Consumer complaint received 2026-04-05 00:00:00
Product: Money transfer, virtual currency, or money service — Virtual currency
Issue: Fraud or scam — 
Company: Foris DAX, Inc.
State: FL

Complaint narrative:
b'I received a Call on XXXX XXXX XXXX XXXX XXXX XXXX XXXX claiming to be Crypo.com support telling me my account was compromised. The person on the phone knew everything about me and my account. They knew my name: Richard Broadbent, my email: XXXX and what type of coins I had in the account. I am not a dumb person, I mine crypto. I know how the security works, but they knew so much that I believed them. \n\nThe person then a text message that had the link XXXX (careful clicking on this) \nUsing my I-Phone I clicked on the link and what I believed was to secure my account by updating the 2FA but allowed them access to itXXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXSorry I believe my BTC wallet address was this XXXX XXXXI never sent any BTC to this wallet, it was cleaned out and I could not access the wallet on Crypto.com so I am going by the transition information. I filed a police report Brevard County Sheriff\'s Office, Case XXXX XXXXThe morning of Dec 7th I saw an email and it said the Crypto withdrawal succeeded and my balance dropped dramatically. \n\nI was texting for 10 hours Crypto.coms support on Dec 7th They didnt really seem to take it seriously. It took 3 days for them to finally secure my account. The app is not meant for detailed conversations. They said since I clicked on a link, I was at fault. But I only followed blindly since the scammer knew everything about my account. \nHere are some of my interactions with the real Crypo.com support. I also made a pdf with everything I captured.\n \nFinal Location of Stolen BTC.\nThe stolen amount was then strategically broken into four smaller transactions, each\nrouted through a distinct intermediary (proxy) wallet to obfuscate the origin and structure\nof the movement:\n Proxy Wallets:\XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXEach of these intermediary addresses served as a temporary buffer. Within minutes, the\nmajority of their balances were funneled into a single large laundering address, believed to act as a crypto mixing or consolidation point:\n Laundering / Final Destination WalletXXXXThe flow pattern is consistent with standard laundering practices used in crypto-related\ncybercrime fragmenting a transaction through multiple hops before aggregation into a\nconcealed pool.\n\nDeep Investigation & Entity Attribution\nDestination Wallet Profile\n Address: bc1qns9f7yfx3ry9lj6yz7c9er0vwa0ye2eklpzqfw\n Entity: FixedFloat Exchange (non-custodial crypto swap service)\n Status: High-Risk / Previously Compromised\n\nThis wallet is associated with FixedFloat, a known no-KYC cryptocurrency swap platform.\nNo-KYC means the service does not require users to verify identity or provide documents,\nmaking it attractive to criminals for laundering stolen assets, avoiding tracing, and\nswapping between coins (e.g., BTC to Monero).\nImportantly, this wallet:\n Was hacked in 2024 leading to the theft of over 400 BTC.\n Receives stolen crypto regularly, as confirmed by victim reports across forums and\nscam trackers.\n Is under scrutiny by blockchain analytics firms, flagged for connections to phishing,\nmalware, and impersonation scams.\n\nDespite ongoing monitoring, the wallet remains active and continues processing low-\nvolume peel chain outputs indicative of laundering behavior.\n\nData Breach Location\nOn criminal markets there is a large crypto users dataset (priced around $10,000) that allegedly includes Crypto.com records. \nhttps://x.com/DarkWebInformer/status/1911926507779301660?s=20\nThe full dataset isnt publicly accessible, and without purchasing it or waiting until it becomes indexed by reputable breach databases, I can\'t conclusively confirm whether Crypto.com records are in that specific dump.\nThe stolen data from the Scattered Spider breaches is not typically found on public "paste" sites. It circulates in the Telegram ecosystem known as "The Com."\n This data is traded in private channels where hackers sell access to "panels" or specific user lookups.\n Reports indicate that threat actors have launched campaigns utilizing data from "Salesloft and GainSight" as well as crypto exchanges.\nThe specific dataset containing the 2023 Crypto.com PII is likely fragmented and sold privately to SIM swappers rather than dumped publicly\n\nArticle: Massive Crypto Breach: Over 18 Million US Crypto Users Data Listed for Sale on the Dark Web\nhttps://www.binance.com/en/square/post/22953815022818'

Company response to consumer: Closed with explanation