Case #7
Investment in SCAM project. Fake coins and liquidity pools.

The victim turned to the academy for training in crypto trading in order to learn how to invest. With the help of a “mentor” from this academy, and to start trading, BUSD tokens were purchased for fiat currency on Binance.
Description of the situation

The victim sent all purchased tokens from the Binance exchange to his address 0x12c...


Further, on the advice of the “mentor”, BUSD tokens were sent to the liquidity pool at the PanCake Swap in the Sweat Coin-BUSD pair. This pool after the introduction of funds showed a significant increase in value, and hence significant earnings for participants.


As it turned out, Sweat Coin is a scam coin created by the same scammer. The client received a reward in USDC tokens (a copy of the original USDC, also a scam) in the amount of 23,844. The client tried to send these scam tokens to Binance, but the exchange refused to accept the token, since it was not the original smart contract.

Smart contract USDC token scam
bscscan.com.
The correct smart contract USDC token
bscscan.com.

As a result, the victim invested real money in a fake liquidity pool and made a profit in a scam coin. Both the coin and the liquidity pool were created by a scammer posing as an academy mentor.

Investigation

Our compliance officer collected all the necessary information from the victim of the scammer and began to investigate.


Data on the site (fatherinvestments.com) - the academy of scammers brought to another country, in contrast to the location of the victim. The registration data was new and din’t contain clues to obtain information about the attacker. We didn’t use paid advertising of the site, we also couldn’t find payment details. The trail is lost.


The scammer's Telegram account was created with fake data and didn’t provide new clues to obtain information about the attacker. The trail is lost.


The blockchain investigation revealed the address of the attacker who was in contact with the victim's wallet. Further, a large network of fake liquidity pools was revealed, copies of popular tokens associated with an attacker and operating for more than a year under this scheme. This is what the fraud scheme looks like:

It is worth noting the dark green colour (the victim) and the pink colour (the scammer). The victim sends real BUSD to the pool → the pool gives the victim a fraudulent reward and the BUSD is transferred to the scammer's address. The abundance of such addresses indicates that scammers have created many pairs and pools to steal funds. Many of the addresses have comments about the scam.

Several withdrawals to the Binance exchange from the attacker's address were detected. An official appeal was made to the exchange to block funds and provide the data of the scammer. Unfortunately, due to the absence of the fact of initiating a criminal case, there was no positive response from the exchange.


This case is not closed, there is a search for other victims and information about the perpetrator. Additionally, the search for other possible victims of the fraudulent network continues to alert them.


Requests are written to blockchain explorers to mark the addresses, pools, and coins of the scammer as scam projects. In the future, this will help other users of blockchain networks to see this marking and not lose their funds.

Acceptable
Result
  • The revealed data is not enough to initiate a criminal case on behalf of law enforcement agencies.
  • Blockchain analysis revealed a large fraudulent attacker network. On the basis of not opening a criminal case, the Binance exchange didn’t give a positive response to the request.
  • The trail is worked out further to warn other potential victims of this scheme. In connection with this activity, additional traces of the fraudster appear, several more victims were discovered and new investigations were launched with them.
  • A website and accounts in Telegram of scammers have been identified. Resources were registered to fake data. No additional clues were found. The trail is lost.

Chance to recover stolen funds

Mid

THE COST OF PREPARING A REPORT DEPENDS ON THE COMPLEXITY OF THE PARTICULAR CASE AND THE WORKLOAD OF OUR COMPLIANCE OFFICER.
Leave an application and we'll do a quick scoping of the situation and give you a cost estimate.
Estimate