How a mysterious crypto exchange used an insider trading scam to swipe $3m from wealthy victims

The story is depressingly familiar. A woman reaches out by text, WhatsApp, or LinkedIn. She wants advice, or maybe she entered the wrong number, and starts a conversation. Eventually, she dupes targets into sending money, then disappears.

Victims can’t believe they fell for it. Todd is one of them.

“I could tell she was a really educated, intelligent person,” Todd told DL News of his conversations with an operator he knew only as “Linda.” “I didn’t suspect that she was setting up a trap to lure me into the investment scam.”

Lured into scheme

Todd, 58, lives near Silicon Valley and works as a software engineering director. He and two others, who spoke to DL News on the condition their names were changed, were lured into a scheme that looks like insider trading.

In 16 transactions, Todd sent money to a cryptocurrency exchange called GateEx at Linda’s behest, according to texts and data from his digital wallet seen by DL News.

He converted his cash into Ether and USDT, the stablecoin issued by Tether. A few months later, he had lost almost $2 million.

Two other investors, Tony in Taiwan and Glenn in Australia, said they were also ripped off by scams that directed them to use the GateEx site. In each case, the scammers tempted the investors to buy crypto on GateEx by promising them a sneak peek at trading orders.

When the investors realised they’d been swindled and tried to get their money back, GateEx representatives threatened them, the men said.

‘The groups behind the scams are world-class social engineers with scripts written with thousands of victims’ experiences.’

—  Adrian Cheek

GateEx did not respond to numerous requests for comment sent to an email address posted on its website, or to messages sent through the customer service chat on its app.

DL News also attempted to send GateEx a WhatsApp message through a contact number provided by the victims and that was also shared on scam watcher websites asking for comment. It was not connected to an active WhatsApp account.

In an industry rife with Ponzi schemes and hacks, romantic investment cons, dubbed pig butchering, have surged over the last few years.

The perpetrators use social media platforms such as LinkedIn to research victims and get them to drop their guard. LinkedIn did not respond to requests for comment.

And crypto exchanges involved in the scams rebrand, morphing into new sites when they come under scrutiny, say crypto analysts.

GateEx, for instance, is one of dozens of platforms used by the same group to execute scams, said Adrian Cheek, a financial crime researcher and former senior manager at Deloitte, the global consulting firm.

Cheek said criminal groups use repeatable patterns such as the same website template, the same wording, or contact number.

“For the criminals to maximise profit, their model must be rinse and repeat and very low maintenance,” Cheek told DL News. “These groups operate by rotating through investment websites quite quickly, and GateEx was the website in use at that time.”

Crypto trading orders

Another tactic is whetting investors’ appetites for riches by proffering secret market information.

That was Linda’s ruse.

She told Todd she worked at a company that had access to crypto trading data at GateEx. By seeing the orders of a successful big trader, or whale, before they were executed, she told Todd he could invest in tokens poised to jump in value.

It was months before Todd caught on to the gambit and tried to withdraw his funds. He couldn’t.

Then the scam shifted into another gear. A person claiming to be a GateEx security representative contacted Todd through the platform’s customer service chat and accused him of stealing company data.

“They wanted me to pay a huge fee of $200,000 for reviewing my account,” Todd told DL News. “Then after I paid it, they accused me of another crime, money laundering, because I sent money to Hong Kong.” (Todd had also wired money to GateEx accounts in Hong Kong and once to China.)

Todd said the person told him the Financial Crimes Enforcement Network, an arm of the US Treasury Department, was involved in investigating his account. But with GateEx’s help, he could avoid paying a “huge fine” to FinCEN by paying another GateEx fee.

GateEx then notified him that the investigations were hurting his credit score and threatened to freeze his bank accounts if he didn’t pay another sum to unfreeze his GateEx accounts, Todd said.

The episode not only demonstrates the evolving sophistication of pig-butchering scammers. It also shows they are targeting wealthier and more savvy prey — educated professionals steeped in the ways of the tech industry.

Legions of coerced workers

It’s hard to get a handle on the scale of these scams. According to the Federal Bureau of Investigation, US-based victims lost about $429 million to romantic crypto investment swindles in 2021, the latest year the agency collected data.

