ChainUSD scam: review and warning about the platform that blocks withdrawals with fake taxes

Foreword: we are a law firm that deals exclusively with online scams. We have already handled the case of a person who fell into the ChainUSD trap and we can help anyone who has suffered the same scam: if you want to be assisted, fill in the contact form at the bottom of this article.

ChainUSD, reachable at g8x6s3.qblinks.cc, is a scam: a platform that shows profits on screen, allows a few small withdrawals and then blocks the rest of the funds behind a sequence of requests for money, each presented as “the last one”: an “anti-money-laundering check”, a “channel for large amounts”, a “risk-management status”, an “international tax”. We are not writing this on hearsay. We have read the chat history with ChainUSD customer service, kept in the case file, and compared the script with the rules governing financial activities and with the most recent case law of the Italian Court of Cassation.

The conclusion is clear-cut: ChainUSD is not an intermediary withholding funds for legal reasons, but a scheme that withholds funds in order to obtain more. To those who have not yet paid anything we say: do not. To those who have already paid we say: stop, and act methodically.

How ChainUSD works: from buying USDT to the account that never empties

The scheme that the documentation shows is linear. The person buys USDT, a stablecoin pegged to the dollar, from a regulated exchange, paying by instant bank transfer, and then sends the USDT to the address indicated by ChainUSD. The regulated exchange is only the point of purchase: the money is lost in the next step, when the USDT leave the victim’s wallet and end up at an address controlled by whoever runs ChainUSD.

On the ChainUSD client area the balance grows, and for a few weeks everything seems to work. The first withdrawals, of small amounts, are actually carried out: this is the bait that turns trust into larger deposits. Then, when the person tries a significant withdrawal, the ChainUSD system stops. From that moment on every exchange takes place only with a support chat, in which the user is identified by a UID code and the counterpart has no first name, surname or company name.

This is the classic structure of the fake cryptocurrency investment scam: the only contact with the victim is a channel that the fraudster can close, change or delete at any moment.

Domain, holder and authorisations: what ChainUSD does not show

The domain on which ChainUSD rests is qblinks.cc, while ChainUSD lives on a random alphanumeric subdomain, g8x6s3. The RDAP record of the .cc top-level domain shows that qblinks.cc was registered on 29 January 2026, expiring on 29 January 2027, through the registrar Cloudflare. The holder’s data is not public and the name servers are Cloudflare’s. This is not in itself unlawful: very many legitimate sites use the same services. It becomes an indicator when added to everything else.

The rest is absence. In the documentation in our possession, attributable to ChainUSD, there is no company name, no VAT number, no registered office, no reliable contact, no reference to a supervisory authority. A service that holds and moves private individuals’ funds cannot remain anonymous. Article 7 of Italian Legislative Decree 70/2003 requires the information society service provider to make available its name, address, contact details and, where they exist, its VAT number and the details of its authorisation.

On the regulatory side, the provision of crypto-asset services is subject to the authorisation required by Regulation (EU) 2023/1114 (MiCA), implemented in Italy by Legislative Decree 129/2024, which entrusts Consob with authorising service providers, after obtaining the opinion of the Bank of Italy. The searches we carried out on public sources, as of 10 November 2026, returned neither independent reviews nor the identification of an authorised entity linked to ChainUSD. We invite everyone to repeat the check on the Consob and ESMA registers before depositing money on any platform.

ChainUSD’s profit percentages: a quarter of the capital in a few weeks

In the case we examined, ChainUSD showed a profit in the order of a quarter of the capital paid in within a few weeks. No regulated operator can guarantee or present as ordinary returns of that level in so short a time: markets do not work that way, and the mere fact that a site displays them as a normal result is an indicator of fraud.

There is, however, a more important point than the percentage: the balance that appears on the ChainUSD screen is not money. It is a number in a database controlled by the operator, who can increase, reduce or zero it at will. The proof that a balance is real is the ability to withdraw it without paying anything. And it is precisely this ability that ChainUSD denies.

Five requests for money in a few weeks: ChainUSD’s script for blocking withdrawals

The chat history with ChainUSD is the most eloquent document. The requests follow one another with a progression that anyone who handles these cases recognises immediately:

• the first obstacle: the person cannot sell the USDT and is told that at least 25,000 USDT must be on the account to move up to a supposed “VIP1 level”, with the trading function disabled during the upgrade;
• the second: the withdrawal remains “under review” and customer service invokes anti-money-laundering rules, objecting that part of the funds came from a third party; to “remove the risk notice” it demands a photograph with the identity document in hand and a deposit equal to 30% of the amount to be withdrawn, with a peremptory deadline;
• the third: the withdrawal is declared blocked because it exceeds 35,000 euros, with reference to an unspecified European rule, and payment of 20% is requested to “activate a channel for high-value transfers”, with a 3% daily penalty in case of delay;
• the fourth: a “test” withdrawal of a few euros is executed, the next one is not, and a “risk management status” appears, to be removed with a fee equal to 30% of the balance;
• the fifth: an “international tax” of 25%, to be paid by a set date, then extended;
• the common thread: with every request, the same reassurance (“once you have paid there will be no further obstacles”), promptly contradicted by the next request.

