zexa66100.com is a scam: fake USDC loan and fake fund recovery

Foreword: we are a law firm that deals exclusively with online scams. We have already handled the case of a person who fell into the trap of zexa66100.com and we can help those who have suffered the same scam: if you want assistance, fill in the request form at the bottom of this article.

zexa66100.com is a scam that can be recognised by one accounting detail: a "loan" of 10,000 USDC, granted by an account showing growing profits, was repaid with real bank transfers made from the person's current account, while the balance on the platform never decreased. A debt that is extinguished outside the system in which it arose is not a debt: it is the tool used to draw real money out of someone who is looking only at figures on a screen. After the transfers the account showed 17,130 USDC, the withdrawals requested were rejected, an additional fee of 7,130 euro was demanded to unlock them and, within a few days, contact ceased and zexa66100.com could no longer be reached. Then came the second scam, more insidious: a fake recovery service that induced the payment of a further 7,700 euro to an account held by a private individual. We examined the account written by the person, the screenshots of the platform, the transfer receipts and the correspondence with our firm.

The conclusion is clear: zexa66100.com is a scam because an account presented as an "exchange" cannot make a withdrawal conditional on payment of a fee, because no legitimate loan is repaid while leaving the debt intact, and because whoever ran the group that steered people towards the platform disappeared together with the site. The case of zexa66100.com is of interest to criminal law practitioners for a further reason: it shows repeat victimisation, with a recovery fraud grafted onto the first, and it offers, in the second scheme, an element that crypto scams almost always lack, namely an Italian bank account held by an identifiable person.

How zexa66100.com works: a "high-level training group", an account that grows and a platform that nobody supervises

The script of zexa66100.com begins outside the platform. The person joins a group presented as providing "high-level training" in investments, led by a self-styled manager and assisted by two collaborators. It is a model that supervisory authorities have been describing for years: a messaging channel that looks like a study community, where the "teacher" shares results, the "tutors" answer doubts and the participants exchange screenshots of gains. Nobody sells a financial product; they merely indicate where to "trade". The platform to use is zexa66100.com.

The screenshots on file show that zexa66100.com presented itself as a cryptocurrency exchange with all the sections one would expect: spot account, futures account, savings account, credit account, a withdrawal section for fiat and for crypto, and a deposit history. This completeness is part of the artifice. A real platform looks the same, but behind the balance there is a register of transactions, a custodian of the funds and an authorised entity answerable for what it displays; behind the balance of zexa66100.com, as it appears, there was only a number that kept rising. In the early stages, the person reports, things went "reasonably well": an apparent gain, enough to consolidate trust and induce further payments.

The turning point, on zexa66100.com, is the offer to take part in an "IPO", that is, the placement of new tokens, with a 10,000 USDC loan made available by the platform on the "credit account". The asset screen shows, under available credit, exactly 10,000 USDC. At this point zexa66100.com ceases to be a platform where one watches an account grow and becomes a tool for drawing money out of the person's current account.

The USDC loan on zexa66100.com: why the debt was fake and the repayment was real

The structure is simple. The person receives, on the platform account, a credit of 10,000 USDC to take part in the IPO. The "loan" has to be repaid. Here the inversion occurs: the repayment is not deducted from the balance of zexa66100.com, as would happen in any real margin or credit system, but is demanded by bank transfers from the current account, with the threat of blocking the account on the platform if payment did not arrive. The receipts on file document an instant transfer of 5,005 euro, ordered on 24 September 2026, to an electronic money institution based in Malta, and a second one, of 3,767 euro, ordered on 30 September. In one week 8,772 euro left the person's account, an amount of the same order of magnitude as the 10,000 USDC "to be repaid". The funds were not taken from the balance of zexa66100.com. This is confirmed by the screen "money on zexa at the end": when the operation was over, the account shows a total value of 17,130 USDC, all "withdrawable", with available credit still equal to 10,000.

The contradiction is legally decisive. A loan is perfected by delivery of money or other fungible things (art. 1813 of the Italian Civil Code) and produces an obligation to return what was actually received. Here nothing was delivered: the "credit" was an entry in the computer system of zexa66100.com, created and managed by the counterparty itself, and its "repayment" took place with real money. The relationship, in other words, never had a cause that could explain the payment: the sole function of the fake loan was to create a pretext for obtaining a payment. It is the kind of scheme, already seen in our analysis of a fake cryptocurrency trading scam, in which the simulated profit and the simulated debt are two sides of the same fictitious accounting.

An observation for those who study these files. The transfers are instant and go to a Maltese IBAN: the destination is an electronic money institution, which provides client companies with accounts bearing a dedicated IBAN. The formal beneficiary of the transfers is therefore not necessarily the operator of the platform, but the payment service provider that opened the account for the operator. For this reason the request for information to the institution, by way of a European Investigation Order in criminal matters (Legislative Decree 108/2017), is the first investigative step: it can reveal who holds the account, with what documents it was opened and where the funds were transferred.

