{"id":21506,"date":"2025-09-10T04:45:36","date_gmt":"2025-09-10T02:45:36","guid":{"rendered":"https:\/\/www.in-diem.com\/portal-invest-trade-investigation-into-a-network-of-digital-platforms-replicating-international-financial-fraud-patterns\/"},"modified":"2026-08-12T14:38:54","modified_gmt":"2026-08-12T12:38:54","slug":"portal-invest-trade-investigation-into-a-network-of-digital-platforms-replicating-international-financial-fraud-patterns","status":"publish","type":"post","link":"https:\/\/www.in-diem.com\/en\/portal-invest-trade-investigation-into-a-network-of-digital-platforms-replicating-international-financial-fraud-patterns\/","title":{"rendered":"Portal Invest Trade: investigation into a network of digital platforms replicating international financial fraud patterns"},"content":{"rendered":"
\n

For months, a client seeking to learn about investing in digital assets became trapped in a structure that precisely replicated the patterns of financial fraud described in European reports. What began as a training process eventually revealed connections to multiple platforms, opaque wallets, and entities spread across different jurisdictions. <\/p>\n\n

The technical investigation carried out by Cryptoveritas 360<\/strong> and the subsequent legal action by IN DIEM Abogados<\/strong> have made it possible to reconstruct the flow of funds, identify connections between dozens of platforms, and provide authorities with a complete map of the operation. The complaint has already been filed and is the first step in a procedure that will foreseeably require international cooperation. <\/p>\n\n

The case reflects a growing reality: digital structures that function as networks, not as isolated platforms. And Portal Invest Trade’s modus operandi \u2014 according to the evidence provided by the victim, the technical report, and the complaint \u2014 aligns with what cyberfraud specialists describe as one of the most sophisticated schemes in recent years. <\/p>\n\n

The starting point: a user who just wanted to learn how to invest<\/strong><\/h2>\n\n

The story begins in April 2024, when the affected individual \u2014 a user with no prior experience in crypto assets \u2014 decided to start a learning process. Their intention was simple: to understand how digital investments work and explore new opportunities. <\/p>\n\n

The first contact came through corporate emails that appeared to belong to Portal Invest Trade<\/strong>. The senders presented themselves as financial analysts and provided a pre-created password and a direct access link to the platform. For experts, this detail is significant: <\/p>\n\n

\n

“When a platform sends pre-configured access and does not require standard registration, it is usually a fraudulent investment technique based on social engineering,” explain experts from Cryptoveritas 360.<\/p>\n<\/blockquote>\n\n

From that moment, a procedure is activated that combines:<\/p>\n\n

    \n
  • technical language to create information asymmetry,<\/li>\n\n\n\n
  • remote control of the device via AnyDesk,<\/li>\n\n\n\n
  • insistent instructions to open accounts on Binance,<\/li>\n\n\n\n
  • and falsified documents attributed to bodies such as FCA, FINRA, CNMV, or EBA.<\/li>\n<\/ul>\n\n

    The narrative used aligns with parameters described in the MiCA Regulation<\/strong>, in the AMLD5\/AMLD6 directives<\/strong>, and in recent warnings from European supervisors regarding unauthorized providers.<\/p>\n\n

    The gradual increase in funding: a recurring pattern in hundreds of cases across Europe<\/strong><\/h2>\n\n

    The process experienced by the affected individual is representative of a pattern widely documented by international organizations:<\/p>\n\n

    Small deposits as an entry phase<\/strong><\/h3>\n\n

    The user makes initial purchases of USDT and ETH. They immediately send them to external addresses, supposedly controlled by the platform.The victim believes the money is applied to their account. The reality, according to the technical report, is that these wallets have no relation whatsoever to their internal panel. <\/p>\n\n

    Manipulated dashboards and fictitious profits<\/strong><\/h3>\n\n

    The dashboard shows constant and seemingly secure growth. There is no volatility or losses.Every withdrawal attempt is blocked, citing: <\/p>\n\n

      \n
    • AML controls,<\/li>\n\n\n\n
    • open operations,<\/li>\n\n\n\n
    • regulatory audits,<\/li>\n\n\n\n
    • alleged internal verifications.<\/li>\n<\/ul>\n\n

