The most likely reason they sent everything back is fear — fear of being tracked down by the victim, who has the resources, as well as by the blockchain forensics community and law enforcement, especially given the enormous amount stolen, which would paint a huge target on their back.
On March 9th, 2024, the investment firm Crypto4Winners, which promised 3–20% monthly returns, announced that they had fallen victim to an exploit.
Due to the exploit, Crypto4Winners found itself in the difficult position of no longer being able to allow ‘process fund withdrawals until it is resolved,’ or so they said.
The issue? DL News, a crypto newspaper, had revealed two months earlier that Crypto4Winners was co-owned by a certain Luc Schiltz, a Luxembourger found guilty in 2017 of defrauding victims for more than $1.5 million and sentenced to six years in prison, serving only two. Soon after his release, he co-founded the Crypto4Winners project.
So when the hack was announced, suspicions arose immediately. After the initial announcement post, Crypto4Winners went entirely silent. As soon, if not earlier, than March 12th, Crypto4Winners’ clients contacted lawyers and the police.
In the following days, it would be revealed that Crypto4Winners showed every sign of being a Ponzi scheme, which made thousands of victims for at least $100 million.
According to DL News, Luc Schiltz had co-founded Crypto4Winners but had kept his involvement hidden. The figurehead of Crypto4Winners was another Luxembourger, Adrien Castellani, who was its official CEO and founder. In truth, however, Castellani was only the co-founder of Crypto4Winners alongside Luc Schiltz.
Despite multiple questions arising about Luc Shiltz’s involvement in Crypto4Winners over the years, he never acknowledged him as either a co-founder or a general partner; instead, he barely recognized him as a consultant. In 2023, he promised to sever all relations between Crypto4Winners and himself by the end of that year, which he obviously did not fulfill.
A little lie among many.
Such as the delirious returns they promised. They went as far as claiming a 377% return on customers’ Bitcoin deposits since 2019, as well as a 7% monthly average return up to 20%, irrespective of the crypto market’s ups and downs, typical of a crypto Ponzi scheme.
They also claimed to be partners of Chainalysis and Ledger, leading both companies to publicly disavow their claims in 2022.
Crypto4Winners is incorporated in Sweden. When asked by the Swedish Companies Registration Office to provide annual reports of its accounts for 2021 and 2022 in 2023, they claimed that their status as a Trust Management Company did not require them to submit them, which was false. Even under the risk of liquidation or being declared invalid, the deadline came and went without them submitting the reports.
It would also be revealed that Crypto4Winners, which publicly appeared to be a Luxembourg-Swedish entity, was actually a complex structure spanning through Dubai, Lithuania, Ireland, Sweden, and Luxembourg.
Worse, Crypto4Winners was, in fact, a shell company; investors’ funds were all transferred to an Irish company named “Big Wave Developments Limited.”
According to the Luxembourg newspaper Virgule, of the estimated $100 million customers’ funds, not even $200,000 appeared to be left in Big Wave Developments Limited’s accounts.
The most dumbfounding thing about this whole case is how its unraveling came about: a very bizarre car crash accident that allegedly caused Luc Shiltz’s amnesia.
On March 5th, before dawn, Luc Shiltz found himself crashing against a road guardrail, sending his car up a slope. He apparently did not suffer any injuries from this accident; then, for reasons unknown, said the Luxembourg police, he walked into the highway where a bus crashed into him.
He did not suffer life-threatening injuries and was hospitalized in the orthopedic department.
However, he claims that the accident has caused him to suffer memory loss. The thing is, Luc Shiltz is the one who has complete control over customer funds; which means he could no longer access the funds in cryptocurrency wallets and exchange accounts.
What stands out is that, according to the Virgule investigation and people who visited Luc Shiltz at the hospital days after the crash, there is room to doubt his amnesia.
Mario (fake name), a friend of Adrien Castellani, recounted to Virgule:
“He initially pretended to have amnesia and then told us that he would retrieve the USB keys from his parents, and that everything would return to business as usual…” (translated from French)
On that very day, Mario uncovered the shell nature of Crypto4Winners and Big Wave Developments Limited. Later, during a call on March 12th with Shiltz, Mario inquired about the mere $200,000 remaining in Big Wave Developments Limited’s account. Shiltz reassured him, explaining that it was to be expected since it represented only the funds in the hot wallet.
Despite his claimed amnesia, Luc Shiltz appears to have a complete grasp of his identity and how his company operates. So one must ask, what is it exactly that he has forgotten that prevents him from accessing the funds? Certainly not the seed phrases; it’s probably unheard of in crypto history for someone to solely rely on their memory, especially when $100 million is involved
.In his own words, he claimed that everything was with his parents and assured that everything would soon return to normal. So, what’s the catch?
The answers to this question and all inquiries raised by this affair will hopefully be unveiled in a court of law.
On March 15th, the Luxembourg public prosecutor’s office announced an investigation into Crypto4Winners for fraud and money laundering charges, and that two individuals have been charged and placed under custody.
One of the individuals is thought to be Luc Shiltz.
On May 3rd, 2024, a person fell victim to an address poisoning attack that would go down in history as the largest address poisoning heist at the time, with $72.7 million lost to the scammer after the victim transferred 1,155 wrapped Bitcoin to the malicious address.
What happened can be summed up as a stroke of extremely bad luck. The victim first successfully completed a test transfer of $149 to the legitimate address starting with 0xd9A1b. Afterward, they mistakenly copy-pasted the wrong address — the poisoned one that mimicked 0xd9A1b.
The victim tried to negotiate the return of the funds in exchange for a 10% ‘bug bounty,’ an attempt that was proven unsuccessful. Blinded by greed, the attacker thought they could take off safely with everything — how mistaken they were.
The entire blockchain security community was on the case, and soon enough, there was talk of the exploiter returning the funds, minus the $7.2 million kept as a bug bounty. On May 10th, almost all of the stolen funds were returned by the attacker, who was barely able to make off with $3 million due to token appreciation.
Two weeks later, it was discovered that the prompt return of funds was not due to a change of heart from the scammer but rather because, despite trying to obfuscate their tracks as much as possible, their identity was partly revealed through the discovery of their “device fingerprint,” as reported by Match Systems CEO Andrey Kutin.
In June 2024, Bill Guan, the Chief Financial Officer (CFO) of The Epoch Times, was arrested in relation to a massive crypto scam.
The U.S. Department of Justice (DOJ) accused Guan of conspiring to launder at least $67 million in fraudulently obtained funds, including proceeds from unemployment insurance fraud. The scheme allegedly involved using cryptocurrency to purchase illicit funds at discounted rates, which were then funneled through various accounts, including those of The Epoch Times, to conceal their origins.
The crypto scam was discovered when banks reported a 410% revenue jump in one year from barely $15 million to over $62 million.
The DOJ’s indictment highlighted that the charges were unrelated to The Epoch Times’ journalistic activities. Guan faces serious charges, including conspiracy to commit money laundering and bank fraud, with potential sentences totaling up to 80 years in prison.
