← Hooked Scams

INTERCEPT CELL RESEARCH / HOOKED SCAMS · CASE 001

Case 001: coin-front.io

An X follower, a $700K humblebrag, and a Lithuanian-hosted PHP kit dressed up as a trading platform.

This case has two reads: a plain-language version for people who may have been contacted by the scam, and a technical readout for investigators and analysts.

This is a case file about a fake crypto trading site called coin-front.io. It's still online as I write this. A man calling himself Cory Bates messaged me on X (Twitter) and tried to walk me through depositing $5,000 onto it. I went along with the conversation on purpose, took notes, took screenshots, and then went and looked at the site itself.

Two reads on this page:

  • What happened is the plain-language version. Read this if you got messaged by someone like Cory, or if a friend or family member did, or if you just want to know how this kind of scam works.
  • Technical breakdown is for analysts and researchers. Same case, deeper dive, with infrastructure indicators, the platform's leaked admin API, and attribution to the kit vendor selling this thing as a turnkey product.

Either tab works as a complete read on its own.

Victim Readout

someone followed me on X. Then they DM'd me. Now they want me to send money to a "trading platform."

If that's the shape of what happened to you, what follows is what was probably going on.

the setup

A stranger named "Cory Bates" followed me on X. His profile looked normal: an aged account from 2011, a clean-cut headshot, a bio that mentioned "Bitcoin," a "Memento mori" header graphic. He had a few hundred followers and was following thousands of people. I followed him back.

Cory Bates X profile, joined March 2011, bio "Freedom · Jiu Jitsu · #Bitcoin", 405 followers and 3,221 following

The reason he followed me first matters. On X, if a stranger DMs you without you following them back, the message lands in a hidden "message requests" folder almost no one checks. By following first and waiting for a follow-back, he could DM me directly and the message would land in my main inbox. Following first is the entry fee. After that, he had a clear channel to me.

the slow conversation

He didn't pitch me anything for days.

  • Saturday: "Hello."
  • Sunday: "How is your trading going? Hope you are wining your trades?"
  • Monday: "From a scale of 1-10 how would you rate your trading skills?"

Three days of DMs: Saturday "Hello", Sunday a friendly trading check-in, Monday a 1-10 self-rating question

That's not a sales pitch. It's a friendly check-in over a long weekend. The slowness is the point. Real con artists know that pitching too fast feels like a pitch. By stretching the conversation across days, they train you to expect a casual relationship instead of a sale. By the time the money question comes up, it doesn't feel like a sale, it feels like a friend giving you a tip.

The Monday question, "rate your skills 1 to 10, do you buy and hold or trade actively," looks like small talk. It isn't. He's bucketing me. People who say "I'm a beginner" get one script. People who say "I've been doing this for years" get a different one. He needed the answer before he could pick which version of the pitch to send.

the pitch

On Tuesday, here it came.

"I've found success with stocks trading and that helped me generate more than $700,000 in trading profits during the months of 2025. Recently, I'm Working on daily trading crypto and making simple earnings as low as $60k after a week of trading."

That's the pitch. Three things to notice:

  1. Big specific numbers from nowhere. $700,000 in 2025. $60,000 a week. There is no source. There is no audit. There are no screenshots from a real broker. Just the numbers, dropped into a friendly chat. Specific numbers feel real. They are designed to.
  2. The "you make money in any direction" line. This is a classic lie of investing scams. It's true that you can technically make money on the way down (by short-selling), but it is not easier than making money on the way up. Anyone telling you otherwise is selling you something. In real markets, more than half of active day-traders lose money. You don't hear that on Cory's pitch.
  3. A grammar that's almost-right. "I advice my followers." "You loss when the market is going down." "Wining your trades." Not bad enough to be a robot, just bad enough to be the actual person on the other end, somewhere, typing on a phone. That's important: there is a real human running this. Probably running thirty of you at the same time.

I told him I might want to start with $5,000. He immediately quoted me back "$5,000 turns into $20,000 in 3 weeks." A 4x return in 21 days.

Cory's reply: "you can startup small with $5000 and generate profits returns of up to $20,000 or more depending on how great the trading signal comes in after 3 weeks of trading"

No real investment does that. Anyone who says so is lying. If a real money manager could quadruple your money in three weeks, they would not be DMing strangers on X. They would be running a hedge fund and turning away clients.

