Cloned trading desk, three exchange hops
What happened
The client believed they were funding a managed trading account with a firm that had cloned the branding of a real brokerage. Deposits were made in five tranches over eleven weeks. When a withdrawal was requested, the desk demanded a 'release fee' — the point at which the client contacted us.
How it ran, step by step
- Day 0 — consultation
Free call, loss timeline captured, deposit transaction hashes collected from the client's own exchange history.
- Day 1–3 — tracing
Funds followed on-chain across three hops. Two intermediary wallets were consolidation addresses; the final hop terminated at a centralised exchange deposit address.
- Day 4 — freeze request
Evidence file submitted to the receiving venue's compliance team, including the trace graph and the client's sworn statement.
- Day 9 — hold confirmed
Venue confirmed the balance was held pending lawful direction.
- Day 23 — release
Funds returned through a regulated escrow to an account in the client's own name.
No upfront fee. A refundable compliance deposit was paid into a wallet in the client's own name to verify the receiving address, and was returned as part of the final disbursement. Our success fee was deducted from the recovered amount only.
How the deposit worksSpeed decides these cases. The deposit addresses were still active when we filed; a fortnight later the balance would have been swept.