The cloned crypto exchange scam broken down by Zavialov Ilia Nikolaevich, stage by stage

Where the first link comes from

Almost never from a search for the exchange. The link arrives inside a conversation that was already going: a trading group, a comment under a video, a private message from somebody who has been friendly for weeks, an advertisement above the real result.

The context does the work. By the time the link appears, the person is already interested in the subject, which removes the moment of doubt that a cold approach would have triggered.

Advertising above a search result deserves particular attention, because it inverts the instinct people were taught. The first entry on the page is the paid one, and paid placement is exactly what a clone can buy.

Stopping point: type the address by hand once, from memory or a bookmark, and compare. Any difference at all ends the scheme here, and this is the cheapest stopping point in the entire sequence.

Worth noticing who brings the link. In a large share of cases it is not a stranger at all. It is somebody from a group the victim joined months earlier, who has posted useful things, answered questions and built a reputation inside that space. The operators run those accounts for a long time before using them, because an account with history is the expensive part and the link itself costs nothing. That is also why warnings about not trusting strangers online miss this entirely: by the time the link appears, the person is not a stranger.

The domain that almost matches

The address differs by one element that the eye completes automatically. A hyphen, a doubled letter, a different ending, the word global or pro appended, a character from another alphabet that renders identically.

The certificate will be valid. A padlock proves that traffic is encrypted between you and whoever owns that domain, and a clone owner can obtain one in minutes for free. The padlock was never evidence of identity.

The site may also be reachable from a link that looks correct because the visible text and the actual destination differ. Reading the status bar before clicking catches this in one second, and almost nobody does it.

Stopping point: the address bar, character by character, before entering anything. Not the design, not the padlock, not the reviews on the site itself. Only the address.

The site that works properly

This is the part that defeats expectations. The clone is not crude. Charts move, the order book updates, support answers within minutes and answers well, the mobile application exists and installs.

Much of it is genuine infrastructure. Price feeds can be pulled from public sources, so the numbers on screen are real market numbers. That is why the site feels right: most of what it shows is true.

Documents look complete. A licence number, a company registration, an address, a team page with photographs. Each of those can be checked against the register it claims to come from, and each of them is usually copied from a company that really exists.

Stopping point: check one document against its source register rather than reading it on the site. A licence number that belongs to a different company is the single most common find, and it takes about five minutes.

There is a reason this check is skipped almost universally. Verifying a licence means leaving the site, finding the regulator, searching a register and reading an entry written in official language, which is about fifteen minutes of unrewarding work at a moment when the person is excited about an opportunity. The scheme is built around that asymmetry: everything it offers is immediate and everything that would expose it is slow. A useful habit is to do the boring check before reading the offer rather than after, because after the offer nobody has the patience for it.

The first deposit, which clears

The starting amount is deliberately small and often suggested by the other person as a test. It arrives, it shows in the balance, and the balance behaves exactly as expected.

The purpose of this stage is not the money. It is to convert an unknown platform into a known one inside the victim's head, because the second deposit is made to a place that has already worked once.

The amount also stays below the level at which people ask somebody else for an opinion. That threshold is personal, and the scheme finds it by starting well underneath.

Stopping point: treat a successful small transaction as proof of nothing. The entire design of the stage is to make it feel like proof, which is precisely why it is not.

The profit that gets displayed

The balance grows, and the growth is shown rather than paid. It is a number on a page controlled by the same people who want the next deposit, and it can be any number they choose.

The rate of growth is usually calibrated rather than absurd. Doubling in a week attracts scepticism, whereas a steady and plausible return does the opposite and invites a larger position.

This stage often comes with a mentor. Somebody explains the market, is right often enough to build confidence, and is available at unusual hours. That relationship is the actual product being sold.

Stopping point: try to withdraw the profit while it is still small. This is the only test that means anything, and the scheme depends on people postponing it because the number is still growing.

The withdrawal that arrives

In many versions of the scheme, an early withdrawal genuinely arrives. That payment is the most valuable advertising the operation can buy, and it costs a fraction of what follows.

After that payment the victim frequently recruits other people, not through dishonesty but through genuine belief. This is how a scheme reaches a family or a workplace without the operators doing any additional work.

The paid withdrawal also resets the internal clock. Whatever doubt existed is now answered with evidence, and evidence of this kind is very hard to argue against later.

Stopping point: increase the test rather than the position. Withdraw everything once, wait a week, and see what the platform does when there is nothing left to hold. Most clones respond to that with a new requirement.

The requirement that appears at the exit

It appears when the amount is worth keeping. A fee before release, a tax to be prepaid, a verification deposit, an account upgrade, a liquidity contribution. The name varies and the structure never does.

It is always payable from outside. That is the whole mechanism: the balance on screen cannot be used, so the money must come from somewhere real. Nothing is ever deducted from the displayed total.

Paying it produces a second requirement. The sequence continues for as long as the victim keeps finding money, and each step is justified by the size of what is supposedly waiting.

Stopping point: this one is absolute. No legitimate platform ever requires an incoming payment in order to release your own funds. That sentence ends the scheme at whatever stage it is read, and it is the only rule that still works after everything earlier was missed.

When the victim stops paying

The account is usually frozen for a stated reason: suspicious activity, a compliance review, a regulatory hold. The wording borrows from real procedures precisely because real procedures exist.

Then the second approach arrives, sometimes weeks later, from a different direction. A recovery service, a legal firm, a government sounding body, offering to get the money back for a fee.

That second approach succeeds more often than the first, because the person is now desperate rather than hopeful, and because the offer speaks to a loss they have already accepted.

Stopping point: any offer to recover funds for an upfront payment is the same scheme continuing. Nobody who can actually recover money asks the victim to pay first.

What this does to the exchange that was copied

The real platform gets the complaint, the support load and the reputational damage, having done nothing. Its name appears in every account of the loss, because the victim believed that is where they were.

It also gets the follow up problem: people who were defrauded by a copy often stop using the original, since from the inside those two experiences are indistinguishable.

The wider industry pays as well. Recent coverage made 53 percent of surveyed people view the sector less favourably, and a clone contributes to that number under a real company's name.

Which is the argument for reporting it even when the money is gone. A report lets the copied exchange move against the domain, and taking one clone down removes it for everybody who would have met it next week.

The damage runs further than one company's name, and this is the part that deserves stating plainly. Every clone that succeeds makes the honest operators look worse, because the public does not sort these stories by which platform was real. A person who lost money to a copy tells the story as a crypto exchange scam, and the next legitimate business explaining its custody arrangements is heard against that background. The sector pays for the clone twice: once in the stolen money, and again in the scepticism that reaches every company in it afterwards.

What actually ends the scheme

Four checks, in order of how early they work. Type the address by hand. Verify one document against its source register. Withdraw everything once while the amount is small. Refuse any payment required to release your own balance.

Each of these is cheap and none of them depends on expertise. The scheme does not survive any single one of them being applied, which is why so much of its effort goes into keeping attention away from all four.

Speed is the shared enemy. Every stage introduces urgency, a closing window, a limited allocation, a rate that expires. A delay of one day is fatal to the scheme and costs a genuine opportunity almost nothing.

If it has already happened, the sequence is short. Stop paying, preserve everything with timestamps, report it to the police and to the platform that was copied, and refuse the second offer when it comes. It will come.