Withdrawal rejected and a 7,130 euro fee: the proof of the artifice on zexa66100.com

When the person tries to withdraw, the script is completed. The screenshots of the withdrawal section of zexa66100.com show two rejected requests: 15,000 USDC on 3 October 2026 and 10,000 USDC on 5 October 2026, both with the status "rejected". The platform's contact states that, in order to unlock the entire balance, 7,130 euro must be paid. The amount has a feature worth noting: it is exactly the difference between the balance, 17,130 USDC, and the credit of 10,000, that is, the entire apparent profit, expressed this time in euro and payable in advance. We do not put it forward as proof, but it is an anomaly to be noted.

Asking for money in order to release money, as zexa66100.com did, is the most reliable indicator of a fictitious platform. An exchange operating lawfully applies withdrawal fees deducted from the balance and cannot, by definition, make access to clients' funds conditional on an external payment. Whatever reason is given ("unlocking tax", "anti-money-laundering check", "tax", "guarantee") is a variant of the same device. Shortly after the rejected requests, the person reports, contact with the group ended; by 3 November fifteen days had passed since zexa66100.com had last been reachable.

Domain, company and authorisations: what can really be verified about zexa66100.com

On 12 November 2026 we queried the RDAP registry of the .com top-level domain. For zexa66100.com the registry shows a registration on 8 May 2026, an expiry on 8 May 2027 and a last update on 18 October 2026. The registrar is a US commercial operator, the name servers are those of Cloudflare, which hides the address of the destination server, and the status is only "client transfer prohibited", an ordinary security lock: the domain does not appear to be suspended or subject to any measure. The holder's data cannot be consulted.

Two elements matter. The first is age: the name was registered about four months before the events, while zexa66100.com already presented itself as a complete exchange, with spot, futures, savings and credit. A recent domain does not prove fraud, but a reliable exchange normally has a verifiable history, an entity that runs it and an authorisation. The second is the date of the last update, 18 October 2026, which coincides with the period in which, according to the person, zexa66100.com stopped being reachable (fifteen days before 3 November, that is around 19 October). We cannot say what change was made, which could be the replacement of the name servers or the cessation of resolution, and we do not attribute to this circumstance a meaning we cannot demonstrate. The timing is, however, compatible with a deliberate deactivation, and the fact that the name is still registered until May 2027 means that whoever controls it could reactivate or reuse it at any time.

As for authorisations, no licence emerges from the file, either for zexa66100.com or for the persons who promoted its use. Since 30 December 2024 Regulation (EU) 2023/1114 (MiCA) has prohibited providing crypto-asset services in the Union without being an authorised legal person (art. 59), and the maximum term of the transitional regime provided for by art. 143 of the regulation expired on 1 July 2026: the facts we are discussing took place in September and October 2026, when no derogation any longer allowed operating without authorisation. A public register of authorised providers is kept at European level by ESMA, and it is the first check anyone should make before opening an account. In Italy the sanctioning framework implementing the regulation is in Legislative Decree 129/2024; moreover, for activities that qualify as investment services, art. 166 of the Consolidated Law on Finance (TUF) remains applicable.

Consob has the power to order the blocking of websites that abusively offer investment services (art. 36, paragraph 2-terdecies, Decree-Law 179/2012), but blocking does not appear to be the fate of zexa66100.com: the person reports that, two weeks after the withdrawals were blocked, the site could no longer be reached, and this is compatible with abandonment by the operators rather than with a measure. It is a known pattern: the operators of these platforms do not wait for anyone to intervene, and when the flow of new payments dries up they shut the site and move to another domain name.

Open-source searches on the name zexa66100.com return no supervisory records and no verifiable dedicated reports. This too, on its own, proves nothing: platforms of this kind operate for months before appearing on the authorities' lists and, when they do appear, they have often already changed name. Anyone checking a site like zexa66100.com before paying money must therefore rely on positive proof (an authorisation that can be verified on the authority's register) and not on the absence of reports.

The second scam: "Sorveglianza e Monitoraggio" and "Crypto Diligence", the fake recovery linked to zexa66100.com

After the loss, the person looks for help. The result, they write, is "disheartening": lawyers with high fee demands and no guarantee of results, payment in instalments and various sites offering to recover the funds. Among them, an entity presenting itself as "Sorveglianza e Monitoraggio". After guaranteeing that it had located the money, it has the person open a first account on a leading exchange and, later, a second account on another exchange, with an agreed fee of 10% of the amount recovered. When the accounts are opened, requests for deposits begin: the sums were to pass from one account to another, with the assurance that they would return to the bank account "within a few minutes".