After he had the amount ($5,000), the exchange ($Coinbase), and a confident-sounding investor on the line, he sent the link:

"Firstly register with Coin-Front.io to get an account all setup and then get back to me so I can direct you through."

coin-front.io is the fake platform. It's the whole point of the conversation. Everything before it (the follow, the slow chats, the $700K humblebrag, the bucketing question) was scaffolding to get you to type that URL into your browser.

what the platform looks like

If you go to coin-front.io, you'll see a clean landing page. Nice photo of a guy at a TradingView desk. Live ticker scrolling at the bottom showing real Bitcoin and Ethereum prices. A button that says "Start Investing." It looks legitimate. It is not.

Here is how I know:

  • No regulator. Real brokers in the US have to be registered with the SEC, FINRA, or the CFTC. In Canada, the IIROC. In the UK, the FCA. They show that registration in the footer with a real license number you can look up. CoinFront has none of that. There is nothing to look them up as.
  • A "Skip" button on identity verification. When the site asks you to upload your driver's license, there is a "Skip" button right there. Real brokers cannot let you skip ID verification, it's against the law. Only fake ones do.

CoinFront "Verify Your Identity" page with an Upload button and, right below it, a Skip button

  • A signup form that asks for everything. Email, password, full name, mobile number, date of birth, full home address, country. A real broker collecting all of that has a privacy policy and a regulator who will take their license away if they misuse it. CoinFront has neither.
  • A "your account is pending verification" wall the moment you sign up. The point of this wall is to send you back to Cory, who will warmly walk you through "funding your account" so trading can begin.

the dashboard is a video game

This is the part most people miss, so I want to spell it out plainly.

When you "deposit money" on a site like CoinFront, the money is gone the second it leaves your wallet. It does not sit on the platform. It does not get traded. It is not invested in anything. It moved straight to a Bitcoin or Ethereum address the operator controls, and the operator immediately moved it again to keep you from clawing it back. There is no pool of customer funds anywhere. There is no broker. There are no "trades." All of that ended at the moment your transfer confirmed.

What you see after that is a website the scammers entirely control. They are the ones who decide what number shows up on your dashboard. They type those numbers in. So the very first thing they do, after pocketing your money, is edit the dashboard to show you that the money is still there, and start adding fake gains on top of it. Day 1: your $5,000 turned into $5,400. Day 4: $6,200. Week 2: $9,800. Week 3: $14,000. None of it is real. The operator is sitting in front of an admin panel typing those numbers in, the same way a kid would edit their score in a video game. The graph going up, the trades you "won," the green percentages, all of it is screen paint. You can refresh the page and watch it move, and it still won't be real.

The reason they do this is not to amuse themselves. It is to make you put more money in. Once you see your "$5,000 turned into $14,000" on the screen, the operator reaches back out: "see, I told you my signals work. Imagine if you had started with $25,000 instead. Why don't you put more in for the next cycle? You're missing out on the bigger gains."

This is when the pressure tactics escalate. They will:

  • Push you up to a higher "tier" or "VIP plan" that needs a bigger deposit.
  • Tell you a one-time "rare opportunity" is happening this week and you have hours to fund.
  • Suggest taking out a personal loan, a HELOC, or even draining a 401(k), framed as "low-risk because you can pay it back from the next round of profits."
  • Bring on a "manager" who messages you with a more authoritative tone to seal the bigger deposit.
  • If you push back, get hostile, then warm again, then guilt-trip you ("I spent so much time on you and now you are second-guessing me?").

People go bankrupt at this stage. Real, well-documented case studies have victims liquidating retirement accounts, mortgaging homes, and borrowing from friends and family because the dashboard says they are about to be rich. They are not. The dashboard is a screen the scammer paints. The "tier upgrades" are nothing but a bigger deposit address.

The final stage of the scam, when you finally try to take any of it out, the withdrawal will fail. The site will ask you for a "verification fee" or "tax payment" or "anti-money-laundering deposit" in Bitcoin to release your balance. The fee will look small next to the (fake) balance on your screen, so it will feel reasonable. Pay it and the next withdrawal will fail for a different reason. Pay that one and another fee will appear. You will never see any of the money back. Not the deposits you made trying to invest, not the "fees" you paid trying to withdraw, none of it.

If this mechanic is unfamiliar to you, the term to look up is "pig butchering scam" (the criminals call it that themselves; the analogy is fattening up a victim before slaughter). The FBI's IC3 publishes annual reports on it, ProPublica and the New York Times have done long-form investigations, and the pattern is identical across thousands of victims. I am describing it from the operator's side because I have now seen it dozens of times, but the public record on this is enormous and consistent.

what I think actually happens to people

I want to be specific because vagueness is how this kind of advice fails.

