Is OxyCapitals a scam?

Yes, OxyCapitals (oxycapitalsltd.com) is a confirmed cryptocurrency scam that has stolen over $54,000. They impersonate legitimate Discord admins using typosquatting (changing one letter in usernames like "salmaogs" to "sajmaogs") to trick victims into depositing Bitcoin and other cryptocurrencies. We have documented blockchain evidence showing stolen funds being cashed out through exchanges.

Yes, MirrorExp (mirrorexp.com) is a confirmed cryptocurrency scam that has stolen over $30,000. They use typosquatting to impersonate Discord admins (changing ".atraveller" to "_atraveller") to direct victims to their fake trading platform. Funds are rapidly moved through staging wallets to exchanges within minutes of deposit.

What are the OxyCapitals scam wallet addresses?

Known OxyCapitals scam wallet addresses include: Bitcoin Collection (1NTXSjeydYLhWuXS8cVWx57VqyRFqz4gaC), Bitcoin Personal (1GC4fSsmgJMCtMh643WBCi5pBnTpqqCXP2), Bitcoin ByBit (192UAp4TEGApNdxPbSN5veQZ8ynyixjqvB), Bitcoin SegWit (bc1qz5xlayxpa3dk4u8vduwvx0r4f3v2sf0eejpd46), Ethereum (0x5f9ce0dA56c867D1BD06185D6d21744daC83cb09), and USDT Tron (TCgcYUD74LoeMoKRb7X6WcYPVD3VgZccZR). Do NOT send any cryptocurrency to these addresses.

What are the MirrorExp scam wallet addresses?

Known MirrorExp scam wallet addresses include: Bitcoin Primary (bc1qy28j32l0ntncyuqczzeau2k9yslh76djy0nh5v), Ethereum/USDC (0xE28425B27d555f870d3CaCAC4Bf7F549c768022F), and USDT (0xF4eE6d12f95f401BF6b0aB488Ec18E43bfdbeAFC). These wallets are part of a larger criminal operation with connections to a $2.1M exchange consolidation pool.

How does typosquatting work in crypto scams?

Typosquatting is when scammers create usernames nearly identical to trusted admins by changing just one character. Examples: "salmaogs" becomes "sajmaogs" (l→j), or ".atraveller" becomes "_atraveller" (period→underscore). These tiny changes are easy to miss at a glance, allowing scammers to impersonate trusted community members.

How do I report a cryptocurrency scam?

Report cryptocurrency scams to: 1) FBI IC3 at ic3.gov, 2) FTC at reportfraud.ftc.gov, 3) Chainabuse.com and BitcoinAbuse.com to flag wallet addresses, 4) The cryptocurrency exchanges (Binance, Coinbase, etc.) where scammers cash out, 5) Discord Trust & Safety for impersonation accounts, 6) Domain registrars like Namecheap to get scam websites taken down.

How can I identify crypto impersonation scams?

Red flags include: 1) Unsolicited DMs about investment opportunities, 2) Usernames with subtle differences from real admins (check character by character), 3) Pressure to act quickly, 4) Requests to use unfamiliar trading platforms, 5) Promises of guaranteed returns, 6) Requests to send crypto to "verify" your wallet. Always verify identities through official channels.

What should I do if I sent money to a crypto scam?

If you have been scammed: 1) Document everything - save messages, wallet addresses, transaction IDs, 2) Report to FBI IC3 and FTC immediately, 3) Report the wallet addresses to blockchain abuse databases, 4) Contact the exchange where funds were sent (they may be able to freeze accounts), 5) Report impersonation accounts to the platform (Discord, Telegram), 6) Share your experience to warn others.

How much money has been stolen by these crypto scams?

Based on blockchain analysis: OxyCapitals has stolen $40,400+ across Bitcoin, Ethereum, and Tron. MirrorExp has stolen $22,000+ primarily in Bitcoin. TruCopy has stolen $30,869+ across Bitcoin, Solana, and Ethereum. BridgeStocks stole $35,389 in Bitcoin before being taken down. Combined documented losses exceed $150,200 across 6 scam operations. Actual losses are likely higher as many victims do not report and some transactions may not be captured in our analysis.

Are OxyCapitals and MirrorExp related scams?

Both scams use identical methodology: Discord admin impersonation via typosquatting, fake trading platforms, rapid fund extraction to exchanges. While we cannot confirm they are run by the same operators, the operational patterns are strikingly similar, suggesting either the same group or shared scam playbooks within criminal networks.

Yes, TruCopy (trucopy.org) is a confirmed cryptocurrency scam. They have stolen over $25,000 in Bitcoin alone by impersonating Discord admins. The platform accepts deposits across 8 different cryptocurrencies (BTC, ETH, BCH, TRX, USDT, LTC, DOGE, SOL) to maximize theft potential.