In November, Tether shed some light on the breadth of pig butchering when it froze $225 million in stolen USDT in conjunction with the crypto exchange OKX and US law enforcement authorities.

‘I was stupid to believe that it was a good investment.’

—  Glenn, pig butchering victim

This type of romantic investment scam originated in China and Southeast Asia, where law enforcement authorities say it is common for organised crime groups to coerce legions of workers to toil in secure compounds and comb the internet for fresh victims.

The United Nations estimates over 100,000 people are held in such compounds. Many travel to the sites from China, Malaysia, the Philippines, and other locales believing they have secured legitimate call centre jobs.

Law enforcement is scrambling to respond. Myanmar officials have handed over more than 31,000 telecom fraud suspects — which includes crypto scammers — to China since the launch of a joint investigation in September, according to The Wall Street Journal.

Meanwhile, Chinese authorities put out arrest warrants in early November for members of the Ming family, one of the four big crime families operating in Myanmar’s Shan State. They offered a reward of up to 500,000 yuan, about $69,000.

Mysterious exchange

Chinese police have said the Mings run many of the compounds in Kokang. Last month, authorities apprehended several members, including its head, Ming Xuechang. He died by suicide in custody, according to Chinese authorities.

Mysterious crypto exchanges lie at the heart of many pig butchering scams.

Little is known about GateEx, for example. The company doesn’t disclose where it is based, though it has offices in San Francisco, Malta, Hong Kong, Singapore, Japan and South Korea, according to its website.

Yet DL News could find no filings for GateEx in the respective corporate registries in these jurisdictions.

The company’s website said it has more than 100 employees, but a search of LinkedIn turned up none. There is no sign that any of the 100,000 active traders it boasts are active in online chat rooms or social media platforms popular with crypto traders.

DL News traced funds from wallets linked to these different exchanges. They show the proceeds are laundered through a complex series of transactions and co-mingled with the funds from other pig butchering wallets.

“GateEx is still active, but my research shows they have already moved on to a new series of websites,” said Cheek, the financial crime analyst who now independently tracks such scams.

Detailed backstories

Wherever they operate, the con artists linked to GateEx appear to know their way around. Todd said Linda knew the neighbourhoods in San Francisco and Silicon Valley. She spoke about Asian food markets well known to locals, he said.

The fraudsters also create highly detailed backstories to make a connection.

Tony, a retired primary school teacher in Taiwan, met a woman who called herself “Amy Li” on a social media app called Line. Amy told him her husband, a firefighter, had died in the line of duty.

Social engineers

Each story follows a predictable pattern.

The women typically say they were born in China and moved to the US or Singapore. They often say they suffered a terrible tragedy. Tony’s scammer was widowed. Todd’s fraudster got divorced after her husband physically abused her, with injuries so bad she ended up in a hospital.

Each woman was depressed until a wealthy family member — an aunt or a sister — who’d done well in finance or business showed up and helped them turn things around. The family member then offers them a job at a data processing company and has access to a cryptocurrency platform’s internal restricted data.

None of it is true, of course. In fact, the women appearing on calls and video chats are probably not the same people texting investment details with the victims. This is how industrialised the operation is, Cheek said.

“The groups behind the scams are world-class social engineers with scripts written with thousands of victims’ experiences,” he said. “The person on the other end is just as likely to be male as they are female.”

Just like “Linda”, “Amy” told Tony she had moved to California and was working in the information technology sector. She said her aunt had access to GateEx’s trading data and Tony could make a fortune by investing on the site. “I just followed her instructions and each time I did earn a profit of around 10%,” he said.

He wound up losing $400,000.

Glenn, an Australia-based engineer, was contacted by a woman calling herself “Tang Na” through a group on the Chinese social media app WeChat.

She knew a lot about his background, Glenn told DL News.

Week after week she urged him to invest his money on GateEx. “She knew when a big player was coming in so if I followed her, just doing the same things, I could make a profit. 100% sure,” Glenn said.

When Glenn became suspicious and tried to withdraw his money, GateEx forced him to pay 20% “income tax” of around $142,000.

Account ‘under review’

In March, he paid it alongside an additional$120,000 late fee and tried to withdraw his funds. But his account only showed that the transaction was “under review.” Multiple attempts to contact customer service went nowhere.

