Good day everyone!
Last week I promised to reveal the details of the refund from GhostSwap for exchange ID 41gf6aamcb79iw8o.
I want to start by thanking everyone who posted in this thread. Without you, the order 41gf6aamcb79iw8o would not have been returned. This is largely your achievement, because I could not find a stronger pressure point on GhostSwap than BitcoinTalk, where the community supported us.
I have been active on Exploit.in for several years, specializing in helping people recover funds from exchanges listed on BestChange. I do not take upfront payment, I have a deposit of $10,000 on Exploit.in, and I have positive reviews. This is not advertising — it is to help you understand the context.
In June 2026, two people contacted me (both via Telegram) almost at the same time with a blocking problem at GhostSwap. One had ID 41gf6aamcb79iw8o, and the other had ID r6gfns7qebjs43e4.
I first learned about GhostSwap when they wrote to me. I asked each of them: "Are you the same person?" They replied that the funds belong to almost the same family, but the transactions were made in different names (according to documents and origin of funds).
I checked all available information about GhostSwap: which listings they are in, what is known about them, reviews, domain and hosting provider, and I traced the movement of funds after the exchange.
GhostSwap turned out to be a classic "nested service." If you don't know what that is, you can Google it. If GhostSwap had been listed on BestChange, they would have had only three options to resolve the problem with me:
Return our funds.
Not return our funds and be removed from BestChange.
Provide evidence that the funds are officially seized by law enforcement (police, security services) and provide contact details of the department handling the case.
But GS was not in any reputable listings and directly exchanged client funds through HitBTC accounts (or their intermediaries). In theory, it could look like this: GS creates a HitBTC account under a straw man's name. For example, three different clients send 1 ETH, 1 BTC, and 1 LTC for exchange. If, say, the 1 LTC is "dirty," the entire HitBTC account is blocked, including the funds of the 1 ETH and 1 BTC clients. That is why "nested services" like GS are very dangerous for exchanges. Such services can have dozens or hundreds of accounts on exchanges, created under straw men, and many clients of such "nested services" can lose their funds, while such "shadow exchangers" are simply closed by their owners.
Let's return to our problem.
As I said earlier, we managed to return 12 ETH for order 41gf6aamcb79iw8o for @Benedesuuuk. My strategy was: first we try to return order 41gf6aamcb79iw8o (12 ETH), and if we succeed, we will try to return the funds from order r6gfns7qebjs43e4 (20.5 ETH). I was afraid that if we asked to return everything at once, GS might simply close and return nothing, because the amount is huge — at least for me.
This strategy partially worked. 12 ETH were returned, but not because @Benedesuuuk provided legitimate documents for the blocked funds (he provided them, and the documents were sufficient to unblock funds for any BestChange exchanger, and they are also valid for legal disputes and courts in @Benedesuuuk's country of residence), but because GS was afraid for its reputation and afraid of community backlash, removal from OrangeFren, and other services.
In mid-August, GS wrote to @Benedesuuuk on Telegram (when GS was already removed from OrangeFren's listing) and offered an alternative solution: they offered to pay from their allegedly personal funds to resolve the problem. That is, the funds allegedly remained blocked, but they would pay anyway.
@Benedesuuuk, after consulting with me, agreed (I will clarify — I wrote ready-made texts for @Benedesuuuk for all complaints, both on forums and in messengers; he often just forwarded them).
In late September, GS provided a Simplex link so we could contact them there. We contacted them. In the screenshots you can see that we had to contact OrangeFren to receive the payment:
https://talkimg.com/images/2026/09/15/UqzwDb.pnghttps://talkimg.com/images/2026/09/15/UqzujC.pnghttps://talkimg.com/images/2026/09/15/UqzHnv.pnghttps://talkimg.com/images/2026/09/15/UqzSvH.pnghttps://talkimg.com/images/2026/09/15/UqzZgg.pnghttps://talkimg.com/images/2026/09/15/UqzCuI.pnghttps://talkimg.com/images/2026/09/15/UqzQNd.pnghttps://talkimg.com/images/2026/09/15/UqzGo5.pngAnd we received it! The main condition for the refund was the removal of all complaints: Trustpilot, KYCnot.me, BitcoinTalk, and other services. @Benedesuuuk did this, and as agreed with GS, he does not disclose all the details. He kept his word to GS.