The point at which the design becomes visible is the bank's intervention. When the person's bank blocks the transfers to the first exchange, the fake recoverers do not give up: they move the operation to the second exchange and, after this channel is also blocked, they have a transfer of 7,700 euro made to a natural person, presented as "their accountant", with the promise of an immediate reversal. The receipt confirms the operation: ordered on 15 October 2026, executed on 16 October, credited on 19 October, to an account opened with a major Italian postal operator. The reversal never arrives. On the contrary, the demand rises to 15,900 euro "to get back the money paid plus that of zexa66100.com" with the promise of a higher gain, and on 6 November, faced with refusal, the price drops to 9,980 euro. The person then discovers that the entity presenting itself as "Sorveglianza e Monitoraggio" now also operates under the name "Crypto Diligence", with the same people and the same technique.

The fake recovery linked to zexa66100.com is a separate offence grafted onto the first: whoever commits it chooses as a target a person who has already been harmed, who has already shown they yield to the pressure of a deadline and who has every reason to believe whoever promises to put things right. It is a circumstance that, in the criminal assessment, must be alleged with care: having singled out a person already harmed by the earlier fraud is an element bearing on the assessment of diminished defence (art. 61, no. 5, Criminal Code), which the Court of Cassation, in judgment no. 27907/2026 (hearing of 14 July 2026), distinguished from the methods of commission provided for by art. 640, second paragraph, no. 2-ter, Criminal Code. We have shown how recovery fraud works in our review of a fund-recovery company that defrauded people trying to recoup their losses: the scheme is the same.

Aggravated fraud (art. 640 Criminal Code), complaint and destination account: the criminal framework of zexa66100.com

The conduct described for zexa66100.com amounts, according to the reconstruction on file, to the offence of fraud under art. 640 of the Criminal Code. The artifices and deceptions are the "high-level training" group that lends credibility to the initiative, the account that shows profits and a non-existent credit, the fake loan to be repaid with real transfers and the fee demanded to unlock withdrawals; the unjust profit is the money received through the transfers and the damage includes the sums paid for the fake loan and those paid for the fake recovery.

Here the rules are those introduced by Law 90/2024 and Decree-Law 48/2025, converted by Law 80/2025. Art. 640, second paragraph, no. 2-ter, Criminal Code provides for an aggravating circumstance for acts committed remotely by means of computer or telematic tools capable of hindering identification of the perpetrator; the Court of Cassation, in judgment no. 27907/2026, clarified that it concerns the methods of commission and that fraud so aggravated is prosecutable on complaint by virtue of the derogation introduced by Decree-Law 48/2025; judgment no. 18913/2026 (hearing of 26 March 2026) reaffirmed that proceedings are brought on complaint if no. 2-ter applies and ex officio if art. 61, no. 5 applies. The practical consequence is that, for the fraud of zexa66100.com, the complaint is not a formality: it is the condition for prosecution, and the time limit is three months from the day on which the person learned of the fact (art. 124 Criminal Code). The period runs from the moment the person realises they have been deceived, which for zexa66100.com falls in the first weeks of October 2026 and, for the recovery fraud, in mid-October. It is now November: there is time, but it is not unlimited.

As for the individual transactions, the Court of Cassation, in judgment no. 5191/2026 (hearing of 13 January 2026), reaffirmed that fraud is "of prolonged consummation" when the deceptive activity continues in order to create the reliance needed to obtain further profits: the two transfers to the Maltese institution are to be read as a single event, with a single direction. The transfer of 7,700 euro belongs to a second fraud, which has a distinct perpetrator or, at least, a distinct design, and must be classified separately.

On the Consolidated Law on Finance front, exchange platforms operating without authorisation commit the abusive activity provided for by art. 166 TUF, and the Court of Cassation, in judgment no. 44378/2022, held that the online sale of virtual currency advertised as a form of investment for savers is an activity subject to the requirements of arts. 91 et seq. TUF. It should however be remembered that the classification remains instrumental: what makes it possible to recover, or at least to freeze, the money is the reconstruction of the flows.

And this is where the case of zexa66100.com offers an investigative advantage that other crypto scams lack. The transfer of 7,700 euro left the person's account for an Italian IBAN held by an identifiable natural person. This account is the first point of attachment: the bank has data-retention obligations, can be asked to produce the account-opening documentation and the transactions, and the public prosecutor can request preventive seizure of the remaining sums (art. 321 Code of Criminal Procedure). The account holder answers, depending on the mental element, for complicity in the fraud or for money laundering (art. 648-bis Criminal Code): the classic defence line is that of the unwitting "straw man", which has to be dismantled by the manner in which the account was opened, the speed of the withdrawals and the chats. The longer one waits, the lower the probability that the money is still in the account: once the funds have left Italy, reconstructing their path requires letters rogatory and European Investigation Orders, taking months.

