On April 15, the internet was abuzz with news of Ponzi platform CBEX that claimed to double investors’ money in 30 days through an AI-powered trading bot. CBEX lured investors with promises of great returns and “no trading skills or experience” required. However, it has been an elaborate scheme in the making. CBEX, or “CryptoBridge eXchange,” an exchange platform that reportedly had claims to Chinese origins, has long been in partnership with crypto trading group Super Technology (ST) Team. Super Technology Team had reportedly been operating in physical offices in Nigeria—under the brand, “Smart Treasure Operation Centre”—including one recently opened in Ibadan and Lagos. TechCabal could not verify the extent of its ties to Super Technology, but CBEX marketed its platform on the technology that Super Technology supposedly provided. An image of ST’s alleged office in Ikeja, Lagos. Taken from their Telegram group. While the CBEX website is still active at the time of this report, Super Technology has deleted traces of its internet presence, including its social media platforms. A screenshot taken from CBEX’s homepage. The promise of trading with AI was false because both CBEX and Super Technology had no real product, and in the unlikely case that they did, both companies had no history of operating a crypto trading business before late 2024. This was the first red flag from CBEX. Additionally, the platform has used multiple domain names since it started operating, including www.cbex9.com, www.cbex39.com, www.cbex38.com, www.cbex18.com, www.cbex1.com, and www.cbex.vip. All of them, except www.cbex9.com, are now inactive, likely due to reports of illegal trading activities. Currently, CBEX remains operative under https://cbex.cx. “The domain [cbex1.com] is tied to the same CBEX crypto scheme that crashed in Nigeria,” said Kassy Olisakwe, a senior blockchain developer and founder of AuroraWeb3. “They’re just using that domain name as a spare, they registered it in early March. They’ve been hopping between multiple domains to avoid getting blacklisted or caught.” USDT “bullion” wallets CBEX operates a highly elaborate scheme, combining multi-level marketing (MLM) with Ponzi techniques. Once a user registers on the platform, it asks them to invite others, known as “downlines”. However, whether they keep the referral loop spinning or not, users earn from compounded returns. A user who “invested” $100 in July 2024—the reported month CBEX became active—will have $25,600 in their account by March 2025, an oversized increase that even some legitimate fast-growing assets, like gold, are unable to match in the same period. When a user creates an account on CBEX, the platform assigns a USDT or Ethereum wallet where they deposit their funds. Shortly after, the platform moves the funds from the deposit wallets to intermediate wallet addresses that carry the money to other accounts. Through some digging, TechCabal traced some of these intermediate wallets to a CBEX-linked website: TLFZVNxiHkfcUQdzN1DJCjHegFQQ368888 TFo7GZvgdUU5gj41irQeH3NDR5FYWPssFQ THn25XKVoBXGSaFfYa6o9pU9Hf4sgtZNZM TKadxGap9adtWVztGkRfdvnAgb4JFopXxX We found those addresses on the website, www.cbex1.com, which, still active, contains USDT transaction records linked to CBEX. To verify the transaction trails, we used public blockchain explorer tools like Tronscan and Tokenview, which allow anyone to check wallet activity on the blockchain. TechCabal was unable to verify if the records showed the total live transactions being processed on the platform. At the time of this report, $145,266 has been moved from its main accounts—random USDT deposit addresses that CBEX generates for its users to deposit money—to its intermediate accounts. About $120,829 has been moved to other accounts. “Those transactions are from an API call they’re making to api.hv2365.com and they control it. They built their backend and database to disappear quickly. Because they’re using anonymous services, we can’t get the exact information of the people that registered CBEX. Even on plain whiteweb name searches, it comes back as ‘(namecheap)’,” said Olisakwe. Screenshot taken from the website, www.cbex1.com It is also likely that these amounts were more, and the transfer records on the website do not tell the full story. TechCabal investigated further. We traced how the money flowed immediately when a user deposited money on the platform. One of CBEX’s victims, who identified only as ‘Earth Laureate’ on Telegram, told TechCabal that she deposited $2,600 on CBEX on April 2, 2025, only days before the platform froze withdrawals. She deposited the sum from a Bybit wallet into the address, TC7nTFpBHp9j81521m5n76D6wsD4suUXrH, a TRON (TRC-20) blockchain address which holds the USDT stablecoin. Transactions on the address, TC7nTFpBHp9j81521m5n76D6wsD4suUXrH/Screenshot taken from Tokenview Transactions on the address, TC7nTFpBHp9j81521m5n76D6wsD4suUXrH/Screenshot taken from Tokenview After three hours, the funds were siphoned to another address, TB6pGj8FiR3XbXbE1th4cVHzASs8xXVL4p, one of the multiple intermediate addresses—likely a level-1 address. At the time of this report, this intermediate address held no USDT; however, it had received $64,591,317 USDT tokens (where 1 USDT = $1), and had sent out the exact amount of tokens. Transactions on the address, TB6pGj8FiR3XbXbE1th4cVHzASs8xXVL4p/Screenshot taken from Tokenview Upon further checks, the level-1 intermediate address frequently sent funds to a Bridgers cross-chain bridge address, TPwezUWpEGmFBENNWJHwXHRG1D2NCEEt5s, which held $422,241 USDT tokens at the time of this report. A bridge cross-chain account is used to move crypto assets between two different blockchains, like moving money from a bank in one country to a bank in another. Transactions on the address, TPwezUWpEGmFBENNWJHwXHRG1D2NCEEt5s/Screenshot taken from Tokenview The public name shows that the address, TPwezUWpEGmFBENNWJHwXHRG1D2NCEEt5s, is a Bridgers cross-chain bridge wallet/Screenshot taken from Tronscan.org From this bridge account, the funds are further obfuscated into different accounts and blockchains. Smaller amounts like $10,000 and lesser are then transferred into layer-2, layer-3, and layer-4 addresses to hide the origin of the money. This is known as “smurfing.” Transactions on the address, TPwezUWpEGmFBENNWJHwXHRG1D2NCEEt5s/Screenshot taken from Tokenview TechCabal examined another case of a CBEX user who managed to withdraw their money from the platform. The person, who asked not to be named, shared that they received $2,619.15 in USDT payment from the address, TY5yKqWoXRVaHYKNNkY2rf1UjkrLDF6323, on April 1, 2025. Transactions on the address, TY5yKqWoXRVaHYKNNkY2rf1UjkrLDF6323/Screenshot taken from Tokenview Transactions on the address, TY5yKqWoXRVaHYKNNkY2rf1UjkrLDF6323/Screenshot taken from Tokenview We traced the source of the funds used to pay the user to the address, TASdnkGdYsRxncjmJBUwKym7BDBFvLsyHM, which
Read More