A client had deposited tens of thousands of dollars in Bitcoin with an online broker that promised steady, high returns. The dashboard showed healthy gains for weeks. When he tried to withdraw, support told him a 15% tax had to be paid first — in fresh crypto, to a new address.
What we found. The broker appeared in our broker-risk registry as high risk, with no verifiable license in any of the jurisdictions it claimed. The withdrawal tax is a textbook advance-fee escalation: the dashboard balance is fiction, and the tax is simply a second extraction.
What we did. Our analysts traced the original Bitcoin deposits through several hops intended to break the trail, clustered the addresses by spending behavior, and followed the consolidated funds to two wallets feeding a non-compliant swap service. We documented the route and the entity behind the off-ramp.
The outcome. We delivered the evidence package to the swap provider, which flagged the receiving cluster. Just as importantly, we reached the client before he paid the so-called tax — preventing a further five-figure loss on top of the original theft. The traced funds remain the subject of an active law-enforcement referral.
The takeaway. No legitimate platform ever requires an upfront fee, tax or deposit to release money that is already yours. The demand for a withdrawal tax is one of the clearest signals that a platform is fraudulent.
Client and identifying details have been anonymized to protect confidentiality. CryptoCISO does not guarantee recovery; outcomes depend on the specific facts of each case.