When we received the 12 ETH payment, I decided after a short time to write to GS (on Simplex) and resolve the issue of returning the 20.5 ETH.
My client with the 20.5 ETH block told me that he previously had another SOL block, but he does not remember the exchange ID and is confused about the hashes. I made it clear to him that I would not help him with other blocks at GS because I have few pressure points on this exchanger (GS) and I am afraid that we might end up without the 20.5 ETH either, because GS might simply close.
As an alternative, I suggested: we now write to GS and ask them to return our 20.5 ETH from their own funds as well, and we are ready to leave the SOL block without claims, especially since he does not remember the exchange ID and is confused about the hashes (regarding the SOL block, I do not know if it actually exists — it is from his words). He agreed. That is, if GS returns our 20.5 ETH, we will have no further claims against GS — neither I nor anyone else.
On September 2, we wrote to GS and in parallel to OrangeFren, explaining the second block of 20 ETH, and that we are ready to resolve this issue peacefully, without unnecessary noise. OrangeFren was notified that GS again has an outstanding obligation, and that they should not return GS's deposit if GS asks. (At that time, GS's deposit with OrangeFren was $32,000.)
GS asked for all the details on the 20.5 ETH transaction and asked us to sign this transaction to confirm that this case really belongs to us. We did this, and they confirmed that they are dealing with the legitimate owner of the blocked funds. It is worth mentioning that GS refused to communicate on Simplex and asked us to write to them at
support@ghostswap.io, so we communicated there.
GS asked for time to analyze everything, but as it turned out, they used that time to protect themselves.
Here is what GhostSwap did since September 2:
Asked to lower the displayed deposit amount on OrangeFren. Before my contact with GS (September 2), it showed $32,000. Now it shows $5,000. I thought GS was already withdrawing funds from the deposit and asked OrangeFren for clarification. They reassured me that GS itself asked them to lower the displayed amount, and their deposit remained at approximately 0.4 BTC.
Changed the tagline on their website from "NO KYC" to "Privacy-Focused Crypto Swaps." But what is their "privacy focus" when all exchanges go through HitBTC? This is a very questionable scheme.
Ultimately, GS said they would "find a solution without publicity" — but without any timeline. Not a month, not a year, not 10 years. Just unknown. And they made it clear that if I am not satisfied, I will have to go through verification again — through HitBTC, where the documents that would be accepted in courts and legal disputes in the client's country of residence are not sufficient for them. That is a dead end. Either we must stay silent while more people suffer from GS, or go through a long process with HitBTC without any explanation.
Of course, this did not suit us, and we will fight with all our strength to return these 20.5 ETH. GS and OrangeFren were warned in advance that their approach would not satisfy us. (OrangeFren, at my request, did not remove GS from its listing, although it was warned, and OrangeFren still has a label stating that GS never asks for KYC.)
I remind you that back in the summer, when we were working on the 12 ETH refund, GS repeatedly claimed that this was their only problem at the moment — that the block of ID 41gf6aamcb79iw8o was the only one. But I am sure there are other problem cases, and people simply do not know about a forum like BitcoinTalk, where the authority of the community can really help return funds.
Website structure of GS:
Domain registrar — NameSilo, LLC (the domain was extended for 2 years on September 11)
Hosting — Cloudflare
Privacy service — PrivacyGuardian.org
If there are other victims of GS, please write in this thread. A collective complaint about the site's structure will help influence the registrars faster. I am not currently working on this (and I hope I won't have to), but just in case.
It remains a mystery to me why GS asked @Benedesuuuk not to disclose the details of the successful resolution of our problem. I believe they acted nobly and correctly — they created this problem and solved it themselves. That deserves respect, and that is how every self-respecting service advertising "No-KYC" should act.
Well, I think I have explained everything as it is and revealed my cards. I hope GS does not close and start all over again — for example, make a site for $1,000, call it something like "ass swap," and continue exchanging, catching naive people who will then suffer.
If anyone has any questions, ask — I will answer what I can. And if needed, my client (whose 20.5 ETH is blocked) will write a new thread with a claim against GS. I publicly state that this 20.5 ETH case is the last one. I will no longer deal with problem exchangers that are not on BestChange.