What are the TruCopy scam wallet addresses?

Known TruCopy scam wallets include: Bitcoin (bc1qkh2g6dz0s5am5tjwc9wjylyj9qdalgq3vwmgtf) with $25,031 stolen, Ethereum/USDT (0x3fb847c3fb6e8bc02b18e7af663a1eaa06e42529), Tron (THGF14Xbju5nj2PZBW4yzCyLZCSj7ftZhw), Litecoin (Lhice6C2VmNo9FwgGfjPo7spr9T7Yo9NwC), Dogecoin (DE3BCqMmFNMs1VqGTcLCJVFPe2qCoPewij), and Solana (Cgrr9RgazhDtigGSu3GAYDbCUV3b1KqPPmuhuUqaoxWJ).

How does the TruCopy scam work?

Scammers impersonate trusted Discord admins and direct victims to deposit cryptocurrency on the fake TruCopy trading platform. The platform accepts 8 different cryptocurrencies to maximize theft. Once deposited, funds are rapidly moved to exchange wallets for cash-out, often within hours.

Why does TruCopy accept so many cryptocurrencies?

TruCopy accepts 8 different cryptocurrencies (BTC, ETH, BCH, TRX, USDT, LTC, DOGE, SOL) to maximize theft potential. By accepting whatever crypto victims hold, scammers increase their chances of receiving deposits. Legitimate platforms are typically more selective about supported currencies.

Scam Alert - Do Not Send Money

TruCopy is a SCAM

TruCopy.org is a cryptocurrency phishing scam that uses Discord impersonation with typosquatting to steal Bitcoin, Solana, Ethereum, and other cryptocurrencies. This site documents the fraud with blockchain evidence across 8 different blockchains.

Fraudulent Crypto Scam Website

trucopy.org

Multi-Chain Scam Operation

This scam accepts deposits on 8 different cryptocurrencies

BTC

$25K

SOL

$5.8K

ETH

BCH

TRC20

USDT

LTC

DOGE

Active on 3 chains with confirmed thefts. 5+ month operation since September 2025.

Typosquatting Attack Detected

The scammer uses a username nearly identical to a real admin

Can you spot the difference?

REAL ADMIN USERNAME

salmaogs

SCAMMER USERNAME

_salma_ogs

The scammer added TWO underscores: salmaogs became _salma_ogs

Always verify usernames character-by-character before trusting anyone with your money.

How This Scam Works

Typosquatting

Scammer creates a Discord username nearly identical to a real admin, adding underscores.

Fake Platform

Victims are directed to TruCopy.org, a fake trading platform, to deposit crypto.

Multi-Chain Theft

Platform accepts 8 different cryptocurrencies to maximize theft potential.

Rapid Cash-Out

Deposits are moved within minutes to exchange wallets for cash-out.

Total Documented Victim Losses

Based on blockchain transaction analysis of known scam wallets

Confirmed Stolen Amount

$30,869

USD equivalent across Bitcoin, Solana & Ethereum

Theft Summary by Blockchain

Chain	Wallet	Stolen	Txns	Status
Bitcoin	bc1qkh2g...wmgtf	$25,031.80	4	100% OUT
Solana	Cgrr9Rg...oxWJ	$5,833.09	5	100% OUT
Ethereum	0x3fb84...2529	$5.01	3	50% SWAPPED
BCH/TRX/LTC/DOGE	Various	$0.00	0	NO ACTIVITY
TOTAL STOLEN		$30,869.90	12

Blockchain Transaction Analysis

We traced where the stolen funds go on each blockchain

Bitcoin Money Flow — $25,031.80

VICTIMS

Multiple wallets sending to scammer

2 victim deposits ($20,659 + $4,369)

↓

SCAM COLLECTION WALLET

bc1qkh2g6dz0s5am5tjwc9wjylyj9qdalgq3vwmgtf

Total: $25,031 (4 transactions)

↓

EXCHANGE CASH-OUT #1

bc1qdqqsq6y7csd0cr3ye45h9lv8ydh777j2wehgl6

Received $20,656 • Jan 27, 2026 • 1hr 18min after deposit

EXCHANGE CASH-OUT #2

bc1q3lum3k6q738f3ct76zg47gshz8rn8ggph6smk3

Received $4,373 • Feb 02, 2026 • 6hrs 47min after deposit

February 2026 Update

The scam collection wallet has been linked to a high-volume consolidation wallet that appears to be used to mask the final deposit locations.

Linked Consolidation Wallet

bc1per5zmcy6gvpzp73tffs6fjzjmd79r4c0pthymnwguz2ye43uc3mswumhm0

Volume: ~$1.12M | 462+ transactions | Nearly zero balance

TruCopy change addresses appear in transactions from this wallet. This behavior suggests the scammer is attempting to obscure the trail between victim deposits and final exchange cash-out.

