OxyCapitals is a SCAM

OxyCapitalsLtd.com is a cryptocurrency phishing scam that uses Discord admin impersonation with typosquatting to steal Bitcoin, Ethereum, and USDT. This site documents the fraud with blockchain evidence across multiple chains.

Fraudulent Crypto Scam Website

oxycapitalsltd.com

Site Taken Down

This scam website has been removed from the internet. The domain is still registered but no longer hosting content.

Linked Operation: This domain was taken down on the same day as MirrorExp (mirrorexp.com). Both domains were updated on Feb 7, 2026 and expire within 9 days of each other — strong evidence the same operator owned both websites.

WHOIS Evidence: Same Day Takedown

Both OxyCapitals and MirrorExp were updated on February 7, 2026 — the day they were taken offline

OxyCapitals WHOIS
WHOIS lookup for oxycapitalsltd.com showing updated date Feb 7, 2026
MirrorExp WHOIS
WHOIS lookup for mirrorexp.com showing updated date Feb 7, 2026

Key Finding: Same Operator

OxyCapitals

Registrar: GoDaddy
Nameservers: domain_principal.net

MirrorExp

Registrar: NameSilo
Nameservers: Cloudflare

Different infrastructure but same takedown date — strong evidence the same operator owned both websites, possibly using different hosting to avoid detection.

Typosquatting Attack Detected

The scammer uses a username nearly identical to a real admin

Can you spot the difference?

REAL ADMIN USERNAME

salmaogs

vs

SCAMMER USERNAME

sajmaogs

The scammer changed just ONE letter: l became j

Always verify usernames character-by-character before trusting anyone with your money.

How This Scam Works

1

Typosquatting

Scammer creates a Discord username nearly identical to a real admin, changing just one letter.

2

Impersonation

Using the fake account, they DM victims pretending to be the trusted admin.

3

Fake Platform

Victims are directed to OxyCapitalsLtd.com, a fake trading platform, to deposit crypto.

4

Rapid Cash-Out

Deposits are moved to personal wallets within hours, then to exchanges for cash-out.

Total Documented Victim Losses

Based on blockchain transaction analysis of known scam wallets

Confirmed Stolen Amount

$54,000+

USD equivalent across Bitcoin, Ethereum & Tron

Bitcoin Wallets — $38,076

$4,918

Collection Wallet

$9,657

Personal Wallet

$23,501

ByBit Wallet

ByBit Wallet Major Transactions

$20,144

Sep 24, 2025

$3,272

Jan 23, 2026

$86

Jan 24, 2026

SegWit Routing Wallet

bc1qz5xlayxpa3dk4u8vduwvx0r4f3v2sf0eejpd46

Intermediate wallet receiving $868 from victims, forwarding to Personal & ByBit wallets. Amounts included in wallet totals above.

Ethereum — $2,252

Wallet

0x5f9ce0dA56c867D1BD06185D6d21744daC83cb09

0.994 ETH

Received Jul 14, 2025 • Cashed out Jul 15

Tron (TRX/USDT) — $75+

Wallet

TCgcYUD74LoeMoKRb7X6WcYPVD3VgZccZR

~500 TRX

Aug 2023 - Apr 2024 • Multiple USDT transfers

120+ transactions across 6 wallets on 3 blockchains • All funds traced to exchange cash-outs

Actual losses are likely higher — USDT transfer amounts on Tron not fully captured, and many victims never report.

Known Scam Wallet Addresses

Do NOT send cryptocurrency to any of these addresses

Bitcoin (Collection)
1NTXSjeydYLhWuXS8cVWx57VqyRFqz4gaC
Bitcoin (Personal)
1GC4fSsmgJMCtMh643WBCi5pBnTpqqCXP2
Ethereum
0x5f9ce0dA56c867D1BD06185D6d21744daC83cb09
USDT (Tron)
TCgcYUD74LoeMoKRb7X6WcYPVD3VgZccZR
Bitcoin (ByBit)
192UAp4TEGApNdxPbSN5veQZ8ynyixjqvB
Bitcoin (SegWit)
bc1qz5xlayxpa3dk4u8vduwvx0r4f3v2sf0eejpd46

Blockchain Transaction Analysis

We traced where the stolen funds go

Money Flow Hierarchy

VICTIMS
Multiple wallets sending to scammer
↓
COLLECTION WALLET
1NTXSjeydYLhWuXS8cVWx57VqyRFqz4gaC
Total: ~$4,918 (43 transactions)
↓
SCAMMER'S PERSONAL WALLET
1GC4fSsmgJMCtMh643WBCi5pBnTpqqCXP2
Total: ~$9,657 (67 transactions)
↓
EXCHANGE (Cash Out)
1FWQiwK27EnGXb6BiBMRLJvunJQZZPMcGd
Large exchange hot wallet (Binance or similar)

