Fourteen Domains, One Template: How the FXO Fake Broker Kept Moving, and the $4.87M Wallet Trail Linked to It

BlockintAI · 2026-10-19T12:15:06.606Z

BlockintAI research. Domain, DNS and registration checks were made on Sunday, October 18, 2026, between about 6:29 PM and 6:48 PM Central Time (CT); stablecoin freeze and sanctions checks at 6:30 PM CT. On-chain figures cover the full history of each wallet on Ethereum and count only real USDC, USDT and ETH transfers of $10 or more. Times are CT unless marked UTC; on-chain dates, registration-record (RDAP) dates and urlscan capture dates are UTC.

On May 6, 2026, Greece's Hellenic Capital Market Commission (HCMC) put out a short notice: the website fxoexchange[.]com was not authorised to provide investment or crypto-asset services in Greece. Two days later IOSCO, the global body of securities regulators, republished it on its I-SCAN warning list.

By then the domain was already dark. Its registrar had put it on hold a week earlier. FXO didn't stop. That same day a replacement name was registered, and over the next four months the brand turned up on a string of new addresses: fxoxx[.]net, fxoex[.]ai, fxoex[.]now, fxovip1 through fxovip4, and finally, in September, a site dressed up as Coinbase.

On the morning of October 17, 2026, Dynadot moved nine FXO domains into deletion in one batch that took about five minutes. As of Sunday evening, none of the 14 domains serves a website.

This post lays out the domain story, the victim accounts and the regulator warnings. It also follows five Ethereum wallets that an investigative lead associates with FXO. That link is low confidence: nothing on-chain names FXO, and no public source confirms the connection. The wallets are worth a close look anyway, because their structure is a textbook example of how a fake trading platform takes deposits at scale.

Key facts

A warning from Athens

The HCMC notice is dated "Athens, 6 May 2026." It names fxoexchange[.]com and says the entity behind it is not authorised to provide investment services, nor authorised as a crypto-asset service provider under the EU's MiCA rules. IOSCO's I-SCAN service, which collects warnings from securities regulators around the world, carried it on May 8, 2026 as warning #52011, under "Unregistered/Unlicensed entity." HCMC came back to FXO on September 21, 2026 with a warning about fxoxx[.]net, which IOSCO carried on September 24 as warning #56696.

A regulator warning doesn't tell you how a platform recruits people. The other public sources fill that in.

BrokerListings, a broker review site, keeps a page on FXO Exchange, last updated October 16, 2026. It names fxoexchange[.]com, fxovip1–4[.]com, fxoxx[.]net, fxoex[.]ai, fxoex[.]now and fxokf[.]top as FXO domains. It says new users need a referral code to sign up, and it cites user complaints about withdrawals that were never paid.

That referral-code detail matters. Real brokers want as many customers as they can get. A trading platform you can only join with a code from someone you already know is how pig-butchering operations work: the "friend," romantic interest or WhatsApp "mentor" supplies the link and the code, so every new account arrives with a handler attached. The code also keeps the site away from casual visitors, reviewers and researchers.

Trustpilot has seven reviews of fxoxx[.]net, 71% of them one-star. Two posted on May 29, 2026 say it plainly: "They scammed me for 3000 usd. they won't let you withdraw," and "I LOST ALL THE INVESTEMENT." A later review on the same page promotes a "recovery" firm. That is a second scam aimed at people who have just lost money, and it is a common pattern under every fake-broker review page.

Fourteen domains, one storefront

FXO never settled on one address. Registration records (RDAP) show 13 FXO domains registered over about ten months, plus the Coinbase lookalike four months after that. Several were registered in batches, down to the second.

A few things stand out.

Batches registered in the same second. fxoex[.]com, fxoex[.]net and fxoex[.]vip were all registered at 15:57:59 UTC on January 10, 2026, split across two registrars, Gname for the .com and Dynadot for the other two. Four months later, fxovip1, fxovip2, fxovip3 and fxovip4 were registered together at 12:59:55 UTC on May 19, 2026. Nobody types four domain orders in the same second by hand. These were bought in bulk, ready to swap in.

