defi-trust.co is a scam: one letter of difference and what a hash really proves

Preliminary note: we are a law firm and we deal exclusively with online fraud and the unauthorised provision of financial services. This article arises from a real case handled by the firm and is published in anonymised form as regards the injured party, for public interest purposes. The technical data come from checks on the public domain-name registries carried out on the date of publication. If you recognise yourself in what you read, you can submit your situation using the form at the bottom of this page.

One letter. Between defi-trust.co, the domain in this affair, and the most widespread commercial extension in the world there is one letter of difference, and in an address bar read in a hurry that difference is invisible.

That is not the only reason this case deserves an article of its own. The other is that, although it dates from 2023 and the site is long gone, the transactions are all still readable, and the injured party has kept their identifiers.

defi-trust.co is a scam, the firm has already handled this case, and here we explain two practical things: why an extension can deceive all by itself, and how a transaction hash is really read when a criminal complaint has to be drafted.

Why defi-trust.co is a scam: the checks

The domain defi-trust.co is no longer registered today, like the other two addresses used in the same affair — one with a .site extension and one that reverses the same two words. Three signboards, all dark.

Behind defi-trust.co there never was a company, a VAT number, an authorisation to provide investment services, or a reference to any intermediary on a supervisory register. The "DeFi" label — decentralised finance — served to explain in advance why, once the money had disappeared, there would be no one to call to account.

The missing letter: .co is not .com

Here is the most useful contribution of this article on defi-trust.co for anyone reading before they pay.

.co is Colombia's country extension, opened years ago to registration by anyone in the world and sold commercially. It is perfectly lawful and thousands of serious projects use it. But it has a feature that makes it valuable to anyone wanting to deceive: it is .com without the "m".

In an address bar glanced at quickly, on a phone screen, inside a link received in a chat, that missing "m" is almost invisible. It is the same principle as extensions that resemble others and names that resemble well-known brands: you do not need to deceive someone looking carefully, it is enough to deceive someone looking in a hurry.

Hence two practical rules that always apply, not only to defi-trust.co.

Read the address from right to left. The part that counts is the one immediately before the slash: that is where the real domain is. Everything before it — subdomains, prefixes, reassuring words — is chosen by whoever registered the name.

Be wary of links you receive. An address typed by hand, or reached from a bookmark saved earlier, cannot be substituted. A link arriving in a chat can.

The hash: what it proves and what it does not

Now to the part that, in the defi-trust.co file, really makes the difference.

Every cryptocurrency transfer recorded on a public blockchain has a unique identifier, commonly called the transaction hash: a long alphanumeric string that typically begins with "0x" on some networks. That string is the exact address of that single operation within the ledger.

What a hash proves: that that operation took place, on that date and at that time, for that amount, in that currency, from one address to a destination address. It is objective data, verifiable by anyone, immutable and permanent.

What it does not prove: who holds the destination address. Blockchain addresses contain no names.

In defi-trust.co this distinction is decisive in drafting the complaint, and it is why a complaint that merely attaches a list of hashes is incomplete. The hash is the starting point of a reconstruction, not its conclusion.

We dealt with this aspect at greater length in our article on m.hashvalueks.com.

How the money is followed: from hash to name

The route, in affairs such as defi-trust.co, is this, and it is worth knowing if only to know what to ask for.

From the hash you trace the destination address. From that address you observe the subsequent movements: funds rarely stay still, they are split, aggregated, moved through several steps.

You keep following them until the point where they leave the circuit, that is, until they are converted into traditional currency or transferred to a service provider. That point is almost always an exchange.

And that is where the important thing happens: those providers, in the European Union, are subject to anti-money-laundering obligations. They must identify customers, retain transaction data and respond to requests from the judicial authority. It is the moment when an anonymous address meets an identity document.

That is why the complaint must not merely list the hashes: it must expressly ask for the flows to be followed to the points of conversion and for the identifying data of the holders to be obtained from those providers, with an application for preventive seizure (Article 321 of the Code of Criminal Procedure) of whatever may still be there.

The advantage cryptocurrency cases have

There is an aspect of defi-trust.co that surprises many people, and it should be said because it changes how you see your own case.

In affairs such as defi-trust.co, time damages the evidence far less than in a fraud carried out by transfers to foreign bank accounts.

Websites vanish: the three domains of the defi-trust.co affair are no longer registered, and with them the registrants' details and the technical configurations have gone. Providers' access logs have very short lives.

The public transaction ledger, by contrast, cannot be erased. A 2023 transfer is readable today exactly as it was then, and will still be in ten years' time. It does not depend on anyone's goodwill and it has no expiry date.

This does not mean waiting is harmless — service providers' data do have retention periods, ten years under anti-money-laundering rules, and money moves — but it does mean that a cryptocurrency case from a few years ago is not a case without evidence.

The legal framework

The facts relating to defi-trust.co date from 2023, and are therefore prior to Law 90/2024: the aggravating circumstance of Article 640(2-ter) does not apply. Diminished capacity to defend oneself (Article 61(5)) and particularly serious financial loss (Article 61(7)) must be pleaded.

Transfers made across several domains of the same activity amount to a continuing offence (Article 81(2)). Offering investment services to the public without authorisation falls under Article 166 of the Italian Consolidated Law on Finance, prosecuted ex officio.

For a 2023 case, however, the most relevant point concerns money laundering (Article 648-bis) and self-laundering (Article 648-ter.1): the subsequent movements of the funds and their conversion are separate conduct, later than the fraud, with longer limitation periods running from their own date. In cryptocurrency affairs those steps are documented on the public ledger, and therefore provable.

What to do now

Anyone who has transferred cryptocurrency to defi-trust.co, or to a platform built the same way, should obtain:

the complete list of hashes for every transfer and of the destination addresses; the complete export of the history from their exchange, in original format; the native export of the conversations using the application's function, with dates and times; the screenshots of the platform and the balance displayed, if any remain; the list of all the domains used in the affair, with their periods; and documentation of the lawful origin of the cryptocurrency used.

The complaint, or the supplement to one already filed, must contain the application for preventive seizure (Article 321), the request for information on registration under Article 335, the request for notice in the event of a request to shelve the case under Article 408(2) and, above all, the express request to trace the flows to the points of conversion.

And the usual warning: anyone who contacts you promising to "recover the cryptocurrency" in exchange for an advance payment is the second scam. No one can return funds from a blockchain without going through the authorities.

Similar cases already handled by the firm

Anyone who has come across defi-trust.co will also find useful our analysis of defi-trust.site, on the same affair from the point of view of the person who made the transfers, and that of trust-defi.link, on name rotation.

If you have the hashes, you have more than you think

The picture is this. defi-trust.co is a scam: a domain with an extension that resembles the world's most common one by one letter, no longer registered today like the other two names of the same activity, behind which there never was a company.

But if you have kept the transaction identifiers, you are not empty-handed. Websites go dark, the public ledger does not: those operations remain readable, and that is where the reconstruction starts, up to the point where the funds met an identity.

The firm has already handled this case. You can submit your situation for a preliminary assessment.

If you have suffered the same scam, we can help you. Fill in the form at the bottom of this page.