Fake exchanges and fake trading apps: deposit-only platforms

Operators ship polished Android/iOS sideloads, cloned websites, or lookalike domains that mimic known brokers and crypto exchanges. Marketing arrives via ads, social DMs, “account managers,” or romance scripts. You fund a deposit address. The in-app ledger shows trades and profits. Early small withdrawals sometimes succeed to build trust.

When balances grow, withdrawal fails: KYC loops, “risk reviews,” network congestion stories, or a demand to pay tax, gas, or insurance before release. Those fees go to new attacker addresses. The dashboard balance was never a claim on segregated customer assets — it was theater.

• App not from the official store listing of the real brand — or a clone with a near-identical name.
• Website domain off by a character, unusual TLD, or recent registration.
• Support only via in-app chat or Telegram handlers.
• Deposits easy; meaningful withdrawals blocked.
• Pressure to deposit more to “unlock” or meet a margin call on fake P&L.

Some scams impersonate a famous exchange: logos, help-center language, even fake proof-of-reserves pages. Others invent a new brand. Mechanically both are deposit-only: crypto leaves your wallet to addresses they control, while your “account” lives in their database.

Cross-check any app by navigating to the real company’s official site from a bookmark you trust, then comparing domains, app publisher names, and support channels. Do not trust links from ads or DMs. If the real brand’s security page warns about clones, read it.

Fabricated profits serve one purpose: larger deposits. The unlock script that follows — AML fee, tax, gas, liquidity fee — is the same advance-fee pattern covered in our withdrawal-fee unlock guide. Paying never converts a fake balance into withdrawable coins on a venue you control.

If handlers now introduce a “recovery specialist” or ask for your seed to “sync the account,” stop. That is a second theft vector. Legitimate investigation never needs your phrase.

1. Every deposit tx hash, network, asset, amount, and destination address.
2. App name, package ID if known, download URL, and website domain.
3. Screenshots of the dashboard balance, blocked withdrawal, and fee demands.
4. Chat logs with account managers, including payment addresses for fees.
5. Email headers or SMS if registration used your phone or mail.
6. UTC timeline from first contact through last deposit.

Block explorers keep public transfers; they do not keep your in-app screenshots. Capture those before you lose access to the account.

On-chain, deposits often consolidate into collector wallets, then move toward OTC brokers, nested services, or major exchange hot wallets. A path analysis can label those hops with confidence language and surface a cash-out candidate — or a dead end.

• Useful for police packets and counsel briefing.
• Useful before writing to an exchange: only contact services with a defensible deposit story.
• Not a recovery button and not a guarantee that KYC data will be released to you.

MBTrace sells that PDF path (from $50+, typically 24–48h after payment). Analysts accept the case before payment. We never ask for seeds. Sample tone: /sample-report.pdf. Soft CTA only — report a case if you need the document.

1. Stop all deposits and fee payments.
2. Export evidence listed above; do not wipe the phone until you have copies elsewhere.
3. Secure real exchange and wallet accounts; change passwords and enable 2FA.
4. File a police report with hashes and timeline (see our police guide).
5. Ignore recovery DMs; read our recovery-scams guide.
6. If a labeled custodial cash-out appears, prepare a factual compliance contact (exchange-freeze guide).

Overlap with romance-investment schemes is common. If a personal relationship drove the deposits, also read our pig-butchering guide. First-day containment steps sit in the first-24-hours checklist.

Fake support will claim they can reopen withdrawals if you pay or connect a wallet. Honest on-chain work starts from public hashes you already control, delivers a written path with limits, and refuses outcome guarantees. For how that process works in plain language, see our how-tracing-works guide.

This article is general information, not legal advice. Freezes, refunds, and prosecutions depend on institutions and jurisdiction — not on a Telegram progress bar.

APKs and “desktop traders” distributed outside official stores may include malware or overlay phishing, not only a fake ledger. If you installed unknown software, treat the device as untrusted: do not enter seeds for real wallets on it, prefer moving remaining assets from a clean device, and rotate passwords entered on the compromised machine.

• Uninstall the fake app after you have exported screenshots and chat evidence.
• Scan for unknown accessibility or remote-access permissions on mobile.
• Do not “verify” a real MetaMask or Ledger by typing the seed into the fake app’s repair flow.

Device compromise can coexist with the deposit scam. Contain keys first; then assemble the on-chain packet for reporting. Soft CTA remains the same: if you need a path PDF toward KYC rails, report a case — without expecting recovery theater.