MSTR Cat

Crypto Law/Level VI · Market conduct/6.2 Insiders and rugs/Lesson 5

Exit scams

When the operator of an exchange, lending programme or investment scheme stops withdrawals and disappears with customers’ money, and what the law can and cannot do afterwards.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Users: the cheapest protection is self-custody, since funds in your own wallet cannot be frozen by an operator who disappears. Catch: you carry key-loss risk yourself, and tax reporting still applies to every disposal.
  2. Before depositing anywhere, search FinCEN’s free money services business register and state or foreign licence lists, read who holds your assets under the terms of use, and test a small withdrawal. BitConnect never registered with FinCEN.
  3. Operators: segregate customer funds and never use them as your own. Where FinCEN registration applies, it is free and due within 180 days of establishment under 31 C.F.R. §1022.380; running an unlicensed money transmitting business is a crime under 18 U.S.C. §1960.
  4. Victims: report free to the FBI’s IC3 and preserve records; recovery comes through forfeiture and remission, insolvency or civil suits, often partial and slow. Never pay upfront fees to ‘recovery’ services, a common second fraud.

MaterialsThe Justice Department’s February 2022 release on the BitConnect indictmentThe FBI’s Ten Most Wanted page for Ruja Ignatova of OneCoinFinCEN’s money services business registration search, or your state regulator’s licence list (lesson 1.3.6)Lessons 4.2.6 (Ponzi schemes) and 4.3.2 (seizure and civil forfeiture)

Wonder

  1. How is an exit scam different from a rug pull?
  2. Can people get their money back once the founder has fled abroad?
  3. What warning signs came before the best-known exit scams?

Explore

  1. An exit scam is the sudden end of a running business that holds other people’s money: an exchange, a lending or ‘yield’ programme, an investment club or a darknet market. The operator freezes withdrawals, often blaming a hack or maintenance, then disappears with the funds. A rug pull (lesson 6.2.1) usually happens around a launch; an exit scam can follow months or years of normal-looking operation that built trust. Like ‘rug pull’, the phrase is not a legal category. Prosecutors charge fraud, theft, money laundering and, where relevant, running an unlicensed money business.
  2. Turkey’s Thodex exchange shows the pattern. In April 2021 it halted trading, saying it was under cyberattack, and its founder, Faruk Fatih Özer, left for Albania; Turkish media reported he had fled with assets worth about $2 billion. Interpol issued a notice, he was arrested in Albania in August 2022 and was extradited to Turkey in 2023. On 7 September 2023 an Istanbul court found him and his two siblings guilty of fraud, money laundering and organised crime and sentenced each to 11,196 years in prison. Özer was found dead in his prison cell in late 2025.
  3. BitConnect ran a ‘Lending Program’ that promised large returns from a trading bot and ‘volatility software’. On 25 February 2022 a federal grand jury in San Diego indicted its founder, Satish Kumbhani, alleging the programme was a Ponzi scheme that took about $2.4 billion from investors. According to the indictment, after about a year he abruptly shut the lending programme, had promoters prop up the price of the BitConnect coin and moved funds through exchanges abroad. BitConnect never registered with FinCEN as a money transmitter. The charges carry up to 70 years in total, but Kumbhani was at large when indicted.
  4. OneCoin is the starkest case of a founder vanishing. US prosecutors say that from about 2014 it took over $4 billion from victims worldwide by selling a supposed cryptocurrency through multi-level marketing (lesson 4.2.6). Ruja Ignatova was charged in the Southern District of New York on 12 October 2017. On 25 October 2017 she travelled from Sofia to Athens and has not been found. The FBI added her to its Ten Most Wanted Fugitives list on 30 June 2022, and the State Department offers up to $5 million for information. Her co-founder, Sebastian Greenwood, was sentenced to 20 years in September 2023.
  5. These cases show the limits of law after the fact. Indictments, Interpol notices and extradition can bring a founder to trial, but they do not by themselves return money. Recovery depends on tracing and freezing assets, criminal forfeiture and remission to victims (lesson 4.3.2), insolvency proceedings where a company still exists (lesson 9.2.3), and civil suits against promoters (lesson 5.3.2). Recovery is often partial and slow. Victims are also prime targets for ‘recovery’ services that promise to trace funds for an upfront fee; lesson 4.2.5 explains that second fraud.
  6. Warning signs recur. Withdrawals that are ‘temporarily’ paused, returns that are guaranteed or unusually steady, payouts that depend on recruiting, an operator with no regulatory licence and ownership that cannot be traced all appeared in these cases. A practical check before depositing anywhere: search the operator’s name in FinCEN’s money services business register and the relevant state or foreign licence lists, read who legally holds your assets under the terms of use (lesson 4.1.1), and test a small withdrawal. Builders running custodial services should know that customer funds belong to customers; using them as the operator’s own is the core of the crime.

Key facts

  • An exit scam is not a defined legal offence; prosecutors charge it as fraud, theft, money laundering or unlicensed money transmitting.
  • Turkey’s Thodex exchange halted trading in April 2021, citing a cyberattack, as its founder Faruk Fatih Özer left for Albania.
  • On 7 September 2023 an Istanbul court sentenced Özer and his two siblings to 11,196 years in prison each for fraud, money laundering and organised crime.
  • On 25 February 2022 a federal grand jury in San Diego indicted BitConnect founder Satish Kumbhani over a scheme alleged to have taken about $2.4 billion from investors.
  • OneCoin founder Ruja Ignatova was charged in the Southern District of New York on 12 October 2017 and was added to the FBI’s Ten Most Wanted Fugitives list on 30 June 2022.
  • OneCoin co-founder Karl Sebastian Greenwood was sentenced to 20 years in prison in September 2023.

Exercise nine, six, three, one

9CollectList up to 9 warning signs that appeared before an exchange or investment scheme collapsed, from this lesson or a case you have followed (some lists are shorter), such as paused withdrawals or guaranteed returns.
6ClusterSort them into 6 categories: problems with withdrawals, promised returns, recruitment, licensing, ownership and control, and explanations given by the operator.
3DistillReduce the 6 categories to 3 groups: signs you could check before depositing, signs that only appeared once trouble began, and signs that are common in honest businesses too.
1CrystallizeWrite 1 sentence explaining, in your own words, why charging a founder who has fled does not by itself return money to customers.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS