m.hashvalueks.com scam: the line missing from the complaint

A premise: we are a law firm and we deal exclusively with online fraud and unauthorised financial activity. This article comes from a real case handled by the firm and is published in anonymous form as regards the injured party, for public interest purposes. The technical data come from checks on the public domain registries carried out on the date of publication. If you recognise yourself in what you read, you can submit your position to us using the form at the bottom of this page.

In the m.hashvalueks.com file a complaint had already been filed. It had been lodged with the Carabinieri, it recounted the facts, it named the person who had carried out the fraud. But one line was missing, and without that line the money cannot be followed: the hash of the transactions.

It is the most widespread and most expensive mistake in complaints about cryptocurrency fraud, and it can still be put right. This article explains what that line is, why it changes everything, and what to do if your complaint does not contain it.

m.hashvalueks.com is a scam, and our firm has already handled this case.

Why m.hashvalueks.com is a scam: what the registries say

Let us start with the technical checks, which anybody can repeat.

The domain on which m.hashvalueks.com runs is registered on 11 September 2026, for one year, with a foreign registrar. The injured party's payments continue until October 2026: the site was created, in other words, a few weeks before the story began, and the one-year registration confirms that this is a tool designed for a single season.

The name is protected by a service that masks the origin server, and it has no mail record configured at all: there is no corporate mailbox associated with the m.hashvalueks.com domain. A company that collects money from the public has mail on its own domain; here there is none.

Then there is a detail that deserves attention, because it is rarely seen. The main address does not answer: only the version with the "m." prefix answers, that is, the variant intended for telephones, which is exactly the one used in our file. In practice m.hashvalueks.com does not exist as a site you can find and visit normally: it exists only for whoever receives the link in a chat and opens it from a mobile.

This is not a casual technical choice. An address that lives only in its mobile version stays outside ordinary browsing, is not stumbled upon by chance, is harder to report and to index, and is displayed on the small screen of a telephone, where the full address is almost illegible and nobody really checks what they are opening.

Finally, the substantive checks all come back negative: no identifiable company, no VAT number, no registered office, no authorisation number referable to m.hashvalueks.com. Anyone offering investment services to the public in Italy must be authorised and entered in the relevant registers, and that authorisation is checked on the supervisory authority's register, not on the page somebody sent you.

The scheme: the acquaintance begins on a dating app

In the m.hashvalueks.com case the first contact is not an investment advertisement. It is an acquaintance that began on a dating app.

The scheme of m.hashvalueks.com is always the same and it is precisely designed. For weeks there is no talk of money: there is talk of life, of plans, of loneliness. A relationship is built. Only afterwards, quite naturally, comes the mention of an investment that is "going well", followed by the offer to help the other person do the same. The link to m.hashvalueks.com arrives at that stage, when it is no longer a stranger's link but the advice of somebody you trust.

Legally this step must be set out clearly in the filing, because the relationship built to order is itself the artifice referred to in article 640 of the Italian criminal code. It is not a background circumstance, it is not "the victim's naivety": it is the machinery of the deception. And where the injured party is in a condition of particular personal fragility which the perpetrator knowingly exploits, the aggravating circumstance of diminished defence under article 61 no. 5 applies, recalled by article 640 paragraph 2 no. 2-bis.

In the m.hashvalueks.com file the total sum is around fifty-two thousand euro, paid by transfers abroad and by cryptocurrency transfers, and partly financed with a loan: a debt that remains even when the money is gone.

The missing line: the transaction hash

Now we come to the point that makes the m.hashvalueks.com file useful even to somebody who has never heard that name.

When money is paid in cryptocurrency, every transfer receives a unique identifier: a long string of letters and numbers, called the transaction hash or TXID. That string is recorded in a public archive, consultable by anybody, which cannot be modified or deleted. It is the equivalent, in plain terms, of the IBAN together with the operation number of a bank transfer — with one important difference in our favour: the cryptocurrency ledger is public and does not forget.

A complaint that says "I sent cryptocurrency on such a date for such an amount" is, from an investigative point of view, almost mute. The magistrate has no point from which to start: he does not know which address the funds went to, he cannot see where they were moved afterwards, he cannot ask an operator to freeze them.

A complaint that contains the hashes of every single transfer is another matter. From those identifiers the destination address is obtained; from the address, the funds' subsequent path is followed step by step; and when that path reaches an exchange platform — and it almost always does, because at some point the funds have to be converted — that platform can be asked, by order of the judicial authority, who holds the destination account, and for the sums to be frozen.

It is the difference between recounting and pointing, and it is the difference between a complaint about m.hashvalueks.com that stops and one that moves.

Where the hashes are found, even now

If they are not in your complaint about m.hashvalueks.com, they are not lost. They are recovered like this.

From the platform you sent the cryptocurrency from: in the withdrawal history every operation has a detail entry showing the transaction identifier and the destination address. Almost all of them allow the whole history to be exported to a file: ask for that, not for a screenshot.

If you bought through a service or a machine, the operator is required to keep the operation data and must provide them on request: you are the account holder.

If you only have the destination address, that is more than enough: entered into a block explorer, it shows every operation received, with date and amount, and allows yours to be identified.

And if bank transfers left your current account for abroad before conversion, that part of the path is already traced by the bank: the complete statement, with ordering party, beneficiary, IBAN, BIC and country, must be requested in official form and attached.

