This article examines the rise of cryptocurrency fraud through Nigeria’s CBEX Ponzi scheme, highlighting global trends such as high-yield investment schemes, pig butchering and romance scams. It explores the sophisticated money laundering methods behind these schemes and identifies key indicators anti-fraud professionals can use to detect and combat this growing financial crime threat.
In April 2025, crowds swarmed a building in Ibadan, Oyo State, Nigeria. They weren't there out of joy or in government protest; they were grieving. Between 250,000 and 300,000 Nigerians and a significant number of Kenyans had invested their savings into CBEX, a fraudulent cryptocurrency exchange that authorities would later describe as a sophisticated, large-scale Ponzi scheme. Estimated losses exceeded NGN 1.3 trillion (or about USD 800 million). Within days of the platform going dark, the people behind it had vanished, and the cryptocurrency entrusted to the scheme was nowhere to be found.
To understand the impact, you have to go back to how it started. CBEX did not arrive quietly. The scheme launched in 2024, and from the beginning, it was built on borrowed credibility. It was called the Crypto-Bridge Exchange and falsely marketed as an AI-powered trading platform with ties to the China Beijing Equity Exchange, a legitimate state-affiliated Chinese financial institution. That claimed affiliation was later denied by Beijing, but by then, the perceived credibility had already done its work. For many potential investors, particularly those with limited exposure to global financial markets, the association with a Chinese state institution carried the weight of institutional legitimacy.
What followed was a textbook social recruitment operation. CBEX promoters flooded WhatsApp groups, Telegram channels and social media feeds with testimonials, dashboards showing growing returns and referral incentives that turned ordinary investors into marketing agents. The platform promised a 100% return on investment within 30 days, a figure so extraordinary that, under normal circumstances, would end the conversation immediately.
However, CBEX operated under the conditions of economic precarity, naira volatility (Nigeria’s official currency) and constrained legitimate investment options that define the financial reality of millions of Nigerians. In that context, the promise of doubling your money in a month did not sound like fantasy; it sounded like the kind of opportunity that people who knew the right people always had access to and now, finally, so did everyone else.
The platform maintained physical offices in Ibadan and Lagos, reinforcing the impression of legitimacy. This was not a fly-by-night website with an anonymous registration because you could walk through the door and speak to someone. That physical footprint was deliberate, as it converted skeptics and gave the scheme the architecture of a real business at a moment when Nigeria's licensing framework for virtual asset service providers was still in its early, formative stage; the Investment and Securities Act 2025 had not yet been enacted.
By early April 2025, the cracks began to show. Withdrawal requests started failing, yet the platform's response was immediate and calculated: A "security breach" had temporarily frozen accounts. Users attempting to access their funds were told they needed to pay "verification fees" (a secondary fraud layered on top of the primary one), designed to extract additional money by exploiting the very desperation the collapse created. On April 14, 2025, CBEX went dark. Account balances were wiped to zero, and the operators disappeared with no trace of the funds. This was not an isolated incident. It was a cautionary case study in the mechanics of modern financial fraud and, more importantly, one that demands analysis from anti-fraud professionals working in an era where the tools of deception have grown significantly more sophisticated.
— Financial Action Task Force, Targeted Update on Virtual Assets and VASPs (June 2025)
Today, cryptocurrency-related fraud has evolved into a genuine global crisis and one of the fastest-growing threats to ordinary people's savings across every continent. What makes this fraud particularly difficult to contain is the combination of three features that are built into the technology: speed, reach and the relative anonymity of blockchain transactions. By the time a victim realizes something is wrong, the money has often already moved across multiple jurisdictions and been converted more than once.
The numbers are stark. The FBI's Internet Crime Complaint Center reported $9.3 billion in crypto fraud losses in 2024 alone, a 66% increase year over year that should give any financial crime professional pause. Chainalysis estimates the real figure is closer to USD 12.4 billion once unreported flows are factored in. The Financial Action Task Force (FATF), which serves as the global standard-setter for anti-money laundering and counter-terrorist financing, has cited approximately USD 51 billion in illicit on-chain fraud activity, a figure that reflects not just direct fraud losses but the broader ecosystem of illicit value moving through virtual asset infrastructure worldwide.
Perhaps more instructive than the losses themselves is what they reveal about the architecture of cryptocurrency fraud. These schemes are not random or improvised. Regardless of differences in geography, platforms and victim profiles, the underlying blueprint is remarkably consistent. The same psychological levers are pulled. The same false legitimacy is constructed. The same exit mechanisms are deployed when the scheme reaches its natural end.
That consistency is actually useful intelligence. It means that with the right framework, an experienced anti-fraud professional can recognize the pattern early, often before the collapse, and sometimes before significant harm has been done. The challenge is that the fraudsters running these schemes are also learning. They read the same typology reports we produce. They adapt their language, platforms and corporate structures in response to regulatory pressure. The 66% year-over-year growth in reported losses is, in part, a measure of how effectively they have adapted to the systems designed to stop them.
