Investors logged into glossy crypto trading dashboards showing five-figure “profits,” then found themselves blocked from withdrawing a cent unless they first wired extra “taxes” or “loan repayments” to overseas accounts.
When victims tried to cash out, the platforms demanded advance fees to “unlock” their accounts, yet never released any money.
On Dec. 22, the SEC charged three purported crypto trading platforms and four investment clubs over an alleged $14 million fraud that ran from January 2024 to January 2025.
Playbook in five steps
The complaint reads like a manual for how these schemes work, and the structure is clean enough to serve as a warning checklist.
The first step consisted of social ads in WhatsApp clubs. According to the SEC, AI Wealth, Lane Wealth, AIIEF, and Zenith advertised on social media and then ran “investment clubs” on WhatsApp, fronted by “professor” and “assistant” personas in each group.
The groups gave the appearance of exclusive access to expert guidance, a technique now common enough that Investor.gov has issued specific alerts warning that unsolicited investment clubs in messaging apps are a primary gateway for scams.
The second step started with AI “signals” and curated screenshots. In those chats, the “professors” allegedly promised high returns from AI-generated trading signals and shared screenshots of supposedly successful trades to build trust.
The complaint says they falsely held themselves out as financial professionals and claimed to use proprietary AI software for stock and crypto tips.
The SEC’s AI fraud alert notes that scammers now use AI to generate fake websites, screenshots, and even deepfake videos to sell bogus investments or impersonate professionals, which is precisely the approach the complaint describes.
The third step funnels to fake licensed platforms. Once investors were primed, the clubs steered them to three supposed trading platforms: Morocoin, Berge, and Cirkor.
The SEC says these sites claimed to have government licenses and security protections, but in reality, there was no actual trading, and all the accounts were fabricated.
The platforms allegedly referenced supposed regulatory investigations to add credibility, a tactic that Investor.gov’s PAUSE program explicitly tracks as a major red flag.
Pushing fictitious STOs was the fourth step of this structure. The next escalation was “Security Token Offerings” in names like NNET, SCT, and HMB, marketed as if they were regulated IPO-style offerings by real companies such as “NeuralNet” and “SatCommTech.”
The complaint alleges that the issuers and offerings did not exist and that the tokens were simply another way to attract deposits. By framing the tokens as IPO-equivalents, the operators borrowed the legitimacy of traditional securities without any of the disclosure or registration that real offerings require.
The fifth and final step was withdrawal gate and advance fees. When victims tried to withdraw, the platforms and club operators allegedly demanded multiple advance payments. These include purported loan repayments, “investigation” fees, and expedited withdrawal charges.
Along with the new requirements, there was a warning that accounts could be frozen for three years if investors did not comply. The SEC calls this a classic advance-fee fraud layered on top of the fake trading platform.
Legitimate firms deduct fees from proceeds rather than asking customers to prepay taxes or pay upfront for access to their own money, a point regulators repeatedly stress in investor alerts.
What the SEC alleges
The case is filed in the US District Court for the District of Colorado against Morocoin Tech Corp., Berge Blockchain Technology Co. Ltd., Cirkor Inc., AI Wealth Inc., Lane Wealth Inc., AI Investment Education Foundation Ltd. and Zenith Asset Tech Foundation.
The SEC alleges that, acting together, they took in at least $14 million from US retail investors between January 2024 and January 2025 and misappropriated all of it, sending funds through overlapping bank accounts and crypto wallets overseas.
The complaint charges violations of the antifraud provisions of the Securities Act and Exchange Act and seeks permanent injunctions, civil penalties, and disgorgement with interest for the platform entities.
The allegations paint a coordinated scheme in which the investment clubs fed victims to the platforms, the platforms fabricated account balances, and the STO layer took a second bite at the same victims before the withdrawal gate closed the trap.
Red flags
Current investor education materials map directly onto the tactics alleged in this case.
Regarding group chats “professors,” Investor.gov’s alert warns that unsolicited investment clubs on messaging apps are now a primary gateway for scams and that investors should be wary of any group where an unknown “leader” dispenses stock or crypto tips.
The complaint describes exactly that structure: WhatsApp groups led by personas claiming expertise, building trust through fake wins before steering members to the real trap.
1. AI-generated signals
The platforms allegedly used AI-generated signals and testimonials to create an aura of sophistication. The SEC’s AI fraud alert notes that scammers use AI to generate fake content, including deepfake videos, to sell bogus investments or impersonate professionals.
2. Too good to be true
If the “professor” or “assistant” seems too polished or the screenshots too perfect, that’s a reason to dig deeper, not to invest faster.
3. Fake licenses
This leads to the third red flag: fake licenses and regulators. The platforms claimed government licenses and referenced supposed regulatory investigations to pressure victims into paying fees.
Investor.gov’s PAUSE program explicitly tracks firms and fictitious “regulators” that falsely present themselves as registered or US-based.
A claimed license is only as good as the regulator’s confirmation, and if the platform resists giving details that can be independently verified, that resistance is the tell.
4. Guaranteed returns
The fourth red flag is the argument of guaranteed returns and “can’t-lose” AI. Both the complaint and multiple Investor.gov alerts flag promises of high, low-risk returns as a hallmark of fraud.
The group chat and social media alerts stress that stock-tip and crypto scams often hinge on claims that an algorithm or insider access can deliver outsized gains. Real markets involve risk. Claims that erase that risk are claims that erase reality.
5. Withdrawal taxes or fees
Another red flag is the presence of fees and taxes to withdraw. The SEC says most of the losses came from “advance fees” demanded to unlock accounts or avoid three-year freezes.
Regulators repeatedly warn that legitimate firms deduct fees from proceeds rather than asking customers to prepay taxes or pay upfront for access to their own money.
