Two Fake Trading Sites, Two Exchange Doors: Following the Velxton and Lexor Finance Money to Binance and HTX

BlockintAI · 2026-10-18T13:26:47.449Z

BlockintAI research. On-chain figures come from public Ethereum and Bitcoin data, re-checked on Sunday, October 18, 2026, between about 7:05 AM and 7:30 AM Central Time (CT). Site, DNS and registration checks were made the same morning. Times are CT unless marked UTC.

It began with a match on an online dating platform. The two talked regularly and even had video calls, which made everything seem genuine. Then the match introduced crypto investing, on a website called Velxton. It started with small amounts and escalated quickly. By the time the victim realized what was happening, they had lost $17,493.41.

That account was posted in r/CryptoScams at 2:16 AM CT on October 14, 2026. The writer had reported everything to a local police department in Texas. The detective did everything he could, they wrote, but the investigation was eventually closed because of jurisdictional limits. They were asking for one thing: help working out where the money went.

In California, a resident answered a Facebook ad about investing in U.S. oil and stocks. That led to a platform called Lexor Finance and a WhatsApp "adviser" who claimed to work in Zurich for a London company. The resident told California's Department of Financial Protection and Innovation (DFPI) that they lost at least $300,000, and named the Ethereum address they paid. That address took in money from December 2025 to April 2026.

BlockintAI published both deposit addresses on X on October 17. This is the full trail behind them. Both end in the same kind of place: a deposit address that Etherscan labels as belonging to a major exchange. That is where investigators can still ask questions.

Key facts

Velxton: a match, a "binary trading" site and a closed case

The Reddit post is short and careful. The writer says they met someone through an online dating platform, that the two talked regularly and had video calls, and that the person introduced them to crypto investing "through a website called Velxton (velxton[.]com), also referred to as Velxon." The payments started small and grew. They say they have transaction records, wallet addresses, screenshots and police documentation, and that they don't want paid "recovery" services. They want to know where the money went and whether it connects to anything else.

The same Reddit account had asked about the site three weeks earlier. On September 24, 2026, at 6:38 PM CT, it posted in r/Scams: "Has anyone dealt with Velxton or Velxon crypto trading?" A second attempt six minutes later carried the domain in its title. Both were removed, one by the subreddit's automatic filter and one by a moderator, so their text isn't public.

The website is still up. On the morning of October 18, velxton[.]com loaded a single-page app titled "Velxton | Advanced Crypto Binary Trading," described as "crypto trading. Real-time charts, market data, and portfolio tracking." The domain was registered at NameCheap on July 20, 2026, for one year, and sits behind Cloudflare.

On October 17, 2026, the site's "Deposit assets" page displayed one Ethereum address for both ETH and USDT (ERC-20) deposits: 0xEF4c7fbE2a6b14F81a34C94Db81573455Ff524CE. Under the address, the page asks for a "proof of transaction": the depositor uploads a screenshot of the transfer and presses "Submit deposit request." Real exchanges credit deposits from the blockchain itself; they don't ask for a screenshot.

That address came from the website, not from the Reddit post, which names no address. So the on-chain figures below describe everything Velxton's address received, not the Reddit user's payments.

Velxton, on-chain: what came in

The address's first activity was a 9 USDT transfer from an exchange wallet Etherscan tags "Kraken: Hot Wallet 5," on August 12, 2026. Real money started arriving on September 6. Counting only real USDT and USDC transfers of $10 or more, the address has received 34,039.54 USDT in five transfers and 300 USDC in two, from three sending addresses:

Most of the money, 24,504.54 USDT, came straight out of an exchange: the wallet Etherscan tags Crypto.com 12. That is the classic shape of these scams. The person paying buys stablecoins at a regulated exchange and is told to send them to an address the "platform" provides.

The September 29 payment took one extra step. 0x59651c19…9d56 received 11,538.44 USDT from Crypto.com 12 at 1:24 PM CT and sent 9,535 USDT on to the Velxton address 18 minutes later. Over the next three days it took in three more payments from Crypto.com 12 and passed nearly all of it to two other addresses. The 300 USDC came from 0x466ba3ed…3064, an address with no public label and more than 197,000 transactions.

Velxton, on-chain: where it went

Everything that left the Velxton address went to one place: 0x017992c035d7fcb4856a2e29c9a7de496dcec861, which Etherscan tags "Binance Deposit."

