Ilia Zavialov takes apart the crypto exchange scam: how a platform is built, run and shut down

01Why the platform looks real

An exchange interface stopped being evidence of seriousness a long time ago. Ready made engines are sold as a boxed product, complete with charts, an order book, a client area and a verification section. Launching takes days rather than months, and the result differs from a genuine platform only in details that an ordinary user never checks.

The second half of credibility is bought separately. Reviews on aggregators, articles in industry publications, mentions in roundups, a rating on comparison sites: all of it sells in packages. A user who researches the platform through a search engine finds exactly the picture that was assembled for them, and mistakes it for independent confirmation.

Early payouts are their own budget line. The first clients withdraw without delays, write satisfied reviews and bring in acquaintances. From the operator's point of view this is not a loss but an advertising cost, and the most effective one available: testimony from a living person who really did receive a transfer.

When examining a crypto exchange scam, Ilia Zavialov suggests holding on to one plain fact: everything the user can see is controlled by the same party that controls the money. The balance on the screen is a row in the operator's database rather than an asset on a blockchain, and it cannot be verified independently.

02The economics of the operation

The scheme has a budget, and it explains the platform's behaviour better than any speculation. Domain, engine, hosting, payment channels, call centre, advertising, seeded reviews and early payouts make up the start up costs. All of it has to be recovered before the flow of complaints reaches critical mass.

That determines the lifespan. A platform runs for exactly as long as the ratio between incoming deposits and outstanding claims stays positive. Once complaints start outpacing receipts, the operation winds down and the infrastructure moves to a new domain under a new name with the same engine underneath.

The scale of the category is visible in the reporting. The FBI complaint centre recorded 8.648 billion dollars in investment fraud losses for 2025, more than forty per cent of all reported losses, and roughly half of all losses in the United States involve cryptocurrency. Numbers like that describe an industry with a division of labour rather than isolated operators.

On chain statistics complete the picture. Fraudulent addresses received at least 14 billion dollars during 2025, and the average payment to such an address grew by 253 per cent year on year. The rise in the average matters more than the rise in the total: it shows that victims are now cultivated for longer and selected more precisely.

03How the money goes in

Deposits almost always travel by routes that are difficult to reverse. A cryptocurrency transfer to a supplied address, a payment through an exchange office, a deposit made at a machine, less often a card payment to a nominee. Every one of those paths is chosen for irreversibility rather than convenience.

Cryptocurrency machines deserve a separate mention, because the most vulnerable users pass through them. From complaints by people aged sixty and over alone, the FBI complaint centre counted 6,188 reports and more than 257 million dollars in losses connected with crypto machines.

The first deposit is usually small. What the operator needs is not the money but the completed procedure: registration, verification, transfer, balance displayed. Once a person has walked that path and seen the credit appear, the second transfer happens without internal resistance.

04The moment everything was built for

The scheme does not live on deposits, it lives on the attempted withdrawal. While the user is topping up and watching a rising chart, the platform behaves impeccably. Everything changes the minute the withdrawal button is pressed, and that moment is engineered in more detail than any other.

The standard set of obstacles looks lawful, which is why it works. A tax to be paid before release, an unlocking fee, an insurance deposit, repeated verification with new documents requested, a requirement to bring the balance up to a minimum threshold. Each obstacle is phrased as a procedure rather than a refusal.

One logic governs all of them: every demand has to be payable. The sum is calibrated so the person can find it, and the wording is arranged so that walking away feels like their own decision to abandon what they already put in. The user is not paying for a withdrawal, they are paying for the hope of recovering earlier deposits.

Support becomes more courteous at this stage rather than less. A personal manager appears, messages are signed with job titles, and the correspondence starts referring to internal regulations and policies. All of it keeps the person inside the procedure while they continue paying.

05Where the assets go

Once received, the money does not sit in the platform's accounts. Cryptocurrency moves through a chain of transfers across intermediate addresses, mixers and exchange services without verification, part of it converts into other assets, part leaves through networks with low fees. The purpose of that chain is not to hide the money forever but to make recovery cost more than it is worth.

This is why recovery so rarely succeeds. Technically the trail is visible, since the blockchain is public and analytics firms can follow the path of funds. Practically, recovery runs into the jurisdiction of the final link, where there is often neither an obligation to answer a request nor anyone to receive it.

The only window of opportunity is open in the first hours. If the money reached an exchange with a functioning compliance department, a request made early sometimes results in a freeze. After a few days that possibility closes, because the funds have already passed through the next links in the chain.

The same public ledger has a useful side. Because the chain is visible, it can be attached to a report: transaction identifiers, intermediate wallet addresses and transfer times form evidence that does not depend on whether the platform's website is still running. For police and for a receiving exchange this is the only part of the file they can verify themselves, so it should be written out in full immediately rather than reconstructed from memory a week later.

06The announcement and the second wave

The ending is rarely abrupt. More often there is a notice about technical work, about a review by a regulator, about a temporary suspension of withdrawals pending an audit. The wording is reassuring, dates are given, support keeps replying. That buys the operator weeks.

