Cryptocurrency scammers run off with more than $2 million after ditching their investors

Scammers appear to have made off with more than $2 million in cryptocurrency after carrying out an apparent fake initial coin offering (ICO), and the individuals linked to the incident may be connected to another recent theft, CNBC has learned.

A bad actor or actors used a fake LinkedIn profile and copied pictures from another user's Instagram to create a false persona — and successfully drew more than 1,000 investors into the ICO project, which was called Giza.

The Wild West world of ICOs

An initial coin offering or ICO is a way for start-ups to crowd-fund investment. Instead of raising cash from venture capitalists, a company can hold an ICO, which allows people to invest a cryptocurrency, such as ethereum or bitcoin, in exchange for a new token that's issued by the start-up. The new digital coin is not equity. Instead, it can be used in exchange for future services offered by the company. It's also possible that the new coin may climb to a much higher value than the initial investment.

There is big money in ICOs, and they are largely unregulated. Last year, companies raised $3.8 billion via ICOs, and this year alone they have already raised $2.8 billion, according to data from CoinSchedule, a site which tracks the activity in the space.

But ICOs are unregulated in most countries, meaning investors don't have the protections that they enjoy with other assets such as stocks. However regulators are keeping a closer eye on ICO activity, amid a rising number of reports of scams.

What happened with Giza?

Investors who spoke to CNBC all described a common experience with the ICO in question: They thought the project was legitimate until warning signs began to appear, including a falling out with the company's sole supplier, a lack of correspondence from its supposed founders, and failed attempts to recoup the lost funds.

The apparently well-orchestrated scam centers around a mysterious individual called Marco Fike, the COO of Giza. Among the eight investors, partners and former employees of Giza interviewed by CNBC, all claim they have never seen Marco Fike's face.

The ICO was for a supposed start-up called Giza, which claimed to be developing a super-secure device that would allow people to store cryptocurrencies.

It carried out its ICO in January and drew investors for several weeks after. One person who put money into the project told CNBC that they invested ether that was equivalent to $10,000 at the time, and another said they had put in around $5,000 worth of ether.

At the beginning of February, Giza had raised and was holding more than 2,100 ethereum coins, which at the time were worth around $2.4 million. All but $16 worth of those ethereum coins are now missing.

But after putting in money throughout January and into February, many who had invested began to become suspicious of the project.

Supplier fallout

"Everything was fine, until that company that was meant to develop their device came out on the internet and said that Giza has cut ties, and it seems to be a scam and they might not be developing anything. Then things started looking fishy," an investor named Chris, who wished to keep his surname anonymous, told CNBC by phone.

Giza's website was deleted last Friday, but an archived version can be seen here.

Late last year, Giza contracted a Russian firm known as Third Pin LLC to make the devices it would eventually sell. The Third Pin website explains that it makes hardware for a number of industries. But on January 30, Third Pin's CEO, Ivan Larionov, posted on a bitcoin forum that his company had cut ties with Giza. Larionov confirmed to CNBC that Giza had contracted Third Pin and that the post was his.

The Third Pin CEO explained that he was contacted by a representative of Giza before the new year. He was given a design for a device that Giza wanted to make, but not technical requirements. Once Third Pin's engineers had worked out the specifications of the device, they quoted a $1 million price for Giza and signed a contract.

Larionov contacted STMicro, a components supplier, to help get the parts required for Giza's device. He said that the sales manager at the company was asking basic questions, such as the quantity required and when it would be produced, which Larionov couldn't answer. The Third Pin CEO got in touch with Fike, who gave answers that Larionov described as unclear. That was a red flag, Larionov said.

Fike asked Larionov if he would be willing to set up new operations outside Russia and manage the relationship with Giza from there, Larionov told CNBC. The Third Pin CEO suspected that Fike wanted to get away from Russia's strict cryptocurrency rules but declined that request.

As Third Pin continued assessments on the cost of production, the company found that it would be higher than initially thought. The cost to Giza went up to $1.5 million. Larionov suggested to Fike that Giza could pay in installments, something Fike didn't want to do.

"At that moment he said no, no way," Larionov told CNBC. "So next thing I said to my employees is that we will cut the contract."

One of the investors, who wished to remain anonymous but who used the screen name ShayJo, showed CNBC an exchange with Larionov over messaging app Telegram, in which he told the same story. In the conversation reviewed by CNBC, Larionov said Giza offered to pay 60 percent of the total contract, with the rest coming later on in 2018, once they had carried out another part of the ICO to raise more money. But by that time Larionov had suspicions about whether the company would disappear after getting the funds so ended the relationship, as seen in the conversation below.

Around mid-February, the digital wallet address associated with Giza, where people had been asked to send money, began showing outflows of large amounts of ethereum. That continued for about two weeks. The last movement of money from the Giza account took place on March 2.

Where did the money go?

Another investor, Nicolas, who asked that his surname remain anonymous, sent CNBC a trail of the money — because ethereum transactions are on the blockchain, they can be tracked, though the person behind them remains anonymous.

Money is sent from wallets, which store cryptocurrencies, to other wallets or an exchange, where people trade cryptocurrencies. By following wallet addresses, it's possible to see the movement of money.

Most of the money from Giza's wallet was drained over the course of two weeks. The money was sent to various other wallet addresses.

Intriguing parallels exist between the movement of money in the Giza case and a separate scam perpetrated against a digital coin called Bee Token. In February, Bee Token ran an ICO. But during the digital coin sale, scammers pretending to be the founders of Bee Token inserted themselves into the money flow, by sending an email to people prompting them to invest in that ICO.

One of the wallets linked to the Bee Token phishing scam sent ethereum to a wallet associated with Giza, according to, a site that tracks all transactions on the ethereum blockchain as shown in the diagram below.



Valerie Krutanova