GhostSwap blocked 20.5 ETH — 4 txs, same source, only the 3rd blocked

[XLXer]

Hello everyone,

I am writing to share my case. I hope the community can help, as it helped with another case involving this service.

On May 24, 2026, I received approximately 88.9 ETH to my address 0xf4f342500991e00271393d754550a2bab2e3e658. These funds came through a bridge (using the bridge aggregator https://Jumper.xyz).

I distributed all these 88.9 ETH across my new different ETH addresses and made 4 exchanges in GS sequentially. Three of them went through successfully. Only the third one was blocked — this one. The blocked amount is 20.5 ETH. The exchange ID is r6gfns7qebjs43e4.

Here is the full timeline with all addresses and hashes.

Transaction 1 (successful):

    Hash: 0x21d44423e0279d4092268ed97bcce613e901a5d608973085816790f8cd78f0b2

    From: 0x0265ed6ba711cca77001a737f0a453bf2d46555f

    To: 0x5eca6a69c152f67f1c0c4fefe5296ee19a78486b (HitBTC address)

    Time: May 24, 2026, 06:49 PM

    Amount: 19.59 ETH

Transaction 2 (successful):

    Hash: 0x6ec209fb60b364ff46790efd58c2ea949c1270eed0626507d431bb7202e0c148

    From: 0x3fda36f0394a65fbae73e038403e2e6fed0120a5

    To: 0xa671acf3e7cc1816007b01006ceed4b79904206a (HitBTC address)

    Time: May 24, 2026, 06:53 PM

    Amount: 21.12 ETH

Transaction 3 (blocked — this case):

    Exchange ID: r6gfns7qebjs43e4

    From: 0xd1329d035ef97c3692132e1574d3e8dd19972c73

    To: 0xe2990bf86e866513e35bbb71cd33599ab5c4e0b2 (HitBTC address)

    Time: May 24, 2026, 07:10 PM

    Amount: 20.5 ETH

Transaction 4 (successful, after the block):

    Fourth transaction went through successfully.

All four transactions came from the same source. Three went through. Only the third was blocked. If the source was "dirty," all four should have been flagged. If it was clean, none should have been. This is not AML logic — this is a selective block.

I also want to note what has changed since my case became known. GhostSwap changed its tagline from "NO KYC" to "Privacy-Focused Crypto Swaps." But what is the "privacy focus" when all exchanges go through HitBTC? And OrangeFren, which lists them, has already updated its website to state that GhostSwap may request KYC. So even their own listing partner now admits the problem.

I have not yet passed KYC because we were trying to resolve everything peacefully. The explanation of this person (link: https://bitcointalk.org/index.php?topic=5587469.msg67146345#msg67146345) is 100% accurate. And now I don't know if there is any sense in passing KYC.

I am asking GhostSwap to return my 20.5 ETH.

If anyone has any advice, I am open. And if there are other victims, please write here.

ID: r6gfns7qebjs43e4

[Slow death]

You are talking about very large sums of money, which means you should thoroughly research the site before using it. For instance, I looked it up on Google and found numerous scam allegations against the site accusations dating back years that could have served as a major warning sign. If you were to use the site despite these claims, you really should only deposit a small amount of money. Someone accused the site of being a scam on February 7th of this year, and another person made the same accusation on December 25th. Then, on December 20th, yet another person accused the site of being a scam; on August 31st, a guy also posted an accusation against them and strongly advised people not to use the site anymore. He said he lost 0.003 BTC—roughly $200.



source: https://uk.trustpilot.com/review/ghostswap.io

If you had done some research and seen the negative reports, you wouldn't have used that site or at least you would have deposited small amounts at a time, thereby minimizing your losses in the event they stole from you. I’m sorry about your losses, though I highly doubt the people behind that site will resolve your issue; they appear to be big scammers who will likely face money laundering charges from some government sooner or later. I hope you don't use that site again and that, in the future, you research a site before using it and avoid depositing large sums of money; it is much better to deposit small amounts so that any potential loss is smaller.

[RGBTC]

On May 24, 2026,

So obviously in that period GS made HitBTC their main liquidity partner (I think to this day). In the previous case, no one here managed to help. It's just that, since the OP marked the case as resolved it suddenly raises the big question "what's the full story". GS has indeed been known for a lack of transparency regarding any claims made on its website ever since the initial announcement.

[mabji1]

If you had done even a little research on GhostSwap, you wouldn’t try them. They’re shady, and I don’t recommend them. Sorry for your loss.

HitBTC = GhostSwap

Copy/Paste this into Google: site:bitcointalk.org "service name" "blocked" OR "KYC"
Copy/Paste this into Google: site:reddit.com/r/CryptoCurrency "service name" "scam"

[XLXer]

Thank you all for your responses.

I understand the criticism. But I want to clarify a few things.

I and my acquaintances used GhostSwap before for smaller amounts, and everything worked fine. That is why I trusted them with a larger amount. I didn't know about the OrangeFren listing at the time. If I had known, I would have used their link, and I would have been refunded 100%.

