♻️ Tomboi - no KYC/AML exchange with XMR, Tor support | $10,000 escrow

[byware.netSCAM]

I also found their ETH addresses: there’s 41 ETH in the wallet, and 100 ETH was transferred to Tornado Cash. This isn’t the first time they’ve pulled off a scam this big.
I can’t message anyone in private messages because I’m limited to two messages per day.


I'm sure there are plenty of other services on BitcoinTalk that scam people—so be careful and don't send large amounts of money; even a deposit isn't a guarantee.

[hugeblack]

I also found their ETH addresses: there’s 41 ETH in the wallet, and 100 ETH was transferred to Tornado Cash. This isn’t the first time they’ve pulled off a scam this big.

I don't believe they all belong to Tomboi; they're probably using Liquidity vaults, but they're definitely part of a larger network. Their purchase of tomboi account indicates they were trying to quickly gain trust.

If you have any more information, please share it, as I believe they currently have an active service.

I can’t message anyone in private messages because I’m limited to two messages per day.

I've added you to my whitelist. You can now send more messages freely. Please don't spam or send messages to anyone who hasn't asked you to.

[avp2306]

I also found their ETH addresses: there’s 41 ETH in the wallet, and 100 ETH was transferred to Tornado Cash. This isn’t the first time they’ve pulled off a scam this big.

I don't believe they all belong to Tomboi; they're probably using Liquidity vaults, but they're definitely part of a larger network. Their purchase of tomboi account indicates they were trying to quickly gain trust.

If you have any more information, please share it, as I believe they currently have an active service.

Its really possible that those things don't belong to them. But by their actions made before like buying an account then name their site with it is really kinda suspicious.

What they do with that matter is like they want to short cut to gain great reputation or trust fast. Now we have seen another great example that its hard to trust those service providers which bough an account, since they can repeatedly do this scams and build another project again. In future maybe its better to pay close attention with new projects offering same services and try to look at if they don't have shady background just like site.

[NotATether]

Everyone please send me your letters of guarantee for Tomboi.io by PM/email/Telegram [ex. ByWare.net/NoKYC-NoAML.cc] (and for their associated site mixer.black if you have used that) - I am attempting to trace their bitcoin addresses as I suspect they are going to come back to us with a different name.

I have already confirmed the two services use the exact same liquidity pool for withdrawals - they are sent to KuCoin before payout - but in order to create a fingerprint for their reserve size, I need more deposit and receiving addresses.

[examplens]

Everyone please send me your letters of guarantee for Tomboi.io by PM/email/Telegram [ex. ByWare.net/NoKYC-NoAML.cc] (and for their associated site mixer.black if you have used that) - I am attempting to trace their bitcoin addresses as I suspect they are going to come back to us with a different name.

I have already confirmed the two services use the exact same liquidity pool for withdrawals - they are sent to KuCoin before payout - but in order to create a fingerprint for their reserve size, I need more deposit and receiving addresses.

I tested Tomboi at the end of April, and I saved their two letters of guarantee. I only had a little look at the flow of subsequent transactions, but I didn't have time for anything more detailed.
I'm sending you both in a PM here, just let me know if you find anything interesting.

[LoyceV]

Code:

I confirm that I have received aditional $5000 USDT (BEP20) and now holding a total of $10000 USDT.

I think you should update your escrow post, just in case the site comes back online and new victims think it's safe to use.

[uchegod-21]

Everyone please send me your letters of guarantee for Tomboi.io by PM/email/Telegram [ex. ByWare.net/NoKYC-NoAML.cc] (and for their associated site mixer.black if you have used that) - I am attempting to trace their bitcoin addresses as I suspect they are going to come back to us with a different name.

This is an angelic move. If this is implemented and it works, it means that it will be more difficult for scammers to quickly return under a new nomenclature to scam unsuspecting victims.

I think you should update your escrow post, just in case the site comes back online and new victims think it's safe to use.

Has there been a situation that a project after exit scamming, came back with same domain to continue scamming?
I am doubtful.

[logfiles]

I'm sure there are plenty of other services on BitcoinTalk that scam people—so be careful and don't send large amounts of money; even a deposit isn't a guarantee.

Looks like the scammer is slowly evolving.

1. Launch a likable service in the forum
2. Pretend to be looking for honest reviews (sometimes launch a review campaign)
3. Contact one of the marketing guys for a possible signature campaign
4. Deposit some escrow as a way of trying to prove that they are serious about reputation
5. Sponsor contests or games around the forum
6. Pull of an exit scam once the money exceeds what they have invested
7. Repeat the scam with a new service a few days/weeks later.

