SEC sues crypto firms for defrauding investors out of $14 million

Multiple cryptocurrency companies were sued by federal regulators this week for their alleged role in an elaborate investment scam that siphoned more than $14 million from retail investors.

The Securities and Exchange Commission (SEC) filed charges on Monday against Morocoin Tech, Berge Blockchain Technology, Cirkor, AI Wealth, Lane Wealth, AI Investment Education Foundation and Zenith Asset Tech Foundation.

SEC lawyers said in a 29-page complaint that the companies ran “investment clubs” on WhatsApp that brought in users from advertisements on social media. Many of the advertisements used deepfake videos of prominent financial professionals and the group chats had fake professors who posted commentary on the economy and stocks. 

The companies, which ran the groups from January 2024 to January 2025, filled the chats with AI-generated investment tips before allegedly asking members to open cryptocurrency accounts on trading platforms Morocoin, Berge and Cirkor. Fictitious members of the group shared manipulated screenshots of successful trades and outlandish crypto earnings. 

The platforms claimed to have “government licenses” and members of the WhatsApp group were also offered “Security Token Offerings” — all of which were fake. 

When those who invested tried to take their money out, they were told to pay additional fees. The $14 million stolen from victims was sent to overseas banks and crypto wallets. The SEC tracked some of the funds to bank accounts held by Chinese or Burmese people in Southeast Asia. 

One Morocoin investor made seven separate wires totaling more than $1 million to accounts in China and Hong Kong and one Cirkor investor wired over $1.4 million to a bank in Indonesia.

“This matter highlights an all-too-common form of investment scam that is being used to target U.S. retail investors with devastating consequences,” said Laura D’Allaird, chief of the Cyber and Emerging Technologies Unit at the SEC. 

The complaint was filed in a Colorado District Court and the SEC is seeking civil penalties against the companies involved in the scheme. All of the companies were registered in Washington or Colorado. 

Multiple members of the WhatsApp group came forward on social media to warn others that the advice offered was fraudulent. 

At least one person reported losses of $156,000 to their local police department and the complaint lists several victims who sent thousands of dollars to the scammers or took out massive loans to invest in the scheme.

Regulators in Washington and Arkansas previously confirmed receiving complaints about several of the companies after residents of the states were scammed. 

All of the companies have removed their websites or have almost no internet presence. 

The SEC complaint comes as U.S. officials have sought to take more robust action against Southeast Asia-based scam operations that have stolen about $10 billion from Americans each year. 

The U.S. created a multi-department strike force last month to target cyber scam compounds in Myanmar, Cambodia and Laos. Two weeks ago, the Justice Department dismantled a website used by several Myanmar-based scam centers that spoofed legitimate forex and commodities trading platform TickMill.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Jonathan Greig

Jonathan Greig

is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

 

Total
0
Shares
Previous Post

US disrupts multimillion-dollar bank account takeover operation targeting Americans

Next Post

More than 22 million Aflac customers impacted by June data breach

Related Posts

4 Outdated Habits Destroying Your SOC’s MTTR in 2026

It’s 2026, yet many SOCs are still operating the way they did years ago, using tools and processes designed for a very different threat landscape. Given the growth in volumes and complexity of cyber threats, outdated practices no longer fully support analysts’ needs, staggering investigations and incident response. Below are four limiting habits that may be preventing your SOC from evolving at
Read More

Notepad++ Hosting Breach Attributed to China-Linked Lotus Blossom Hacking Group

A China-linked threat actor known as Lotus Blossom has been attributed with medium confidence to the recently discovered compromise of the infrastructure hosting Notepad++. The attack enabled the state-sponsored hacking group to deliver a previously undocumented backdoor codenamed Chrysalis to users of the open-source editor, according to new findings from Rapid7. The development comes shortly
Read More