      Psychological pressure through falsified emails<\/strong><\/h3>\n\n

      A second phase introduces an emotional element: emails impersonating international authorities, reporting alleged deposits exceeding \u20ac47,000<\/strong> in their name.<\/p>\n\n

      To release this fictitious capital, non-existent fees and commissions were demanded, accompanied by threats of daily surcharges of 1.25%<\/strong>.<\/p>\n\n

      Use of impersonated platforms<\/strong><\/h3>\n\n

      The fraudulent infrastructure incorporates a domain that simulates Coinbase \u2014 coin-base.work<\/strong> \u2014 from which new payments are demanded.The user believes they are interacting with a regulated entity; in reality, it is a website designed to reinforce the pressure.<\/p>\n\n

      The hidden network: 20 individuals and 25 affiliated companies<\/strong><\/h2>\n\n

      One of the most relevant revelations of the investigation is the scope of the structure:<\/p>\n\n

        \n
      • more than 20 individuals<\/strong> linked to recruitment,<\/li>\n\n\n\n
      • at least 25 legal entities<\/strong> operating as shell companies, payment gateways, or auxiliary platforms.<\/li>\n<\/ul>\n\n

        This figure, included in the complaint, is only the minimum verifiable in the initial phase.<\/p>\n\n

        Entities include:<\/p>\n\n

          \n
        • recruiters,<\/li>\n\n\n\n
        • fictitious analysts,<\/li>\n\n\n\n
        • technical service providers,<\/li>\n\n\n\n
        • payment gateways,<\/li>\n\n\n\n
        • intermediate companies in different countries,<\/li>\n\n\n\n
        • fraudulent domains linked to each other.<\/li>\n<\/ul>\n\n

          The complaint filed by IN DIEM Abogados requests that, during the investigation, identification be expanded through:<\/p>\n\n

            \n
          • international letters rogatory,<\/li>\n\n\n\n
          • KYC\/AML requirements to exchanges,<\/li>\n\n\n\n
          • requests to hosting operators and financial entities,<\/li>\n\n\n\n
          • cross-analysis of logs and IPs.<\/li>\n<\/ul>\n\n

            Traceability reconstructed by Cryptoveritas 360: a comprehensive map of fund flows<\/strong><\/h2>\n\n

            The central piece of the investigation is the blockchain analysis carried out by Cryptoveritas 360.The technicians reconstructed each of the client’s transactions, including 16 documented withdrawals<\/strong> from the platform to addresses controlled by the network.<\/p>\n\n

            Identified final exchanges<\/strong><\/h3>\n\n

            The funds ended up on fully identifiable platforms, including:<\/p>\n\n

              \n
            • Binance<\/li>\n\n\n\n
            • Coinbase \/ Coinbase Wallet<\/li>\n\n\n\n
            • Bybit<\/li>\n\n\n\n
            • Maskex<\/li>\n\n\n\n
            • KuCoin<\/li>\n\n\n\n
            • Kraken<\/li>\n\n\n\n
            • HTX<\/li>\n\n\n\n
            • OKX<\/li>\n\n\n\n
            • HitBTC<\/li>\n\n\n\n
            • SettlePay (intermediate infrastructure)<\/li>\n\n\n\n
            • Flowbank (mentioned in internal communications)<\/li>\n<\/ul>\n\n

              These entities have been judicially requested to provide:<\/p>\n\n

                \n
              • KYC information,<\/li>\n\n\n\n
              • access logs,<\/li>\n\n\n\n
              • transaction history,<\/li>\n\n\n\n
              • and, where appropriate, fund blocking.<\/li>\n<\/ul>\n\n

                Technical information: phone numbers, email addresses, IP addresses, servers, and metadata<\/strong><\/h2>\n\n

                The technical investigation includes:<\/p>\n\n

                  \n
                • Phone numbers of recruiters and fake analysts.<\/li>\n\n\n\n
                • IP addresses used to access dashboards and send fraudulent emails.<\/li>\n\n\n\n
                • Metadata of impersonated domains and servers used.<\/li>\n\n\n\n
                • Access logs and routes from which movements were executed.<\/li>\n\n\n\n
                • Matches in servers, hosting providers, and spoofing patterns.<\/li>\n<\/ul>\n\n

