Thread by @SpecterAnalyst

An investigation into CBEX — a Ponzi investment platform that has successfully defrauded people of more than $12M through their website. I began this investigation two weeks ago.

This is going to be a long thread. Take a seat.
Let’s dive in 👇

CBEX claims to have been in existence since 2017 under a company named ST Technologies International Limited. That’s a lie.

According to WHOIS data, none of the websites were registered before January 2024, meaning the CBEX Ponzi scheme only went live last year.
Worth noting: CBEX and PCEX are owned by the same team. More on that later.

Now, there is a legitimate company called CBEX Group — China Beijing Equity Exchange — a government-run equity platform.

In February and April 2024, the real CBEX (China) and the Hong Kong authorities released statements denying any link to the crypto exchange CBEX using their name.

CBEX was registered with Nigeria's Corporate Affairs Commission (@cacnigeria1 ) and listed under SCUML, a compliance database operated by the @officialEFCC (Nigeria’s anti-financial crimes agency).

However, registering with both agencies costs about $50 — and no due diligence is done before approval. Literally anyone can register a business.
CBEX even opened physical offices in Nigeria to appear legitimate and gain public trust.

Let’s look at the web traffic.

More than 80% of the traffic to the CBEX website came from Nigeria, followed by Kenya.

Onchain data analysis 🧵

CBEX generates a new wallet address for every new user. When victims deposit, their funds are moved to another wallet.
TRON is the primary chain used. Since TRON requires "Energy" to reduce transaction fees, CBEX uses some wallets to delegate energy to new wallets before moving the funds out.

Here are a few of those energy provider addresses:

TYMZdfff9RzDbszgivGkpioHSxLE9Km8mJ
TNn41mXch49gjJ6XeAgAgfBCipG2Z5UGB6
TDUXCBVPmhEDN3Zgtc6WmiyH7CQLU7f3n1
THKmu36cUpMz48WTvPiNBeXgfdP22HJTT1

Victims’ funds were first routed through these:
TWZ9GGUtiDoK5yC1xb1ToHdoJM6GTcUECF
TA7E8YZy1sh8K7rn5TaShHJ3t6LbQTmG7y
TGTCxCxM5tcu6D287X6Q43Y3RsGRYyYE21

Afterward, funds were sent through intermediaries, bridged to Ethereum, and obfuscated.

Three outcomes after bridging:
-Sent to centralized exchanges (CEXes)
-Bridged back to TRON via new wallets
-Swapped to the decentralized stablecoin USDD

Wallets Traced
Frame 1:
I traced one wallet that held $3.2M in USDT & USDD. The last activity was 24 days ago until yesterday, when $2.9M was swapped and distributed across multiple wallets. It now holds $353K in USDD.
Frame 2:
Another traced wallet still holds $1.9M USDD.
Frame 3:
About $1M was sent to centralized exchanges.
Frame 4:
$5.7M from three wallets was distributed to OKX, Bitget, and HTX.

These are just a few of the funds I was able to trace for now. There are more inflows and outflows across different wallets, and I will track and trace more as the investigation continues.

Not all funds are from CBEX or PCEX — there are other Ponzi websites run by the same syndicate targeting other regions. (More later.)

They use one bridge wallet frequently: TPwezUWpEGmFBENNWJHwXHRG1D2NCEEt5s

I contacted @okx and @bitgetglobal :
OKX said they can’t help unless the victims reach out themselves — even after I offered to intermediate (most victims lack technical knowledge).

Meanwhile, @okx was recently charged with money laundering.

@HTX_Global (formerly Huobi) has faced multiple fraud allegations and barely responds to similar reports.

Okx said individuals should contact them. If you deposited to cbex or PCEX, send a message to @OKXHelpDesk as requested by them. lol

I'm still in contact with Bitget and hoping for support.