The deadlines and penalties serve one purpose only: to stop the victim from pausing to think. When each payment serves to “unlock” the previous one, the capital already lost becomes the reason to pay more. It is the mechanism that holds fake investments together: the victim no longer pays to earn, but pays so as not to lose what has already been paid.

Fake anti-money laundering and fake taxes: why no rule requires you to pay in order to withdraw

ChainUSD’s justifications are all built on real rules, turned upside down.

The customer due diligence obligations of Legislative Decree 231/2007 fall on the obliged entities and translate into identifying the customer, acquiring information and monitoring transactions. They never provide that the customer must pay a percentage of the amount to be withdrawn as a “deposit” to prove the lawfulness of the funds. Accusing the victim of money laundering because part of the money was lent by a friend serves to put them in a state of subjection, not to comply with the law.

Nor is there any “international tax” or “European tax” on withdrawals from a crypto-asset platform that is paid by depositing funds into the platform’s own account. The tax obligations of those who earn income from crypto-assets are met in the tax return, and no tax authority asks for advances through a support chat. Likewise, there is no European limit of 35,000 euros that requires the purchase of a “channel for large amounts”.

The request for a selfie with the identity document is a risk in itself. A document linked to a face is exactly what is needed to open accounts or to present oneself to third parties in the victim’s name: whoever uses it answers for substitution of person (art. 494 of the Italian Criminal Code), but meanwhile the risk falls on the person who handed over that image.

The practical rule is just one: whoever has to pay in order to receive money that is already theirs is suffering a fraud.

Aggravated fraud (art. 640 c.p.), complaint and unauthorised financial activity (art. 166 TUF): the criminal framework of ChainUSD

The conduct described amounts to the offence of fraud provided for by art. 640 of the Italian Criminal Code: the artifices and deceptions consist in the false appearance of an operating platform, the profits shown on screen, the invented rules and the simulated deadlines, and the damage is the property paid in by the injured person.

When the act is committed remotely through computer or telematic means capable of hindering the identification of the offender, the aggravating circumstance of art. 640, second paragraph, no. 2-ter, c.p. applies, introduced by Law 90/2024 and in force since 17 July 2024. In judgment no. 27907/2026 (hearing of 14 July 2026) the Second Criminal Section of the Court of Cassation clarified that this aggravating circumstance concerns the manner in which the conduct is carried out, placing it among the offences committed by means of a computer system, and distinguishes it from the diminished defence of art. 61, no. 5, c.p., linked instead to the victim’s concrete vulnerability. In the same ruling the Court stated that fraud so aggravated is now punishable only upon complaint by the injured person, as a result of the derogation in the fourth paragraph of art. 640 as amended by Decree-Law 48/2025, converted by Law 80/2025. Judgment no. 18913/2026 (hearing of 26 March 2026) confirmed it: proceedings are brought upon complaint if no. 2-ter applies, ex officio if art. 61, no. 5 applies.

The practical point, for those defrauded by ChainUSD, is that without a complaint, in many of these cases, the proceedings cannot continue. The complaint is not a formality: it is the condition that sets the public prosecutor’s office in motion.

When ChainUSD collects money by promising profits from transactions in financial instruments or investment services, the unauthorised activity provided for by art. 166 of Legislative Decree 58/1998 (TUF) also comes into play, which punishes anyone who provides investment services or activities without being authorised. The Court of Cassation, in judgment no. 5191/2026 (hearing of 13 January 2026), made final the finding of liability for multiple frauds and for the concurrent offence of unauthorised activity under art. 166, paragraph 1, letter a), TUF. It must be said precisely that, for crypto-assets, the authorisation perimeter is now that of the MiCA Regulation and Legislative Decree 129/2024: the exact classification of ChainUSD’s activity as regards unauthorised activity depends on what the investigation ascertains about the collection scheme, while fraud remains conceivable in every case in which a payment was induced by deception.

The same precedent offers a useful insight into why ChainUSD’s subsequent requests are not “incidents” but part of the offence. The Court held there that fraud is “of prolonged consummation” even when the deceptive activity continues in order to hinder the discovery of the conduct and to create in the victims the reliance needed to obtain further profits. The case decided concerned fictitious interest paid by a false intermediary, not a USDT platform, but the logic is the same: each “payment to unlock” is an act of the same fraudulent design, not a separate event.

