Robbed! (1) The Biggest Crypto Scams – and How You Could Have Spotted Them Beforehand

In the summer of 2021, the lending platform Celsius offered up to 17.78 percent interest a year on crypto deposits. About 1.7 million customers had money there. In June 2022, Celsius stopped all withdrawals, and bankruptcy followed in July. The platform owed its users more than 4.7 billion dollars.

Founder Alex Mashinsky was sentenced to twelve years for fraud in May 2025.

The interesting question is not how it ended. It is: could you have seen it coming? With Celsius, you could. On 23 September 2021, Kentucky's financial regulator ordered Celsius to stop its business in an emergency order, and New Jersey followed the same month. That was nine months before withdrawals stopped, public and dated.

So before you face the next promise of returns, it is worth knowing what the biggest cases looked like beforehand.

Why smart people paid in

In hindsight, every scam looks clumsy. Beforehand, it rarely did.

Celsius had an explanation that sounded reasonable: deposits would be lent to others, and the interest would go to customers. That is roughly how a bank works, too.

Other cases had other strengths. With FTX, the money sat on an exchange, not an investment platform, and no return was promised at all. Bitconnect had a supposed trading bot that profited from price swings. OneCoin had packages and a price display that only went up. PlusToken could only be joined through a member's referral, meaning through someone who was already in. And the pyramid schemes really did pay out at first: whoever joined early got money, out of the deposits of those who came later.

A scam works because it pays out at the start.

So what did the biggest cases still have in common?

The ranking: billions gone, little back

The 15 biggest fraud cases in which the operators themselves were the perpetrators. Theft by hackers comes in Part 2.

Amounts as measured by each source, so not directly comparable. "Value of the coins today" only where the coin amount taken in is documented, prices of 13 Oct 2026. n/a = not documented.

Two things stand out. First, measured in coins, the old cases are huge today. What PlusToken took in up to June 2019 according to the verdict, mainly 314,211 BTC and 9.17 million ETH, would be worth 51.4 billion dollars today. The court put it at a minimum of 2.2 billion back then.

Second, little comes back. In only four of the fifteen cases is any money to victims documented at all.

The bigger the scam, the less the damage depends on the amount and the more on the outcome in court.

But how could you have spotted these cases beforehand?

The warning was in the offer, not in the code

For each case, the warning signs that were publicly visible before the collapse were checked.

● = publicly documented before the collapse. – = not applicable or not documented in the research.

The pattern is clear:

• In 9 of 15 cases, a fixed return or money for recruiting was part of the offer itself.
• In 14 of 15 cases, no customer could check whether the money was really there. The exception is Forsage, whose contract sat publicly on the blockchain. It showed openly that later deposits paid the earlier participants.
• In 5 of 15 cases, a regulator had already warned.

The returns alone say a lot. According to the Texas emergency order, Bitconnect advertised "up to 40 percent interest per month". HyperVerse promised 0.5 to 1 percent a day. Over a year, that is a multiple of the stake. No exchange, no fund and no loan pays that for long.

Then there was recruiting. PlusToken could only be joined through a referral. According to the verdict, the system had up to 3,293 levels. At OneCoin, co-founder Sebastian Greenwood received 5 percent of global monthly sales. If your income depends on how many people you bring in, the new ones pay the old ones.

And the source of profit was always a story nobody could check: a trading bot at Bitconnect and Mirror Trading, an "arbitrage dog" at PlusToken, mining at HyperVerse. According to the court, the "arbitrage dog" did not exist. OneCoin did not even have a blockchain. The company set the price itself, from 0.50 to 29.95 euros.

You did not have to read code to find the warning sign. It was in the advertising.

And the cases without a promise of returns, FTX and Thodex?

With exchanges, the warning is in the balance sheet

FTX did not promise a fixed return. Even so, its biggest problem was public nine days before the collapse. On 2 November 2022, Ian Allison at CoinDesk published the balance sheet of Alameda, the trading firm of FTX founder Sam Bankman-Fried. Of its 14.6 billion dollars in assets, 5.8 billion were FTT. That is the token FTX issued itself.

A trading firm whose assets are 40 percent the in-house token of its sister exchange stands on its own promise. According to the verdict, FTX customer money had flowed to Alameda. Bankman-Fried was found guilty on all seven counts and sentenced to 25 years.

Celsius was similar. The platform had its own token, CEL. At Bitconnect it was BCC, at WOTOKEN WOR. At Thodex in Turkey, JPEX in Hong Kong and QuadrigaCX in Canada, customer money was not kept separate from the company's.

When a platform measures its safety in its own token, it measures nothing.

Shouldn't regulators have stopped this?

Where regulators warned, it was online months in advance

In five cases, a regulator warned before the collapse:

• OneCoin: Finnish police warned in April 2015, Bulgaria's financial regulator in September 2015. Money was collected until the end of 2016.
• Forsage: The Philippine securities regulator ordered it to stop in September 2020. The US SEC sued in August 2022.
• Celsius: Kentucky and New Jersey stepped in in September 2021, nine months before withdrawals stopped.
• JPEX: Hong Kong's regulator SFC put JPEX on its warning list from July 2022. The exchange collapsed in September 2023.
• Bitconnect: Texas and North Carolina issued emergency orders in early January 2018. Twelve days later, Bitconnect shut down.

So the range runs from twelve days to over a year. In ten cases, the research found no warning beforehand. You cannot rely on regulators alone.

A warning list is no proof of safety. But an entry on it is proof of danger.

And if it has already happened: what do you get back?

You get little back, and rarely your coins

FTX customers got the most back. They receive 96 to 120 percent of their claim, depending on the creditor class. That sounds like a good ending. The catch: claims count in dollars at the price on the day of bankruptcy, 11 November 2022. Bitcoin stood at 16,871 dollars then and at 83,223 today.

