SEC sues crypto firms for defrauding investors out of $14 million

Multiple cryptocurrency companies were sued by federal regulators this week for their alleged role in an elaborate investment scam that siphoned more than $14 million from retail investors.

The Securities and Exchange Commission (SEC) filed charges on Monday against Morocoin Tech, Berge Blockchain Technology, Cirkor, AI Wealth, Lane Wealth, AI Investment Education Foundation and Zenith Asset Tech Foundation.

SEC lawyers said in a 29-page complaint that the companies ran “investment clubs” on WhatsApp that brought in users from advertisements on social media. Many of the advertisements used deepfake videos of prominent financial professionals and the group chats had fake professors who posted commentary on the economy and stocks. 

The companies, which ran the groups from January 2024 to January 2025, filled the chats with AI-generated investment tips before allegedly asking members to open cryptocurrency accounts on trading platforms Morocoin, Berge and Cirkor. Fictitious members of the group shared manipulated screenshots of successful trades and outlandish crypto earnings. 

The platforms claimed to have “government licenses” and members of the WhatsApp group were also offered “Security Token Offerings” — all of which were fake. 

When those who invested tried to take their money out, they were told to pay additional fees. The $14 million stolen from victims was sent to overseas banks and crypto wallets. The SEC tracked some of the funds to bank accounts held by Chinese or Burmese people in Southeast Asia. 

One Morocoin investor made seven separate wires totaling more than $1 million to accounts in China and Hong Kong and one Cirkor investor wired over $1.4 million to a bank in Indonesia.

“This matter highlights an all-too-common form of investment scam that is being used to target U.S. retail investors with devastating consequences,” said Laura D’Allaird, chief of the Cyber and Emerging Technologies Unit at the SEC. 

The complaint was filed in a Colorado District Court and the SEC is seeking civil penalties against the companies involved in the scheme. All of the companies were registered in Washington or Colorado. 

Multiple members of the WhatsApp group came forward on social media to warn others that the advice offered was fraudulent. 

At least one person reported losses of $156,000 to their local police department and the complaint lists several victims who sent thousands of dollars to the scammers or took out massive loans to invest in the scheme.

Regulators in Washington and Arkansas previously confirmed receiving complaints about several of the companies after residents of the states were scammed. 

All of the companies have removed their websites or have almost no internet presence. 

The SEC complaint comes as U.S. officials have sought to take more robust action against Southeast Asia-based scam operations that have stolen about $10 billion from Americans each year. 

The U.S. created a multi-department strike force last month to target cyber scam compounds in Myanmar, Cambodia and Laos. Two weeks ago, the Justice Department dismantled a website used by several Myanmar-based scam centers that spoofed legitimate forex and commodities trading platform TickMill.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Jonathan Greig

Jonathan Greig

is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

 

Total
0
Shares
Previous Post

US disrupts multimillion-dollar bank account takeover operation targeting Americans

Next Post

More than 22 million Aflac customers impacted by June data breach

Related Posts

Google Uncovers PROMPTFLUX Malware That Uses Gemini AI to Rewrite Its Code Hourly

Google on Wednesday said it discovered an unknown threat actor using an experimental Visual Basic Script (VB Script) malware dubbed PROMPTFLUX that interacts with its Gemini artificial intelligence (AI) model API to write its own source code for improved obfuscation and evasion. "PROMPTFLUX is written in VB Script and interacts with Gemini's API to request specific VBScript obfuscation and
Read More

Google Adds Layered Defenses to Chrome to Block Indirect Prompt Injection Threats

Google on Monday announced a set of new security features in Chrome, following the company's addition of agentic artificial intelligence (AI) capabilities to the web browser. To that end, the tech giant said it has implemented layered defenses to make it harder for bad actors to exploit indirect prompt injections that arise as a result of exposure to untrusted web content and inflict harm. Chief
Read More