In all, 34,041.07 USDT and 299.09 USDC went out. (The USDT total is slightly higher than the $10-and-over inflows because the 9 USDT from August went out with the second batch.) The USDT sat in Velxton's address for between 2 and 12 hours each time. The two USDC payments waited 30 and 78 hours and left together on October 10. What remains, 7.48 USDT and 0.91 USDC, is still there.

The Binance side behaves exactly like an exchange deposit address. Nine minutes after its first deposit, at 4:30 AM CT on September 7, it got its gas money from the wallet Etherscan tags "Binance: Deposit Funder 1." After that, every payment was swept into Binance's own hot wallets within 1 to 14 minutes.

The important detail is what the deposit address didn't receive. Its entire stablecoin history is these six transfers from Velxton's address. It has never received real USDT or USDC from anyone else, and its only ETH is that one gas payment from Binance. (Three fake-token transfers sent to it from lookalikes of Velxton's address are excluded.) All of the Velxton money visible on Ethereum, about $34,340, went into this one Binance deposit address, and Binance can look up which customer account it credits.

The trail also drew the usual hangers-on. Twenty minutes after the first forward, on September 7, a lookalike address, 0x01796e177f52901fc935e42a72fe93bf2f23c861, started sending the Velxton address tiny amounts of real USDT. Its first and last characters copy the Binance deposit address. Through October 16, 2026 the Velxton address also received 56 transfers of fake tokens with lookalike "USDT" and "USDC" names, and seven zero-value transfers of the real ones. This is address poisoning: it seeds a wallet's history with addresses that look like ones it pays, hoping someone copies the wrong one. None of it is counted above.

Velxton's other deposit addresses. The same deposit page showed a Bitcoin address, bc1q34cdjfxa9at6ny24qgwpl6hs3uu7lc2dgkj3gx. It received 0.6018261 BTC in 13 payments between September 9 and October 8, 2026, and has spent all of it. A TRON address on the page, TNBtBt2Zbky95dJrz7MFKVytUT2QeLTi4X, has never been activated.

Lexor Finance: an ad, an "adviser" and a $30,000 demand

California's DFPI keeps a public Crypto Scam Tracker built from consumer complaints. Its entry for Lexor Finance at web.lexorfinance[.]us, filed under "Fraudulent Trading Platform" and "Pig Butchering Scam," tells a story that follows the script almost step by step:

• The ad. A California resident saw a Facebook ad about investing in U.S. oil and stocks. After they responded, "Lexor Finance US" reached out and encouraged them to open an account on the platform.
• The adviser. Next came a person on WhatsApp who claimed to be a Zurich-based financial adviser for a London-based company. Over the next several months, the "adviser" taught the resident how to trade on the Lexor platform.
• The proof. The adviser assured the resident they could withdraw at any time and showed a successful $200 withdrawal early on.
• The push. After a run of successful trades came the push for bigger trades that needed more capital, along with an offer to put in "her own funds" and arrange loans.
• The trap. When the resident tried to withdraw more, the platform claimed "suspicious activity" and demanded $30,000 within five days, or a 10% penalty.
• The loss. At least $300,000, sent, the resident reported, to the Ethereum address 0x9952E129A85a939fc6b29430B640dF0261E07Ca7.

DFPI notes that it does not verify the losses complainants report. The entry carries no date of its own; DFPI posted it in October 2026, after October 11 (it is absent from the Internet Archive's copy of the tracker that day). The payments are dated on the blockchain: December 2, 2025 to April 2, 2026. The scam's name is a lookalike of a legitimate Australian company at lexorfinance.com.au, as DFPI's entry notes.

The name has been through DFPI before. A separate tracker page for "Lexor Finance – Homepage (Fraudulent Platform)," at wb.lexorfinance[.]io and last updated December 5, 2025, describes a Facebook ad that claimed links to a well-known CEO and promised AI-assisted investing, and a $5,000 loss sent to the Bitcoin address bc1qch8azpgn4vnykfmp2sqn8tlxw08z2xgk433jep. That address received 0.16931257 BTC in 11 payments between April 14 and May 12, 2025, all spent by May 19, 2025. The lexorfinance[.]io domain is no longer registered. DFPI lists the two complaints separately. Both use the Lexor Finance name and both began with a Facebook ad.

The .us site is still running. On the morning of October 18, web.lexorfinance[.]us served a trading app whose configuration names the brand "Lexor," loads its logo from a third-party image server and points to lexorfinance[.]co as its website and support email domain. That .co domain no longer exists. The lexorfinance[.]us domain was registered through 1API GmbH on January 14, 2025; the bare domain doesn't resolve, only the web. subdomain does.

