Is OxyCapitals a scam?

Yes, OxyCapitals (oxycapitalsltd.com) is a confirmed cryptocurrency scam that has stolen over $40,400. They impersonate legitimate Discord admins using typosquatting (changing one letter in usernames like "salmaogs" to "sajmaogs") to trick victims into depositing Bitcoin and other cryptocurrencies. We have documented blockchain evidence showing stolen funds being cashed out through exchanges.

Yes, MirrorExp (mirrorexp.com) is a confirmed cryptocurrency scam that has stolen over $22,000. They use typosquatting to impersonate Discord admins (changing ".atraveller" to "_atraveller") to direct victims to their fake trading platform. Funds are rapidly moved through staging wallets to exchanges within minutes of deposit.

What are the OxyCapitals scam wallet addresses?

Known OxyCapitals scam wallet addresses include: Bitcoin Collection (1NTXSjeydYLhWuXS8cVWx57VqyRFqz4gaC), Bitcoin Personal (1GC4fSsmgJMCtMh643WBCi5pBnTpqqCXP2), Bitcoin ByBit (192UAp4TEGApNdxPbSN5veQZ8ynyixjqvB), Bitcoin SegWit (bc1qz5xlayxpa3dk4u8vduwvx0r4f3v2sf0eejpd46), Ethereum (0x5f9ce0dA56c867D1BD06185D6d21744daC83cb09), and USDT Tron (TCgcYUD74LoeMoKRb7X6WcYPVD3VgZccZR). Do NOT send any cryptocurrency to these addresses.

What are the MirrorExp scam wallet addresses?

Known MirrorExp scam wallet addresses include: Bitcoin Primary (bc1qy28j32l0ntncyuqczzeau2k9yslh76djy0nh5v), Ethereum/USDC (0xE28425B27d555f870d3CaCAC4Bf7F549c768022F), and USDT (0xF4eE6d12f95f401BF6b0aB488Ec18E43bfdbeAFC). These wallets are part of a larger criminal operation with connections to a $2.1M exchange consolidation pool.

How does typosquatting work in crypto scams?

Typosquatting is when scammers create usernames nearly identical to trusted admins by changing just one character. Examples: "salmaogs" becomes "sajmaogs" (l→j), or ".atraveller" becomes "_atraveller" (period→underscore). These tiny changes are easy to miss at a glance, allowing scammers to impersonate trusted community members.

How do I report a cryptocurrency scam?

Report cryptocurrency scams to: 1) FBI IC3 at ic3.gov, 2) FTC at reportfraud.ftc.gov, 3) Chainabuse.com and BitcoinAbuse.com to flag wallet addresses, 4) The cryptocurrency exchanges (Binance, Coinbase, etc.) where scammers cash out, 5) Discord Trust & Safety for impersonation accounts, 6) Domain registrars like Namecheap to get scam websites taken down.

How can I identify crypto impersonation scams?

Red flags include: 1) Unsolicited DMs about investment opportunities, 2) Usernames with subtle differences from real admins (check character by character), 3) Pressure to act quickly, 4) Requests to use unfamiliar trading platforms, 5) Promises of guaranteed returns, 6) Requests to send crypto to "verify" your wallet. Always verify identities through official channels.

What should I do if I sent money to a crypto scam?

If you have been scammed: 1) Document everything - save messages, wallet addresses, transaction IDs, 2) Report to FBI IC3 and FTC immediately, 3) Report the wallet addresses to blockchain abuse databases, 4) Contact the exchange where funds were sent (they may be able to freeze accounts), 5) Report impersonation accounts to the platform (Discord, Telegram), 6) Share your experience to warn others.

How much money has been stolen by these crypto scams?

Based on blockchain analysis: OxyCapitals has stolen $40,400+ across Bitcoin, Ethereum, and Tron. MirrorExp has stolen $22,000+ primarily in Bitcoin. Combined documented losses exceed $62,400. Actual losses are likely higher as many victims do not report and some transactions may not be captured in our analysis.

Are OxyCapitals and MirrorExp related scams?

