A documented pattern of organised fraud is targeting corporate borrowers across Europe and the Gulf. It has cost technically sophisticated founders tens of millions of dollars since 2021, exploiting a recurring gap in understanding how non-custodial cryptocurrency wallets work. This fraud reveals a category of transaction risk that legal due diligence has not traditionally addressed: the closing process itself. This blog explains the mechanics from first principles, examines the corporate lending variant and identifies the structural protections available to practitioners and their clients.
From Cash to Crypto: The Same Fraud, Higher Stakes
The “Rip Deal” is a long-established European confidence fraud. In its original form, a seller of something valuable, such as gold, currency or a prestige watch, agrees to sell for cash. At the point of exchange, genuine banknotes are switched for either counterfeits or a bundle of real notes concealing paper filler. The target walks away believing the transaction is complete. Vienna's Rip-Deal Unit, established as one of the few specialised law-enforcement units focused on this fraud typology, has tracked this pattern across Austria, Germany, Switzerland, France, Italy and Spain, attributing it primarily
to criminal networks based in the Western Balkans.
Around 2018, those same criminal networks recognised that cryptocurrency offered a materially better version of the same scheme, a development sometimes described by European investigators as “
Rip Deal 2.0.” Large cash transactions had become difficult. Commercially sophisticated targets resist parting with physical cash without legal protections, cash movements attract regulatory scrutiny, and large banknote transfers no longer correspond to how serious business is conducted. Cryptocurrency materially reduced those frictions.
A blockchain balance is visible, verifiable and carries the legitimacy of modern finance. Targets who would decline a cash deal often engage readily with a crypto-denominated one. It does not help that many people who have encountered cryptocurrency believe they understand it well enough to conduct a secure transaction; that confidence is often the critical vulnerability. According to
Szaga-Doktor of Vienna's Rip-Deal Unit, approximately two-thirds to three-quarters of its cases involve cryptocurrency. Unlike cash fraud schemes, cryptocurrency scam cases involve no counterfeit material, a largely eliminated trail of evidence and are difficult to recover because of the nature of the technology itself.
The Technical Blind Spot
A non-digital native’s mental model of a cryptocurrency wallet is often wrong in one respect, and that mismatch is the foundation of the fraud. A wallet application, such as Trust Wallet, Exodus or MetaMask, does not hold cryptocurrency in the way a bank account holds money. It holds a private key: a cryptographic number from which wallet addresses are derived. The cryptocurrency exists as an entry on the blockchain ledger, at an address controlled by that key. The device is a key ring, not a safe.
Every non-custodial wallet generates a seed phrase on creation: 12 to 24 ordinary words from which the private key is derived, enabling recovery on any new device. Whoever possesses the seed phrase controls the wallet’s contents permanently from anywhere in the world. It cannot be changed, cancelled or reversed by any institution. This produces the insight on which the entire fraud turns: Once an unauthorised party obtains a seed phrase, by any means and however briefly, the wallet is permanently compromised. Physical custody of the device provides no meaningful protection, as a switched-off phone held by a lawyer is no safer than one left on a table. The loss of control occurs the moment the phrase is seen.
The Corporate Lending Variant: A Worked Example
The most significant recent development is the adaptation of this fraud to fabricated institutional lending transactions, a variant we have encountered directly in advisory engagements. Consider the following composite of documented cases.
A company is approached via LinkedIn by a European fund offering a multimillion-dollar term loan. Correspondence is professional, the loan agreement is drafted to institutional standards, and the counterparty has legal representation. After weeks of negotiation, the borrower’s advisers have reviewed documentation that seems to be commercially reasonable. When the closing schedule arrives, the borrower must deposit the first year’s interest in cryptocurrency into a non-custodial wallet and demonstrate the balance at an in-person meeting. The rationale given is proof of solvency or financial capacity, or some variant thereof. The borrower’s advisers, unfamiliar with the mechanics of non-custodial wallets, raise no objection.
