The SEC says a crypto investment scam run through WhatsApp group chats took more than $12.5 million from over 300 investors, and a second, separate one took at least $2.8 million from about 1,715.
The two complaints were filed together on September 29. Read side by side, they list the same Bitcoin address and the same Ethereum address.
How The Crypto Investment Scam Worked
In its complaint against Cryptoaiml Ltd. and Cryptoaiml Capital Foundation, the SEC describes a scheme that ran from at least August 2024 to March 2025. Defendants allegedly created WhatsApp groups and posed as investment professionals.
The complaint says one persona claimed ties to Raymond James, and another was presented as the president of Citadel Securities, with biography details copied from the real executive’s public profile. The filing presents both firms as impersonated, not involved.
Members were steered to a website, cryptoaiml.vip, and handed wallet addresses to send crypto. The platform then showed growing balances. The SEC says no trading took place and the profits were fictitious.
Withdrawals were blocked. The complaint says victims were told accounts were “frozen” and were directed to wire dollars to U.S. bank accounts to “unlock” them, in one case to pay a “miner’s fee.” Some sold stock or drew on 401(k) accounts to pay.
One investment management agreement quoted in the filing set a fee schedule under which no fee applied as long as profits reached 1200% per month.
The Second Scam Sold AI Trading Bots
The SEC’s complaint against TSAI Pro Ltd. and TSAI Capital Foundation describes a second crypto investment scam with a different pitch. From September 2024 to March 2025, investors were told they could “rent” AI trading bots for guaranteed daily returns, from a $100 entry bot to a $500,000 one promising $17,500 a day for 360 days.
They could also earn commissions for recruiting others. The complaint says there were no bots, no real accounts and no program. It puts the take at no less than $2.8 million from about 1,715 retail investors, with about $2.7 million of it on the Bitcoin blockchain.
Both operations also posted what looked like proof of SEC compliance: a falsified Form D and a certificate that referenced it. The SEC says it has now removed both Forms D from its website.
Two Complaints, One Shared Bitcoin Wallet
Each complaint lists the wallet addresses that received the money. Cryptoaiml’s list has nine, four Ethereum-format addresses and five on Bitcoin. TSAI’s has four, two on each chain.
Two of those addresses are identical, which links the two crypto investment scam cases on the public ledger. The Bitcoin address beginning 1JKGf3Tot and the Ethereum address ending 909425 appear in both lists. The SEC filed the cases separately and does not say in either complaint that the operators are the same.
What The Ledger Says About The Crypto Wallets
The Bitcoin blockchain can be checked directly. The TSAI-only Bitcoin address was active from September 27, 2024 to March 22, 2025, the same window the complaint alleges. It received 31.46 BTC across 78 transactions, about $2.65 million at today’s price, in line with the roughly $2.7 million on Bitcoin the SEC cites.
The shared address looks different. It received 1,755.99 BTC across 346 transactions and sent every coin on, leaving a zero balance. That is about $148 million at today’s price, nearly ten times the $15 million the SEC says both schemes took together.
Its activity also runs from January 25, 2024 to July 16, 2025, starting months before the alleged schemes began and continuing months after they ended.
The other four Cryptoaiml Bitcoin addresses add roughly 521 BTC, with activity between October 2023 and March 2025. All six Bitcoin addresses together handled about 2,308 BTC, worth roughly $194 million today. Every one of them is now empty or nearly so.
A total like that does not mean the extra coins came from victims. It means these addresses carried far more than the alleged losses, and the ledger cannot say whose the rest was. The complaints do not address it.
On Ethereum, both the shared address and the TSAI-only address are now essentially empty, at 0.0099 ETH and 0.0019 ETH. The shared one’s last transaction was March 15, 2025.
What The SEC Wants, And What Is Still Unproven
The SEC asks the court for permanent injunctions, disgorgement and civil penalties. These are allegations, not findings. The SEC says the entities are likely run by individuals overseas.
The Cryptoaiml complaint says the crypto was moved across blockchains and on through a series of complex transfers outside the United States, often within days and sometimes in under 24 hours. Whether any of it can be frozen or recovered is the open question.
The agency points investors to Investor.gov to check who is selling them an investment, and says a crypto investment scam like this typically leans on popular group chats and false claims of SEC registration to lure victims.