All this material is to be filed in supplementation of the complaint already lodged, not by starting over: the filing refers to the proceedings already open, adds the identifiers, reconstructs the flow and formulates the requests the original complaint did not contain — seizure of the sums, enquiries with the destination operators, extension of the investigation beyond the first step.

The facial recognition handed over

In the m.hashvalueks.com file there is a further element that must be handled carefully, because its consequences arrive later.

The injured party was asked for, and handed over, an identity document, a tax code, a bank statement and a facial recognition check.

Biometric facial data is not a document like the others. It is personal data of a special category under article 9 of the European data protection regulation, and above all it is the key many platforms use to verify identity remotely when an account is opened. Whoever holds your document and a facial verification of you has, in practice, the material to open accounts in your name at exchange platforms or payment institutions.

In cases like m.hashvalueks.com the risk is not theoretical. Accounts opened with an injured party's documents serve to route other victims' money, and when that money is traced the first name that emerges is yours. Opening accounts with somebody else's documents amounts to impersonation under article 494 of the criminal code.

What to do, concretely. The filing must include a precise list of everything that was handed over, with the date of delivery and the channel used, and an express, dated declaration of disavowal: I did not open or authorise any account using my documents and I disavow every operation carried out with them. It must be reported in writing to your bank. It is useful to set up periodic monitoring of your position in the credit databases, so as to notice straight away any loan or account you do not recognise. And no further photograph, selfie or verification video must be sent, for any reason: every new upload increases the material available.

When the fraudsters make threats

In the m.hashvalueks.com case the injured party is still in contact with those who defrauded him, and is receiving threats.

It is a phase many people live through and almost nobody talks about, out of shame. It must be said plainly: threats are a separate offence and must be reported, and when they serve to extract more money you enter the territory of extortion under article 629 of the criminal code, or at the very least of attempted extortion. It is not a detail of the story: it is a charge, and one of the most serious in the whole affair.

In cases like m.hashvalueks.com the practical rules are four.

Do not pay any more money, for any reason and under any label: taxes, commissions, unlocking fees, penalties. Whoever pays to make the pressure stop pays twice.

Do not delete or block anything before exporting everything. Conversations must be saved in native format, with date and time, the numbers noted down, the threats captured within the context of the message and not cropped.

Bring the threats into the filing, as a chapter of their own, with the contact details they come from: those contacts are live channels, active today, and they are investigative material of far greater value than a site that has already been switched off.

If the threat concerns you or your family, go to the police at once, without waiting for the lawyer's filing.

The legal framework

The m.hashvalueks.com facts date from 2026, and therefore come after law 90/2024: article 640 paragraph 2-ter of the criminal code applies, which aggravates fraud committed remotely by means of computer tools capable of hindering identification of the perpetrator.

Alongside it come diminished defence under article 61 no. 5 recalled by article 640 paragraph 2 no. 2-bis, damage of particular seriousness under article 61 no. 7 — aggravated by the resort to a loan — impersonation under article 494 for the documents and the biometric data, threats and possible extortion, including attempted extortion, under article 629, unauthorised financial activity under article 166 of the Consolidated Law on Finance, prosecutable of the court's own motion, and, as regards the path of the funds, money laundering under article 648-bis and self-laundering under article 648-ter.1, to be presented as somebody else's conduct.

On the time limit: the last payment dates from October 2026, so the three-month limit for the complaint falls in January 2027. The aggravating circumstances of the second paragraph of article 640 and unauthorised financial activity entail prosecution of the court's own motion in any event, but the supplementary filing should be made at once, not least because the funds move.

What to secure immediately

Anyone who paid money to m.hashvalueks.com must obtain: the complete bank statement in official form, outgoing and incoming; the exported history of all cryptocurrency operations, with the transaction identifiers and the destination addresses; the native export of all conversations, including those on the dating app and including the threats; the profiles and contact details used by the other side; the screenshots of the platform and the exact address it opened from; the list of documents and biometric data handed over; the loan documentation; a copy of the complaint already filed and its receipt.

And a warning that applies to every case like m.hashvalueks.com: anybody who contacts you promising to recover the sums on advance payment is the second scam, built on the lists of the victims of the first.

Similar cases already handled by the firm

Anyone who crossed paths with m.hashvalueks.com will find useful our analysis of tiktok yalmy.shop, where romance baiting is the engine of the fraud and the site lives only as a subdomain; that of dam-w24platform.com, on the deleted domain and the fake recovery; and, on money entrusted to a self-styled adviser, the one on unauthorised financial activity. On transfers stopped by the bank and foreign accounts, see bgc4invests.com.

If you invested in m.hashvalueks.com: what to do now

This is the picture. m.hashvalueks.com is a scam: a domain registered on 11 September 2026 for one year, behind a service that masks its server, with no mail, with no identifiable company or authorisation, and reachable only in its telephone version — that is, only by whoever receives the link in a chat.

If you have already filed a complaint and the transaction identifiers are not in it, you are not out of time: those identifiers can be recovered and filed in supplementation, and the public cryptocurrency ledger keeps everything.

If you handed over documents or a facial verification, the disavowal must be put in writing now.

And if you are receiving threats, that is the most urgent chapter, not the most embarrassing one.

Our firm has already handled this case. You can submit your position to us for a preliminary assessment.

If you have suffered the same scam, we can help you. Fill in the form you will find at the bottom of this page.