BlackHatWorld – Amy Castor

Previously, I wrote that QuadrigaCX cofounders Michael Patryn and the now-deceased Gerald Cotten worked together for a period at Midas Gold, a Liberty Reserve exchanger that ran from 2008 until May 2013, when it was pulled offline. Now it appears that their connections stretch back even further.

According to data gathered by Reddit user QCXINT, the two business partners were active on TalkGold, a popular forum for pushing high-yield investment programs, aka Ponzi schemes, as early as 2003. Likely, that is where they first met. Evidence also suggests the two were active on BlackHatWorld, a site for discussing dubious marketing strategies for websites. Cotten also appears to have been a Ponzi operator himself. 

This is a long post, so here is a quick summary of what’s ahead:

• Cotten began promoting Ponzi schemes in his teens.

• He was posting on TalkGold under the username “Sceptre.” 

• Michael Patryn, aka Omar Dhanani, posted on TalkGold as “Patryn.”

• “Patryn” and “Sceptre” joined TalkGold in 2003, within months of each other.

• Michael Patryn also posted as “Patryn” on MoneyMakerGroup and BlackHatWorld.

• “Sceptre” first appeared on BlackHatWorld in 2012, but changed his profile name to “Murdoch1337.” 

• “Sceptre” posted as “Lucky-Invest” on TalkGold to promote a Ponzi.

What is a high-yield investment program?

HYIP schemes typically promise ridiculously high rates of returns, but behind the scenes, no real investment is taking place. The operator simply uses money from new investors to pay off earlier ones, all the while skimming funds off the top for himself. When the supply of new investors runs dry, the scheme collapses. All Ponzi schemes collapse at some point.   

Ponzi schemes are nothing new. The name stems from Charles Ponzi, an Italian immigrant who defrauded tens of thousands of Bostonians out of $18 million in 1920. Ponzi went to jail, and when he got out, the U.S. promptly deported him to Italy. New York financier Bernie Madoff ran a $65 billion Ponzi, the largest in history. His Ponzi fell apart during the financial crisis when too many customers started trying to pull their money out. Madoff was convicted in 2008.

In the early 2000s, the internet and the advent of early centralized digital currencies, like E-gold and Liberty Reserve, saw a new wave of Ponzi schemes. Operators anonymously set up their storefronts online and used e-currencies to obscure the source and flow of funds.

HYIP operators typically rely on social media and referrals to create hype and make their offerings appear legitimate. Despite the red flags, many people invest in HYIPs, thinking that if they get in early enough, they can make a buck.  

An entire subculture has proliferated around HYIPs. There are sites that track and monitor HYIPs, and forums where people go to promote and learn more about HYIPs. There’s even an HYIP subreddit.

When an HYIP scheme collapses, the collapse is generally blamed on a hack, a theft, or a bad investment—some type of external event that is plausibly at arm’s length from the operator. When that happens, the HYIP operator begins issuing “refunds”—in good faith, of course.

Some HYIP operators even go to the effort of setting up long-winded spreadsheets and paying back dribs and drabs over months. Naturally, the first people to get paid back are generally insiders or the operators themselves—under different names—who then proclaim what a great guy the operator is, and how decent it is of him to spend all of his time and effort refunding everyone.

The U.S. Financial Industry Regulatory Authority (FINRA), the regulatory body charged with governing business between brokers, dealers and the investing public, writes that “virtually every HYIP we have seen bears hallmarks of fraud.”

TalkGold and MoneyMakerGroup

Starting in January 2003, TalkGold and sister site MoneyMakerGroup were two hugely popular internet forums for launching and promoting HYIPs. The sites were pulled offline on August 21, 2017, a day after the Department of Justice filed an asset forfeiture complaint against the Krassenstein brothers, Edward and Brian, who ran the sites. Homeland Security raided the twins’ Florida homes a month later.

According to BehindMLM, the DoJ docs read:

“Since at least 2003, Brian and Edward Krassenstein … have owned and operated websites devoted to the promotion of fraudulent HYIPs. In particular, the Krassenstein run sites ‘talkgold.com’ and ‘moneymakergroup.com’ are discussion forums in which HYIP operators advertise and promote their fraud schemes to potential victims.”

Patryn on TalkGold

Michael Patryn, formerly Omar Dhanani, was arrested in October 2004 on charges related to his involvement with Shadowcrew, a cybercrime message board. Operating under the pseudonym “Voleur,” French for thief, he offered Shadowcrew members an e-money laundering service—wire him cash, and he would fund your E-gold account, helping to obscure your financial trail. 

After the Shadowcrew bust, TalkGold users began to speculate that “Patryn,” a prolific poster on TalkGold, was in fact, Dhanani—and there is good reason to suspect that he was. 

