The ICO was for a supposed start-up called Giza, which claimed to be developing a super-secure device that would allow people to store cryptocurrencies.
It carried out its ICO in January and drew investors for several weeks after. One person who put money into the project told CNBC that they invested ether that was equivalent to $10,000 at the time, and another said they had put in around $5,000 worth of ether.
At the beginning of February, Giza had raised and was holding more than 2,100 ethereum coins, which at the time were worth around $2.4 million. All but $16 worth of those ethereum coins are now missing.
But after putting in money throughout January and into February, many who had invested began to become suspicious of the project.
“Everything was fine, until that company that was meant to develop their device came out on the internet and said that Giza has cut ties, and it seems to be a scam and they might not be developing anything. Then things started looking fishy,” an investor named Chris, who wished to keep his surname anonymous, told CNBC by phone.
Giza’s website was deleted last Friday, but an archived version can be seen here.
Late last year, Giza contracted a Russian firm known as Third Pin LLC to make the devices it would eventually sell. The Third Pin website explains that it makes hardware for a number of industries. But on January 30, Third Pin’s CEO, Ivan Larionov, posted on a bitcoin forum that his company had cut ties with Giza. Larionov confirmed to CNBC that Giza had contracted Third Pin and that the post was his.
The Third Pin CEO explained that he was contacted by a representative of Giza before the new year. He was given a design for a device that Giza wanted to make, but not technical requirements. Once Third Pin’s engineers had worked out the specifications of the device, they quoted a $1 million price for Giza and signed a contract.
Larionov contacted STMicro, a components supplier, to help get the parts required for Giza’s device. He said that the sales manager at the company was asking basic questions, such as the quantity required and when it would be produced, which Larionov couldn’t answer. The Third Pin CEO got in touch with Fike, who gave answers that Larionov described as unclear. That was a red flag, Larionov said.
Fike asked Larionov if he would be willing to set up new operations outside Russia and manage the relationship with Giza from there, Larionov told CNBC. The Third Pin CEO suspected that Fike wanted to get away from Russia’s strict cryptocurrency rules but declined that request.
As Third Pin continued assessments on the cost of production, the company found that it would be higher than initially thought. The cost to Giza went up to $1.5 million. Larionov suggested to Fike that Giza could pay in installments, something Fike didn’t want to do.
“At that moment he said no, no way,” Larionov told CNBC. “So next thing I said to my employees is that we will cut the contract.”
One of the investors, who wished to remain anonymous but who used the screen name ShayJo, showed CNBC an exchange with Larionov over messaging app Telegram, in which he told the same story. In the conversation reviewed by CNBC, Larionov said Giza offered to pay 60 percent of the total contract, with the rest coming later on in 2018, once they had carried out another part of the ICO to raise more money. But by that time Larionov had suspicions about whether the company would disappear after getting the funds so ended the relationship, as seen in the conversation below.
Around mid-February, the digital wallet address associated with Giza, where people had been asked to send money, began showing outflows of large amounts of ethereum. That continued for about two weeks. The last movement of money from the Giza account took place on March 2.
Where did the money go?
Another investor, Nicolas, who asked that his surname remain anonymous, sent CNBC a trail of the money — because ethereum transactions are on the blockchain, they can be tracked, though the person behind them remains anonymous.
Money is sent from wallets, which store cryptocurrencies, to other wallets or an exchange, where people trade cryptocurrencies. By following wallet addresses, it’s possible to see the movement of money.
Most of the money from Giza’s wallet was drained over the course of two weeks. The money was sent to various other wallet addresses.
Intriguing parallels exist between the movement of money in the Giza case and a separate scam perpetrated against a digital coin called Bee Token. In February, Bee Token ran an ICO. But during the digital coin sale, scammers pretending to be the founders of Bee Token inserted themselves into the money flow, by sending an email to people prompting them to invest in that ICO.
One of the wallets linked to the Bee Token phishing scam sent ethereum to a wallet associated with Giza, according to etherescan.io, a site that tracks all transactions on the ethereum blockchain as shown in the diagram below.
That could mean that person or persons involved with the Giza scam were also behind the Bee Token heist. Or it could mean that the people behind the scam perpetrated against Bee Token have some sort of relationship with those behind Giza. It is ultimately unclear.
Eventually some of the ether made it to the ShapeShift cryptocurrency exchange via associated Giza wallet 2, shown above. ShapeShift doesn’t allow people to exchange cryptocurrencies into government-issued cash, but it does allow a person to change between different digital coins. After CNBC reached out to ShapeShift, the exchange said it blacklisted the wallet associated with Giza. But it said it could not reveal the person who was registered to the wallet address because “we don’t collect user data.”
Despite their efforts to get in contact with Giza, investors still have no clear way to reclaim their money. Several told CNBC they have contacted law enforcement authorities in the United Kingdom.
Who is Marco Fike?
After Third Pin made its announcement on the bitcoin forum, investors began to worry. Those who had bought Giza digital coins banded together to create a Telegram group to investigate the people behind the scam, led by the previously-mentioned Nicolas, as well as others.
The central figure in the Giza scam was its Chief Operating Officer Marco Fike. Several people who spoke to CNBC, including developers hired by Fike as well as investors in Giza itself, said they had never seen him. All said they had spoken to the person behind the alias via messaging services.
His LinkedIn page claims he studied at the University of Oxford in the U.K but does not list which college there. Oxford told CNBC on Thursday that it was investigating those claims.
CNBC reached out to Fike via LinkedIn but received no response.
Microsoft: He never worked for us
Fike listed Microsoft as a previous employer in Switzerland. However, the software giant revealed to CNBC on Friday that he had never worked for the company.
Fike said he was the assistant to the CEO at a company called the United Arab Emirates Agency in Dubai. CNBC contacted all the numbers listed on the site. Two numbers in the U.K. and Croatia went unanswered. The main Dubai headquarters number went to an individual who denied any knowledge of a company by that name.
One member of the Telegram group managed to trace the source of Fike’s LinkedIn profile picture came from — it appears to be from an Instagram user based in Dubai.
It’s unclear whether that Instagram user knows the person behind the Fike persona, or if his image was used without his knowledge. CNBC reached out to the Instagram user to request comment, but received no response.
“We contacted people on LinkedIn associated with the company. None of them had said they had met this guy Marco, it was all online. Some started removing their association with Giza, it all started looking shady,” an investor who goes by the name of ShayJo told CNBC.
Third Pin CEO Larionov provided more details about Fike. Larionov said he communicated with Fike over Skype, but that Fike never turned his video on. Instead, they spoke with just audio. Larionov described Fike as a fluent Russian speaker but with an accent.
Backlash from Giza
As their suspicions rose, investors in the ICO began trying to ask questions directly of Giza. A Telegram channel existed for the investors to talk with Giza. A user called Karina appeared to be the community manager for the group and for Giza.
The investor with the screen name ShayJo said Karina banned several people from the Telegram group who had asked questions. Karina posted in the Telegram channel that she was paid by Giza, but had never spoken to Marco Fike. Eventually, the company stopped paying Karina, she said.
CNBC contacted Karina via LinkedIn, and she followed up on Telegram. Karina said that Marco Fike hired her on a website called Freelancehunt.com, but she spoke with him only over Telegram and Skype chat, never via a voice call or video.
In a transcript of the Telegram group posted online, Karina claimed on February 11 that she had no information from Fike since February 7.
full story on CNBC