Lexor Finance, on-chain: nine payments, each at HTX within six minutes

The address in the DFPI complaint received 37,939.57 USDC in nine transfers between December 2, 2025 and April 2, 2026, all from one sending address, the wallet Etherscan tags Coinbase 10. No USDT came in.

The pattern never changes. A payment arrives from Coinbase. Within one to three minutes it is swept, in full, to 0x8e5a6e6fb4926284774a437241769f9b30c2f743, an address Etherscan labels "HTX" and "Deposit Address," with nearly 195,000 transactions. Each sweep is paired with a tiny top-up of ETH for gas from another unlabeled address, 0x8af28d9d522fd11ddc63d492cf65dabfb7dbc585. Within another one to four minutes, 0x8e5a6e6f sends the money to the wallet Etherscan tags HTX 48. Five of the nine payments went on alone, to the cent. The other four went together with exactly one other incoming payment, and each combined transfer equals the two amounts added up, to the cent. All 37,939.57 USDC reached HTX 48.

That isn't how a scammer's private wallet usually behaves. It's how exchange deposit plumbing behaves. In the roughly two days around the last Lexor payment, from 12:38 PM CT on April 1 to 11:53 AM CT on April 3, 2026, 0x8e5a6e6f received about 4.77 million USDC from 193 sending addresses and sent every one of its 197 USDC outflows in that window to HTX 48.

Etherscan labels 0x8e5a6e6f "HTX" and "Deposit Address," its marker for an address used to deposit into an exchange. So the Lexor money went into an HTX deposit address, which HTX can tie to the account it credits, and from there into HTX's own wallet. That account handled far more than Lexor's payments: 193 sending addresses in two days. The Lexor address itself carries no label. Its pattern, a gas top-up before every sweep and each payment forwarded in full within one to three minutes, is that of an automated forwarding address, not a person's wallet.

Two more details from the address's history:

• Only part of the money is visible here. About $37,940 passed through this address. The resident reported losing at least $300,000, so other payment routes are likely.
• It was poisoned too. At 3:00 PM CT on January 22, 2026, minutes after that day's two payments, a lookalike address, 0x8e5a4df3747eed8590396c3e81dd468f85aff743, sent it 0.000005 USDC and a fraction of a cent in ETH. Its first and last characters copy 0x8e5a6e6f…f743. Four minutes later a zero-value transfer appeared in the address's history, showing it "paying" a second lookalike, 0x8e5aba95d1244fd4b77809169bac89876fdff743. The 0.000005 USDC is the dust still sitting on the Lexor address.

Two trails, two doors

The two cases came in through different doors: a dating platform for one, a Facebook ad for the other. They left through the same kind of door.

• Velxton used an ordinary wallet as a holding point. Money sat for hours, sometimes days, then went to a Binance deposit address that has only ever received real stablecoins from Velxton's address.
• Lexor Finance skipped the holding point. Every payment into the address its victim used was swept, within minutes, into an address Etherscan labels an HTX deposit address.

Neither trail is frozen, and almost nothing is left on-chain. As of 7:06 AM CT on October 18, 2026, Tether and Circle had not frozen any address in either path. Velxton's address holds 7.48 USDT and 0.91 USDC, the Binance deposit address holds none, and the Lexor address holds dust. None of the addresses in this post is on OFAC's sanctions list.

What the trails offer is a place to ask. Exchanges keep records on the accounts behind their deposit addresses, and law enforcement can request them. For a victim, that makes the transaction hashes of your own payments, and the exact deposit address you were given, the most valuable thing you hold. The Velxton victim wrote that they kept transaction records, wallet addresses, screenshots and the police paperwork. That's exactly what investigators need.

Status of both platforms (October 18, 2026, about 7:08 AM CT)

Red flags in these two scripts

• A new romantic interest, or a friendly "adviser," who brings up trading. On a dating app it's a match. After a Facebook ad it's a "financial adviser" in Zurich. Either way, the person teaching you to trade is the person running the platform.
• A platform nobody has heard of. Velxton's domain was three months old on October 18. A real exchange has a track record you can check.
• A deposit page that asks for a screenshot. Real exchanges see your deposit on the blockchain and don't need a "proof of transaction" upload.
• A small withdrawal that works. The early $200 Lexor withdrawal is part of the script. It buys trust for the bigger deposits.
• Offers to lend you money or add their own. It raises the stakes and makes walking away feel like betraying a friend.
• "Suspicious activity" with a deadline. A demand for $30,000 within five days or a penalty is a fee to release money that is already gone.
• "Recovery" offers. Anyone who contacts you offering to recover your money for a fee is running the next scam.
• Report it. In the U.S., report fraud to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov. In California you can also file a complaint with the DFPI. Elsewhere, report to your national police cybercrime unit. If you've been scammed, you can also file a report at blockint.ai with the website, chat names, deposit addresses and transaction hashes; it is free, and anonymous reports are accepted.

