INVESTIGATIONS

INVESTIGATIONS (5)

Ongoing initiatives.

The illegal Finiko service started operating at the end of 2017. It was positioned as an automatic profit-making system. Currently, it is represented by Cyfron FNK LTD, registered in the state of Saint Lucia (no license is required to work with cryptocurrencies).

The site in the .ru domain zone is not available. There is a working mirror of “thefiniko” (in the .com zone). The user agreements on both sites are identical. What is noteworthy is that the platform offers gaming programs that mimic investment programs. And the internal CFR token is not an official currency and has no financial value. The company does not bear any responsibility.

This approach allows Finiko to work without loss since 2017. In November 2018, the platform launched an active advertising campaign. The scammers offered to buy an apartment or a car, pay off another loan for 35% of the cost. The peak of active use of the service occurred at the end of 2019. This was accompanied by the visibility of the accrual of funds to users. However, few users were able to withdraw real funds...

There are the main signs of a financial pyramid: lack of regulation, registration in an offshore company, short life (the cost of the CFR token is close to zero), very high profitability (promised more than 200% per year), enticing and expensive website design, a lot of good reviews.

Finiko, the only known cryptocurrency, has a huge number of wallets in Bitcoin and Ethereum. The largest crypto wallet received 12099.294 BTC (almost in 2.5 years). It may have been used for trading on the stock exchange. More than 129 thousand wallets involved in the activities of the illegal service have been identified. The main large (used for receiving / sending) wallets are monitored by the services of the SICP platform.

In the darknet, there is a forum where enthusiasts are working to identify large Finiko wallets and select private keys to them. In total, Finiko attracted more than $300 million from the population (according to SICP experts, more than $400 million)!..

Analysis of recent transactions shows that the funds are withdrawn mainly on the Asian cryptocurrency exchange, managed from Russia. If you or your loved one suffered from the activities of Finiko, please contact CryptoCERT (This email address is being protected from spambots. You need JavaScript enabled to view it.).

Source: sicp.ueba.su

Saturday, 26 December 2020 12:21

ADDED CUSTODIAN XAPO CRYPTOCURRENCY WALLETS

Written by

Users of the SICP platform have access to a pool of Xapo wallet addresses for analysis, with user marks of owners (the largest received 231,834.287 BTC), which was launched in the jurisdiction of Hong Kong in 2013. Already in 2014, support for debit cards for operations with cryptocurrencies was implemented. In 2015, the headquarters was moved from the USA to Switzerland.

In August 2019, Coinbase acquired the Xapo custodian (for about $ 55 million). Thus, Xapo came under the control of Coinbase Custody, making the relatively young custodian of the crypto exchange the world's largest storage of cryptocurrencies by capitalization. Today, he holds over $ 7 billion for over 120 large clients in 14 countries.

In 2020, the company moved its operations from California to Gibraltar, which offers a regulatory framework for cryptocurrency companies. The changes in Xapo come amid litigation after the custodian was accused of circulating stolen funds…

So, according to a lawsuit filed by German citizen D. Novak, Xapo and the Indodax cryptocurrency exchange contributed to the turnover of stolen cryptocurrencies. It also reveals that Xapo holds 19.99 BTC from the stolen assets, and the Indodax exchange has 476.69 BTC.

By the end of 2020, the crypto custodian (owned by crypto exchange Coinbase) plans to restructure its business and become a digital bank. Represented by legal entities in the United States (Xapo Blockchain Limited) and Gibraltar (Xapo Gibraltar Limited) and meets the regulatory requirements for financial services, virtual asset providers, electronic money and security.

Source: Xapo

SICP experts have identified another scammer using social media to cheat. Katrina Lucas from Los Angeles adds potential victims as friends on Facebook and starts a dialogue with them about cryptocurrencies and investments. She offers them up to 50% profit in the first week by investing her bitcoins in her services. The scammer mentions the cloud mining service Coincloudhashing, but this site is not available in the .com zone.