Key Transactions to Personal Wallet

01/19/2026$20.98
12/30/2025$48.30
12/26/2025$86.88
12/14/2025$276.87
And more...~$788 total

Cash-Out to Exchange

01/27/2026$480.19
12/24/2025$344.59
12/23/2025$605.20
12/18/2024$6,808.63
Total to exchange~$9,657

Scammer's Fake Business Details

These are likely fake or stolen identities

Contact Email

support@oxycapitalsltd.com

Claimed Address

Flat 8 Graves Court
16 Pevensey Avenue, Southgate
London, UK, N11 2RD

(Likely fake or a virtual office)

Related Scam Operations

This scam uses identical methodology to other known operations

MirrorExp

$30,000+ stolen

View Investigation

TruCopy

$30,000+ stolen (8 chains)

View Investigation

BridgeStocks

$35,389 stolen (TAKEN DOWN)

View Investigation

EverrexTrade

Under Investigation

View Investigation

AffluenceAura

$0 stolen (abandoned)

View Investigation

Pattern Match: These scams use Discord impersonation, fake trading platforms, and shared infrastructure. They may be operated by the same criminal network.

Impersonation Exposed

The scammer copies a real Discord admin's profile to trick victims

Spot the difference in the usernames:

REAL ADMIN

salmaogs

vs

SCAMMER

sajmaogs

The scammer changed just ONE letter: "l" → "j" to impersonate the real admin!

Real Admin - salmaogs
Real Discord admin salmaogs profile - legitimate crypto community moderator
Scammer - sajmaogs
Fake Discord account sajmaogs impersonating admin - crypto scammer typosquatting profile

Click images to expand

Warning: Scammers use "typosquatting" - changing one letter in a username to impersonate trusted people. Always double-check usernames character by character!

Scammer Conversation Evidence

Actual messages from the scammer trying to steal money

Click any image to expand

OxyCapitals scammer Discord DM conversation - crypto phishing message evidence
1
Cryptocurrency scam conversation - fraudster asking for Bitcoin deposit
2
Discord impersonation scam messages - fake admin requesting crypto payment
3
OxyCapitalsLtd scam chat evidence - fraudulent investment scheme messages
4
Crypto scammer social engineering tactics - phishing conversation screenshot
5
Bitcoin theft scam conversation - OxyCapitals fraud evidence
6
Cryptocurrency investment scam chat - impersonation fraud proof
7

Platform & Technical Evidence

Screenshots of the scam operation

Click any image to expand

OxyCapitals scam website homepage - fake crypto trading platform screenshot

Scam Homepage

OxyCapitalsLtd fraudulent deposit page requesting Bitcoin

Deposit Page

OxyCapitals scam Bitcoin wallet address for stealing cryptocurrency

BTC Address Display

Crypto scammer personal Bitcoin wallet with stolen funds

Scammer's Wallet

DNS records proving oxycapitalsltd.com is a fraudulent domain

DNS Records

Additional evidence of OxyCapitals cryptocurrency fraud

Additional Evidence

RDAP Record 1
RDAP 1
RDAP Record 2
RDAP 2
RDAP Record 3
RDAP 3

Official Fraud Reports

This scam has been officially reported to cybersecurity authorities

Netcraft Incident Response

Official Cybersecurity Report

Report ID:

f2f3oteicz4yrmh2qenr54

Status:

Classified as Phishing & Malicious

Reported Domain:

oxycapitalsltd.com

Category:

Cryptocurrency Fraud / Phishing

View Official Netcraft Report

About Netcraft

Netcraft is a leading cybersecurity company that has been protecting the internet since 1995. They provide anti-fraud and anti-phishing services to major banks, governments, and enterprises worldwide. Their Incident Response system is used globally to report and take down malicious websites.

This official report helps prevent others from being scammed and supports takedown efforts.