                  All this information is part of the complaint and has been submitted to the competent authorities.This data will allow for requests for:<\/p>\n\n

                    \n
                  • cross-referencing with telecommunications operators,<\/li>\n\n\n\n
                  • international information requests,<\/li>\n\n\n\n
                  • and analysis of associated structures.<\/li>\n<\/ul>\n\n

                    The Interconnection Between Platforms: A Network, Not an Isolated Website<\/strong><\/h2>\n\n

                    Perhaps the most relevant element of the case is that Portal Invest Trade does not function as an autonomous platform<\/strong>, but as part of an ecosystem of interconnected websites.<\/p>\n\n

                    Among the linked platforms identified in the investigation:<\/p>\n\n

                      \n
                    • portalinvest.org<\/li>\n\n\n\n
                    • portalinvest.info<\/li>\n\n\n\n
                    • pitplatform.org<\/li>\n\n\n\n
                    • portaltechnologiesltd.com<\/li>\n\n\n\n
                    • settlepay.net<\/li>\n\n\n\n
                    • settlepay-2.net<\/li>\n\n\n\n
                    • flowbank.com<\/li>\n\n\n\n
                    • dtsmoney.net<\/li>\n\n\n\n
                    • dtsmoney.com<\/li>\n\n\n\n
                    • xwardpay.io<\/li>\n<\/ul>\n\n

                      Shared digital infrastructure<\/strong><\/h3>\n\n

                      All of them feature:<\/p>\n\n

                        \n
                      • identical web architecture,<\/li>\n\n\n\n
                      • replicated dashboards,<\/li>\n\n\n\n
                      • matching endpoints,<\/li>\n\n\n\n
                      • common servers,<\/li>\n\n\n\n
                      • cloned forms,<\/li>\n\n\n\n
                      • repeated hosting providers.<\/li>\n<\/ul>\n\n

                        Nothing suggests they are distinct projects.<\/p>\n\n

                        Wallets connected between platforms<\/strong><\/h3>\n\n

                        Cryptoveritas 360 detected that the client’s funds:<\/p>\n\n

                          \n
                        • were sent to recurring addresses,<\/li>\n\n\n\n
                        • ended up in Portal Invest Trade, pitplatform.org, or SettlePay wallets,<\/li>\n\n\n\n
                        • exhibited typical layering<\/em> behavior,<\/li>\n\n\n\n
                        • subsequently converged on Binance, Coinbase Wallet, or other exchanges.<\/li>\n<\/ul>\n\n

                          Technical coordination and synchronized recruitment<\/strong><\/h3>\n\n

                          Recruiters used identical scripts, remote access, virtually identical emails, and homogeneous patterns for justifying blocks.<\/p>\n\n

                          Bridges to fiat and payment gateways<\/strong><\/h3>\n\n

                          The following are related:<\/p>\n\n

                            \n
                          • SettlePay<\/li>\n\n\n\n
                          • 4Bill<\/li>\n\n\n\n
                          • Worldsec Payments<\/li>\n\n\n\n
                          • BestPey<\/li>\n\n\n\n
                          • Ademio LLC<\/li>\n\n\n\n
                          • Extra Lloyd LLC<\/li>\n\n\n\n
                          • Digital Finance LLC<\/li>\n<\/ul>\n\n

                            All of them allow for fragmentation, dispersion, and subsequent extraction of funds in fiat.<\/p>\n\n

                            Professional Practice: Technology + Law<\/strong><\/h2>\n\n

                            Cryptoveritas 360: investigation<\/strong><\/h3>\n\n

                            The team carried out:<\/p>\n\n

                              \n
                            • exhaustive blockchain analysis,<\/li>\n\n\n\n
                            • identification of wallets and transit nodes,<\/li>\n\n\n\n
                            • verification of domains and servers,<\/li>\n\n\n\n
                            • complete reconstruction of money flow,<\/li>\n\n\n\n
                            • technical correlation between platforms,<\/li>\n\n\n\n
                            • identification of operational patterns.<\/li>\n<\/ul>\n\n

