dam.w24platform.com is a scam: vanished crypto, a deleted domain and a fake recovery operation

Please note: we are a law firm that deals exclusively with online investment fraud and unauthorised financial activity. This article is based on a real case handled by the firm and is published in anonymised form in the public interest. If you recognise your own situation in what follows, you can submit your case using the form at the bottom of this page.

The domain no longer exists. It is not offline, not suspended, not "under maintenance": dam.w24platform.com is a scam whose infrastructure has simply been erased. A query to the authoritative .com registry returns 404 — the name is not registered — and DNS resolution answers NXDOMAIN for both the apex and the third-level host. Anyone who sent money to that platform today has not even a web page to show a prosecutor. That, far more than any review, is the technical proof of what w24platform actually was.

Why w24platform is a scam: the technical checks on a domain the registry does not know

Start with the verifiable facts about w24platform, because in criminal proceedings that is where a complaint is built.

The first check is registry-based. An RDAP query to the .com registry returns 404 for w24platform.com: the domain is not registered. Not "privacy protected", not "redacted": absent. It means the name, after being used operationally, was allowed to lapse and was released, or was cancelled on request. The practical outcome is the same: the legal container that would have allowed investigators to trace the registrant, the historic nameservers and the contact data has dissolved.

The second check is resolution. DNS queries for w24platform.com and for dam.w24platform.com return no A record, no MX record, no NS record: the authoritative answer comes from the gTLD root servers with a negative SOA. In technical terms, NXDOMAIN. The platform on which the victim watched a crypto balance grow no longer has an IP address, no mail server, nothing at all. Anyone claiming w24platform is an operating company has to explain how a financial operator can exist without a domain.

The third check concerns digital reputation, and it is silent. There is not a single indexed review, not a forum thread, not an entry on any aggregator, not a single supervisory warning naming w24platform. The complete absence of a public footprint, for a platform presenting itself as a crypto investment intermediary, is an anomaly that points in one direction: client acquisition was not public but relational, carried out in private chats and instant messaging. It is the pattern we described, with variants, in our analysis of cryptoledgerx.top and the blocked balance behind fake tasks.

The fourth check concerns the protocol. The address through which the platform was presented to the victim was served in clear text, over HTTP rather than HTTPS. An operator who asks users to enter credentials and upload identity documents over an endpoint with no TLS is not being technically careless: it is deliberately avoiding a certificate which, however minimal, would leave a trace with a certification authority. Every element of w24platform is built to leave no handhold.

No authorisation, no company, no VAT number

The second block of checks is the one that qualifies the conduct of w24platform in legal terms. The provision of investment services in Italy is a reserved activity: the reservation is protected by criminal law under art. 166 of the Consolidated Law on Finance (TUF), which punishes anyone carrying out investment services or activities without authorisation. Taking deposits from the public is reserved to authorised entities under art. 130 of the Consolidated Banking Act (TUB). For crypto-asset services, the framework is now completed by Regulation (EU) 2023/1114 (MiCA) and, domestically, by legislative decree 129/2024, which adapted Italian law and attached sanctions to the unauthorised provision of crypto-asset services.

Against that framework, w24platform is a phantom. No entry in any register kept by a supervisory authority. No company name displayed on the site. No VAT number, no LEI code, no registered office, no declared share capital. Not even a fake licence number: many fraudulent platforms at least display the licence number of a real intermediary, copied from elsewhere, to survive a superficial check. w24platform did not even bother, and that is significant: it indicates a short-cycle operation, designed to close and disappear, not to sustain an appearance of legitimacy over time.

Anyone looking today for confirmation that w24platform is a scam will not find a blocking order, because there was no time to issue one: the domain died first.

The mechanics: from the first foreign transfer to a balance that cannot be withdrawn

The w24platform scheme reconstructed in the file is the familiar one of assisted fake investment, with a variant that deserves attention.

Initial contact with w24platform took place in 2025 and ran entirely over messaging. The victim was presented with a crypto investment platform with a dedicated account manager. There was no prospectus, no framework agreement, no pre-contractual disclosure: there was a chat and a link. Payments were made through transfers abroad in favour of third-party beneficiaries — individuals or shell companies that do not match the platform's own name. This is the first anomaly no authorised operator could ever present: an intermediary receives funds into its own account, not into a third party's account in a different country.

On the w24platform client area, the balance grew. It grew in a linear, predictable way, with no drawdown and no volatility: in other words, in a way incompatible with real trading on crypto markets. Here is the figure that recurs with statistical monotony in our files: the share of winning trades displayed by fraudulent platforms approaches 100%. No existing strategy produces a loss-free curve over a multi-year horizon, and the depiction of such a curve constitutes, in criminal terms, the artifice typical of art. 640 of the Italian Criminal Code: not an optimistic forecast, but the representation of a fact that does not exist.