[examplens]

4. Deposit some escrow as a way of trying to prove that they are serious about reputation

In spite of everything, users still have the problem that they sent an amount 10 times larger than what was guaranteed through escrow.
As far as I understand, the $100k guy found this exchange through Discord. Therefore, neither escrow nor any campaigns here on the forum had much influence on him.
Until now, I have not had the need for a swap transaction worth $100k or similar, but I am sure that I would not do it all at once, but would divide it into several smaller ones. The fee has not been that big for a long time, and a few dollars more is insignificant compared to how much the risk is reduced.

[NotATether]

I have crawled over 10k Bitcoin addresses connected to the Tomboi service over a two-month time span.

I've only received a few letters of guarantee, so there aren't many deposits and withdraws to look at, but it's enough information to map the flow of addresses going from start to end.

View the interactive map here: https://sienna-stork-851124.hostingersite.com/ <temporary domain>
https://web.archive.org/web/20260605131911/https://sienna-stork-851124.hostingersite.com/ (click the "x" on the header to view the full content)


Keep in mind that a lot of the addresses aren't actually owned by the scammer - they are exchange addresses. Exchange addresses are used for all withdraw orders, but the exchange seems to change some of the times. Deposit addresses do belong to them, however.

A few deposit addresses mapped to the scammer's exchange accounts can also be found on the graph, though they are not marked.

Address ownership was annotated using Arkham Intelligence.

Try and see if you guys can make any use of the data, but basically the main rule is intact - any future service with balance flows connected to the addresses in this graph is definitely the same person.

[avp2306]

I'm sure there are plenty of other services on BitcoinTalk that scam people—so be careful and don't send large amounts of money; even a deposit isn't a guarantee.

Looks like the scammer is slowly evolving.

1. Launch a likable service in the forum
2. Pretend to be looking for honest reviews (sometimes launch a review campaign)
3. Contact one of the marketing guys for a possible signature campaign
4. Deposit some escrow as a way of trying to prove that they are serious about reputation
5. Sponsor contests or games around the forum
6. Pull of an exit scam once the money exceeds what they have invested
7. Repeat the scam with a new service a few days/weeks later.

It seems they get the formula on how to gain trust of people here, so maybe its time to change the view towards those actions they made. Also with all of those things we have seen on Tomboi even if they held some amount on escrow there's still huge chance for them to run or became a scam.

What also need to look at by people is  the amount held by escrow, if they know that the amount cannot cover up their deposited.  Better not to put huge money in their site, also what happened here shows us that better not to trust them instantly and if they are curious to use, better test with small amount.

[logfiles]

4. Deposit some escrow as a way of trying to prove that they are serious about reputation

In spite of everything, users still have the problem that they sent an amount 10 times larger than what was guaranteed through escrow.
As far as I understand, the $100k guy found this exchange through Discord. Therefore, neither escrow nor any campaigns here on the forum had much influence on him.
Until now, I have not had the need for a swap transaction worth $100k or similar, but I am sure that I would not do it all at once, but would divide it into several smaller ones. The fee has not been that big for a long time, and a few dollars more is insignificant compared to how much the risk is reduced.

It means whoever recommended it in the discord server (if he wasn't part of the scammers) must have seen the service from somewhere. Perhaps in this forum or one of the aggregator website and probably saw a security deposit but possibly didn't pay attention to how much had been deposited. Either way people need to learn how to value their money and always carry our background checks before any transaction is made

[uchegod-21]

I'm sure there are plenty of other services on BitcoinTalk that scam people—so be careful and don't send large amounts of money; even a deposit isn't a guarantee.

Looks like the scammer is slowly evolving.

1. Launch a likable service in the forum

Something that is privacy oriented and preach against KYC and AML scrutiny

2. Pretend to be looking for honest reviews (sometimes launch a review campaign)

Pretend to also update some changes suggested in the review.

3. Contact one of the marketing guys for a possible signature campaign

Possibly the most trusted ones to increase trust.

4. Deposit some escrow as a way of trying to prove that they are serious about reputation

Something not so high so that they could hit a victim fast.

5. Sponsor contests or games around the forum
6. Pull of an exit scam once the money exceeds what they have invested
7. Repeat the scam with a new service a few days/weeks later.

I used to think few months and years, does it come as fast as days and weeks?

Be it as it may, there are still genuine projects who still use the same template above. So, we are not going to judge them hastily, time is the perfect judge.