Skip to main content

Criminals stole £9,693.80 from Crypto.com and ByteDance in just 3 working days - and they're still stealing


Introduction

Even after cybersecurity awareness campaigns and platform safety assurances, scammers continue to outmanoeuvre users-and often with the help of the very companies that claim to protect them.

A staggering £9,693.80 was stolen in just three working days using platforms such as Crypto.com and alleged connections to ByteDance, the parent company of TikTok.

Trust-based platforms are now being exploited.

The Scam Unfolded

The scam originated from two fraudulent websites:

The sites were clean, responsive, and deceptively professional. They featured the same design as Crypto.com, including:

  • Dashboards with fake data
  • Transaction reports that are false
  • Confirmation screens that are realistic


Scammer INTLBTCS China Chinese BitWell TikTok  Crypto.com Telegram WhatsApp

In order to increase credibility, scammers falsely claimed  ByteDance and  TikTok referral links. In an effort to confuse users with familiar Chinese tech terms, they even claimed affiliations with  ByteDance’s Content Quality and User Experience Platform (Byte Jumping's Content Quality and User Experience Platform (节跳动内容质量与用户体验平台)).

 

 

Fake Scammers INTLBTC Crypto.com TikTok Telegram intlbtc WhatsApp Scammers

 

Communication Channels Used

The following aliases were used to contact victims via Telegram Messenger and WhatsApp:

  • @Aisha89895
  • @Marchesi668 (aka Livia Marchesi)
  • @Alexandria96888 (also using the name Alexandria and Carter Pattinson)
  • @Victorie883

Aisha with Telegram ID @Aisha89895-Telegram
Telegram ID @Aisha89895 for Aisha

Livia Marchesi with Telegram ID @Marchesi668

Telegram ID @Marchesi668 for Livia Marchesi
Alexandria with Telegram ID Alexandria96888

Telegram ID Alexandria96888 for Alexandria

Carter Pattinson Telegram ID @TG06Carter-Telegram
Telegram ID @TG06Carter for Carter Pattinson

Vicorie Telegram ID @Victorie883
Vicorie  Photo 02 Telegram ID @Victorie883
Vicorie  Photo 03 Telegram ID @Victorie883
Vicorie  Photo 04 Telegram ID @Victorie883
Vicorie  Photo 05 Telegram ID @Victorie883
Telegram ID @Victorie883 for Vicorie


Their methods of operation were as follows:

Telegram Messenger
WhatsApp using the following numbers: 

  • +44 7349 041315
  • +44 7349 558238
  • +44 7562 707634


Initially, the accounts would be used to lure targets with small, seemingly harmless transactions. Once trust was established, increasingly large payments would be demanded.

“This is the final top-up,” victims were told.
But it never was.

The last transfer before suspicion was raised was £4,555. In the next minutes, more money was demanded.


Crypto.com: The Silent Enabler?

It appears that the entire scam was facilitated through Crypto.com, which processed over £9,693.80 in payments over three business days without raising any alerts, holdings, or flags.

What happened was as follows:

  • There were no alerts triggered for high-value payments to anonymous wallets.
  • Despite suspicious behaviour, fraud detection systems did not intervene.
  • There is no security verification or intervention from the platform.
  • After the victim reported it, there was no acknowledgement or assistance offered.

 

Screenshot exposing Crypto.com, intlbtcs.uk, and ByteDance-related TikTok, Telegram, and WhatsApp scammers impersonating Bitwell

Evidence of coordinated scams involving Crypto.com, intlbtcs.uk, and ByteDance via TikTok, Telegram, and WhatsApp targeting Bitwell users


Visual evidence of the fourth scam link involving Crypto.com, intlbtcs.uk, and ByteDance-operated platforms using TikTok, Telegram, and WhatsApp to impersonate Bitwell and deceive users


Fifth captured screenshot showing how scammers exploit Crypto.com, intlbtcs.uk, and ByteDance platforms via TikTok, Telegram, and WhatsApp to impersonate Bitwell and defraud users


Sixth image revealing continued abuse of Crypto.com, intlbtcs.uk, and ByteDance platforms via TikTok, Telegram, and WhatsApp in scams impersonating Bitwell to steal from users

What the Victim Did Right

Everything was gathered and submitted by one victim:

  • Wallet addresses
    • 0xeaa9323c8bcb05fca7a8a11e13883e92a8da4c35
    • 0x15f0d9e5ebd668f9c6f69e89b769288657c05e7b
  • Chat transcripts
  • Telegram usernames
  • Phone numbers
  • Screenshots of transactions

However, Crypto.com provided the following:

  •          No follow-up
  •          No reimbursement
  •          No official response

· Multiple victims reported similar patterns, with Crypto.com serving as the common facilitator.