The mechanism of w24platform reveals itself, as always, at the withdrawal stage. The redemption request is not refused: it is made conditional. Unlocking fees appear, along with supposed tax charges, "compliance checks", margins to be restored. Each further payment is presented as the last step required. It is the same architecture we described in EliteClouds and the unlocking fees on a non-existent prize.

In this case the last traced transfer is dated 27 February 2026. Total exposure currently stands at around EUR 28,000–29,000. Then silence: no further contact from the operators, an inaccessible client area, a cancelled domain.

The second hit: fake fund recovery as a separate offence

This is where the file becomes technically interesting, because the victim of w24platform was defrauded twice.

After w24platform closed, the victim was contacted by people offering to recover the lost sums. The mechanism is known internationally as a recovery room and is run either by the same organisation that carried out the primary fraud or by structures that buy its lists. The operating premise is brutally effective: someone already defrauded is the best possible target, because they have a motive — recovering their capital — that suspends critical judgement, and because their identity, their amounts and their story are already known to the caller, who uses them to establish credibility.

In this case the second cycle produced a further payment of around EUR 4,000, again abroad, in November 2026. So when we talk about w24platform we are not talking about damage that stopped in February 2026: we are talking about damage the structure continued to produce for nine months after the platform vanished.

Why fake recovery is not breach of contract but a completed fraud

It is a recurring mistake, even in complaints concerning w24platform, to describe fake debt recovery as a service that was not delivered. It is not, and the correct classification carries heavy procedural consequences.

Fake recovery constitutes a separate offence of fraud under art. 640 of the Criminal Code: the artifice consists in representing a recovery capability that does not exist — often supported by forged documents, fake orders of foreign authorities, fake exchange communications — and the loss is complete on payment. There is no unperformed contract, because there was never any performance the perpetrator intended to render. It is a second offence, committed at a different time and place, with its own complaint deadline and its own limitation period.

Where the recovery operator presents himself as a lawyer, an authorised adviser, an official of a supervisory authority or an exchange representative, the fraud is accompanied by impersonation under art. 494 of the Criminal Code and, where legal practice is simulated, by unauthorised practice of the profession under art. 348.

The practical implication is that the complaint must contain two distinct narratives, with two chronologies, two sets of payment details and two lists of counterparties. A complaint that merges the two cycles into a single undifferentiated account risks having the second one — the more recent and therefore investigatively richer, because the accounts are still live — treated as a tail of the first and shelved with it.

ID document and bank details handed to the organisation: the money mule risk

The victim sent w24platform a copy of an identity document and personal bank details. This is standard practice: the request is presented as an anti-money-laundering requirement, using terminology borrowed from the genuine customer due diligence obligations set out in arts. 17 ff. of legislative decree 231/2007. The mimicry is deliberate, because it makes the request not merely acceptable but reassuring.

The consequences of handing those documents to w24platform are two, and both must be addressed immediately.

The first is impersonation. A copy of an identity document, associated with a face and a bank account, allows positions to be opened with payment institutions using remote onboarding, utilities to be activated, credit agreements to be signed. The relevant provision is art. 494 of the Criminal Code and, where an unjust profit and corresponding loss follow, further property offences.

The second is more insidious: the risk of being drawn into money laundering flows. An account attributable to a real person, with a verified identity, is a valuable asset for an organisation that needs to move criminal proceeds. If sums originating from other frauds pass through the victim's account — including in-and-out, in the pass-through pattern — the position changes radically: a suspicious transaction report is triggered, the account is frozen, and the victim finds themselves under investigation for money laundering under art. 648-bis or self-laundering under art. 648-ter.1 of the Criminal Code.

Art. 63 of the Code of Criminal Procedure: when the victim risks becoming a suspect

This procedural point must be stated plainly, because in files such as w24platform it decides the victim's position.

Where a person is summoned by the judicial authority or the police as a witness and, during the interview, makes statements from which evidence of their own criminal involvement emerges, art. 63 of the Code of Criminal Procedure requires the authority to stop the examination, warn them that investigations may be opened against them, and invite them to appoint defence counsel. Statements already made cannot be used against them. If, however, the person should have been heard as a suspect from the outset, their statements are wholly unusable.

The operational corollary is simple and too often ignored: anyone who handed documents and bank details to a structure like w24platform should not attend an interview without counsel, and should not build their account solely around the status of victim. The account must be anchored documentarily to a passive role in the flows, and must be filed before a possible anti-money-laundering report pushes the prosecutor's office towards a different reading.

Legal classification: art. 640, aggravating circumstances and the new paragraph 2-ter

The conduct attributable to w24platform constitutes fraud under art. 640 of the Criminal Code in its fullest form. The artifices are numerous and all documentable: a platform simulating non-existent trading; reporting of returns never produced; a support structure simulating a professional relationship; a sequence of pretexts to obtain further payments. Inducement into error is proved by the victim's own conduct, who made repeated transfers. Unjust profit and loss are quantified by the payment records.