Instant transfers, payee verification and the bank: what can still be done

The receipts on file show that the transfers to the Maltese institution are instant transfers (SCT Inst), irrevocable once executed: the payment is credited in a few seconds and the originating bank cannot "cancel" it. What remains is the recall request for fraud, which the bank can forward to the beneficiary's bank: it is not a right to restitution, but a request that the other bank may accept if the funds are still available. Every day lost reduces the chances of success.

There is also an aspect worth checking in the file. Since 9 October 2025, payment service providers in the euro area have been required, under Regulation (EU) 2024/886, to offer the payee verification service, which compares the name entered by the payer with the one associated with the IBAN and flags any mismatch. The file does not show whether, for the transfers to the Maltese institution and for the one of 7,700 euro to the postal account, a mismatch warning appeared and was overridden: this is information to be obtained by written request to the bank, because a warning overridden by the customer affects the allocation of liability, whereas a missing warning is a breach by the bank. As regards authorised payments, the intermediary's liability remains limited: Legislative Decree 11/2010 protects mainly against unauthorised transactions, and a civil claim against the intermediary should be pursued only with proof of a specific defect.

On the criminal side, the bank has already shown it can intervene: it blocked the transfers to the first exchange. This matters, because it indicates that the anti-fraud systems recognised some movements as anomalous and not others. A request to the institution to state the reasons for the block, and to explain why the transfer to a private account was not intercepted, is a useful step both in criminal proceedings and in a possible civil action, on which see our analysis of recovery of undue payments after an online scam. On confiscation see the in-depth piece on confiscation of equivalent value in online scams.

What to do if you have lost money with a platform like zexa66100.com

If you have paid money to zexa66100.com or to a platform that asked you to repay a "loan" by bank transfer or to pay a fee in order to withdraw, these are the steps we recommend, in order of urgency:

• do not pay any more money to anyone, for any reason: not to "unlock" the account, not to repay a credit, not to pay for a supposed recovery service;
• ask your bank immediately, in writing, to recall the instant transfers and to flag the transaction, stating dates, amounts and beneficiaries' IBANs;
• keep everything: receipts with TRN and beneficiaries' IBANs, screenshots of the account, of the withdrawal section and of the credit, complete chats of the group and of individual contacts, phone numbers, e-mails and profiles;
• download and keep the platform's deposit and withdrawal history while it can still be viewed, and note every wallet address used;
• do not open accounts on exchanges or payment services at the request of anyone promising a recovery, and do not allow remote access to your device;
• file a criminal complaint with the Public Prosecutor's Office or a judicial police office within three months of realising the deception, attaching the documentation in order of date and amount, and report the case to the Postal Police and to Consob;
• state in the complaint the investigations you ask to be carried out: acquisition of the account-opening documentation for the destination accounts, preventive seizure of the sums, a request for information from the foreign payment institution;
• distrust anyone who, after the loss, offers to recover the funds by asking for an advance, a deposit or the opening of an account.

How to recognise a platform like zexa66100.com before paying money

Some signs, in the case of zexa66100.com, were visible before the first payment and recur in almost all platforms of the same kind:

• an invitation to trade on a platform indicated by a "training" or "investment" group in which a manager shares results and the other participants comment;
• a balance that grows quickly and a first small withdrawal that succeeds, to show that "the money comes out";
• an offer of credit or a loan "to take part in an IPO" or in a once-in-a-lifetime opportunity, with repayment to be made outside the platform;
• the threat of blocking the account if the repayment does not arrive, and repayment demanded by transfers from the current account rather than by deduction from the balance;
• a withdrawal rejected without explanation and a fee or "tax" to be paid before being able to withdraw;
• contact that suddenly stops, a site that disappears and, soon afterwards, someone offering to recover the money;
• instant transfers to foreign IBANs held by payment institutions, or to accounts of natural persons described as "accountants" or "consultants".

zexa66100.com is a scam: the final warning

The elements examined lead to a conclusion that, absent proof to the contrary, we consider well founded: zexa66100.com is a scam, in the criminal-law sense of the term. An account that shows profits, that grants a credit that does not exist, that demands its repayment in real money, that rejects withdrawals and that asks for a payment to release the balance is not an exchange platform: it is the staging that makes the taking of the money credible. What is missing from our file is not proof of the deception, but the reconstruction of the flows after the transfers: a reconstruction that, for the Italian account of the second fraud, can be done quickly.

If you have lost money with zexa66100.com or with a fake recovery service, time is not on your side: the funds leave the accounts, the time limits for the complaint run and the platforms change name. If you have suffered the same scam, we can help you.