“I was stupid to believe that it was a good investment,” he said.

Using the lure of inside information to shake down investors shows how crypto scams are evolving. The three men who shared their stories said they saw the move as an opportunity to make money in an unruly marketplace.

Todd said he asked Linda about whether the scheme was legal. She told him to keep it a secret and nobody would know.

Glenn also asked Tang Na about the legality of her proposal in November last year. She told him that she’d consulted on potential legal issues and asked friends involved with crypto. It wasn’t considered insider trading, just short-term trading, she told him.

With their latest inside information gambit, the fraudsters are adding yet another layer of manipulation. It is illegal to use confidential information to trade on securities in the US and many other nations.

US authorities are cracking down on the practice in crypto markets. In May, a former Coinbase product manager was sentenced to two years in prison in the US for tipping off associates about crypto assets that were going to be listed on the exchange.

‘I have no other choice but to accept the fact. I still have to continue with the rest of my life, but sometimes, as soon as I think of it, I feel down.’

—  Tony, pig butchering victim

And in August, Nathanial Chastain, a former head of product at OpenSea, was sentenced to a three-month prison term in connection with a scheme to profit from knowing which NFTs would be featured on the marketplace’s website.

Yet James Park, a law professor at the University of California, Los Angeles, who specialises in securities regulation, said insider trading may not be applicable in cases where a company is not a bona fide business.

Park said executives at companies that issue assets such as shares are normally obliged to keep “material” non-public information confidential to prevent market manipulation. A chief financial officer, for example, is duty-bound not to release earnings figures to others lest they trade shares before the news is released.

But in the case of GateEx, that rule may not apply, said Park.

“If the company is not legitimate and just a scam, there is a question as to whether such a duty could exist,” he said.

Suspect white paper

GateEx has attracted the scrutiny of authorities in a couple of nations. In August, the Ontario Securities Commission in Canada flagged GateEx and its websites on a list of 13 firms that may pose a risk to investors and are not approved to deal in securities in the province.

Users trying to access some of GateEx’s domains from China are greeted by a message from authorities in Shanghai warning that the page is a scam.

The white paper GateEx relied on to launch its service also appears to be suspect. It looks identical to the one used by Wazir X, a crypto exchange in India. All that is different is the use of the name “GateEx” in the place of Wazir X, as if someone used the “find and replace” function.

Nischal Shetty, Wazir X’s founder, told DL News that his venture has nothing to do with GateEx.

Another exchange

Meanwhile, the group appears to have changed up site names. As part of his research, Cheek communicated with one of the scammers who interacted with one of the three men DL News interviewed. But instead of directing him to GateEx, she steered him toward another exchange.

It’s extremely difficult to recover assets from these operations. Tony, the retired teacher in Taiwan, was fortunate because he used bank transfers at his local post office to move his money onto GateEx.

The police were able to trace his transactions to so-called money mule accounts — bank accounts often bought by criminal groups to send and receive money.

For his part, Todd said he reached out to local and federal law enforcement agencies in the US, but little was done other than record his complaint.

Cybera found that his money had ultimately been transferred to accounts at Binance, OKX, and an Australian crypto exchange called Independent Reserve.

So in July, Todd contacted a crypto tracing non-profit in Canada called Cybera. It traced the on-chain journey through multiple wallets where it was co-mingled with the funds of other victims.

According to its report for Todd, Cybera found that his money had ultimately been transferred to accounts at Binance, OKX, and an Australian crypto exchange called Independent Reserve. Cybera contacted the exchanges to no avail.

OKX and Independent Reserve declined to comment. Binance did not respond to a request for comment.

For all three men, the aftermath has been painful. It isn’t just the financial toll.

“I have no other choice but to accept the fact,” Tony said. “I still have to continue with the rest of my life, but sometimes, as soon as I think of it, I feel down.”

Glenn says he needs to take sleeping pills and he’s suffering from high blood pressure.

“It’s awful. Before, I was confident to do everything and work hard and be successful. But my confidence is…” He doesn’t finish the sentence.

Have you been the victim of pig butchering or another crypto scam? Get in touch at callan@dlnews.com.