Both scams use identical methodology: Discord admin impersonation via typosquatting, fake trading platforms, rapid fund extraction to exchanges. While we cannot confirm they are run by the same operators, the operational patterns are strikingly similar, suggesting either the same group or shared scam playbooks within criminal networks.

Yes, MirrorExp (mirrorexp.com) is a confirmed cryptocurrency scam. They have stolen over $22,000 by impersonating Discord admins using typosquatting - changing ".atraveller" to "_atraveller" (a period to an underscore). Victims are directed to deposit crypto which is rapidly moved through staging wallets to exchanges.

What are the MirrorExp scam wallet addresses?

Known MirrorExp scam wallets: Bitcoin Primary (bc1qy28j32l0ntncyuqczzeau2k9yslh76djy0nh5v) with $21,853 stolen, Ethereum/USDC (0xE28425B27d555f870d3CaCAC4Bf7F549c768022F), USDT (0xF4eE6d12f95f401BF6b0aB488Ec18E43bfdbeAFC). Funds flow to a $2.1M exchange consolidation pool at bc1qdfl3dfnwwvlqa5jpckh0ccwpjczh5y566c4g76.

How does the MirrorExp typosquatting scam work?

The scammer creates a Discord username nearly identical to a real admin by changing one character: ".atraveller" becomes "_atraveller" (period → underscore). This subtle change is hard to spot. They then DM victims pretending to be the real admin, building trust before directing them to deposit crypto on the fake MirrorExp platform.

How fast does MirrorExp move stolen funds?

MirrorExp operates with alarming speed: Bitcoin deposits are moved to staging wallets within 74 minutes, and Ethereum is cashed out within just 5 minutes. This rapid extraction indicates automated monitoring of deposit wallets, making fund recovery extremely difficult.

Scam Alert - Do Not Send Money

MirrorExp is a SCAM

MirrorExp.com is a cryptocurrency phishing scam that uses Discord admin impersonation with typosquatting to steal Bitcoin, Ethereum, and USDT. This site documents the fraud with blockchain evidence across multiple chains.

Fraudulent Crypto Scam Website

mirrorexp.com

Dirty Digital, Clean Cash - Cartoon illustrating how crypto scammers launder stolen cryptocurrency through exchanges

"Dirty Digital, Clean Cash" — How crypto scammers launder your money through exchanges

Typosquatting Attack Detected

The scammer uses a username nearly identical to a real admin

Can you spot the difference?

REAL ADMIN USERNAME

.atraveller

SCAMMER USERNAME

_atraveller

The scammer changed just ONE character: a period . became an underscore _

Always verify usernames character-by-character before trusting anyone with your money.

How This Scam Works

Typosquatting

Scammer creates a Discord username nearly identical to a real admin, changing just one letter.

Impersonation

Using the fake account, they DM victims pretending to be the trusted admin.

Fake Platform

Victims are directed to MirrorExp.com, a fake trading platform, to deposit crypto.

Rapid Cash-Out

Deposits are moved to personal wallets within minutes, then to exchanges for cash-out.

Total Documented Victim Losses

Based on blockchain transaction analysis of known scam wallets

Confirmed Stolen Amount

$22,000+

USD equivalent across Bitcoin, Ethereum, USDT & USDC

Bitcoin — $21,853

$21,853

Primary Scam Wallet

4 transactions tracked

$2.1M+

Exchange Consolidation Pool

65 input addresses

Ethereum & Stablecoins — $500+

~$75

ETH Wallet

Est. $200+

USDT (ERC-20)

Est. $200+

USDC (ERC-20)

6+ month operation across 4 blockchains • All funds traced to exchange cash-outs

Known Scam Wallet Addresses

Do NOT send cryptocurrency to any of these addresses

Bitcoin (Primary Deposit)bc1qy28j32l0ntncyuqczzeau2k9yslh76djy0nh5v

Current balance: 0.13 BTC (~$9,450) | Total received: $21,853

Bitcoin (Staging #1)bc1qqtjrzvrft6rz794x0qr70zvm9r6kz5y4zu5u0x

Emptied to exchange | Received: 0.05 BTC ($3,628)