Key Findings

  1.  Payments were processed by Crypto.com without any intervention or flagging.
  2. Users exhibiting abnormal payment behaviour did not receive warnings.
  3. Crypto.com branding was used by scammers to mislead users.
  4. Crypto.com ignored reports submitted to it.
  5. The scammers were able to carry out fake advertisements on TikTok
  6. With Telegram Messenger, scammers were able to operate on a massive scale.

 

Graphic warning that states "This is not the real Crypto.com" with a yellow triangle exclamation icon, highlighting fraudulent use of Crypto.com branding linked to intlbtcs.uk and scams across TikTok, Telegram, WhatsApp, and ByteDance platforms impersonating Bitwell.


What Victims Are Demanding

There are now public demands from victims:

  • All known wallet addresses should be investigated and flagged.
  • Any traceable funds should be suspended or frozen.
  • Provide compensation or partial financial responsibility.
  • Improve internal fraud detection systems to prevent future incidents.

 “If they can’t stop it, they should at least own up to it.”

Final Warning: Don't Be the Next Victim

A platform's popularity does not guarantee protection. Crypto.com and similar platforms must do better until they do.

·         “Just because it's a big name doesn’t mean it’s safe.”
Don’t trust platforms that remain silent in the face of fraud.

This is a call to action for Crypto.com

  1. Fraudulent flaws should be identified in internal systems.
  2. Pursue crypto criminals in collaboration with law enforcement.
  3. Address the repeated reports from victims in the public sphere.
  4. People affected by the disaster should be provided with recovery paths or compensation funds.

Stay Safe in the Crypto World

Take these steps if you suspect fraud or have been affected by it:

  • Action Fraud UK should be notified immediately
  • Crypto transactions should be frozen by your bank
  • Publicly share wallet IDs and screenshots to warn others

Author

 Ziggy Rafiq's article sheds light on the growing threat of online scams targeting vulnerable individuals, specifically veterans. Ziggy highlights the need for stronger security, vigilance, and victim support systems based on the story of a disabled British Army veteran who lost a significant sum to a sophisticated scam. In his opinion, companies like Crypto.com and ByteDance should take responsibility in preventing scams, and readers should stay informed and proactive to protect themselves and their loved ones.





Comments

Most Viewed Ziggy Rafiq Blog Posts

How to Truncate String in C#

  Overview In today’s post, I am writing about one of the fundamental aspects of C# and as programmers, we should use this approach I have realised throughout my life as a software engineer that not everyone knows the most basic approaches or how to use them efficiently. Truncating a string in C# means reducing the length of a string to a specified number of characters, typically by removing characters from the end of the string. This is often done when a string is too long to be displayed or used in a specific context and needs to be shortened to fit. Ley says if we have a string that is 100 characters long, but we only want to display the first 50 characters, we will truncate the string to a length of 50. There are several ways to truncate a string in C#, including using the Substring method, StringBuilder, and LINQ. A simple example of this is below, we're creating a longString variable with a long string value. We're also defining a maxLength variable with a value of 20...

A Complete Guide to Using GUIDs in C# with Code Examples

  Overview In this post, we are looking at GUIDs (Globally Unique Identifiers), which are widely used in C# for generating unique identifiers for objects, entities, and resources in a system. In this post, we'll explore the basics of GUIDs in C#, their advantages, and how to convert strings to GUIDs. In this post, we have used Guid Generator to create the GUID from the following URL Address https://guidgenerator.com/ What is GUID GUID (Globally Unique Identifier) in C# is a 128-bit value that is used to identify objects, entities, or resources in a unique manner across different systems and applications. It is also known as UUID (Universally Unique Identifier) in some other programming languages.   GUIDs are generated using a combination of unique factors such as the MAC address of the network adapter, the current time and date, and a random number. The resulting GUID is a string of 32 hexadecimal digits separated by hyphens, such as "b86f2096-237a-4059-8329-1bbcea72769b...

ASP.net Core Services Lifetime Differences Between Using AddTransient, AddScoped and AddSingleton Services

  ASP.net Core Services Lifetime Differences Between Using AddTransient, AddScoped and AddSingleton Services Overview In this blog post, I will be explaining to you the ASP.net core Service Lifetime and will be explaining to you what is the difference between them and which one can be a risk to a memory leak if used incorrectly. AddTransient, AddScoped, and AddSingleton are dependency injection services in ASP.NET Core. The differences between them are as follows below. AddTransient: A new instance of the service is created every time it is requested. AddScoped: A single instance of the service is created per request within the same scope. AddSingleton: A single instance of the service is created for the entire application lifetime. In general, it's recommended to use AddScoped for services that are stateful and AddTransient for services that are stateless or have a short lifetime. AddSingleton is usually used for services that are expensive to create or only need to be crea...