The single most important thing to understand about fake crypto exchange warning signs is this: fraudulent trading platforms in 2025 are not crude forgeries. They are sophisticated, professionally constructed systems designed to pass casual and even attentive scrutiny. They have live market data. They have customer support. They have FCA branding, MAS logos, and SEC registration numbers — all fabricated.
According to OFAC’s May 2025 sanctions action against Funnull Technology — a Philippines-based infrastructure provider linked to more than $200 million in US pig butchering losses — the fraudulent platforms its infrastructure supported used 200,000 unique domain hostnames and cloned interfaces from legitimate financial platforms. The same investigation by Chainalysis found that the majority of crypto investment scam sites reported to the FBI were built on Funnull’s domain-generation infrastructure.
At ICAR, our investigators have examined dozens of fraudulent trading platforms across cases originating in the UK, US, Canada, Australia, Singapore, and Hong Kong. The architecture of these platforms follows consistent, identifiable patterns. This article documents those patterns — the seven warning signs that distinguish a fraudulent platform from a legitimate one, a side-by-side comparison of real versus fake exchange features, and a per-jurisdiction guide to verifying any platform before committing funds.
| 200,000+
Unique fraudulent domain hostnames operated by Funnull Technology alone Source: OFAC Sanctions Action · May 2025 |
Why Fake Crypto Exchanges Look Legitimate
The primary design objective of a fake crypto exchange is not to conduct trading — it is to conduct convincing. The platform’s entire purpose is to persuade a victim to deposit funds, and then to persuade them to deposit more, while creating every possible obstacle to withdrawal.
Modern fake exchanges achieve this through several technical and design mechanisms:
- Interface cloning: the front-end design of established exchanges — Binance, Coinbase, Kraken, eToro — is copied with high fidelity using publicly available CSS and HTML. Chainalysis identified an 87 percent CSS similarity between one fraudulent platform and a legitimate EU broker in a 2025 case analysis.
- Live data feeds: legitimate-looking price charts and market data are generated using free APIs from real financial data providers. The data is real; the trading is not.
- Fabricated account balances: the victim’s portfolio dashboard shows real-time updating balances and returns. These numbers are entries in a database — not the result of any actual trade. They can be set to any value the operator chooses.
- Professional support infrastructure: many fake platforms include live chat support, email help desks, and even phone numbers staffed by the criminal operation’s employees — some of whom are themselves trafficked workers.
- Regulatory branding: FCA logos, SEC registration numbers, and central bank certifications are copied from legitimate platforms or fabricated entirely. These images are screenshots or downloaded assets — they confer no actual authorisation.
The 7 Warning Signs of a Fake Crypto Exchange
The following seven red flags are present in virtually every fraudulent platform ICAR has investigated. No single flag is definitive in isolation but encountering two or more simultaneously should trigger immediate verification before any further action.
| âš‘ 1 | The Platform Cannot Be Verified on Any Official Regulatory Register
Every legitimate investment platform or crypto exchange operating in a regulated jurisdiction must be authorised by the relevant financial regulator. In the UK, this means FCA authorisation (or registration for crypto firms under the Money Laundering Regulations). In the US, registration with the SEC, CFTC, or FinCEN. In Australia, an ASIC licence. In Singapore, MAS authorisation. In Hong Kong, SFC registration. In Canada, registration with IIROC or provincial securities commissions. If a platform cannot be found on any of these registers — regardless of how convincing its regulatory branding appears — it is not authorised. ✓ CHECK: UK: fca.org.uk/register · US: sec.gov/check-an-investment-professional · AU: moneysmart.gov.au/check-register · SG: mas.gov.sg/investor-alert-list · HK: sfc.hk/en/Regulatory-Functions/Intermediaries/Licensing/Register-of-licensed-persons · CA: aretheyregistered.ca |
| ⚑ 2 | The Domain Was Registered Recently — Weeks or Months Before First Contact
Every fraudulent platform ICAR has investigated was registered within months — often weeks — of the victim’s first contact with the scammer who introduced it. A legitimate exchange like Binance (est. 2017), Coinbase (est. 2012), or Kraken (est. 2011) has a domain age measured in years and a well-documented public history. A platform with a domain registered 30–60 days ago is almost certainly fraudulent, regardless of how established it claims to be. ✓ CHECK: Check: whois.domaintools.com — enter the platform URL and check ‘Created’ date. A legitimate major exchange will show years of history. |
| âš‘ 3 | Withdrawal Requests Are Blocked, Delayed, or Subject to Fees