Bitcoin (Staging #2)bc1q6z9f0gcl7d0j2jsc02jxcxv4n2ydjnqqr5v6ug

Emptied to exchange | Received: 0.06 BTC ($4,391)

Bitcoin (Exchange Pool)bc1qdfl3dfnwwvlqa5jpckh0ccwpjczh5y566c4g76

Final cash-out destination | Received: 29.43 BTC ($2.1M) from 65 sources

Ethereum / USDC (ERC-20)0xE28425B27d555f870d3CaCAC4Bf7F549c768022F

Same address used for ETH and USDC deposits

USDT (ERC-20)0xF4eE6d12f95f401BF6b0aB488Ec18E43bfdbeAFC

Active since August 2025 | 6+ months of operation

Blockchain Transaction Analysis

Complete money flow traced across multiple chains

Bitcoin Money Flow Hierarchy

VICTIMS

Directed to deposit via fake admin DMs

↓

SCAM DEPOSIT WALLET

bc1qy28j32l0ntncyuqczzeau2k9yslh76djy0nh5v

Total: ~$21,853 (4 transactions)

↓

STAGING WALLET #1

bc1qqtjr...u5u0x

0.05 BTC ($3,628)

STAGING WALLET #2

bc1q6z9f...v6ug

0.06 BTC ($4,391)

↓

EXCHANGE CONSOLIDATION (Cash Out)

bc1qdfl3dfnwwvlqa5jpckh0ccwpjczh5y566c4g76

29.43 BTC ($2.1M) from 65 different addresses

Lightning-Fast Cash-Out Pattern

Bitcoin

74 min

From deposit to staging wallet

Ethereum

5 min

From deposit to cash-out

This rapid extraction indicates automated monitoring or active watching of deposit wallets.

Fraud Confidence Score: 100/100

✓

Rapid cash-out

✓

Multi-chain

✓

Staging wallets

✓

Exchange consolidation

✓

Round numbers

✓

Shared addresses

✓

6+ month operation

✓

Large pool destination

Statistical analysis confirms 99.9% confidence this is a deliberate scam operation.

Strong Evidence: Round Number Pattern

Manual withdrawals reveal scammer behavior

MirrorExp Scammer's Withdrawal

From scam wallet to staging

0.05000000 BTC

EXACT ROUND NUMBER

Why this matters: Real trading creates messy decimals from fees and price conversions (e.g., 0.04973 BTC). A perfectly round 0.05 BTC indicates a manual, deliberate withdrawal — the scammer chose a "nice" amount to extract.

Exchange Pool Shows Pattern of Fraud

The exchange consolidation wallet received 65 inputs in a single transaction. Analysis reveals 15+ round number amounts:

0.50 BTC

×2

0.40 BTC

×2

0.25 BTC

×2

0.21 BTC

0.20 BTC

0.19 BTC

0.15 BTC

0.12 BTC

0.10 BTC

0.09 BTC

0.07 BTC

0.06 BTC

0.05 BTC

×3

This concentration of round numbers strongly suggests the exchange pool is a criminal cash-out point receiving funds from multiple manual fraud operations.

Strong Evidence: 65-Input Consolidation Transaction

All roads lead to the same criminal cash-out point

Both Staging Wallets → Same Destination

Staging Wallet #1

bc1qqtjr...u5u0x

Emptied at 14:01:55

Staging Wallet #2

bc1q6z9f...v6ug

Emptied at 13:57:30

Only 4 minutes apart → Same operator

The $2.1 Million Pool

Final Destination Wallet

bc1qdfl3dfnwwvlqa5jpckh0ccwpjczh5y566c4g76

Input Addresses

29.43

BTC Received

$2.1M

USD Value

Why this matters: A single transaction receiving funds from 65 different addresses indicates this is either:

• A cryptocurrency exchange deposit address (can be subpoenaed for KYC records)
• A mixing/tumbling service used to obscure fund origins
• A larger criminal operation consolidating proceeds from multiple scams

This is the key lead for law enforcement — identifying who controls this wallet can unmask the entire operation.