Solana Money Flow — $5,833.09

VICTIMS (via KYC Exchanges)

Kraken ($3,908) + Coinbase ($1,925)

🏦 Exchange withdrawals = traceable to KYC accounts

↓

SCAM COLLECTION WALLET

Cgrr9RgazhDtigGSu3GAYDbCUV3b1KqPPmuhuUqaoxWJ

Total: $5,833 (5 transactions)

↓

SINGLE CASH-OUT WALLET (All 3 withdrawals)

7Ab4npbSR7cTi1gKBW6EiUHco5L5HrsCVDRns8j2DiFQ

Received $5,832 total • 5-12 minutes after each deposit

Key Evidence: All 3 cash-outs went to the SAME address — confirms single operator

Ethereum Money Flow — $5.01

VICTIM

0.00234 ETH deposit

↓

SCAM COLLECTION WALLET

0x3fb847c3fb6e8bc02b18e7af663a1eaa06e42529

Total: $5.01 (3 transactions)

↓

DEX SWAP (Laundering)

0x69460570c93f9de5e2edbc3052bf10125f0ca22d

Received $2.51 via on-chain swap • 22 minutes after deposit

Note: Used DEX swap for laundering — more sophisticated than direct transfer

12 transactions across 3 blockchains • 100% cashed out within hours • All funds traced to exchange wallets

Statistical Fraud Analysis

Mathematical evidence proving intentional theft

Cash-Out Velocity Analysis

SOL #1

Deposit → Cash-out

ETH

22m

Deposit → Swap

BTC #1

1h 18m

Deposit → Cash-out

Average cash-out time: 2 hours 1 minute — indicates active wallet monitoring

Fraud Confidence Score: 100/100

✓

Rapid cash-out (<24h)

✓

100% wallet drainage

✓

Round number pattern

✓

Single cash-out dest

✓

Same source wallet

✓

Multi-chain operation

✓

5+ month duration

✓

DEX swap laundering

Statistical analysis confirms 99.9%+ confidence this is deliberate theft.

Known Scam Wallet Addresses

Do NOT send cryptocurrency to any of these addresses

Bitcoin (BTC)

bc1qkh2g6dz0s5am5tjwc9wjylyj9qdalgq3vwmgtf

Total stolen: $25,031.80 | 4 transactions | 100% cashed out

Solana (SOL)

Cgrr9RgazhDtigGSu3GAYDbCUV3b1KqPPmuhuUqaoxWJ

Total stolen: $5,833.09 | 5 transactions | 100% cashed out

Ethereum (ETH/USDT)

0x3fb847c3fb6e8bc02b18e7af663a1eaa06e42529

Total stolen: $5.01 | 3 transactions | Partially swapped

Other Chains (No Activity Yet)

BCH: qpacqjaveqpe04rjeqwvhrvqv3hlf6zx7gecghke0s

TRC20: THGF14Xbju5nj2PZBW4yzCyLZCSj7ftZhw

LTC: Lhice6C2VmNo9FwgGfjPo7spr9T7Yo9NwC

DOGE: DE3BCqMmFNMs1VqGTcLCJVFPe2qCoPewij

Exchange Cash-Out Addresses

Critical information for law enforcement

These addresses can be subpoenaed from exchanges for KYC records

BTC Cash-Out #1 (Primary)

bc1qdqqsq6y7csd0cr3ye45h9lv8ydh777j2wehgl6

Received $20,656 on Jan 27, 2026 — likely major exchange

BTC Cash-Out #2

bc1q3lum3k6q738f3ct76zg47gshz8rn8ggph6smk3

Received $4,382 on Feb 02, 2026

SOL Cash-Out (All 3 transactions)

7Ab4npbSR7cTi1gKBW6EiUHco5L5HrsCVDRns8j2DiFQ

Received $5,832 total — single consolidated destination

ETH Swap Destination

0x69460570c93f9de5e2edbc3052bf10125f0ca22d

Received $2.51 via on-chain swap

For Law Enforcement

All exchange deposit addresses require KYC verification. Subpoenas to Binance, Coinbase, Phantom, or other exchanges can reveal identity documents, IP addresses, and bank withdrawal records.

Critical KYC Evidence

Exchange Source Wallets

Inbound funds came directly from KYC-verified exchange hot wallets

🏦

Why This Matters

Exchange withdrawals can be traced to specific KYC-verified accounts

When someone withdraws SOL from Coinbase or Kraken, the funds come from the exchange's hot wallet (a shared wallet), but the exchange maintains internal records of exactly which verified user account initiated each withdrawal. This creates a direct paper trail to someone who passed KYC verification.