The most reliable single indicator of a fraudulent platform is a blocked or fee-conditioned withdrawal. Legitimate exchanges process withdrawals — they may have verification requirements, but they do not charge ‘tax clearance fees’, ‘compliance deposits’, ‘insurance premiums’, or ‘capital gains release charges’ as conditions for releasing your own funds. If any withdrawal attempt results in a request for additional payment, the platform is fraudulent. This is the mechanism by which the fraud extracts the final layer of value from the victim. ✓ CHECK: Action: attempt a small test withdrawal (e.g. £100 or equivalent) before making any significant deposit. If the withdrawal is blocked or subject to a fee, cease all activity immediately. |
| âš‘ 4 | The Platform Was Introduced Through a Social or Romantic Contact
Legitimate investment platforms are not introduced through dating apps, social media contacts, or messaging applications by individuals who have been cultivating a relationship. No genuine exchange requires a personal introduction from a trusted contact to access it — they are publicly available, regulated services. If your awareness of a platform came through a WhatsApp conversation, a dating app match, or a social media connection who mentioned a family member’s success, the introduction itself is a red flag — regardless of what the platform looks like. ✓ CHECK: Verify independently: search the platform name + ‘scam’ or ‘review’ on Google, Reddit, and Trustpilot. Check the FCA’s ScamSmart warning list at fca.org.uk/scamsmart. |
| âš‘ 5 | The Platform’s Interface Is a Clone of a Known Legitimate Exchange
Advanced forensic comparison of fraudulent platform interfaces frequently reveals near-identical CSS, HTML structure, and graphic assets copied from legitimate exchanges. Visual clues for non-technical users include: company names that closely resemble established exchanges (e.g. ‘Binance Pro Capital’, ‘Coinbase Markets Global’, ‘Kraken Advanced’); logos that are slightly modified versions of real brand assets; and Terms of Service documents that are word-for-word copies of legitimate brokers with only the company name changed. ICAR’s OSINT investigation of one fraudulent platform found its Terms of Service document was a verbatim copy of a regulated EU broker, with only 11 text replacements made. ✓ CHECK: Check: search the exact text of any suspicious platform’s Terms of Service in quotation marks on Google. If the same text appears under a different company name, the Terms have been plagiarised. |
| âš‘ 6 | The Platform Shares Infrastructure With Other Known Fraudulent Sites
Fraudulent platforms are rarely isolated — they share hosting infrastructure, SSL certificates, domain registration patterns, and IP addresses with dozens or hundreds of other fraudulent sites. OFAC’s action against Funnull Technology documented 200,000+ domain hostnames sharing the same infrastructure. Investigative tools including VirusTotal, Shodan, and URLScan can identify shared infrastructure links. If a platform’s hosting IP resolves to the same address as known fraudulent sites, that is a significant investigative finding. ✓ CHECK: Check: urlscan.io — enter the platform URL and review the IP address, ASN, and linked domains. Cross-reference with OFAC’s SDN list at sanctionssearch.ofac.treas.gov. |
| ⚑ 7 | Returns Are Consistently Exceptional — and Only Visible, Not Withdrawable
Fraudulent platforms universally display exceptional returns — daily gains of 5–10 percent, monthly returns of 30–50 percent, or consistent upward movement regardless of real market conditions. These figures are database entries, not trading outcomes. The critical test is whether those returns are withdrawable. A platform that shows £200,000 in your account but cannot release £500 to your bank account is not a trading platform — it is a display system designed to justify further deposits. ✓ CHECK: Test: before making any deposit above a small test amount, attempt to withdraw the test amount in full. The response to that request tells you everything about the platform’s legitimacy. |
Real vs Fake: A Feature Comparison
The following comparison table documents the differences between legitimate cryptocurrency exchanges and fraudulent platforms across seven key features. This table is designed as a practical reference tool.
| FEATURE | ✓ LEGITIMATE EXCHANGE | ✗ FAKE EXCHANGE |
| Regulatory Status | Verifiable registration on FCA, SEC, ASIC, MAS, SFC, IIROC register | Claims registration but cannot be found on any official register |
| Domain Age | Years of documented history (Binance: 2017, Coinbase: 2012) | Registered days or weeks before first contact with victim |
| Withdrawals | Processed promptly — standard KYC verification only | Blocked, delayed, or subject to ‘release fees’ and ‘tax clearances’ |
| Returns | Reflects real market conditions — variable, sometimes negative | Consistently exceptional — 5–30% monthly regardless of markets |
| Company History | Public founding story, named executives, audited accounts | Vague or fabricated history — executives cannot be verified |
| Introduction | Discovered through public advertising, app stores, or organic search | Introduced through a social media contact, dating app, or WhatsApp |
| Terms of Service | Original legal documentation specific to the platform | Copied verbatim from a legitimate broker with minimal changes |
The OSINT Signature of a Fraudulent Platform
In every fraudulent platform ICAR has investigated, open-source intelligence reveals a consistent signature. The following represents a composite of the findings from multiple cases across 2024–2025.