A typical full run of this scam, on someone who isn't suspicious enough to bail out, ends in $15,000 to $50,000 in losses. The losses come in two waves. First the deposit (the $5,000 in my case). Then the "fees" they invent to block the fake withdrawal, those usually grow because the operators escalate as the target gets desperate. Once the target stops paying, the operators ghost. A few weeks later, a different person reaches out claiming to be a "recovery specialist" who can get the money back, for an upfront fee. That's the same scammer, the same network, on round two.

If you uploaded a copy of your driver's license to the site before this happened, the situation is worse than the cash. Your ID is now on a server in Lithuania, in the hands of people who lied about everything else. That ID can be sold, used to open accounts at real exchanges in your name, used to bypass identity checks at services where they want to launder. The cash loss is recoverable, in principle, with insurance and time. The identity damage outlives it.

who I was actually talking to

After I went silent on Cory for two weeks, I came back with a story (a "family emergency") to see what would happen. He picked up the conversation like nothing was wrong, asked if my account was verified yet, and asked for my phone number so we could "communicate better."

X DM thread: Cory asks "Are you there?" then "I hope you have been able to resolve your family emergency", "What's the status in your trading account?", "Also what's your number?"

Asking for a phone number is not friendliness. It is moving the conversation off the platform that can ban him. X can suspend a scam account; X cannot suspend your text messages. The moment he had my number, he texted me and tried to keep the same conversation going, with the same script, on a channel where he was no longer accountable to a moderation team.

Text messages to/from "+1 (213) 397-6550" with "Hello", "How are you doing?", "Okay proceed and get back to me so we can commence further", and a question about my verification status

Then he asked me to send him a screenshot of my account verification page. That was an opportunity I had been waiting for. I made him a tracking link.

There is a free service called Grabify that lets you wrap any link in a tracker. When the recipient's device fetches the page, the service logs the IP address, location, and device information of whoever opened it. I uploaded a real verification screenshot to a public image host, then wrapped that image's URL in a Grabify link with a domain (screenshare.pics) chosen to look ordinary. To Cory, it looked like I sent him a screenshot. To me, it was a doorbell.

Text message thread: I send "Imgur screenshare.pics" link, Cory replies asking about ID submission

Within seconds, his phone fetched the link to render the message preview. The log told me everything.

Grabify Advanced Log: Date 2026-04-30 21:37:49 UTC, IP 98.97.77.181, Country Nigeria Lagos, ISP SPACEX-STARLINK, Hostname customer.lgosnga1.isp.starlink.com

He is in Lagos, Nigeria, on Starlink. Not Los Angeles. Not anywhere in the United States. The "+1 (213)" phone number was a US-based VoIP relay he rented to look local. The aged X account was bought or stolen. The "Cory Bates" headshot was somebody else, probably scraped from someone's real profile years ago. Every visible part of his identity, from the name to the area code to the timezone of his messages, was wrong on purpose.

Lagos is where a large share of these scams originate. The shorthand is "Yahoo Boys", a long-running West African online-fraud subculture that started with romance scams and Nigerian-prince emails in the 2000s and now does crypto-investment pig-butchering at industrial scale. They run dozens of personas in parallel, off scripts, with offshore-staffed call centers and ESL-grade English. The poor grammar in Cory's messages ("you loss," "wining your trades," "I advice my followers") is not a bug; it is the dialect, and once you have seen one of these, you start noticing it in every other one.

The reason this matters for you, if it's happening to you or someone you love right now: the person on the other end of the chat has no relationship to anything they claim. They are not a trader. They are not American. They do not live in your country. They are running a script from an apartment in Lagos and they have several other targets going at the same time. Nothing they say about themselves is true, and nothing the platform shows you is real, and there is no version of "if I just play along a little longer the money I deposited will come back." It will not.

what to do if this happened to you

Do these in order, today if you can:

  1. Stop talking to Cory or whoever your version of Cory is. Don't argue, don't explain. Block. The longer the conversation continues, the more they know about you and the more pressure they apply.
  2. Don't pay any "fee" or "tax" they ask for to release a withdrawal. It is fake. The money on the dashboard does not exist. There is no withdrawal coming. Every dollar you send to "release" it is gone.
  3. File a report with IC3.gov. That's the FBI's intake for cyber-enabled fraud in the United States. You do not have to have lost money to file. They aggregate reports and use them to prioritize takedowns. The earlier you file, especially within 72 hours of contact, the higher your chances of help.
  4. If you're outside the US, file with your equivalent: Action Fraud (UK), CAFC (Canada), Scamwatch (Australia), Europol Reporting Center (EU).
  5. If you uploaded ID, freeze your credit at the three US bureaus (Equifax, Experian, TransUnion) and put a fraud alert on file. In other countries, freeze with whichever bureaus your banks check. This is free. Do it the same day.
  6. If you wired money or sent crypto, file with your bank within 24 hours and request a recall. After 72 hours, recall on a wire is much harder. Crypto is harder still, but file the IC3 report regardless because the addresses get flagged across exchanges and sometimes funds are frozen at the cash-out point.
  7. Tell one person in your life. A friend, an adult child, a sibling. The hardest part of recovering from one of these is the shame, and the shame is what the operators rely on to keep you from telling anyone until it's too late. Tell someone. They will not think less of you. These pipelines are built to work on smart people.

what to look for in someone else

If a friend, parent, or co-worker is in the early stages of this, they have been chatting for two weeks with someone they "met online" who is "good at trading," they recently mentioned a name like CoinFront or any other platform you've never heard of, they are excited about a new opportunity that pays out a percentage every week, those are the warning signs:

  • The relationship started with a friendly DM from a stranger they did not seek out.
  • The stranger has a full life on social media but zero overlap with anyone they actually know.
  • The conversation has been long, slow, and warm.
  • A "platform" was mentioned, with a name that sounds like a real broker but isn't one anyone they know uses.
  • The platform "promises" returns measured in weeks. Or "signals." Or "copy trading."
  • They are about to make a deposit, or have just made one, or are talking about making a bigger one.

Don't accuse the operator and don't shame your person. Just ask three questions, in this order:

  1. "How did you meet this person?"
  2. "Do they have any mutual friends with you that you can ask about them?"
  3. "Have you actually withdrawn any money yet, or have you only seen the number go up on a website?"

That third question is the one. If they cannot withdraw, the money is not real. If they have a story about how the withdrawal "is delayed" or "needs a fee", you are watching the second stage of the scam land in real time.

this is not just one website

If your person mentioned a different site, it might still be the same scam. CoinFront is one of dozens of near-identical sites built from the same template by the same vendor and run by different criminal teams. Same fake dashboard, same Skip button on ID verification, same "withdrawal fee" trick at the end, just a different name on the homepage. Other names I have personally confirmed are running this same template, as of this writing: Parsonex Market, CapitalTechPip, CryptoPalmsMarket, DeluxePlusWealth, SynergyTrades, VeltrixCapitalPro, QuorixTrading, FidexExpert, RocketStake, BizzyEarners, CrestMarkets, FortuneLivex, Solvex Capital Limited, SignalSurge, Tillid FX, TradeSphere. There are at least thirty more pre-registered domains waiting to be turned on.

If your person's site is not in that list, that does not mean it's legitimate. It means it is not in this list. The pattern is what matters: a stranger DM, a slow chat, a "platform" with a fake dashboard, a "withdrawal fee" right when you try to take money out. If that's the pattern, it's the same scam.

For scale: across the sites I confirmed, I tracked at least $526,000 in cryptocurrency deposits going into the wallet addresses these sites were collecting from in the last several months alone. One single wallet on one of these sites took in $426,000 from 29 deposits in a single 30-day window, with the largest single deposit being about $128,000. The "median" deposit was about $7,900. Those are real people losing real money to this template, right now, today. The average victim gave up enough to wreck their year.

why this site exists

The CoinFront site, the Cory account, the slow conversation, and the platform with a Skip button on KYC all exist because this works. It works on retired engineers, on doctors, on lawyers, on day-traders, on people who absolutely know that crypto scams exist. The reason it works is that it never feels like a pitch until it's already too late. The Cory persona feels like a friend. The platform feels professional. The dashboard feels real. By the time the withdrawal fails, the operator has already had the deposit for weeks.

Telling people "watch out for crypto scams" doesn't help, because every person who falls for this thinks they were watching. What helps is showing the inside of one, in order, with screenshots, so the next person who sees the same play in their own DMs can stop on the second message instead of the second deposit.

That's why this site is here.

If something like this is happening to you or someone you love, report it. The next person to see the same script in their DMs deserves a faster warning than you got.

Need a scam, impersonation, or fraud infrastructure investigation? Cipher Cortex provides fixed-scope investigation support for organizations, executives, legal teams, and security teams.

Request a Briefing