Exchange Cash-Out Addresses

Critical information for law enforcement to identify the scammer

These addresses can be subpoenaed from exchanges for KYC records

Primary Cash-Out Wallet (Bitcoin)

Likely Binance - Major exchange hot wallet

1FWQiwK27EnGXb6BiBMRLJvunJQZZPMcGd
Amount Cashed Out:~$9,657+
Transactions:Multiple deposits

Ethereum Cash-Out

0x5938E9B77bA995c402B17ABa9e069731F27e6FF3

Received 0.994 ETH (~$2,252) • Jul 15, 2025

Scammer sent entire ETH balance here within hours of receiving

Tron (TRX) Cash-Out

TTBFQK759oYTXSscYp5DahGtDN6zLyNXUp

Received 296.9 TRX • Apr 4, 2024

Destination for TRX funds from scam wallet

ByBit-Linked Wallet (Requires KYC)

192UAp4TEGApNdxPbSN5veQZ8ynyixjqvB
Total Volume:

$23,501

Largest Txn:

$20,144

Exchange:

ByBit

For Law Enforcement

These exchange deposit addresses are tied to accounts with KYC verification. Exchanges like Binance and ByBit maintain records of user identity documents, IP addresses, and withdrawal history. A subpoena to these exchanges for the accounts associated with these deposit addresses can reveal the scammer's identity.

Important Warning

Never send money to strangers online. OxyCapitals is not a registered business and there is no real identity behind the company.

  • • No legitimate company registration or business license
  • • No verifiable team members or leadership
  • • Fake address (likely a virtual office or nonexistent)
  • • No regulatory oversight or investor protection
  • • Anonymous operators hiding behind a fake website

If someone you don't know asks you to send crypto, it's almost always a scam.

What To Do If You've Been Scammed

1. Report to Authorities

2. Report Wallet Addresses

3. Report to Domain Registrar & Hosting

Report the scam website to get it taken down:

Include the scam domain, wallet addresses, and any evidence of fraud in your report.

4. Report the Discord Account

Report the impersonator account to Discord Trust & Safety with screenshots of the conversation and the fake username.

5. Document Everything

Save all messages, transaction records, wallet addresses, and screenshots. This evidence is crucial for any investigation.

6. Warn Others

Share this page to help prevent others from falling victim to this scam.

Crypto Scam Awareness: Protect Yourself from Phishing & Impersonation Fraud

What is a Crypto Impersonation Scam?

Cryptocurrency impersonation scams, like the OxyCapitals fraud documented on this page, are a growing threat in the crypto community. Scammers create fake profiles that closely mimic trusted figures—Discord moderators, crypto influencers, customer support agents, or even friends. They use tactics like typosquatting (changing one letter in a username) to appear legitimate. The goal is always the same: trick you into sending Bitcoin, Ethereum, or other cryptocurrencies to their wallet.

Keywords: crypto impersonation scam, discord scam, cryptocurrency fraud, typosquatting attack, social engineering crypto

How to Identify Crypto Phishing Attacks

Crypto phishing attacks are designed to steal your funds or private keys. Warning signs include:

  • Unsolicited DMs about “investment opportunities” or “guaranteed returns”
  • Usernames that look almost identical to real admins (check every character!)
  • Links to unfamiliar trading platforms or wallet connection requests
  • Urgency and pressure to act immediately
  • Requests to send crypto to “verify” your wallet or “unlock” rewards
  • Fake websites mimicking legitimate exchanges (always check the URL carefully)

Keywords: crypto phishing, cryptocurrency phishing attack, fake crypto website, bitcoin phishing scam, how to spot crypto scam

About OxyCapitals / OxyCapitalsLtd Scam

OxyCapitals (also known as OxyCapitalsLtd, operating at oxycapitalsltd.com) is a fraudulent cryptocurrency investment platform. This scam operation impersonates legitimate Discord administrators to build trust with victims, then directs them to deposit Bitcoin and other cryptocurrencies to their fake trading platform. The deposited funds go directly to the scammer's personal wallet and are subsequently cashed out through major exchanges.

The scam has been reported to Netcraft and other cybersecurity authorities. The domain oxycapitalsltd.com has no legitimate business registration, no verifiable team members, and uses a fake UK address. This is a classic example of a pig butchering scam combined with impersonation fraud.

Keywords: oxycapitals scam, oxycapitalsltd fraud, oxycapitalsltd.com scam, is oxycapitals legit, oxycapitals review, oxycapitals warning

Related Crypto Scam Types to Watch For

Beyond the OxyCapitals scam, be aware of these common cryptocurrency fraud schemes:

  • Pig Butchering Scams: Long-term romance or friendship scams that eventually lead to fake crypto investments
  • Fake Exchange Scams: Fraudulent trading platforms that steal deposits
  • Giveaway Scams: Fake celebrity or influencer giveaways requiring you to “send crypto first”
  • Recovery Scams: Fraudsters promising to recover lost crypto for an upfront fee
  • Rug Pulls: Crypto projects that disappear with investor funds
  • Phishing Links: Fake websites stealing wallet credentials or seed phrases

Keywords: pig butchering scam, crypto romance scam, fake crypto exchange, bitcoin giveaway scam, crypto recovery scam, rug pull scam