How does a crypto investment scam actually work?

How does a crypto investment scam actually work?

A crypto investment scam works by giving you an account on which a balance climbs, while your deposit is booked away elsewhere and nothing has ever been invested. Everything you see after that is meant to hold those two things together: a credible screen and a vanished amount.

That is also why a payout stalls. There is no investment to sell, so a large withdrawal can only be made out of newly deposited money. As long as there is inflow, a small withdrawal works, and as soon as it dries up a reason appears why you have to pay in first.

This pattern is a form of investment fraud and is often called a Ponzi structure: existing participants are paid out of the deposits of new participants, without any underlying proceeds.

How is such an operation built up from the inside and which roles does it contain?

From the inside a crypto investment scam consists of four parts that function separately: intake, sales, platform and outflow. That separation is deliberate, because it means nobody knows the whole picture and there is nobody who can tell you the whole picture.

• Intake: advertisements, imitation news items, groups on messaging apps and purchased contact lists. The aim is not selling but filtering who responds.
• Sales: people who call or chat with you, working from a script and with a second person who confirms the offer as a specialist. Their reward hangs on your deposit.
• Platform: a website or app that gives you an account, a balance and a chart. Technically this is the simplest part and at the same time the part that carries the story.
• Outflow: the addresses and accounts along which the deposits disappear, usually via a collection point and then via several steps towards a trading platform.

What we see in files is that the sales part and the outflow part rarely belong together. The person you spoke to often does not know where your money went, and that is exactly why an investigation does not start with that person but with the booking.

Why is the platform the most important part of a crypto investment scam?

The platform is the most important part because it absorbs your doubt without anyone having to be involved. You log in, you see a balance, and that experience weighs heavier than any argument.

Technically a fake crypto platform can be unmasked with one check: look up the transactions the platform shows in a public block explorer. If they do not exist, the holding does not exist. That is not an estimate but a factual finding you can make yourself.

A variant of this works with a token that does really exist but whose rate is steered. That is called pump and dump and produces a chart that is correct while the outcome is fixed.

Why does a crypto investment scam work so well psychologically?

It works because every step is small and because every doubt has a prepared answer. You do not deposit a large amount in one go, you start with an amount you can spare, and only after that does the scale shift.

• The first small withdrawal works, which tells you that paying out is possible.
• There is a personal guide who knows you by name and who is in contact more often than your bank ever was.
• You are asked not to discuss the offer with anyone else, which removes the one test the story would not survive.
• When you want to stop, there is always a reason why right now is the worst possible moment.

With the slow variant, in which trust is built up over months first, we speak of pig butchering. The build up is different, the machine underneath is the same.

Where does the money go in a crypto investment scam once you have deposited?

Your deposit almost never goes straight to a final destination but first to a collection point where payments from several participants come together. From that point a route begins that is meant to conceal the origin, and that is exactly what money laundering means in this context.

In the files we see, that route runs in three phases: merging at a collection point, splitting into smaller amounts across several addresses, and finally paying out at a trading platform. That last point is usually the last factual finding, because the blockchain stops telling there.

What is often underestimated is the meaning of the collection point. As soon as it turns out that several affected people end up at the same address, an individual story turns into a pattern with a timeline, and that makes a police report more concrete.

How does an investigation expose the crypto investment scam machine?

An investigation exposes the machine by starting at your own booking and recording per step what happened, in this order.

1. Establishing which payments you made, with date, amount, receiving address and transaction hash.
2. Checking whether the transactions the platform showed exist on a public block explorer.
3. Following the receiving address to the collection point and establishing how many other incoming bookings landed there in the same time window.
4. Following the outgoing bookings from that collection point, including small branches that are easily overlooked.
5. Establishing at which service providers the holdings arrive and at which moment.
6. Naming up to which point the route is certain and where the uncertainty begins, with the data that rests on.

Paucitas uses no automated analysis software, in any role whatsoever. The investigation is done manually on the basis of publicly accessible block explorers. Every transaction and every transaction hash is verified one by one before it is included in a report.

What can an investigation into a crypto investment scam not establish?

An investigation establishes where your payment ended up and not who was behind the operation. That boundary is hard and belongs explicitly in the report, because a file that suggests more than it can substantiate collapses at the first critical question.

• Paucitas does not independently establish who is behind a crypto address. What is recorded is which service provider or party holdings went to, so that this information can be followed up through the channels intended for it.
• Paucitas makes no commitment about the outcome of an investigation.
• Transactions outside the blockchain, such as cash payments or internal bookings within an exchange, are not visible in blockchain data. They are only included if underlying documents are available.
• Where mixers or privacy oriented networks are used, the chain cannot always be followed in full. In that case it is stated explicitly up to which point the route can be established.
• Paucitas holds no funds itself and carries out no transactions on behalf of clients.
• A report by Paucitas is limited to factual observations and the investigation of those observations.
• Paucitas gives no tax or legal advice.

Paucitas also makes no statement on whether something qualifies legally as fraud. The report states what was found, and the interpretation of that belongs with a lawyer or a competent authority.

What can you do yourself and when is that not enough?

With a suspected crypto investment scam you can do the most important check yourself: look up the transactions the platform shows in a public block explorer, and look up the provider in the register and on the warning list of the Dutch Authority for the Financial Markets and in the European overview kept by ESMA. That costs a quarter of an hour.

It is no longer enough as soon as you have deposited and want to know where the money went, as soon as the route splits, or as soon as you want to supplement a police report with facts instead of with a story. From that point recording and following is work that has to be verifiable. Where you can go with your notification is set out on the situation page about where to turn if you were scammed with crypto.

Data is supplied digitally or at the office. Per case a delivery list is provided which states what data is needed. Where necessary Paucitas guides the collection and delivery of that data.

Paucitas never asks of its own accord for your recovery phrase or private key. If you need help reading out or restoring your wallet, we guide you through that completely, without us having to see that data ourselves.

What is in the report and how long does an investigation take?

A report by Paucitas follows a fixed structure: reason and description of the assignment, the questions, the scope, the starting points, the data supplied, the sources consulted, the method in outline, verification and quality assurance, reservations and limitations, findings per part, a chronological overview, analysis and coherence, conclusion, statement of independence and appendices. Not every report contains all parts, and the structure is matched to the purpose.

An investigation by Paucitas takes, depending on the size of the file and the urgency, between one working day and two weeks. An urgent report can be delivered within one working day and in exceptional cases on the same day. A regular investigation is usually ready within three working days. In files with many transactions, several wallets or missing history the lead time rises to around two weeks. A surcharge applies to urgent assignments.

Paucitas works with a fixed rate based on your situation. Sometimes we apply an hourly rate by agreement, but the hours are always fixed in advance, so that you never face surprises. No investigation is started before the costs have been discussed and agreed.

Paucitas usually responds within a few minutes to an hour and in virtually all cases on the same working day.

Where does the work of the AFM and the police begin and where does that of Paucitas?

The AFM supervises providers and warns about parties without a licence, and the police take down your report and can demand data through criminal procedure. Paucitas does neither and instead establishes the facts that substantiate your notification and your police report.

If you have doubts about an offer or have already deposited, you can have your situation gone through calmly in a free intake. We are honest about what can still be established. More about this service is on blockchain investigation and transaction tracing. For the signals in advance, our explanation of recognising a fake crypto platform is the logical next step.

Date of last revision: 2 September 2026.