Related BlockintAI reports

• Velxton (velxton[.]com): deposit address, inflows and the Binance deposit address
• Lexor Finance (web.lexorfinance[.]us): DFPI-listed address and the path to HTX 48

Sources

Victim accounts and regulator complaints

• Reddit r/CryptoScams, "Lost $17,493.41 in a Romance / Pig Butchering Crypto Scam Involving Velxton," posted Oct 14, 2026, 2:16 AM CT: https://www.reddit.com/r/CryptoScams/comments/1x5kqfd/ (archived copy: https://arctic-shift.photon-reddit.com/api/posts/ids?ids=1x5kqfd)
• Reddit r/Scams, "Has anyone dealt with Velxton or Velxon crypto trading?" and a second post, both Sept 24, 2026 (removed): https://www.reddit.com/r/Scams/comments/1wph58c/ and https://www.reddit.com/r/Scams/comments/1wpha7z/
• California DFPI Crypto Scam Tracker, entry "Lexor Finance Web.lexorfinance[.]us": https://dfpi.ca.gov/consumers/crypto/crypto-scam-tracker/
• California DFPI, "Lexor Finance – Homepage (Fraudulent Platform)," updated Dec 5, 2025: https://dfpi.ca.gov/consumers/crypto/crypto-scam-tracker/lexor-finance-homepage-fraudulent-platform/
• Internet Archive copy of the DFPI Crypto Scam Tracker, Oct 11, 2026 (no Lexor Finance .us entry yet): https://web.archive.org/web/20261011112541/https://dfpi.ca.gov/consumers/crypto/crypto-scam-tracker/

On-chain (Ethereum; Etherscan public name tags as shown on Oct 18, 2026)

• Velxton deposit address: https://etherscan.io/address/0xEF4c7fbE2a6b14F81a34C94Db81573455Ff524CE
• Binance Deposit 0x017992c0…c861: https://etherscan.io/address/0x017992c035d7fcb4856a2e29c9a7de496dcec861
• Senders: Crypto.com 12, 0x59651c19…9d56, 0x466ba3ed…3064, Kraken: Hot Wallet 5
• Binance endpoints: Binance 14, Binance: Hot Wallet 34, Binance: Deposit Funder 1
• Sample transfers: first Crypto.com 12 payment, Sept 6, first forward to the Binance deposit address, Sept 7, sweep to Binance 14, Sept 7, last forward, Oct 10
• Lexor deposit address: https://etherscan.io/address/0x9952E129A85a939fc6b29430B640dF0261E07Ca7
• Lexor path: Coinbase 10, 0x8e5a6e6f…f743 (Etherscan labels: HTX, Deposit Address), 0x8af28d9d…c585, HTX 48
• Sample transfers: first Lexor payment, Dec 2, 2025, its forward to HTX 48, last Lexor payment, Apr 2, 2026, its batched forward to HTX 48
• Freeze and balance checks: Tether USDT isBlackListed and Circle USDC isBlacklisted and balanceOf, read through a public Ethereum RPC at block 26,219,340 (Oct 18, 2026, 7:06 AM CT)

Bitcoin and TRON

• Velxton BTC address: https://mempool.space/address/bc1q34cdjfxa9at6ny24qgwpl6hs3uu7lc2dgkj3gx
• Address in DFPI's earlier Lexor Finance entry: https://mempool.space/address/bc1qch8azpgn4vnykfmp2sqn8tlxw08z2xgk433jep
• Velxton TRON address: https://tronscan.org/#/address/TNBtBt2Zbky95dJrz7MFKVytUT2QeLTi4X

Sanctions, registration and DNS

• OFAC Specially Designated Nationals list (SDN, alternate-name and digital-currency address files, downloaded Oct 18, 2026): https://sanctionslistservice.ofac.treas.gov/
• RDAP record for velxton[.]com and RDAP record for lexorfinance[.]us
• DNS over HTTPS (Google Public DNS): A record lookup for velxton[.]com, A record lookup for web.lexorfinance[.]us