“Patryn” joined TalkGold on April 3, 2003. His profile linked directly to VFS Network, a network for several digital currency exchangers, including three that Patryn himself operated: Midas Gold, HD Money, and Triple Exchange. VFS Network (stands for Voleur Financial Services) was also his business. 

“Patryn” also openly admits on TalkGold that he operates Midas Gold. The business registration for Midas Gold also lists “Omar Patryn” (one of Patryn’s known aliases) as its sole director. 

Further, Patryn appears to have used the profile name “Patryn” on MoneyMakerGroup, with the same link to VFS Network. He joined MoneyMakerGroup on November 27, 2007, six months after he got out of a U.S. federal prison, where he served 18 months related to his earlier Shadowcrew arrest.

Sceptre on TalkGold

Cotten was likely “Sceptre” on TalkGold. Sceptre joined TalkGold on July 4, 2003, three months after “Patryn” joined. Cotten would have been 15 or 16, at the time.  

TalkGold members were able to list “friends” on the site. A May 2013 profile page for Patryn shows that he had six friends—one of whom is Sceptre. Similarly, a May 2013 profile page for Sceptre shows he had one friend—“Patryn.”  

The two also interacted. Many of Sceptre’s TalkGold posts appear alongside Patryn’s in the same thread, either promoting or defending VFS Network, Midas Gold, or one of the other exchanges that Patryn operated. (There is also evidence to suggest that Cotten, not Patryn, was the main operator for Midas Gold.)  

On December 7, 2009, when a user on TalkGold complains that he is having issues with Midas Gold, Sceptre replies: “I’ve never had any problems with M-Gold. They are usually very efficient.” Patryn follows on the same thread with, “M-Gold does not work during weekends. What is your order reference number? I will have it taken care of ASAP.”

On September 29, 2012, “Patryn” responds to someone complaining about Midas Gold keeping their money. (This was not unusual, by the way. There were many complaints about Midas Gold withholding customer funds. See here, here and here.)

“Patryn” writes:

“To the best of my knowledge, both of us have been responding to your emails. You sent me five emails yesterday demanding that I hurry up and resolve this issue. Your issue will be resolved ASAP. Unfortunately, I cannot force the banks to speed up their investigation process.”

In the same thread, Sceptre replies to “Patryn,” almost mocking the customer.

“lol, I’m surprised you’re willing to help him. You offer your dispute resolution for free, and he thanks you by spamming your inbox and complaining that you don’t reply while you’re sleeping.”

In September 2012, a poster asks, “I am looking for a LR Exchanger into HD-Money.” (Basically, the poster wants to convert one digital currency, Liberty Reserve, into another, HD-Money, without having to go through fiat). Sceptre replies, “For this type of trade I would use ecashworldcard.” Patryn follows by posting a link to his HD-Money site, which lists Ecash World Card as an offering.

Cotten and Patryn on BlackHatWorld

BlackHatWorld is a forum where people go to discuss “black hat” marketing tactics. Paid shilling (paying someone to promote your product on social media), negative SEO attacks (improving your SEO ranking by destroying your competitor’s) and gaming a search engine’s algorithm are all topics of discussion on this forum.

These tactics are generally used by Websites that only plan to stick around long enough to make a quick financial gain, which is exactly what HYIPs aim to do.

Someone going by “Patryn” was also active on BlackHatWorld. This person joined on September 6, 2012, and was last active on September 7, 2017. He only posted nine messages.

Another poster—”Murdoch1337″—in BlackHatWorld, was much more active. He joined on February 12, 2012, and his last activity was January 8, 2017. This person appears to have previously been posting as Sceptre, and we believe this was Cotten. 

(QXCINT also tells me that one of Cotten’s email accounts—[email protected], which was tied to a number of Cotten’s domain registrations—has or had an active account on BlackHatWorld, but the method he used was too technical for me to confirm independently.)

Murdoch1337 appears as the original poster in a thread titled “Sceptre’s Spectacular Content Services!!! – $1.50 per 100 words” — an indication that Sceptre likely switched his profile name to Murdoch1337 sometime after he started the thread. He responds to other posters in the thread as if he is the one offering the content services. “That’s all the review copies for now,” he writes. “For everyone else, feel free to place your orders using the order info in my original post.”

On September 10, 2013, Murdoch1337 posts an ad for a developer to help him with an upcoming cryptocurrency exchange. In the ad, he writes:

“I am looking for a programmer who is familiar with Bitcoin to develop a website that is very similar to Bitstamp…Also, I’m looking to get this project built and online quickly, so if you are able to do it quickly, that is a bonus.”