Kraken Hot WalletCONFIRMED

FWznbcNXWQuHTawe9RxvQ2LdCENssh12dsznf4RiouN5

Amount Sent:

18.78 SOL ($3,908.10)

Withdrawal Time:

Sep 04, 2025 @ 04:11:44 UTC

Coinbase Hot WalletCONFIRMED

5g7yNHyGLJ7fiQ9SN9mf47opDnMjc585kqXWt6d7aBWs

Amount Sent:

9.27 SOL ($1,924.99)

Withdrawal Time:

Sep 04, 2025 @ 04:32:29 UTC

Scenario A: Scammer's Own Accounts

If the scammer used their own Kraken/Coinbase accounts to fund the scam wallet, these exchanges have full KYC records (ID, address, phone, bank details) for the person who initiated these withdrawals.

Scenario B: Victim Funds

If victims were instructed to withdraw from their exchange accounts, law enforcement can still trace communication patterns and timing correlations between deposits.

Actionable Intelligence for Law Enforcement

Subpoena Kraken for account records of whoever initiated withdrawal of 18.78 SOL toCgrr9Rgazh...oxWJ on Sep 04, 2025 at 04:11:44 UTC

Subpoena Coinbase for account records of whoever initiated withdrawal of 9.27 SOL toCgrr9Rgazh...oxWJ on Sep 04, 2025 at 04:32:29 UTC

Cross-reference account holder information between both exchanges — if same person, this directly identifies the scammer

Fake Platform Evidence

Screenshots of the fraudulent TruCopy trading platform

Click any image to expand

TruCopy scam dashboard - fake crypto trading platform

Fake Trading Dashboard

Shows fake balance and trading interface

Deposit Page

Shows 8 different crypto deposit options

Personal Info Portal

Collects victim personal data

Discord Impersonation Evidence

Side-by-side comparison of the fake scammer account vs the real admin

Fake Scammer Account

Username:_salma_ogs

Member Since:Jul 20, 2025

Mutual Servers:0 (No Mutual Servers)

Activity:None

Real Admin Account

Username:salmaogs

Member Since:Jun 12, 2020

Mutual Servers:1 Mutual Server

Bio Note:"ONLY ACCOUNT"

How to Spot the Fake

• Username difference: Fake uses underscores (_salma_ogs) vs real (salmaogs)
• Account age: Fake created Jul 2025 (5 years newer than real account from 2020)
• No mutual servers: Scammer account has no connection to the actual community
• Real account warns: States "ONLY ACCOUNT / DMS ALWAYS OPEN" indicating awareness of impersonators

Scammer Conversation Evidence

Actual messages from the scammer attempting to steal money

Click any image to expand

Message 1

Message 2

Message 3

Message 4

Message 5

Warning: These messages show the scammer impersonating a trusted Discord admin. Never trust unsolicited investment opportunities, even from accounts that appear legitimate.

Official Fraud Reports

This scam has been officially flagged by cybersecurity authorities

Netcraft Site Report

Official Cybersecurity Analysis

Domain:

trucopy.org

Status:

Malicious URLs Detected

Hosting Provider:

Cloudflare, Inc.

IPv4 Address:

104.21.15.201

Nameserver:

margo.ns.cloudflare.com

Category:

Cryptocurrency Fraud / Phishing

View Official Netcraft Report

About Netcraft

Netcraft is a leading cybersecurity company that has been protecting the internet since 1995. They provide anti-fraud and anti-phishing services to major banks, governments, and enterprises worldwide. Their site reports help identify malicious domains and protect users from online fraud.

This official report helps prevent others from being scammed and supports takedown efforts.

Related Scam Operations

This scam uses identical methodology to other known operations

OxyCapitals

$54,000+ stolen

View Investigation

MirrorExp

$30,000+ stolen

View Investigation

BridgeStocks

$35,389 stolen (TAKEN DOWN)

View Investigation

EverrexTrade

Under Investigation

View Investigation

AffluenceAura

$0 stolen (abandoned)

View Investigation

Pattern Match: These scams use Discord impersonation, fake trading platforms, and shared infrastructure. They may be operated by the same criminal network.

What To Do If You've Been Scammed

1. Report to Authorities

• FBI IC3: ic3.gov (Internet Crime Complaint Center)
• FTC: reportfraud.ftc.gov
• Local law enforcement

2. Report Wallet Addresses

• Chainabuse: chainabuse.com
• Bitcoin Abuse: bitcoinabuse.com
• Report to exchanges (Binance, Coinbase, Kraken, etc.)

3. Report the Discord Account

Report the impersonator account to Discord Trust & Safety with screenshots of the conversation and the fake username.

4. Document Everything

Save all messages, transaction records, wallet addresses, and screenshots. This evidence is crucial for any investigation.

5. Warn Others

Share this page to help prevent others from falling victim to this scam.