A replacement the same day. Gname put fxoexchange[.]com on hold at 09:35 UTC on April 29, 2026. At 12:58 UTC the same day, fxoex[.]cc was registered. That one was held too, on May 12.

Building ahead of the warning. fxoxx[.]net and fxoex[.]ai were registered on May 5, 2026, the day before HCMC published its notice. fxoex[.]now followed on May 18 and the four fxovip names on May 19. When the regulator's warning reached the main domain, the next set of storefronts was already in place.

Shared certificates. One Amazon certificate dated September 11, 2026 covers both fxovip1[.]com and fxovip2[.]com (public certificate logs via CertSpotter). On September 14, 2026, fxoex[.]net and fxoex[.]com received new certificates two minutes apart, at 20:56 and 20:58 UTC, even though the two sit at different registrars.

The same page every time. Public urlscan captures of fxovip1[.]com (October 4, 2026) and fxoxx[.]net (September 25, 2026) show the same homepage, titled "FXO," with the tagline "Empowering Global Transactions," the promise to "Easily trade over 1700 cryptocurrencies," and an odd market list that leads with metals: GOLD, COPPER, Lead, Nickel, Palladium, Silver. Both were hosted on Amazon infrastructure.

The rotation ran in one direction only. Once a registrar held or deleted an FXO domain, it stayed that way. The operators didn't fight to get names back; they moved to the next one.

The Coinbase lookalike

The newest domain changed tactics. coinbasefxo[.]com was registered at Gname on September 21, 2026, on the same nameserver family as fxoexchange[.]com and fxoex[.]cc.

On October 4, 2026, urlscan captured coin-base.coinbasefxo[.]com. The page used a Coinbase-style logo and carried the browser title "Coinbase." Underneath, it was the FXO storefront: the same metals-first list (GOLD, COPPER, Lead, Nickel, Palladium) and a similar menu, with Markets, Futures and Asset Management. It is a template match, not a copy of Coinbase's real site.

Two days earlier, on October 2, 2026, a sister subdomain, cb-fxo.coinbasefxo[.]com, was already behind a Cloudflare "Suspected Phishing" warning page. The domain picked up four certificates in its short life, from Let's Encrypt (September 25), Sectigo (September 30 and October 1) and Amazon (October 3), all wildcards covering every subdomain. On October 6, 2026, Gname put the whole domain on hold.

Wrapping a fake broker in a famous exchange's name is a small change with a big effect. A victim who is told to "check it's real" sees a familiar logo. A victim who searches the name later finds the real company. That is what a lookalike is for: it borrows a trusted brand's look to lend a fake broker credibility.

The takedowns

The registrars dealt with FXO in two waves.

Gname acted one domain at a time:

• fxoexchange[.]com on April 29, 2026, a week before the HCMC warning.
• fxoex[.]cc on May 12, 2026, thirteen days after it was registered.
• coinbasefxo[.]com on October 6, 2026, about two weeks after it was registered.

Dynadot moved fxoex[.]vip into deletion on October 10, 2026. Then, on October 17, 2026, between 10:42 and 10:47 UTC (5:42 to 5:47 AM CT), it moved nine more into redemption or pending delete: fxokf[.]top, fxoex[.]net, fxoxx[.]net, fxoex[.]ai, fxoex[.]now and all four fxovip domains. In about five minutes, most of FXO's remaining storefronts went dark.

That leaves fxoex[.]com, registered at Gname in the same second as two of the Dynadot domains. Of the 14 domains in this post, it is the only one not on hold or in deletion. As of 6:48 PM CT on October 18, 2026 it has nameservers but no address record, so it serves nothing. Every other domain on the list returns no DNS answer at all.