Once a platform starts asking for money to give back money, the relationship has flipped from investment to extortion.
6. Pressure to send crypto
The last red flag pointed by the SEC is the pressure to wire or send crypto to unknown wallets.
The complaint details wire transfers and crypto transactions to dozens of bank accounts and wallet addresses unrelated to any regulated broker. The group chat alert specifically lists wiring money to individuals or sending crypto to unknown wallets as a key sign of fraud.
Real brokers use clearing accounts with transparent ownership and regulatory oversight. If the destination account changes or the platform insists on crypto-only transfers to a wallet address with no institutional backing, that’s the exit sign.
| Scam claim (or pattern) | What’s actually happening | How a reader can check it |
|---|---|---|
| “We’re SEC-licensed / fully regulated” | The entities behind Morocoin/Berge/Cirkor are not in SEC, FINRA, or state registries. The “licenses” and badges on the site are invented. | Search the person and firm on Investor.gov’s “Check Out Your Investment Professional” and on the SEC’s PAUSE list. No hit = walk away. |
| “Look at your profits in the app – you’re up 40% already” | The “portfolio” screen is just a UI; there is no real brokerage account or external custody. Scammers can type any balance they like. | Ask: “Where is my account held, and what’s the custodian?” Then independently contact that firm or check your name and holdings in their portal. If everything lives only inside one obscure app, that’s a major red flag. |
| “Our AI trading model has never lost – low risk, guaranteed returns” | Real advisers cannot truthfully guarantee returns. Here the “AI” is just marketing gloss to justify aggressive signals and bigger deposits. | On Investor.gov, look up the individual/firm and review Form CRS and ADV. Any talk of “guaranteed” or “risk-free” performance is itself a sign you’re dealing with a scam. |
| “This STO is like an IPO – pre-screened and approved by regulators” | The alleged STOs and issuers do not exist in any securities registry; they are made-up tickers on a fake platform, used to demand larger investments. | Search the token name and issuer on EDGAR (sec.gov), on your national securities regulator’s site, and in basic corporate registries. If you only find the scam site promoting it, assume it’s fictitious. |
| “To withdraw you must first pay taxes/loan fees/‘investigation’ costs” | Classic advance-fee fraud. Legitimate firms deduct taxes and fees from your proceeds; they don’t require you to wire more money just to access your own balance. | Ask any licensed broker or bank how withdrawals work. If someone insists you must pre-pay taxes or ‘unlock’ fees by sending money to a new wallet/account, stop and report it. |
| “Send funds by wire or crypto to this wallet – your account will be credited” | Victims are sending money straight to the scammers’ bank accounts and wallets, often in other countries. Once sent, it’s very hard to recover. | Check the payee name on wires: does it match a real, registered firm? For crypto, be suspicious of any platform that only funds via transfers to personal or OTC-looking addresses rather than through known exchanges. |
| “We are investigating your account; if you don’t cooperate, it will be frozen for years” | Fear tactic to keep you engaged and paying more “fees.” There is no regulator involved and no legal power to freeze anything – they control the database. | Independently contact the regulator they claim to represent. Use contact details from the official website, not from the chat or app. If the regulator has never heard of your case, you’re dealing with impostors. |
Verify claims in 90 seconds
Investor.gov provides a verification routine that takes less time than scrolling through a group chat.
- Potential investors should check the person via Investor.gov using the “Check Out Your Investment Professional” search, and look up the individual’s name and the firm they claim to represent.
The group chat alert and AI fraud alert both tell investors to confirm they are dealing with the real, registered firm using Form CRS details, not phone numbers or links sent in a chat. If the search returns nothing or returns a different firm with a similar name, that is a stop sign.
- Check the platform. Search for the trading site’s name on the SEC’s PAUSE list and in general web searches, using terms like “scam,” “complaint,” or “Investor.gov alert.”
The PAUSE program is designed specifically to surface unregistered entities and fake regulators. A clean PAUSE result does not guarantee legitimacy, but a hit on the list is definitive.
- Sanity-check the claims. Copy a line of promotional text or a “testimonial” into a search engine and see if it appears word-for-word across different sites, which is common with template scam content.
Cross-check any purported licenses against the relevant national regulator’s database rather than relying on screenshots. If the platform or club resists providing verifiable details, that resistance is an answer.
Why this case matters now
The SEC’s newsroom write-up explicitly links this enforcement action to its broader warning that fraudsters are now using popular social-media platforms and messaging apps to target US retail investors with AI-flavored pitches.
Recent Investor.gov alerts add context: regulators are seeing more “long-con” relationship and group chat scams in which trust is built over weeks through friendly or romantic exchanges before the investment hook appears, often involving crypto platforms that exist only on the scammer’s servers.
AI lowers the cost of churning out convincing screenshots, prospectuses, “STO” white papers, and even deepfake videos. At the same time, encrypted chats give scammers a closed, high-pressure funnel to migrate victims off public platforms.
The combination makes these schemes scalable in ways that earlier generations of fraud were not. A single operator can run dozens of WhatsApp groups, each with a different “professor” persona, feeding victims to the same set of fake platforms with minimal marginal cost per new victim.
On the legal side, the SEC is seeking permanent injunctions, civil penalties, and disgorgement with interest from the main platform entities.
That means, if it prevails, the court can bar the defendants from future violations, impose money penalties, and order any traceable funds to be repaid into a distribution process for victims.
For investors suspecting they have been targeted by a similar scheme, the SEC and FBI accept tips through the SEC’s online complaint center and the FBI’s Internet Crime Complaint Center (IC3).
Even if the money is gone, filing a report creates a record that can help regulators identify patterns, freeze assets, and potentially recover funds for other victims. The PAUSE list gets updated as new entities surface, and each report makes the next warning faster.