Some EVM Wallets Used:
0x0D51e3B408a3EB81eD145BB6b6751e253fcED38c
0x2717c41C7547acB2144BFB1b1F947F1A6F6691F2
0x9fbeBFf1C2FFF3A58FF25338Ca7bE4Bbd3C83622
0xDE4d79160152DE3C34F0d04c56Ae7f447cBb2903
0xC0Db4248ffeA3C1dc632Ba7e90866B7dA9004a3F 0x5326f5efa87ba7ddda8ff5df51d1e1bfd7381b52 0x656101388914942284ad3deb6904ce95e448e900
… and more

Two days before CBEX disabled withdrawals, I reported the platform to @SECNigeria via ReportGov. They acknowledged the report and said to await a response. 5 days later — no reply.

I also contacted @Tether_to , asking if they could freeze $1.9M in USDT before it was moved. They responded quickly but said they need involvement from local authorities, which I understand.
Still, a shoutout to Tether for responding and providing leads.

During my research, I uncovered another Ponzi website linked to CBEX called LWEX (lwex.com) target to Slovakiaz and Hungary. It shut down early this month. I found a report on Facebook and observed similar operations and money movement patterns as with CBEX.

I recovered the website using the Wayback Machine — it has the same interface as CBEX and PCEX.

About the fraudsters

I found wallets linked to Huione Pay, a payment/exchange platform in Southeast Asia.
According to an article by @elliptic , Huione Pay is a subsidiary of Huione Group and operates a darknet marketplace on Telegram called Huione Guarantee (now “Haowang Guarantee”).
On this platform:

Scammers sell fake crypto investment website templates.

AI face-swap tools and telecom services are also sold.

Users must be verified before joining groups — new

This is the same design as CBEX.

Huione International Payments, part of Huione Pay, acts as a merchant on this network — helping scammers launder funds globally.

Over 100 Telegram groups are linked to Huione Guarantee — offering illegal services like:

KYC-bypassing exchange accounts
Money laundering
USDT “black market” services

A Telegram scam dev known as Kehon8 (formerly Honke8) sells scam website templates to over 145k subscribers.
CBEX used his website design for their operation.

The centralized exchanges used by the CBEX team may be intermediaries to hide fund flows, and likely make use of KYC-purchased accounts sold on Telegram.

Additionally, all CBEX users’ KYC data is at risk and may already be on darknet marketplaces.

Note: image; All all the images are Translated from the original Chinese language posts

Local involvement
While investigating, I discovered several CBEX Telegram groups managed by Nigerians who actively promoted the platform. Many of them claimed to know the people behind CBEX, using that trust to earn referral bonuses and lure in more victims.

Some used fake screenshots showing fake deposits ($20k, $8k, etc.) to lure others in.
Upon tracing the transactions, I discovered they were simply moving funds between Bybit and MEXC — no actual CBEX deposits.

This is a criminal offense under Nigeria’s Advance Fee Fraud Act Section 1(1).

Initially, I didn’t want to expose them — in a dog-eat-dog nation, the victim will do the same lol. But yesterday, a woman messaged me saying one of the admins threatened to jail her simply for asking why he changed his display picture.

All the admins had removed their profile pictures after the crash. One admin, who goes by “TRUTH” on Telegram, deleted his username.

Using OSINT, I found it: @truth1_5

In less than an hour, I uncovered his real identity:
Victor Aiguosatile Osamwende, from Edo State — an accountant who was shortlisted for the Edo civil service job in 2021.
Victor, stop threatening victims. People are hurting.
Phone: [phone]

I shared his info so as not to end up arresting any victim

Many Nigerians — both old and young — fell victim to this scam.

Even though some suspected it was a Ponzi, they went ahead, hoping to cash out early. Now they’re left in tears.

In my future post, I’ll explain how to identify Ponzi and pyramid schemes and stay safe.

If you found this helpful, please share — we need more awareness around crypto scams and how they operate.

You can donate to support my investigation, wallet address in bio or specteranalyst.sol

Thank you.

@threadreaderapp unroll

if you finding it difficult to read. let unroll help to make it an article

Read it as an article here

https://x.com/threadreaderapp/status/1912153315791565122?t=JHIo5O17-WpW6EEagvzIMA&s=19

This is fake❌

1. they didn't use $ETH at all except the chain

2. How many $ETH is even in circulation 😂

3. they only used $USDT and $USDD