One more name may belong on the list. ScamAdviser's page for fxoxx[.]net shows "Redirecting from website fxoex[.]one." RDAP shows fxoex[.]one was registered at Gname on January 23, 2026, and, like fxoex[.]com, it is not on hold or in deletion. As of 6:55 PM CT on October 18, 2026 its nameservers return no answer. With their registrations intact, fxoex[.]com and fxoex[.]one are the ones to watch.

The wallets: an investigative lead

An investigative lead associates five Ethereum wallets with FXO. To be plain about it: the link between these wallets and FXO is low confidence. No public source confirms it, nothing on-chain names FXO, and none of the five wallets carries a public name tag on Etherscan (checked October 18, 2026). What follows is what the blockchain shows about these wallets. Anyone can check it on Etherscan.

The lead started with one address, 0xf72a87dfd1581ff2d7e2ad9144dcb74eb607a265. Its real transfer history fits in a few lines:

That is all: 2,203.68 USDC in two transfers, each gone about two minutes after it landed.

The sending side looks like an ordinary person paying. The sending wallet is older, from 2023. Minutes before each payment it was funded: once by an unlabeled address, 0x7bef1627…, and once by a withdrawal from an address Etherscan tags "Bybit: Wallet 4." Buy stablecoins at an exchange, withdraw to your own wallet, then send to the address the "platform" gives you: that is how most pig-butchering deposits look on-chain.

The receiving side looks like machinery. An address that holds money for about two minutes, is topped up with exactly enough gas to move it, and empties into one bigger wallet is a per-user deposit address. Platforms that use this setup give each customer their own address, then sweep all of them into a central wallet. It lets the operator see who paid what, without customers ever seeing each other's addresses.

4,003 senders, one gas wallet

The consolidation wallet, 0x7ebcb8e15c47c99629619b9a5a571c3aa2698258, first moved on July 9, 2026. Over its full history it received about $4.87M in USDC, USDT and ETH, counting only transfers of $10 or more, from 4,003 different sending addresses between July 9 and August 24, 2026 (UTC). Most of that was USDC: about 4.77 million, with about 93,000 USDT and a few ETH.

Those 4,003 addresses aren't 4,003 people. One person paying several times through their own deposit address shows up once, but a person given new addresses, or paying from several wallets, can show up more than once. What the number does show is scale. About $2.18M came in during July and about $2.69M in August. Most senders paid in the hundreds or low thousands of dollars:

The key detail is where those addresses got their gas. 3,780 of the 4,003, about 94%, were topped up with ETH by the same wallet, 0xb9f5c378f929fce7e408e7d3a39bfec96a2b48e9, the one that fuelled the lead address. They carried about 95% of the money. In other words, nearly all the inflow came through deposit addresses built and serviced by one operator.

The consolidation wallet then sent everything on to just three places:

• about $3.72M USDC to the gas and payout wallet 0xb9f5c378…48e9
• about $912K USDC to a secondary wallet, 0xb93daead3715d2dc1060aa639856d49d177c6072
• about $243K in USDC and USDT, plus about 5.24 ETH, to an exit wallet, 0xd964cc46e1ec2b2af1898461beb0b8e0a75f9b22

Its last outgoing transfer was on August 25, 2026. It is empty now.

The payout wallet: 4,021 addresses gassed, $5.13M paid out

0xb9f5c378f929fce7e408e7d3a39bfec96a2b48e9 has two jobs.

The first is gas. Over its history it sent ETH to 4,021 addresses, almost all of them tiny top-ups, just enough to move a deposit. That is the fuel line for the deposit-address system.

The second is paying out. It received about $3.72M USDC from the consolidation wallet and about $817K from the secondary wallet, along with money from other addresses. Between July 9 and August 25, 2026, it paid about $5.13M USDC out to 2,148 addresses outside this group of wallets. None of the largest recipients carries a public label. The wallet was last active on August 27, 2026.

Public data can't say who those 2,148 addresses belong to. The pattern fits two readings, and both are common in investment fraud. Some of it may be "withdrawals" paid back to customers: in a pig-butchering script, the first small withdrawal that actually works is what persuades a victim to send the big deposit. Some may be onward wallets controlled by the operators. Only five of the 2,148 recipients also appear among the 4,003 senders.

