European Investment Fraud

Executive Summary

An investment platform marketed as a regulated European asset manager collected deposits from retail investors across several member states. Deposits were accepted by bank transfer and by stablecoin. Withdrawals were processed normally for a period, then delayed, then refused with escalating documentation requirements.

SEQRIA was engaged to reconstruct the operational structure behind the platform, document the flow of investor funds, and produce an evidentiary package suitable for submission to banks, payment institutions and national authorities.

Investigation Scope

Scope was defined narrowly at intake to keep the work evidentiary rather than speculative.

• ›Reconstruction of the deposit chain from investor account to receiving institution
• ›Identification of the corporate entities, domains and payment intermediaries used
• ›Documentation of the marketing claims and regulatory representations made to investors
• ›Preparation of a submission-ready evidence package per affected jurisdiction

Technical Challenges

The platform operated behind rotating domains, each with a short registration lifetime and privacy-shielded registrant data. Investor dashboards displayed synthetic balances with no relationship to any real custody position, so account statements had no evidential value on their own.

Deposits were split across a fiat rail and a stablecoin rail, which meant two entirely separate evidentiary methods had to be reconciled into one timeline.

Investigation Methodology

Work followed the standard SEQRIA investigation lifecycle: intake and scoping, source collection, reconstruction, attribution, corroboration, and reporting.

• ›Structured intake of investor documentation with hash-verified preservation at receipt
• ›Passive infrastructure analysis of the domain and hosting footprint
• ›Corporate registry and regulatory-register checks across the relevant jurisdictions
• ›Timeline reconstruction correlating marketing activity with deposit windows

Blockchain Analysis

The stablecoin deposit rail was reconstructed from the public ledger. Deposit addresses issued to investors were shown to be single-use forwarding addresses consolidating into a small number of aggregation wallets within minutes of receipt.

Consolidated balances were then moved through a predictable pattern of intermediate hops before reaching deposit addresses attributable to centralised services. Attribution was recorded at the service level only; no individual identity was inferred from on-chain data alone.

Evidence Collection

Every artefact was captured with a timestamp, an acquisition method note and a cryptographic hash, then recorded in a chain-of-custody log. Web material was preserved as rendered captures alongside raw responses so later takedowns could not remove the record.

• ›Hash-verified captures of platform pages, terms and marketing material
• ›Transaction exports with block heights and confirmation data
• ›Correlated fiat payment references supplied by affected parties
• ›A written methodology annex describing how each artefact was obtained

Findings

The investigation established that the platform's regulatory claims did not correspond to any entry in the registers it referenced, that investor deposits were consolidated rather than held in segregated custody, and that the fiat and stablecoin rails converged on the same operational cluster.

Findings were stated at the level the evidence supported, with explicit confidence notes where attribution rested on behavioural patterns rather than direct records.

Outcome

A structured evidence package was delivered to the affected parties and their legal representatives, formatted for submission to the receiving institutions and to national authorities in each jurisdiction. Institutional follow-up remained with those bodies.

No outcome is promised in any engagement. The deliverable is a documented, verifiable evidentiary record.

Lessons Learned

Investor-side documentation collected in the first days after a withdrawal refusal is disproportionately valuable, because it predates the removal of platform material.

• ›Preserve dashboards and correspondence before contacting the platform
• ›Record payment references exactly as they appear on the bank statement
• ›Treat platform-issued balances as claims, not as evidence of custody