What must be avoided is the mistake, common in complaints drafted without technical assistance, of invoking art. 640-ter — computer fraud. That provision requires alteration of the functioning of a computer system or unlawful intervention on data or programs. Nothing of the sort happens here: the computer system is the instrument of the false representation, not its object. The deception operates on the person, not on the machine.

Art. 61 no. 5 and the already-defrauded victim

Art. 640(2)(2-bis) aggravates fraud where the circumstance in art. 61 no. 5 is present, namely taking advantage of circumstances of time, place or person such as to hinder public or private defence. In online frauds such as w24platform the circumstance is structural: distance, the anonymity of the channel, the victim's inability to verify the counterparty's identity in real time.

In the second cycle — the fake recovery — the circumstance takes on a further and, in our view, decisive weight. The perpetrator is not exploiting a generic condition of distance: he is exploiting a qualified impairment of defence, namely the condition of someone who has already suffered a substantial financial loss and is under psychological pressure the organisation itself created. It is targeted, selective exploitation built on a known vulnerability.

What paragraph 2-ter unlocks for the investigation

Art. 640(2-ter), introduced by law 90/2024, aggravates fraud committed remotely through computer or telematic means capable of hindering the identification of the perpetrator or of others, providing for two to six years' imprisonment and a fine of EUR 700 to 3,000.

The facts concerning w24platform fall in 2025 and 2026, therefore entirely after the entry into force of that reform: no issue of non-retroactivity under art. 2 of the Criminal Code arises here. The aggravating circumstance is fully available, and its availability is anything but neutral.

A statutory maximum of six years — this being an aggravating circumstance with special effect and therefore counted under the criteria of art. 4 of the Code of Criminal Procedure — places the offence above the threshold in art. 266(1)(a), which requires offences punishable by more than five years' imprisonment. In other words: on simple fraud, telephone and electronic interceptions are not permitted; on aggravated fraud under art. 640(2-ter) they are. For files like w24platform, where identification necessarily runs through telematic traffic and contact numbers, that is the difference between a real investigation and shelving against unknown persons.

The same statutory maximum affects the limitation period, which under art. 157 equals the maximum penalty and in any event not less than six years.

Unauthorised financial activity: the offence that is complete regardless of loss

Alongside the w24platform fraud sits a provision systematically forgotten in complaints, to the serious detriment of the victim's position.

Art. 166 TUF punishes anyone providing investment services or activities without authorisation, and art. 130 TUB protects the reservation on taking deposits. These are offences of danger, complete upon the mere unauthorised exercise of the reserved activity, regardless of whether any individual investor suffered loss. For crypto-asset services, unauthorised provision is now also covered by the regime introduced by legislative decree 129/2024 in adaptation to MiCA.

The procedural difference is substantial. Unauthorised financial activity is prosecuted ex officio and is not subject to any complaint deadline. Pleading it gives the prosecutor an independent basis for prosecution that survives even where simple fraud has become unprosecutable. We developed this approach, successfully, in our analysis of unauthorised financial activity and money entrusted to an acquaintance for a foreign broker.

The complaint deadline is the real guillotine

This is the critical point of the file, and it serves as a general warning to anyone who paid money to w24platform.

For victims of w24platform, art. 124 of the Criminal Code sets a three-month deadline, running from knowledge of the facts, for filing a criminal complaint. In online fraud, knowledge of the facts does not coincide with the first transfer: it coincides with the moment the victim becomes aware of the fraudulent nature of the operation — typically the definitive refusal of a withdrawal or the disappearance of the contact.

In this case the victim first approached a lawyer in March 2026, did not follow through, and returned to the firm in October–November of the same year. Seven months. On the first cycle, the three-month deadline for simple fraud had long expired.

What saves the position is not timeliness, which was absent: it is ex officio prosecution. Art. 640, as amended following legislative decree 150/2022, provides for prosecution on complaint save where one of the aggravating circumstances in the subsequent paragraphs applies, or that in art. 61 no. 7. It follows that pleading the circumstance in art. 61 no. 5, the circumstance in paragraph 2-ter, or substantial financial loss under art. 61 no. 7, makes the offence prosecutable ex officio and neutralises the deadline problem.

This is where the distance between a complaint drafted as a narrative and one drafted as a technical instrument is measured. The material is identical; the outcome is the opposite. And on the second cycle — the fake recovery of November 2026 — the deadline is still fully open, a further reason not to merge it into the first.

Foreign transfers: jurisdiction, venue and cooperation

Payments made to w24platform beneficiaries abroad raise three issues that must be addressed in the complaint itself.