The previous case was resolved, but my case is not a repeat — it happened at approximately the same time. I could have filed a complaint earlier, but I was asked to wait. I didn't have the patience, but I had to.

I have not yet passed KYC because we were trying to resolve everything peacefully. And now I don't know if there is any sense in passing KYC.

I understand that some of you think I should have done more research. You are right. But I am sharing this now so that others don't make the same mistake.

[FinneysTrueVision]

You have a nearly identical situation as Benedesuuuk, who also made a swap on GhostSwap the same day and had his funds blocked. I see that you are familiar with the case since you made a comment in that thread.

Just like Benedesuuk, you received funds from Tornado Cash and tried to obfuscate the origin by using pass through addresses and then doing some bridging back and forth between Ethereum and Solana using the same aggregator.

Unfortunately for you and the other guy who faced the exact same situation, GhostSwap uses third party liquidity providers and HitBTC decided to freeze their funds, leaving them unable to fulfill your swap.

[XLXer]

You have a nearly identical situation as Benedesuuuk, who also made a swap on GhostSwap the same day and had his funds blocked. I see that you are familiar with the case since you made a comment in that thread.

Just like Benedesuuk, you received funds from Tornado Cash and tried to obfuscate the origin by using pass through addresses and then doing some bridging back and forth between Ethereum and Solana using the same aggregator.

Unfortunately for you and the other guy who faced the exact same situation, GhostSwap uses third party liquidity providers and HitBTC decided to freeze their funds, leaving them unable to fulfill your swap.

Thank you for your analysis. But I want to point out one thing.

You say the funds came from Tornado Cash. I don't know if that's true — I didn't track it that way. What I do know is this: I sent four transactions from the same source. Three of them went through successfully. Only the third one was blocked.

If the source was truly the problem, all four should have been flagged. But only one was.

[examplens]

I am moving this discussion from the Orangefren thread so as not to derail it, and you certainly opened a topic dedicated to your case.

You are asking if a warning would have changed my decision. Honestly — probably yes. If I had seen a warning about unresolved cases and KYC issues, I would have thought twice. But at that time I didn't look into the details, because "NO KYC" was written in big letters, and I had already exchanged funds there before without any problems.

But you didn't use Orangefren, nor did you reach GS through them, right? With any warning from them ^OF, you wouldn't notice. (my comment where you say that the warning is not enough)
You certainly didn't do enough research, but you believed what was written on the website. For example, when you see that an exchanger uses a 3rd party liquidity provider, it cannot possibly be no-KYC, because it does not depend entirely on them.
So, for example, in your case, it is not GS who is asking for KYC from you, but rather Hitbtc.

Regarding the AML analysis — here is what I don't understand: four transactions from the same source. Three went through. Only the third was blocked. If my address is high risk, why were the other three processed without any issue? That is the question I have not received an answer to.

What I noticed in some earlier cases like yours. Sending several transactions from the same source to the same exchanger often triggers AML alarms. This is seen as suspicious behaviour.
Moreover, all your addresses had a similar risk level due to the connection with Semenov Roman


The reason your third transaction was blocked, while the fourth went through, may be found in the explanation he provided.
Ghostswap has several accounts on HitBTC that it uses. If funds are blocked on one of them, they move on to the next one. That's why tx 3 is blocked, while tx 4 is executed because they switched to a new account.

But GS was not in any reputable listings and directly exchanged client funds through HitBTC accounts (or their intermediaries). In theory, it could look like this: GS creates a HitBTC account under a straw man's name. For example, three different clients send 1 ETH, 1 BTC, and 1 LTC for exchange. If, say, the 1 LTC is "dirty," the entire HitBTC account is blocked, including the funds of the 1 ETH and 1 BTC clients. That is why "nested services" like GS are very dangerous for exchanges. Such services can have dozens or hundreds of accounts on exchanges, created under straw men, and many clients of such "nested services" can lose their funds, while such "shadow exchangers" are simply closed by their owners.

I am not asking for sympathy. I am asking for my 20.5 ETH to be returned.

You should get your money back. I hope that the new pressure on GS will force them to realise your transaction and maybe to think about changing the mechanism that includes HitBTC.

[XLXer]

I am moving this discussion from the Orangefren thread so as not to derail it, and you certainly opened a topic dedicated to your case.

You are asking if a warning would have changed my decision. Honestly — probably yes. If I had seen a warning about unresolved cases and KYC issues, I would have thought twice. But at that time I didn't look into the details, because "NO KYC" was written in big letters, and I had already exchanged funds there before without any problems.

But you didn't use Orangefren, nor did you reach GS through them, right? With any warning from them ^OF, you wouldn't notice. (my comment where you say that the warning is not enough)
You certainly didn't do enough research, but you believed what was written on the website. For example, when you see that an exchanger uses a 3rd party liquidity provider, it cannot possibly be no-KYC, because it does not depend entirely on them.
So, for example, in your case, it is not GS who is asking for KYC from you, but rather Hitbtc.

Regarding the AML analysis — here is what I don't understand: four transactions from the same source. Three went through. Only the third was blocked. If my address is high risk, why were the other three processed without any issue? That is the question I have not received an answer to.

