In March of this year the TokenScope Team conducted an analysis of the Finiko pyramid, revealing damage to its clients in the amount of more than $4.6 billion. More than 90 thousand participants suffered from fraudulent actions of the organizers and the "stars" of the pyramid.
This review is devoted to the Frendex pyramid, which is probably the next project from the Finiko promoters, who used its scheme and client base to raise and then theft funds.
The Frendex pyramid operated from May 2020 to August 2021. More than 300 depositors have applied to law enforcement agencies about fraud, who have suffered damage, which is estimated today at more than $2.8 million. In October 2021, a criminal case was initiated against the organizers of the pyramid, Ruslan Pichugin and Dmitry Chechulin, under the article fraud, in frame of which they were put on the international wanted list.
Frendex fundraising was carried out through the frendex.ltd website platform (friendex.io) in the BTC cryptocurrency. The pyramid's investments were allegedly carried out in the stock market, where the average return on investments was declared at about 30% per month.
Studying the comments to the video-guidance on the YouTube channel Frendex how to make a deposit revealed one of the fundraising addresses: 1DM37wwUESeUMywbp8AX4ruCpk3uqp6bTv.
Analyzing of the deposits and withdrawals of the abovementioned address revealed a full scope of the Frendex addresses.
The study of the replenishments of the address allowed us to establish the main Frendex addresses:
| Address | Date of creation and the last transaction date | Turnover | Current balance |
|---|---|---|---|
| 3Dd3HiP8zuq1rUnrd4s44FpPsYY2WmzQeT | 20/05/2021; 01/08/2021 | 1 521 BTC | 0 |
| 3Fnd35xk2iRYMySjwrNwJWchGr2NCuJ32z | 04/06/2021; 24/08/2021 | 1 199 BTC | 0 |
| 3BqHzZAgqEE8pYz2cYikWrvwW8UZSL4Y6w | 02.05.2021; 27/09/2021 | 1 408 BTC | 0 |
Replenishments of the address 1DM37wwUESeUMywbp8AX4ruCpk3uqp6bTv through the chain of non-large addresses indicates that the funds were deposited through a hot wallet on the Binance exchange 1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s.
The replenishment of the address was also carried out through a chain of transactions including the large addresses, possibly related to the exchanges: 3Jx1ThThGhh5P9vL5XkMw1NauH2YEDSZo4Wd (turnover of the address is 2 530 BTC) and bc1qwxqd25yk2dtw2ml04vxj9atq3huv4rdytf6vt (turnover of the address is over 40 000 BTC).
The study of withdrawals from bc1qwxqd25yk2dtw2ml04vxj9atq3huv4rdytf6vt revealed that funds were withdrawn through the hot wallet on Binance exchange 1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s.
Further study of the Frendex promotion advertising in the Internet, TokenScope analysts we able to find out a withdrawal guidance where as an example a withdrawal of $500 to the address 17pHCb9JBsWbqtVcf88ZAXqidoZSaM9RnH was taken.
Studying this transaction of March 4, 2021 we were able to figure out the origin of the deposit - the large addresses, probably belong to the exchangers or the exchanges: 39EKjvDK6UEkpaBcLVbBen1M4dhh2iE9Lq (98 000 transactions), 3479gSjwpQXmw2PtuDqyTRqLk5b8e1KLJi (122 000 transactions), and the address 32GkyzYodQe43Go71pCHqJv7LJXN4Jd2QE (187 transactions).
Analysis of the deposits of the address 32GkyzYodQe43Go71pCHqJv7LJXN4Jd2QE shows that it in turn was replenished mainly from two main Frendex wallets: 3Fnd35xk2iRYMySjwrNwJWchGr2NCuJ32z and 3Dd3HiP8zuq1rUnrd4s44FpPsYY2WmzQeT.
The next steps of this crypto investigation of the Frendex pyramid included the study of Internet forums and messengers, published data on the successful payouts of the service and data on payments to participants. The results obtained were analyzed and they confirmed that payments were made from three main wallets by making transactions to many addresses at once (up to 2 000 addresses at once), but a part of the funds was returned to the address of the sender (for example, transaction 1026dcc6327b3164c3a427d3fb5f5093180b05e2a99cfd2bf89f3c777cac09c).
Thus, the transfer of money to the pyramid participants was carried out through the main addresses of Frendex, also a part of the funds came from major exchanges and exchangers 3479gSjwwpQQmXmw2PtuDqyTRqLk5b8e1KLJi, 32GkyzYodQe43Go71pCHqJv7LJXN4Jd2QE and 3Jx1ThGhh5P9vL5XkMw1NauH2YEDSZo4Wd, bc1qwxqd25yk2dtw2ml04vxj9atq3huv4rdytf6vt, where the scammers probably have their accounts.
Withdrawal of the funds from the main Frendex wallets. Analysis and examination of the withdrawal chain from Frendex main wallets shows that the main amount of the funds was withdrawn through a chain of hot wallet addresses on the Binance exchange 1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s. The study of outgoing transactions of one of the Frendex main addresses 3Fnd35xk2iRYMySjwrNwJWchGr2NCuJ32z using the TokenScope graph allowed to establish the main withdrawal links:
The logic of outgoing transactions is that the main amount of outgoing transaction is returned to address of the sender and the balance is distributed among hundreds of the recipient addresses, among them there are addresses of btc-multiply100x.com, BitZlato and Wasabi-wallet services.
Outgoing transactions of the Frendex addresses 3Dd3HiP8zuq1rUnrd4s44FpPsY2WmzQeT, 3BqHzZAgqEE8pYz2cYikWrvwW8UZSL4Y6 are of a similar nature. Withdrawals were also made to the addresses of btc-multiply100x. com, BitZlato and Wasabi-wallet services. Further tracking of the chain of the outgoing transactions leads to the withdrawal via the Binance exchange.
Also, the withdrawal of funds was made through the addresses possibly related to exchanges or exchange services: 39EKjvDK6UEkpaBcLVbBen1M4dhh2iE9Lq (turnover of the address is 4 671 BTC, last transaction date is March 03, 2022), 3479gSjjwpQmXmw2PtuDqyTRqLk5b8e1KLJi (turnover of the address is 4 654 BTC, last transaction date is December 20, 2021), 3Jx1ThThGhh5P9vL5XkMw1NauH2YEDSZo4Wd (turnover of the address is 2 552 BTC, last transaction date is April 25, 2022).
The further study of the activity dynamics of these addresses helped us to understand that the highest turnover occurs in July 2021, with the following sharp decrease in activity that almost went to none. This coincides with the time when the payments to the participants of the Frendex pyramid were suspended deposits that indirectly confirms the connection of these addresses with the pyramid creators.
As a result of the analysis of open sources, the TokepScope Team puts forward a reasonable assumption that the number of victims of the pyramid's activities is at least 23 thousand people, a number equal to the number of participants in the Frendex Telegram channel.
The total amount of funds collected by the Frendex pyramid, revealed as a result of the TokenScope investigation, amounted to at least $170 million (4 128 BTC), and not $2.8 million, as previously assumed. The collected funds were withdrawn mainly through wallets on the Binance exchange.