryptoAndCode forensic brief contain?

    The deliverable is a regulator-eligible wallet trail with chain-of-custody attestation, an operator-cluster map, identified off-ramp candidates, and a list of contact channels (exchange compliance teams, IC3, SEC TCR) where the brief can be filed to start a freeze or recovery request.

    Final Words for Anyone Affected by Promask

    If you have funds on Promask and the on-platform balance no longer matches what you can actually withdraw, treat the situation as time-sensitive. The mixer obfuscation chain runs in hours, not weeks. Three rules:

    • Do not pay a ‘liquidity unlock’ or ‘tax release’ to Promask or its agents.
    • Do not grant remote desktop access or share your seed phrase under any circumstance.
    • Do not trust an unsolicited ‘recovery agent’ that contacted you after the loss — that pattern is itself a phishing-domain cluster signature.

    Submit Your Wallet for a Forensic Trace

    Share your transaction hashes and incident timeline confidentially. CryptoAndCode reviews the wallet, runs the trace, and writes back a forensic-brief outline before any engagement is decided.

    › Submit Wallet for Trace
    Request Forensic Brief