The secondary wallet, 0xb93daead3715d2dc1060aa639856d49d177c6072, first moved on July 9, 2026, 17 minutes after the consolidation wallet. It took in about $912K USDC from the consolidation wallet and passed it on: about $817K to the payout wallet and about $258K in USDC and USDT to the exit wallet. The difference came mostly from another wallet it traded back and forth with. It last moved on August 25, 2026, and holds nothing.

The exit wallet and the bridge

0xd964cc46e1ec2b2af1898461beb0b8e0a75f9b22 is different from the others. It has been active since November 15, 2025, eight months before the consolidation wallet existed, and it has dealt with counterparties that have nothing to do with this group. Older wallets reused as an exit point are common; it is one reason to be careful about totals.

From July to August 2026 it received about $538K in USDC and USDT from the consolidation, secondary and payout wallets. Its main outlet was 0x1481e58411608b2d628ef305b92b01cf4f83db70, which Etherscan tags "HiFiSwap: Bridge 7," a public cross-chain swap service. Over its whole history the exit wallet sent about $995K in USDC and USDT there. Only part of that belongs to this story: about $444K in USDC and USDT went to HiFiSwap from July 9, 2026 on, when the consolidation wallet began operating. The rest went earlier.

A cross-chain swap takes coins on one blockchain and delivers coins on another. For a scam operation, it moves the money off Ethereum, away from the trail that leads back to the deposit addresses.

The exit wallet's last stablecoin move was on August 25, 2026, and its last ETH move on August 26, 2026. Later entries in its history are junk tokens sent to it, not real activity. The payout wallet received one more USDC transfer on August 27, 2026; none of the five wallets has sent anything since.

What the trail adds up to

Taken together, the five wallets describe one system:

1. Each payer gets their own deposit address.
2. One gas wallet tops up those addresses so their contents can be swept.
3. Everything is swept into one consolidation wallet, $4.87M from 4,003 sending addresses in about seven weeks.
4. A payout wallet sends large sums back out to thousands of addresses.
5. An older exit wallet moves money through a cross-chain swap service.

Shared gas funding, minute-scale sweeps and a same-day setup on July 9, 2026 make it likely, at medium confidence, that one operator runs all five wallets. The same structure is also how a legitimate custodial service handles deposits, which is why the on-chain pattern alone doesn't prove fraud. The tie to FXO comes from the investigative lead, at low confidence. The evidence that FXO itself operated as an unauthorised broker with scam indicators, from the regulator warnings, the victim reviews and the domain rotation, is high confidence.

Nothing has been frozen. As of 6:30 PM CT on October 18, 2026, the USDT contract's blacklist check and the USDC contract's blacklist check both return false for all five wallets, and none of them is on OFAC's sanctions list.

Red flags in the FXO playbook

• An invite code from someone you met online. A trading platform that needs a referral code from your new contact is a platform that contact controls.
• A name you can't find a history for. FXO's storefronts lasted weeks or months each. A real broker doesn't change its web address every few months.
• A regulator warning. Search the platform's name and domain on your national regulator's site and on IOSCO's I-SCAN list before you send anything. FXO drew HCMC warnings on May 6 and September 21, 2026.
• A familiar logo on an unfamiliar address. coin-base.coinbasefxo[.]com showed a Coinbase-style logo. Type the real exchange's address yourself rather than following a link.
• A deposit address that is "just yours." Your own address on a platform isn't proof it's real. Fake brokers use the same per-user deposit setup as genuine ones.
• A small withdrawal that works. It is part of the script. It buys trust for the bigger deposits that follow.
• Withdrawals blocked by fees, taxes or "verification." That is the end of the script, not a glitch.
• "Recovery" offers. Anyone who contacts you offering to get your money back for a fee is running the next scam.
• Report it. In the U.S., report fraud to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov. In Greece and the EU, contact the HCMC or your national regulator; elsewhere, report to your national police cybercrime unit. If you've been scammed, you can also file a report at blockint.ai with the website, chat names, deposit addresses and transaction hashes; it is free, and anonymous reports are accepted. Keep the exact deposit address you were given and the transaction hashes of your own payments. They are what investigators need.