High-yield investment schemes (HYIS): This tactic remains one of the most common methods used by fraudsters to attract victims, as seen in cases like CBEX, where victims are promised unrealistically fixed and guaranteed returns. The schemes typically rely on aggressive marketing tactics and pressure to recruit additional participants, using realistic dashboards to show growing "profits" that do not exist. A key reason crypto is the preferred payment rail is that deposits are usually irreversible once confirmed, posing serious challenges for investigators.
Pig butchering: Known in Mandarin as Sha Zhu Pan, meaning “fattening the pig before slaughter,” this scheme is built on a simple but sophisticated premise: earn a victim’s trust before exploiting it. Fraudsters take their time to carefully build connections with victims that feel authentic, often over the course of weeks or even months, before steering them into a fake investment opportunity. Since 2020, these schemes have extracted an estimated USD 75.3 billion globally, and estimated average individual losses have reached more than USD 155,000.
Crypto-enabled romance scams: Emotional manipulation as the heart of romance scams hasn’t changed. Rather, the payment method has evolved with wire transfers increasingly being replaced by cryptocurrency. The FBI's Operation Level Up, launched in 2024, had by early 2026 notified nearly 9,000 victims still being actively defrauded and referred 93 for suicide intervention. While media coverage often focuses on financial losses, these scams also take a significant human and emotional toll on victims.
In my experience analyzing these cases as an intelligence analyst, I have often observed a tendency to ask why victims failed to see the warning signs. However, the more useful question to ask is: What did the fraudsters understand about their targets that we didn’t? That answer lies in their understanding of economic precarity, aspiration and social networks. CBEX spread through word-of-mouth recommendations within trusted community endorsements like church networks, family groups and WhatsApp communities. Real people received legitimate early returns and shared their experiences with people closest to them. The testimonies shared weren’t false but structural in nature, because Ponzi schemes thrive on the key principle that early investors always get paid.
Various studies have documented the trauma responses among victims, including shame, self-blame and profound reluctance to come forward. When cryptocurrency fraud is labeled as a "too good to be true" situation that should have been obvious to the victims, we miss the uncomfortable reality that fraudsters know the mental and emotional tolls of their scheme are tools they can use to perpetuate and conceal their crimes even longer.
Understanding the complexities involved in these schemes is only half the job. The other half is following the money, a path that has become increasingly sophisticated. In a high-profile, large-scale investment fraud scheme analyzed by the NFIU, the laundering process followed a deliberately engineered pattern. The scheme generated a unique wallet address for every individual victim, which prevented competent authorities from clustering transactions or identifying common exposure across the network. Victim funds were then channeled through multiple intermediary "funnel addresses," creating a complex transaction web on the TRON blockchain. The analysis further showed that offshore centralized exchanges, including major global virtual asset service providers (VASPs) operating entirely outside Nigeria's regulatory reach, served as the final cash-out points. These exchanges provided not only an exit ramp for illicit proceeds but an additional layer of anonymity for the perpetrators. FATF's 2026 report on offshore VASPs specifically cited this NFIU analysis, including one global VASP-linked wallet that held approximately USD 600 million at the time of review. The NFIU disseminated its findings to law enforcement agencies for further investigation.
The TRON network deserves particular attention. Its low transaction costs, speed and widespread USDT availability have made it a preferred laundering rail for crypto-fraud proceeds globally. For criminal actors moving large volumes of funds, these features offer an efficient way to transfer value across jurisdictions without the delays and costs associated with traditional financial channels. In some cases, the laundering process does not end on a single blockchain. Funds may be transferred through cross-chain bridge services, allowing assets to move between networks, adding another layer of complexity to the tracing process.
While bridges serve legitimate purposes within the digital asset ecosystem, they can also be exploited by criminal actors seeking to fragment transaction trails and hide the movement of funds. Viewed through an AML lens, the process itself is surprisingly familiar:
The technology may be new, but the underlying laundering logic remains largely unchanged.
The good news is that these schemes rarely appear out of nowhere. They leave clues along the way. For compliance professionals, investigators, analysts, auditors and Certified Fraud Examiners (CFEs), the following indicators can help separate legitimate opportunities from carefully disguised frauds:
The CBEX collapse wiped out the savings of a quarter of a million people in a matter of weeks. Meanwhile, pig butchering networks have spent years refining their methods and expanding across continents, often staying one step ahead of enforcement actions. These are not isolated incidents or unusual cases in the crypto-fraud world and have unfortunately become part of the landscape.
For CFEs, the lesson is not that these schemes are impossible to stop, but that they are rarely as unique as they appear. Behind the promises of extraordinary returns, sophisticated technology and convincing narratives lies a familiar playbook. The fraud may be modern, but many of the underlying mechanisms are not. The more we understand how these schemes recruit victims, move money and conceal profits, the better equipped we become to disrupt them. Through stronger investigations, smarter compliance programs and effective public education, we can make it increasingly difficult for these operations to thrive at scale. Fraudsters are constantly adapting, and the anti-fraud profession must adapt faster.