What I noticed in some earlier cases like yours. Sending several transactions from the same source to the same exchanger often triggers AML alarms. This is seen as suspicious behaviour.
Moreover, all your addresses had a similar risk level due to the connection with Semenov Roman
https://talkimg.com/images/2026/09/16/Uq3j8C.png

The reason your third transaction was blocked, while the fourth went through, may be found in the explanation he provided.
Ghostswap has several accounts on HitBTC that it uses. If funds are blocked on one of them, they move on to the next one. That's why tx 3 is blocked, while tx 4 is executed because they switched to a new account.

But GS was not in any reputable listings and directly exchanged client funds through HitBTC accounts (or their intermediaries). In theory, it could look like this: GS creates a HitBTC account under a straw man's name. For example, three different clients send 1 ETH, 1 BTC, and 1 LTC for exchange. If, say, the 1 LTC is "dirty," the entire HitBTC account is blocked, including the funds of the 1 ETH and 1 BTC clients. That is why "nested services" like GS are very dangerous for exchanges. Such services can have dozens or hundreds of accounts on exchanges, created under straw men, and many clients of such "nested services" can lose their funds, while such "shadow exchangers" are simply closed by their owners.

I am not asking for sympathy. I am asking for my 20.5 ETH to be returned.

You should get your money back. I hope that the new pressure on GS will force them to realise your transaction and maybe to think about changing the mechanism that includes HitBTC.

Thank you for your analysis and for understanding my situation. I was also told that GS uses several HitBTC accounts created under straw men's names. I don't know who Semenov Roman is.

And I have never used Tornado Cash myself.

What would you advise — should I ask GS to pass KYC? Or is there something else I should do?

[MuffinMaster]

Thank you for your analysis and for understanding my situation. I was also told that GS uses several HitBTC accounts created under straw men's names. I don't know who Semenov Roman is.

And I have never used Tornado Cash myself.

What would you advise — should I ask GS to pass KYC? Or is there something else I should do?

The fact that the previous case was resolved positively gives you great hope that you will recover your money. Based on the explanations of how that case was settled, I assume the money was refunded from GhostSwap's own funds. In your case, the amount is much larger, so it might be more difficult. I feel that everything depends on how much they care about continuing their business.

The truth is, when you made the transfer, their platform clearly stated it was a No-KYC service. You were subject to those exact rules at that time, and regulations cannot be applied retroactively. Therefore, in my opinion, you should not have to go through the KYC verification process.

However, if you do not have a problem with it, you should just do it for peace of mind. This will take away all their arguments for withholding your money.

To help us give you the best advice, I am still missing information about your communication with GhostSwap. Could you please update the status regarding when you last spoke with them and what response you received?

[XLXer]

Thank you for your analysis and for understanding my situation. I was also told that GS uses several HitBTC accounts created under straw men's names. I don't know who Semenov Roman is.

And I have never used Tornado Cash myself.

What would you advise — should I ask GS to pass KYC? Or is there something else I should do?

The fact that the previous case was resolved positively gives you great hope that you will recover your money. Based on the explanations of how that case was settled, I assume the money was refunded from GhostSwap's own funds. In your case, the amount is much larger, so it might be more difficult. I feel that everything depends on how much they care about continuing their business.

The truth is, when you made the transfer, their platform clearly stated it was a No-KYC service. You were subject to those exact rules at that time, and regulations cannot be applied retroactively. Therefore, in my opinion, you should not have to go through the KYC verification process.

However, if you do not have a problem with it, you should just do it for peace of mind. This will take away all their arguments for withholding your money.

To help us give you the best advice, I am still missing information about your communication with GhostSwap. Could you please update the status regarding when you last spoke with them and what response you received?

Thank you for your advice. I agree — the rules cannot be applied retroactively. When I made the transfer, their platform clearly stated "NO KYC". That is what I trusted.

Here is the last email from GS (September 14): https://talkimg.com/images/2026/09/17/Uqf8MD.png

And here is my last reply to them (September 14): https://talkimg.com/images/2026/09/17/UqfKJf.png

I have also been writing to OrangeFren for several days now, but no one is responding to me.

[OrangeFren]

[...]

I have also been writing to OrangeFren for several days now, but no one is responding to me.

Because your email is broken

Code:

This is the mail system at host mail.w14.tutanota.de.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

                   The mail system

<[REDACTED BY ORANGEFREN]@tutamail.com>: host fd:ac:0:0:0:0:d:10[fd:ac::d:10] said: 554
    general failure (in reply to end of DATA command)

[XLXer]

[...]

I have also been writing to OrangeFren for several days now, but no one is responding to me.

Because your email is broken

Code:

This is the mail system at host mail.w14.tutanota.de.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

                   The mail system

<[REDACTED BY ORANGEFREN]@tutamail.com>: host fd:ac:0:0:0:0:d:10[fd:ac::d:10] said: 554
    general failure (in reply to end of DATA command)

Sorry, there must have been some technical issues yesterday. My email is working today, and I've already received several messages from other services. Please try replying again.