#CryptoScam #PigButchering

Related BlockintAI report

• "FXO" / "FXO Exchange" unauthorised crypto broker: 14 rotating domains now offline, Coinbase lookalike and lead wallets (2025-2026)

Sources

Regulator and victim accounts

• Hellenic Capital Market Commission, warning on fxoexchange[.]com, May 6, 2026: http://www.hcmc.gr/aweb/files/warnings/files/fxoexchange_eng.pdf
• IOSCO I-SCAN warning #52011, May 8, 2026: https://www.iosco.org/i-scan/?id=52011
• IOSCO I-SCAN warning #56696 (HCMC, fxoxx[.]net), published at HCMC Sept 21, 2026: https://www.iosco.org/i-scan/?id=56696
• BrokerListings, "FXO Exchange" review, updated Oct 16, 2026: https://brokerlistings.com/reviews/fxo-exchange
• Trustpilot reviews of fxoxx[.]net (quoted reviews posted May 29, 2026): https://www.trustpilot.com/review/fxoxx.net

Domains, certificates and site captures

• RDAP registration records, e.g. https://rdap.org/domain/fxovip1.com, https://rdap.org/domain/fxoex.com, https://rdap.org/domain/fxoexchange.com, https://rdap.org/domain/coinbasefxo.com, https://rdap.org/domain/fxoex.one (checked Oct 18, 2026)
• ScamAdviser, fxoxx[.]net page (lists fxoex[.]one as a redirecting site): https://www.scamadviser.com/check-website/fxoxx.net
• CertSpotter certificate logs, e.g. https://api.certspotter.com/v1/issuances?domain=fxovip1.com&expand=dns_names
• urlscan captures: fxovip1[.]com, Oct 4, 2026; coin-base.coinbasefxo[.]com, Oct 4, 2026; cb-fxo.coinbasefxo[.]com, Oct 2, 2026; fxoxx[.]net, Sep 25, 2026
• DNS over HTTPS (Google Public DNS), e.g. fxoex[.]com (Oct 18, 2026, 6:48 PM CT)

On-chain (Ethereum; Etherscan public name tags as shown on Oct 18, 2026)

• Deposit address: https://etherscan.io/address/0xf72a87dfd1581ff2d7e2ad9144dcb74eb607a265
• Consolidation wallet: https://etherscan.io/address/0x7ebcb8e15c47c99629619b9a5a571c3aa2698258
• Gas and payout wallet: https://etherscan.io/address/0xb9f5c378f929fce7e408e7d3a39bfec96a2b48e9
• Secondary wallet: https://etherscan.io/address/0xb93daead3715d2dc1060aa639856d49d177c6072
• Exit wallet: https://etherscan.io/address/0xd964cc46e1ec2b2af1898461beb0b8e0a75f9b22
• HiFiSwap: Bridge 7 (Etherscan tag): https://etherscan.io/address/0x1481e58411608b2d628ef305b92b01cf4f83db70
• Bybit: Wallet 4 (Etherscan tag): https://etherscan.io/address/0x93228d328c9c74c2bfe9f97638bbb5ef322f2bd5
• Sample transfers: gas top-up for the first deposit into the lead address, Jul 26, 2026; its sweep to the consolidation wallet; first transfer from the consolidation wallet to the payout wallet, Jul 9, 2026
• Freeze checks: Tether USDT isBlackListed and Circle USDC isBlacklisted, read through a public Ethereum RPC on Oct 18, 2026, 6:30 PM CT (the same reads are free on each token's Etherscan "Read Contract" tab)
• OFAC Sanctions List Search: https://sanctionssearch.ofac.treas.gov/