At the meeting, the phone is briefly handled. One person engages the borrower in conversation. Another, unnoticed, photographs the seed phrase displayed in the application settings, scans a QR code that silently imports the wallet to a second device, or has already positioned a camera in the room to capture the screen. Extraction does not require the borrower to hand over anything voluntarily. The same result can be achieved via video call, where screen capture replaces physical observation. Victims often cannot identify the method, even retrospectively. The meeting ends. At the lender’s suggestion, the phone is placed with the borrower’s lawyer or in a Faraday bag, which is presented as funds protection during the transfer period. This step protects nothing. The seed phrase has already been compromised. The loan never funds. The wallet is drained remotely while the device sits undisturbed.
Documented cases confirm the pattern.
Webaverse co-founder Ahad Shams lost USD 4 million at a Rome hotel meeting in November 2022.
Coin Publishers CEO Chris Hunter lost USD 206,000 in Barcelona in January 2023, with the seed phrase photographed in 30 seconds. Victim funds have not been recovered in any publicly reported cases.
The Legal Diagnostic
The corporate variant has a recognisable negotiation pattern: the counterparty accepts all substantive commercial terms without resistance, including assignment restrictions, borrower-protective covenants and liability exposure, but remains rigid about the closing process. A legitimate institutional lender negotiates hard on assignment rights and enforcement provisions because they determine whether the facility is commercially viable. Indifference to every operative provision, combined with inflexibility on a physical wallet demonstration, communicates the actual objective plainly. The documents are not the transaction; the closing process is the transaction.
That signature also aligns with regulatory guidance. The Financial Action Task Force’s 2020 “Virtual Assets: Red Flag Indicators of Money Laundering and Terrorist Financing” is reflected in the United Arab Emirates (UAE) anti-money laundering (AML) and countering the financing of terrorism (CFT) supervisory frameworks, including those of the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM). These directly flag three patterns that map precisely onto this closing mechanism:
- A large deposit into a non-custodial wallet inconsistent with the customer’s profile,
- Use of unhosted wallets to bypass regulated custody.
- Persistent “Know Your Client” (KYC) refusal.
In plain terms, regulators have already identified features of this closing structure as suspicious transaction indicators. The commercial diagnostic and the regulatory framework point to the same conclusion: Practitioners advising on transactions that show these characteristics should consider AML reporting obligations before any further engagement.
Protective Measures
No legitimate large-value transaction requires proof of financial capacity via a non-custodial wallet demonstration. Standard instruments are bank proof-of-funds letters, regulated escrow confirmations or audited statements. Any closing mechanism requiring a client to load material cryptocurrency into a non-custodial wallet for physical display is itself the red flag, irrespective of how professional the surrounding documentation appears. As
Mario Kaintz of Vienna's Rip-Deal Unit has observed, a genuine business partner never demands a specific wallet or insists that a new wallet be installed.
The most effective counter-proposals function as transactional integrity tests, analogous in structure and designed to sanction screenings or proof-of-funds verifications in cross-border transactions. The counterparty’s funds are lodged with a regulated escrow bank, conditional on the borrower’s cryptocurrency being lodged with a licensed custodian, such as BitGo or Anchorage Digital, with simultaneous dual-confirmed release. In our experience, fraudulent counterparties do not accept this structure because it removes the conditions necessary for wallet compromise. The refusal or disengagement that follows converts a complex judgment about counterparty legitimacy into a near-binary structural test, at no commercial disadvantage to a legitimate lender.
Recourse and Implications for Practitioners
Stolen funds are fragmented within minutes across blockchain addresses and routed across jurisdictions before any intervention is possible. The FATF's 2025 update notes that, at the time of reporting, only 3.8% of the funds stolen in the Bybit theft had been recovered, highlighting broader challenges in virtual asset recovery. Prevention is, in practice, the primary protection.
Key recommendations for practitioners:
- Familiarity with this typology is critical. The FATF red flag framework and Vienna unit advisories are the relevant reference points, in the same way that sanctions screening guidance informs deal work in other contexts.
- Any non-custodial wallet demonstration requirement in a closing schedule warrants immediate specialist input, regardless of how professional the surrounding documentation appears.
- The transactional integrity test described above is available at any stage and does not impose meaningful added cost. A counterparty’s response to it has, in our experience, consistently provided the clearest available signal of legitimacy.
The crypto rip deal is a closing mechanic fraud and closing mechanisms are now a category of transaction risk that practitioners must analysis with the same rigor as counterparty due diligence or contractual risk allocation.