Anyone who had 1 BTC on FTX and gets 105 percent back can buy about 0.21 BTC with it today.

The other cases look worse:

• Celsius: about two thirds of claims in the first three distributions. A fourth, of 344 million dollars, began in February 2026.
• QuadrigaCX: 46 million Canadian dollars recovered, against at least 169 million in losses.
• Bitconnect: 17.6 million dollars for about 800 victims, against 2 to 2.4 billion in damages. That is under one percent.
• PlusToken and WOTOKEN: The seized coins went to the Chinese state treasury. Victims got nothing.
• OneCoin, Forsage, HyperVerse: The main suspects are fugitives or have not been extradited. The research found no program for victims.

So what you get back hardly depends on the size of the case. It depends on where it plays out. A US bankruptcy with assets pays. A criminal case against fugitive founders pays nothing.

Even if you get everything back, you do not get your coins back.

Are these old stories?

Today's fraud no longer needs a platform

The big pyramid schemes shaped the years up to 2022. Today, fraud looks different.

The FBI's Internet Crime Complaint Center, IC3, counts the losses people in the US report. For crypto, it looks like this:

FBI IC3, annual reports. Only reported cases in the US.

In five years, reported losses have grown almost fiftyfold. More than half of all losses reported to IC3 now involve crypto.

The largest item in 2025 was crypto investment fraud at 7.23 billion dollars. This mainly means so-called pig butchering. The name describes the method: the victim is first "fattened" over weeks with trust and fake profits, and then "slaughtered".

According to IC3, it usually goes like this:

1. Someone contacts you by text message, on social media or a dating app.
2. The conversation moves to a messenger. It is about friendship, often more.
3. At some point comes a tip about an investment, with access to a platform that looks real and shows profits.
4. You pay in more, sometimes with a loan.
5. When you want to withdraw, taxes or fees suddenly fall due.
6. Afterwards, supposed helpers get in touch offering to recover your money. That is fraud, too.

According to IC3, many of these cases are run by organized gangs in Southeast Asia that use victims of human trafficking as forced labor. In 2025, the FBI contacted 3,780 people it suspected were being defrauded. 78 percent of them did not know they were being scammed.

You used to have to find a platform that would defraud you. Today, the fraud finds you.

The pattern from the ranking still holds: a return that is too good and a profit you cannot check. Only now the offer comes from a person instead of a company.

"Hindsight is 20/20": usually one question beforehand would have done

"Hindsight is always 20/20. Beforehand, it all looked legitimate."

That is partly true. FTX made no promise of returns and had no regulator warning. Anyone with money there would have had to read Alameda's balance sheet, and that was public only nine days before the end. In some cases, crucial facts only came out afterwards: according to Guardian Australia, HyperVerse's supposed CEO was a paid actor.

But in nine of fifteen cases, no insider knowledge was needed. The fixed return was on the website. The commission for recruiting was in the compensation plan. And that the trading bot could not be checked was clear to anyone who asked.

Hindsight is only needed by those who did not ask beforehand.

Which questions are those?

Before you deposit: five questions

1. Is there a fixed return, per day, per month, or well above the market? Then ask who pays it. No legitimate business guarantees percent per day.
2. Do you earn from bringing in others? If recruiting is part of the income, the new ones pay the old ones.
3. Can you check the source of profit yourself? "Trading bot", "arbitrage", "AI trading" or "mining" without proof is a claim, not a profit.
4. Can you check whether your money is there? Is there proof of reserves, are customer funds kept in separate accounts, and how much of the collateral is the platform's own token?
5. Who brought you here, and what does the regulator say? If the tip came from someone you only know online, that is a warning sign. And look up the provider in the warnings of your financial regulator.

If you get stuck on one question, that is already the answer.

A good offer survives questions. A scam does not.

Not every high return is fraud, and a platform without these warning signs is not automatically safe. The five questions sum up what the biggest documented cases had in common beforehand.

That leaves the other half of the risk. What if the operator does not rob you, but a third party robs the operator? That is Part 2: the biggest crypto hacks and where your money is most likely to disappear.

FAQ

Why is Terra/Luna missing? Terra is a borderline case. Its collapse in May 2022 wiped out 40 to 60 billion dollars in market value. That is lost value, not money collected and embezzled. Founder Do Kwon still pleaded guilty to fraud and was sentenced to 15 years in December 2025. In doing so, he admitted that a trading firm had propped up UST's dollar peg in May 2021.

Why do the amounts differ so much? Courts, indictments, media and analytics firms measure differently: at deposit value, at the lowest price, or as claims. For Thodex in Turkey, media cite about 2 billion dollars in deposits, the indictment 356 million lira in damages. That is why every amount names its source.

I think I am affected. What should I do? Do not pay in anything more, not even a "fee" for the withdrawal. Save chats, addresses and transfers and report it to the police. And be careful with anyone who offers to recover the money for an upfront payment. According to IC3, that is exactly the second wave of the fraud.

How it was measured

Ranking by the amounts from the best available source in each case: verdicts, US Justice Department, SEC, CFTC, regulators, otherwise analytics firms or media, each named. Only cases in which the operators themselves were the perpetrators. Perpetrators are named only if convicted or after a guilty plea; defendants without a verdict remain unnamed, except the OneCoin founder wanted by the FBI. Today's values only where the coin amount taken in is documented, at Binance prices of 13 Oct 2026. Warning signs count only if publicly documented before the collapse. FBI IC3 figures are reported cases in the US and therefore a lower bound. Research on 13 Oct 2026.

---

Not investment advice, not a recommendation, not a forecast — historical patterns are no promise.

Study the Past — Improve your Future 🥋