| ▌ OSINT SIGNATURE — FRAUDULENT CRYPTO EXCHANGE (COMPOSITE) |
| // Domain analysis
Domain age:         < 90 days at victim first contact Registrar:          Privacy-protected (Namecheap / NameSilo / GoDaddy privacy) Registrant:         REDACTED — offshore privacy service SSL certificate:    Let’s Encrypt (automated, free — legitimate sites also use this)
// Infrastructure Hosting:            Cloudflare CDN — origin IP masked Shared IP cluster:  5–200+ other domains on same IP (check: urlscan.io) Known-fraud overlap: 1+ shared domains match OFAC SDN / FBI flagged list
// Interface analysis CSS similarity:     75–95% match to legitimate exchange (Chainalysis methodology) Logo asset:         Downloaded/screenshot from real exchange — pixel-for-pixel copy Terms of Service:   Plagiarised — Google exact phrases in quotes to confirm
// Regulatory FCA register:Â Â Â Â Â Â Â NOT FOUND SEC EDGAR:Â Â Â Â Â Â Â Â Â Â NOT FOUND MAS register:Â Â Â Â Â Â Â NOT FOUND ASIC register:Â Â Â Â Â Â NOT FOUND FCA warnings list:Â Â Check fca.org.uk/scamsmart for named alerts
// Operational Introduction:       Via WhatsApp / dating app / social media romantic contact Customer support:   Present but scripted — delays withdrawal queries indefinitely Withdrawal outcome: Blocked — ‘compliance review’ / ‘tax clearance’ demanded |
How to Verify a Crypto Platform Before Depositing By Jurisdiction
Before depositing any funds into any cryptocurrency trading platform or investment service, verify its registration using your country’s official financial regulatory register.
United Kingdom
FCA Financial Services Register: fca.org.uk/register · FCA ScamSmart warnings: fca.org.uk/scamsmart · FCA Crypto Asset Register (AML): fca.org.uk/firms/cryptoasset-businesses · For investment firms: search the firm name and registration number. If not found, report to the FCA directly.
United States
SEC Investment Adviser Public Disclosure: adviserinfo.sec.gov · CFTC SmartCheck: smartcheck.gov · FINRA BrokerCheck: finra.org/investors/have-problem/check-your-broker · FinCEN MSB Registrant Search: fincen.gov/msb-registrant-search · For crypto specifically: state-level Money Transmitter licences — check NMLS.
Canada
Are They Registered: aretheyregistered.ca — covers all provincial securities commissions · FINTRAC MSB Register for money services businesses · CSA Investment Fraud Warning: securities-administrators.ca · BCSC Investment Caution List for BC residents.
Australia
ASIC Connect Professional Registers: connectonline.asic.gov.au · MoneySmart Check Register: moneysmart.gov.au/check-register · AUSTRAC for registered reporting entities · ACCC Scamwatch for reported scams: scamwatch.gov.au.
Singapore
MAS Financial Institutions Directory: eservices.mas.gov.sg/fid · MAS Investor Alert List (unregulated entities): mas.gov.sg/investor-alert-list · SGX listed companies and regulated brokers: sgx.com.
Hong Kong
SFC Register of Licensed Persons: apps.sfc.hk/licenseeListWeb · HKMA Register of Authorized Institutions: hkma.gov.hk/eng/regulatory-resources/monetary-institutions/ai-register · SFC Fraud Alert: sfc.hk/en/alert-list for known fraudulent platforms.
What to Do If You Have Already Deposited Into a Suspicious Platform
If you have deposited funds into a platform that matches the warning signs described in this article, act immediately:
• Do not make any further deposits — including ‘release fees’, ‘tax clearance’, or ‘compliance charges’. Every additional payment goes directly to the fraudster.
• Do not confront the scammer — this may accelerate the platform’s closure and evidence deletion.
• Attempt a withdrawal immediately. The response will confirm whether the platform is fraudulent.
• Screenshot the platform URL, your dashboard, all transactions visible, and all communications.
• Contact your bank immediately and request a review of any transfers made to the platform.
• Report to your country’s fraud authority: Action Fraud (UK), IC3 (US), CAFC (Canada), Scamwatch (Australia), Singapore Police Force, Hong Kong Police anti-deception hotline 18222.
• If funds entered cryptocurrency, contact a forensic investigator urgently — blockchain tracing success depends heavily on early engagement.
• Check the regulatory register for the platform. If it is not listed, report it to the regulator: FCA (UK), SEC (US), ASIC (Australia), MAS (Singapore), SFC (Hong Kong), provincial commission (Canada).