This ad was posted three months before Quadriga launched in beta. The timing makes sense given that Quadriga was based on WLOX, an open-source exchange solution available on Github, which would have dramatically reduced the time it took to create a functioning crypto exchange. Alex Hanin built the Quadriga platform, though it is not clear if Cotten actually recruited Hanin via this ad on BlackHatWorld.

An almost identical ad with the title “Bitstamp clone – Bitcoin trading project” was posted on Freelancer.com. The job poster, who was anonymous, had 38 projects on the site. He left a few telling details behind on one of the projects:

Hi

I’m looking for programmers who are knowledgeable when it comes to Bitcoin and I found you.

I have a number of projects that need work, including a new Bitcoin exchange. Are you able to build sites like this? If so, i’d like to get in touch

Thanks

Gerry

Skype: gerrywc

email: [email protected].

S&S Investments and Lucky Invest

One of Sceptre’s HYIPs was S&S Investments, a website that opened for business on January 1, 2004. (“Copyright @2004 Sceptre” is written at the bottom of the page.) He promotes the scheme as a way to double your money. 

“You invest a sum of money into the program and within 48 hours (usually within 18) you will receive a return of anything from 103% to 150%, possibly more.”

He is sure to point out that this is “not what is called a ponzi or pyramid scheme.” It offers returns that are far better!  

In case the first offer sounded a little too far fetched, he changes the text later to something only slightly more believable. S&S now becomes a “fixed-term investment,” which pays 115% in a week….”you can invest and walk away in profit after just 7 days!”

Of course, S&S ultimately collapses, and discussion around it gets moved to the “Closed / Scammed Programs” section of TalkGold, where Sceptre continues to string along anxious investors, who continue to hold out hope for a “refund.” He writes:

“Refunds WILL take some time. I cannot guarantee that they will all be made quickly. The refund process is likely to spread over a long period of time, but I am willing to do my best to refund everyone to the best of my ability. Please be patient and you will receive a lovely surprise in your e-gold, a refund from S&S Investments,” Sceptre writes.

One TalkGold user reviewed what he considered to be the 12 biggest HYIP “scams” on TalkGold. This is what he wrote about S&S Investments:

“S&S Investments is an interesting program because it was operated by a ‘well known’ person in the HYIP arena. I use the quote marks, because this person was not well known at all, in fact he was very anonymous. No one knew his name, other than his nickname he used to post with, Sceptre. He used anonymous proxies, he was very well hidden. Yet because he had over 1000 posts on TalkGold, he earned a kind of pseudo-trust that people get from being very visible and always online.

Sceptre started off with a small little program that promised to pay back a large amount after a few days. It soon grew to become very, very popular, and it was not long before he upgraded to a fully automated script.

Sceptre wouldn’t tell people how he made the money, he just said that was his little secret. Virtually everyone invested into S&S Investments based on his post count on TalkGold. “He’s made a lot of posts on TalkGold, therefore he must be honest” seemed to be the general opinion of the investors.

S&S Investments went for sometime before cracks started to appear. First the website went offline, then was back again, but withdrawals weren’t being honoured, then the site went offline again. Finally, Sceptre made an announcement that S&S Investments were closed and refunds were to promised.

For a while, refunds did proceed, but then things started to dry up. Since the summer, no more refunds have been processed.

Hey, just because someone has thousands of posts on a forum, doesn’t mean he’s a trustworthy guy. Use your head, look at what the whole program is offering.”

In May 2004, Sceptre appears to switch to another TalkGold profile, “Lucky-Invest,” to promote a Lucky Invest HYIP. 

At one point in a thread, he apparently forgets to log out of Lucky-Invest and continues responding as if he were Sceptre, until another poster calls him out:

“You forgot to sign in as ‘sceptre’. ohhhhhhhhhhhhhh . .. looks like Lucky-Invest changed their message!!! . . . too funny!!! . .. did you get caught Sceptre??? hahaha ;)”

Sceptre/Lucky-Invest replies:

“I’m not trying to hide. Lucky Invest, the Newest Investment/Game. My profits go to help pay refunds. THIS IS A GAME, IT WILL NOT HAVE ANY REFUNDS.”

This is a straight out admission that Lucky Invest was not an actual investment. It was a “game.” In other words, a fraud. Essentially, Sceptre/Lucky-Invest/Gerald Cotten is saying: When you give me your money, it is mine. There are no refunds in this game, just me sharing my profits.

Knowing that Cotten and Patryn did business together on TalkGold does not tell us where the CA$250 million worth of crypto and fiat that went missing on Quadriga went. (Only a fraction of those funds have been recovered so far.) But it does bring up questions. Was Cotten really just a starry-eyed Bitcoin libertarian? Or was he a seasoned con artist who had no qualms about taking other people’s money?

If you like my writing, consider supporting my work by subscribing to my Patreon for $5, $20, or $50 a month. Every little bit helps!