Then comes the second wave, aimed at exactly the same people. Lawyers appear promising recovery, investigators with access to databases, intermediaries with contacts inside the exchange administration. All of them ask for payment in advance, and all of them make contact first, because the list of victims already exists.

The marker of the second wave never changes: they approach you, and they want money up front. Genuine legal work begins with a meeting and an engagement letter, not with a promise to recover the full amount for a percentage paid beforehand.

07What litigation actually delivers

Going to court has a purpose, and it helps to understand in advance what that purpose is. Litigation settles questions of law: it establishes facts, confirms the amount and produces an enforceable document. Whether money comes back depends on whether the defendant owns anything and whether it sits somewhere the judgment can reach.

The first obstacle a claim meets is the defendant. A platform may have no legal entity at all, or one registered in a jurisdiction with no office, no assets and no duty to answer foreign requests. Against a defendant like that, judgments are obtained and never enforced.

The second obstacle hides in the user agreement. It almost always contains an arbitration clause naming a specific country, a waiver of class actions and a choice of governing law. The agreement is accepted with a tick box at registration, and the court a victim approaches will most likely begin by examining that clause.

The third concerns timing and evidence. What counts as evidence is what was captured: transfer addresses, transaction identifiers, the full correspondence, screenshots of the account area with dates, payment documents. Material gathered after the platform closes is almost always weaker than material gathered while it was live, which is why capture comes before consultation.

08When the courts do work

Some scenarios justify the legal route. If the money passed through a bank or a regulated payment provider, the dispute is with them, and that is a proper defendant with assets and obligations. If the platform has a real legal entity in a comprehensible jurisdiction, a claim makes sense. If there are many victims and they combine, the cost of the process is shared.

Insolvency is its own branch. When an operator is declared insolvent, claims go into the procedure and the order of payment is set by law rather than by negotiation. Distributions are usually partial and take years, but this is the one route where money is allocated formally.

A criminal report is worth filing in any case, even when expectations are low. It produces a reference number, and that number opens conversations with banks, exchanges and platforms that are otherwise under no obligation to reply. Cases against operators are assembled from individual reports, and without reports nothing is assembled at all.

Costs should be calculated before filing rather than after. Litigation of this kind usually requires translated documents, a blockchain analytics specialist and court fees, and the timeline is not measured in months. Where the loss is comparable to those costs, effort is better spent on the bank, the payment provider and the police report, with the decision about court left until it is clear whether the defendant owns anything at all.

09Why the same scheme reappears under a different name

Closing a platform does not end the operation. The engine, the support scripts, the letter templates, the manager instructions and the lists of purchased review placements all stay with the same team. The domain changes, the name changes, the colour scheme changes, and the machinery moves across intact.

A move can be spotted through details nobody bothers to rewrite. Phrasing in the terms section and in support messages repeats word for word, the client area has the same structure, translation errors sit in the same places. Overlap in the legal section is especially common, because it gets copied wholesale.

Technical traces work better than textual ones. Shared hosting, identical mail records, a repeating set of scripts on the page, the same certificate pattern: all of it links a new platform to an old one faster than comparing designs. Domain age remains the simplest and most informative signal of all.

The practical conclusion is straightforward. If a platform appeared recently and already has many reviews, all of them positive, that measures the seeding budget rather than the quality. Genuine history accumulates over years and includes unhappy customers, because every working exchange has them.

10The first seventy two hours

The order is fixed and does not depend on the size of the loss. Capture first: download the correspondence in full, record the account area with balances and dates, write out the addresses and identifiers of every transfer, keep the payment documents. Everything with timestamps and the time zone stated.

Then the bank or payment provider, if the money went through them, using the fraud line rather than general enquiries. Then a police report for the reference number. Then the receiving exchange, if the final address belongs to a known platform with a compliance function.

Only after that comes the conversation with a lawyer, with a complete file already in hand. At that point a discussion of the crypto exchange scam stops being theory and becomes a set of documents somebody can work with. One figure is worth holding on to: in four impersonation reports out of five no money was lost at all, because somebody checked before they paid.

11Questions and answers

12Read next

• Ilia Zavialov Explains How a Crypto Transfer Actually Works, Step by Step How crypto works
• Ilia Zavialov Explains the Types of Crypto Scams and How Each One Is Built Scam types
• Ilia Zavialov on the Crypto Wallet Protections That Hold After a Breach Protection
• Ilia Zavialov on the First Hours After a Crypto Theft: What Actually Helps Incident
• Where Fraud Losses Actually Go: Ilia Zavialov Reads the 2025 Numbers In numbers
• Ilia Zavialov fraud: how one photograph becomes the face of an advert nobody filmed A face from one photo
• Ilia Zavialov on the fee to unlock a withdrawal and what a real exchange delay looks like Blocked withdrawals
• Services that promise to recover lost crypto: Ilia Zavialov on how the offer is built and why refunds never arrive Crypto recovery
• Ilia Zavialov on the seed phrase and the fake wallet support desk Seed phrases
• Checking a wallet address before you send: the checks Ilia Zavialov runs first Wallet checks
• Ilia Zavialov Explains How an Approval Drainer Empties a Wallet Wallet drainers

Back to the blog