Frequently Asked Questions: Fake Crypto Exchanges
These are the questions ICAR receives most frequently from victims, families, and professionals assessing suspicious platforms.
1. How can I tell if a crypto exchange is legitimate or fake?
Check the platform against your country’s official financial regulatory register before depositing any funds. In the UK: fca.org.uk/register. In the US: adviserinfo.sec.gov and smartcheck.gov. In Australia: moneysmart.gov.au/check-register. In Singapore: mas.gov.sg/investor-alert-list. In Hong Kong: apps.sfc.hk/licenseeListWeb. In Canada: aretheyregistered.ca. If the platform is not listed, treat it as fraudulent. Also check the domain registration date (any major exchange will have years of history), attempt a small test withdrawal before significant deposits, and Google the platform name combined with ‘scam’ or ‘review’.
2. What happens to my money when I deposit into a fake crypto exchange?
When you deposit funds into a fraudulent trading platform, the money is transferred to cryptocurrency wallet addresses controlled by the criminal operation. The platform displays a fabricated balance showing your ‘investment’ growing — but no actual trading occurs. The displayed balance is a number in a database. The funds are typically converted to stablecoins (usually USDT on the TRON network) within hours of receipt and moved through a series of wallets before reaching an exchange or a self-hosted wallet controlled by the fraudster.
3. Can the FCA or my bank recover money lost to a fake crypto exchange?
In the UK, the Payment Systems Regulator’s mandatory APP fraud reimbursement rules (in force since October 2024) require banks to reimburse most APP fraud victims up to £85,000 — but this applies to bank transfers, not to cryptocurrency losses processed through crypto exchanges. Cryptocurrency losses require specialist blockchain investigation to trace and freeze. The FCA can investigate and sanction fraudulent platforms but cannot directly recover individual victim losses. Report to both Action Fraud and the FCA, then engage a specialist forensic investigator for the crypto portion of any loss.
4. How do fake crypto exchanges get fake FCA or SEC registration numbers?
Fraudulent platforms obtain fake regulatory numbers through several methods: directly copying a legitimate firm’s registration number and presenting it alongside a different company name; fabricating a plausible-looking number that does not correspond to any real registration; or creating a fraudulent ‘clone firm’ that impersonates a real authorised entity. The FCA maintains a warning list of known clone firm impersonators at fca.org.uk/scamsmart. Always verify the specific firm name AND registration number on the official register — a number that matches a different firm’s name is evidence of impersonation.
5. What is Funnull Technology and what does it have to do with fake crypto exchanges?
Funnull Technology is a Philippines-based web infrastructure provider sanctioned by the US Treasury’s Office of Foreign Assets Control (OFAC) in May 2025 for providing hosting, domain generation, and infrastructure services to pig butchering fraud networks responsible for more than $200 million in losses to US victims. Chainalysis research linked Funnull’s infrastructure to the majority of fraudulent crypto investment platforms reported to the FBI. Funnull’s model — generating 200,000+ fraudulent domain hostnames through automated domain generation — represents the industrialisation of fake exchange infrastructure at a scale previously impossible.
6. Why do fake crypto exchanges look so professional?
Fraudulent platforms look professional because they are built using the same tools as legitimate ones. Front-end cloning tools copy the HTML and CSS of established exchanges in minutes. Free APIs provide real-time market data. Database systems generate convincing fabricated portfolio dashboards. Customer service chatbots handle withdrawal delay queries. The infrastructure for building a convincing fake exchange costs a fraction of the value it is designed to extract from victims. According to Chainalysis, the average infrastructure cost of a large pig butchering operation is negligible compared to the hundreds of millions it generates annually.
7. What should I do if I find a fake crypto exchange?
Report it to: the FCA (UK) at fca.org.uk/consumers/report-scam; the SEC (US) at sec.gov/tcr; the FBI IC3 at ic3.gov; ASIC (Australia) at asic.gov.au/report-misconduct; MAS (Singapore) at mas.gov.sg/consumer-help; the SFC (Hong Kong) at sfc.hk/en/complaints; and your provincial securities commission (Canada) via aretheyregistered.ca. Also report to ACCC Scamwatch (Australia), Action Fraud (UK), and the Internet Crime Complaint Center (US) for victim fraud reports. Preserving the platform URL, domain name, screenshots, and any wallet addresses or transaction IDs will make your report more actionable.
About ICAR: International Cyber Asset Recovery (ICAR) is a UK-based forensic investigation and asset recovery firm specialising in cryptocurrency fraud, investment scams, and digital asset recovery. ICAR operates across the UK, US, Canada, Australia, Singapore, and Hong Kong. Free initial case assessments: Complete Case form or Contact out team via WhatsApp