Jurisdiction. Under art. 6 of the Criminal Code an offence is deemed committed in Italy where the act or omission occurred there in whole or in part, or where the result occurred. In fraud, an instantaneous offence of loss, completion coincides with obtaining the unjust profit and the corresponding depletion of the victim's assets. Since that depletion takes place with a debit ordered in Italy, Italian jurisdiction exists even where the entire structure sits abroad.

Venue. Art. 9 of the Code of Criminal Procedure provides the residual rules where the place of completion cannot be determined; in practice, anchoring to the victim's domicile or to the place where the payment operation originated is what allows registration with an identifiable prosecutor's office.

Cooperation. Obtaining banking evidence from institutions in other Member States runs through the European Investigation Order under legislative decree 108/2017. Towards third countries the instrument is letters rogatory, with incomparably longer timelines. The choice depends on the beneficiaries' jurisdictions, which must therefore be identified and set out institution by institution.

On-chain tracing, seizure and value confiscation

Where funds paid to w24platform pass into cryptocurrency, chain analysis is the only tool capable of turning a transfer into a lead.

Transactions on public blockchains are immutable and fully inspectable: from the first destination address it is possible to reconstruct subsequent transfers, identify mixing services and, above all, identify the point at which the funds reach a centralised exchange subject to customer due diligence obligations. That is the point of attack: there, and only there, is there an obliged entity capable of linking an address to an identity.

The tools against those who ran w24platform are the ordinary ones: evidentiary seizure under art. 253 of the Code of Criminal Procedure and preventive seizure under art. 321 to freeze assets with a view to confiscation. Where the proceeds can no longer be traced in specie — the normal outcome with structures such as w24platform, which fragment and convert — value confiscation remains available.

The decisive factor, in w24platform files, is time. Every week that passes reduces the probability that the sums are still reachable, and in this file nine months have already been spent.

The position of the bank that executed the transfers

A necessary clarification, because w24platform victims build unfounded expectations on this point.

The transfers made by the victim are authorised payment transactions: the victim voluntarily gave the instruction, albeit in error. The refund regime applicable to unauthorised transactions under legislative decree 11/2010 — which presupposes the absence of the payer's consent — therefore does not apply. Anyone promising bank recovery by invoking PSD2 on authorised transfers is stating something technically false, and it is, not coincidentally, one of the recurring arguments of recovery rooms.

There is, however, a different ground of bank liability, to be argued in civil proceedings and not confused with the former: compliance with professional diligence obligations under art. 1176(2) of the Civil Code and with the customer due diligence and abstention duties under arts. 17 ff. of legislative decree 231/2007, in relation to manifestly anomalous activity — repeated transfers to foreign beneficiaries not matching the declared counterparty, to recently opened accounts, inconsistent with the client profile. It is a technical claim with an uncertain outcome, but it is a real one.

What to secure immediately, now that the domain no longer exists

For anyone who paid w24platform, the list is operational. Full export of the conversations with the operators, using the messaging application's native export function, preserving the original file rather than a printout. All transfer records, with complete beneficiary details, IBAN, BIC, country and reference. Emails in their original formats, with full technical headers. A list of the telephone numbers and email addresses used by the counterparties, with contact dates. Captures of the client area, if any were taken before closure. A registry attestation of the domain's current status and of the DNS failure, obtained and dated, because it is the technical proof that the platform does not exist. For crypto transfers, the transaction history exported from the exchange used, with destination addresses.

On that basis a complaint is drafted pleading aggravated fraud under art. 640(2)(2-bis) and (2-ter), unauthorised financial activity under art. 166 TUF, the second fraud cycle relating to fake recovery and, where applicable, art. 494, with a concurrent application for seizure under arts. 253 and 321 of the Code of Criminal Procedure and a request to activate the cooperation instruments under legislative decree 108/2017. The complaint should be filed with a request to be notified of any application to shelve the case under art. 408(2), the minimum safeguard enabling an objection to be lodged.

Readers who recognise their own case may also find useful our analysis of HyperCommunity and the daily-return Ponzi scheme.

If you invested through w24platform: what to do now

The picture is this. w24platform is a scam with no authorisation of any kind, whose infrastructure was erased from the registries after collecting money through transfers abroad, and which continued to cause loss through a second cycle of fake debt recovery. There is no prospect of recovering the sums by negotiating with the platform or with anyone offering to recover them: there is a technical route, running through banking and on-chain traceability, correct criminal classification of the facts, and promptness.

Our firm has already handled this case. If you sent money to dam.w24platform.com, or to a platform following the same pattern, you can submit your position for a preliminary assessment: we will tell you which documents are usable, which aggravating circumstances can be pleaded in your case and whether the conditions for a seizure application are met.

If you have suffered the same fraud, we can help you. Fill in the form at the bottom of this page.