Strong Evidence: Disposable Staging Wallets

One-time-use wallets designed to obscure the money trail

Wallet Lifecycle Analysis

Staging Wallet #1

bc1qqtjrzvrft6rz794x0qr70zvm9r6kz5y4zu5u0x

BALANCE: 0.00 BTC

Received

0.05 BTC

Held for

~3 hours

Emptied

100%

Staging Wallet #2

bc1q6z9f0gcl7d0j2jsc02jxcxv4n2ydjnqqr5v6ug

BALANCE: 0.00 BTC

Received

0.06 BTC

Held for

~3 hours

Emptied

100%

Why this matters: These wallets exhibit classic "burner wallet" behavior:

• Single use: Each wallet received exactly one deposit, then was emptied completely
• Zero balance: Both wallets now hold 0 BTC — abandoned after use
• Brief holding: Funds held for only ~3 hours before forwarding
• Layering technique: Creates an extra hop between victim and exchange to obscure the trail

This is textbook money laundering — using intermediate "staging" wallets to distance stolen funds from their source before cashing out.

Impersonation Evidence

Side-by-side comparison of real admin vs scammer account

Spot the difference in the usernames:

REAL ADMIN

.atraveller

SCAMMER

_atraveller

The scammer changed just ONE character: . → _

.atraveller (Real Admin)

_atraveller (Scammer)

Click images to expand

Warning: The scammer uses "typosquatting" - creating a username that looks almost identical to the real admin by changing just one character. A period . looks very similar to an underscore _ at a glance. Always verify usernames character by character!

Fake Platform Evidence

Screenshots of the fraudulent MirrorExp trading platform

Click any image to expand

MirrorExp scam website homepage - fake crypto trading platform

Scam Homepage

MirrorExp fake investment dashboard showing fake profits

Fake Dashboard

MirrorExp fake trading interface designed to steal cryptocurrency

Fake Trading Page

Deposit Page

Withdrawal Page

MirrorExp Bitcoin deposit address for stealing crypto

BTC Deposit Link

Blockchain explorer showing MirrorExp scam wallet transactions

Blockchain Evidence - Scam Wallet Transactions

Related Scam Operations

This scam uses identical methodology to other known operations

Same Methodology as OxyCapitals

Identical scam playbook detected

Tactic:

Discord Admin Impersonation

Method:

Typosquatting Usernames

Infrastructure:

Fake Trading Platform

Cash-out:

Rapid exchange deposits

View OxyCapitals Scam Evidence

Exchange Cash-Out Addresses

Critical information for law enforcement

These addresses can be subpoenaed from exchanges for KYC records

Primary BTC Cash-Out (65-Input Pool)

Likely major exchange or mixing service

bc1qdfl3dfnwwvlqa5jpckh0ccwpjczh5y566c4g76

Total Received:29.43 BTC (~$2.1M)

Input Sources:65 different addresses

ETH Cash-Out #1

0x00f03542c5c73705d9be26c82f2fb1cc202f32a8

Received 0.02659 ETH

ETH Cash-Out #2

0x0559de40ac8f780648490143b90aa8ff3b1b805a

Received 0.00881 ETH

For Law Enforcement

The 65-input consolidation wallet is the key lead. If law enforcement can identify which exchange controls this address, they can subpoena KYC records including identity documents, IP addresses, and bank withdrawal history.

What To Do If You've Been Scammed

1. Report to Authorities

• FBI IC3: ic3.gov (Internet Crime Complaint Center)
• FTC: reportfraud.ftc.gov
• Local law enforcement

2. Report Wallet Addresses

• Chainabuse: chainabuse.com
• Bitcoin Abuse: bitcoinabuse.com
• Report to exchanges (Binance, Coinbase, Kraken, etc.)

3. Report the Discord Account

Report the impersonator account to Discord Trust & Safety with screenshots of the conversation and the fake username.

4. Document Everything

Save all messages, transaction records, wallet addresses, and screenshots. This evidence is crucial for any investigation.