                              IN DIEM Abogados: complaint filed<\/strong><\/h3>\n\n

                              The firm filed:<\/p>\n\n

                                \n
                              • a comprehensive criminal complaint,<\/li>\n\n\n\n
                              • digital evidence,<\/li>\n\n\n\n
                              • fraudulent communications,<\/li>\n\n\n\n
                              • request for national and international proceedings,<\/li>\n\n\n\n
                              • requests for blocking and preservation of funds.<\/li>\n<\/ul>\n\n

                                Conclusion: A complex case, a sophisticated network, and an ongoing investigation<\/strong><\/h2>\n\n

                                The Portal Invest Trade case reveals a digital network equipped with:<\/p>\n\n

                                  \n
                                • social engineering,<\/li>\n\n\n\n
                                • identity theft,<\/li>\n\n\n\n
                                • remote device control,<\/li>\n\n\n\n
                                • interconnected wallets,<\/li>\n\n\n\n
                                • cloned platforms,<\/li>\n\n\n\n
                                • and advanced use of fund dispersion tools.<\/li>\n<\/ul>\n\n

                                  Thanks to the joint work of Cryptoveritas 360<\/strong> and IN DIEM Abogados<\/strong>, it has been possible to reconstruct the money trail, identify key entities, link all involved platforms, and initiate criminal proceedings with guarantees.<\/p>\n\n

                                  \n\n

                                  Can money be recovered from Portal Invest Trade?<\/strong><\/h2>\n\n

                                  There is no guaranteed recovery. What does exist is a real possibility<\/strong>, provided certain key factors are met: <\/p>\n\n

                                    \n
                                  • That the funds reached a regulated exchange.<\/li>\n\n\n\n
                                  • That action is taken quickly.<\/li>\n\n\n\n
                                  • That complete traceability is available.<\/li>\n\n\n\n
                                  • That the court orders the blocking of wallets or accounts.<\/li>\n\n\n\n
                                  • That there are matches between cases that allow linking those responsible.<\/li>\n<\/ul>\n\n

                                    In several of our cases, preventive blocks<\/strong> have been achieved on international platforms before the money moved to advanced stages of money laundering. It is not always possible, but it does happen. <\/p>\n\n

                                    Key tips to avoid falling for an online investment scam again<\/strong><\/h2>\n\n

                                    Some basic guidelines can make a difference:<\/p>\n\n

                                      \n
                                    • If someone asks for remote access<\/strong>, cut off communication.<\/li>\n\n\n\n
                                    • Never accept a username and password “created for you.”<\/li>\n\n\n\n
                                    • Always verify if the entity is registered with the CNMV<\/strong>.<\/li>\n\n\n\n
                                    • Be wary of guaranteed returns<\/strong>: they do not exist.<\/li>\n\n\n\n
                                    • Do not send cryptocurrencies to unknown private wallets.<\/li>\n\n\n\n
                                    • Any “AML fee” to release funds is a 100% scam.<\/li>\n<\/ul>\n\n

                                      Most victims confess that, looking back, something “felt off.” But the staging was so convincing that they ended up trusting. This is precisely why these scams work. <\/p>\n\n

                                      \n\n

                                      How can IN DIEM Abogados help you?<\/strong><\/h2>\n\n

                                      At IN DIEM Abogados, along with our forensic analysis team from Cryptoveritas 360<\/strong>, we accompany victims of cryptocurrency scams through all phases of the process, from the first consultation to the full investigation and the filing of the complaint.<\/p>\n\n

                                      We can help you with:<\/p>\n\n

                                        \n
                                      • Investigation and analysis of fraud.<\/li>\n\n\n\n
                                      • Professional blockchain traceability.<\/li>\n\n\n\n
                                      • Identification of wallets and final exchanges.<\/li>\n\n\n\n
                                      • Preparation of robust expert reports.<\/li>\n\n\n\n
                                      • Filing and technical direction of the criminal complaint.<\/li>\n\n\n\n
                                      • Request for international proceedings and fund blocking.<\/li>\n\n\n\n
                                      • Assistance to national and international clients affected in Europe and Latin America.<\/li>\n<\/ul>\n\n

                                        If you suspect you have been a victim of Portal Invest Trade or any other cryptocurrency scam<\/strong> or online investment scam<\/strong>, do not wait. The sooner we act, the greater the chances of achieving results. <\/p>\n\n

                                        Contact us. We can help you. <\/strong><\/p>\n\n

                                        \n\n