So, one of the scammer's wallets received 4 transactions worth 0.027 BTC. Subsequently, the funds were transferred to the consolidating wallet of the illegal service (in transit, with division into parts).

Associated with the profile is a bitcoin investment company page that leads to an inaccessible site in the domain zone in Nigeria (bitcoincom). From the information it follows that the illegal investment service allegedly charges $ 50,000 for 1 bitcoin. Here are trader Jennifer Smith's contacts and reviews of active users.

One of the wallets of the illegal service received 410 transactions in the amount of 5,669,312 BTC (over a period of about 3 months). It is linked to several other major wallets in the group in question.

The second scammer's wallet was launched a few days ago. Funds are withdrawn directly to the Huobi Global crypto exchange wallet. The wallet of the exchange user took 5 transactions for 0.034 BTC, which so far contain about 100 BTC. In total, the wallet received 14 785 129 BTC.

Katrina's Facebook page is currently unavailable, and messages from the correspondence have been deleted by the scammer (please take screenshots in advance). There are no active sites on the network.

Look before you jump!

Service: sicp.ueba.su

CoinPayments payment system was launched in Estonia in 2013. The electronic wallet of the payment system is used by a large number of sellers and buyers in more than 180 countries, as the wallet supports more than 2005 tokens. The payment system received a regional license to work. However, the withdrawal function to fiat currency is not available.

Over the past 2-3 years, information has been received that cybercriminals have discovered a vulnerability that allows them to withdraw more funds than were in the account. Then the administration of the service compensated for the damage to half of the victims. Also, the site stopped working, which affected a large number of complaints from users and led to problems in investment projects of clients.

CoinPayments also supports the issuance of prepaid cards with a deposit in cryptocurrencies (over 100 types). Such cards can be used in various jurisdictions and carry significant risks of money laundering. There is an official website in the TOR network.

Source: CoinPayments

Friday, 27 November 2020 18:18

FRAUDERS USE NAME OF BIG PLAYERS

Written by

On November 2, 2020, the Polymetal international investment phishing site was launched. Its contents have been copied almost entirely from the original Polymetal International website. Most of the pages were copied and modified for the needs of the attackers. However, the link in the clone logo leads to the original site.

The home page of the fake site contains information about investment packages (5 types), with a profit of 5 to 50 percent in 8 days. The same information is available in the investor's personal account after registration. Investments can only be made in bitcoins.

 

In less than a month, the scammers sold 34 packages worth about 0.19 BTC. The criminals' consolidating crypto wallet received 250 transactions at 53.44 BTC. Most of the funds are withdrawn on the Hong Kong crypto exchange Binance.

It is noteworthy that on the same hosting in Phoenix (California, USA) there is another project of Lugwise Asset Management (Lugwiseinvest). The project was launched on October 5 and is positioned as a London-based asset management firm. Although the legal address on the site is listed in San Francisco (California, USA).

Judging by the activity and the amount of funds on the associated purses of the scammers, this is not a complete list of their illegal services and projects.

If you or your loved ones have suffered at the hands of fraudsters, please send notifications to the service mailbox of the CryptoCERT service (This email address is being protected from spambots. You need JavaScript enabled to view it.).

Original: Polymetal International

Scam: Polymetal International Investment

About SICP

Security Intelligence Cryptocurrencies Platform - Cybersecurity infrastructure of the blockchain and antifraud in the cryptocurrency sphere. SICP - antiscam, trust, compliance.

Get In Touch

Address: Russia St. Petersburg Marshal Tukhachevsky 22

Phone: +7 (812) 983-0483

Fax: +7 (812) 983-0483

Email: sicp@ueba.su

Website: www.ueba.su

Join Our Community

Sign up to receive email for the latest information.
© 2020 SICP. All Rights Reserved.                                                                                                                                     Grant BTC 1CdD6Xk9RDZ9wyeRqq1uXkktgdaPpGpt8f

Search