Anyone who receives and transfers the proceeds, even merely as an intermediary, may answer for money laundering and self-laundering (arts. 648-bis and 648-ter.1 c.p.): liability does not stop with whoever built the site.

Complaint, seizure and tracing: the timing that decides recovery

The time limit for filing a complaint is three months from the day on which the injured person learned of the fact (art. 124 c.p.). The same judgment no. 5191/2026 recalls that the starting point of the complaint period coincides with full knowledge of the criminal action and is distinct from the moment of consummation, relevant for limitation periods: it is not wise, however, to play with dates, because every day spent hoping for a refund reduces the chances of intercepting the funds.

On the asset side, what matters is reconstructing the flow. Bank transfers to the exchange and transactions on public blockchains leave traces that make it possible to identify destination addresses and the points at which the USDT were converted or moved. The criminal complaint to the public prosecutor’s office, complete with dates, amounts, transaction hashes and addresses, is the act that allows the judicial authority to assess preventive seizure (art. 321 c.p.p.). In the context of joining the proceedings as a civil party, conservative seizure (art. 316 c.p.p.) and, against those who have collected the sums without title, recovery of undue payment (art. 2033 of the Civil Code) remain available, as we showed in the solved case on recovery of undue payment after an online scam (in Italian). On confiscation, see also the in-depth piece on confiscation by equivalent and online scams (in Italian).

On the administrative side, against sites like ChainUSD Consob orders connectivity providers to black out abusive sites (art. 36, paragraph 2-terdecies, Decree-Law 34/2019, converted by Law 58/2019): according to the press release of 5 November 2026, the sites blacked out since July 2019 number 1,878. The blackout, however, does not return a single euro and does not prevent the same scheme from reopening under another address: it is a containment tool, not a recovery tool.

What to do if you have already used ChainUSD

The first step, for those who have used ChainUSD, is to stop paying, whatever deadline is imposed and whatever penalty is threatened: a penalty that applies after an invented deadline is further pressure, not an obligation. The second is to preserve every element:

• the chat history with customer service, saved in full and with dates;
• the receipts of bank transfers and the confirmations of USDT purchases at the exchange;
• the transaction hashes and destination addresses;
• screenshots of the balance and of the failed withdrawals;
• the messages of any other contacts, including on WhatsApp or Telegram.

The third is not to send any more documents or further photographs with an identity document. The fourth, to be done within hours and not days, is to report the matter to the bank and the exchange to ask for the checks that are possible: the outcome depends on the instrument and on the time elapsed and cannot be guaranteed. The criminal complaint follows, drafted so as to allow the prosecutor’s office to act on the flows.

One must also be wary of anyone offering to “recover” the funds for an upfront payment, or posing as an authority, a tax body or a court. After the victim stops paying ChainUSD, it is common for the same group to reappear under another name and another identity: this is the second scam, analysed in our review of fake fund-recovery services (in Italian). On why to entrust the complaint to a professional we have written in this guide on how to entrust the complaint to a lawyer expert in online scams (in Italian); for another cryptocurrency exchange platform with the same script, read the analysis of BTNEXCHANGE (in Italian).

How to check a USDT platform before depositing

Before paying money to a service that offers trading or custody of crypto-assets, the check takes a few minutes:

• look for the indication of a company with name, registered office and VAT number, and compare it with the business register;
• check on the Consob and ESMA registers whether the entity is authorised as a crypto-asset service provider;
• check the age of the domain: an “established” platform registered a few months ago is a serious warning sign;
• distrust profits shown on screen with no possibility of withdrawing them immediately;
• never pay fees, taxes or “checks” in order to withdraw your money: if a payment is needed to unlock a withdrawal, the check is already over.

A closing warning about ChainUSD

A single missing element could be an oversight. In the case of ChainUSD there is no company, no VAT number, no registered office, no authorisation; the domain was registered less than ten months ago and the holder is not public; the balance grows and the significant withdrawal never comes out; every request for money is presented as the last one and backed by rules that do not exist. The picture is such that, absent proof to the contrary, prudence requires treating ChainUSD as a scam. The operator of ChainUSD is free to reply with public documents, indicating company, authorisations and registered office.

If you have used ChainUSD, paid money or been asked to pay to unlock a withdrawal, contact us by filling in the form at the bottom of this page: we are a law firm that handles only online scam cases, we have already followed this case and we assess your position, including out of court, indicating the initiatives that can concretely be pursued, without promising results that no serious professional can guarantee. If you have suffered the same scam, we can help you.