Any platform that uses high returns as a gimmick and requires recruiting others to profit should be approached with extreme caution.

Author: SlowMist Technology

Reprinted from: Plain Language Blockchain

Background

According to reports, on June 26, 2025, an online investment platform named XinKangJia DGCX suddenly closed all withdrawal channels, and many users found their account assets frozen or cleared, making it impossible to withdraw funds. This incident quickly gained traction on social media platforms, attracting widespread attention. Although no authoritative organization has released accurate data on the number of victims and financial losses, investors have circulated that the incident may involve a fund scale of up to 13 billion yuan, with the number of affected individuals possibly exceeding 2 million.

According to some publicly disclosed information, as early as 2019, XinKangJia sold oil filtration equipment worth 200,000 yuan to a certain enterprise, which was later packaged as "signing a five-year strategic cooperation agreement with PetroChina"; in March 2021, the project began operating under the name Guizhou XinKangJia Big Data Co., Ltd. Although the company claimed to have a registered capital of 30 million, the actual paid amount was zero, and it had long been listed as operating abnormally, fitting the characteristics of a "shell company."

In May 2023, the platform launched the DGCX XinKangJia Big Data Trading Platform, claiming to be the "official branch of the Dubai Gold and Commodity Exchange (DGCX) in China," and self-proclaimed to have reached cooperation with several state-owned enterprises such as PetroChina and COSCO Shipping. The platform reinforced its "regular army" image by publishing forged contracts, official letters, and screenshots of its official website.

In fact, the platform has no affiliation or business relationship with DGCX, and the entire qualification system is disguised under the guise of "international finance." The real DGCX has publicly issued statements multiple times denying any authorization or cooperation with it and warning users to guard against counterfeit platforms.

It is rumored that the founder Huang Xin left a message in the member WeChat group after fleeing overseas. Although the authenticity of this content cannot be independently verified, it has been widely circulated in the community, further exacerbating investors' anger.

MistTrack On-chain Analysis

To analyze the on-chain fund flow situation of the XinKangJia DGCX project, we used the anti-money laundering tracking analysis system MistTrack (https://misttrack.io/) under SlowMist to conduct in-depth tracing of the on-chain addresses related to this case. On-chain behavior indicates that the project may have constructed a complex multi-level funding structure, with funds flowing in from a centralized entry point and then being transferred multiple times before flowing out, initially exhibiting characteristics common to Ponzi schemes.

Currently, we have analyzed and identified approximately 800,000 user deposit addresses, involving a fund scale of up to 1.5 billion dollars. It is important to emphasize that the data in this section is based on technical analysis and mining of publicly available on-chain information and does not represent the complete funding paths and final facts of the project. The statistical results may have errors and are for reference only. Some inferences are based on current on-chain behavior and do not constitute legal fact recognition, requiring further data support and multi-party verification.

1. User Fund Inflow

Analysis shows that the source of funds almost entirely comes from the hot wallets of centralized trading platforms, and these funds are subsequently distributed to numerous addresses in whole amounts (such as 1000, 2000 USDT, etc.). Considering that the project requires users to join with USDT, users must first exchange RMB for USDT and then deposit it into a designated address. Therefore, it is speculated that this may be the project’s operation of collecting RMB from users and then uniformly withdrawing coins from the trading platform to distribute USDT. These whole amounts align with the project’s claimed "membership fee" model and may also indicate deposit behavior. The platform is suspected of adopting a management method that centralizes control of coins and distributes deposit addresses, meaning the platform provides users with addresses for participating in the project, and users do not directly hold the private keys.

2. Internal Fund Aggregation of the Platform

Multiple "user addresses" that received USDT then transfer the funds through 1-2 layers into aggregation addresses controlled by the platform. The aggregation addresses exhibit the following characteristics:

The number of income transactions is significantly higher than that of expenditure transactions;

• Funds are aggregated from multiple "user addresses";
• Subsequently, transfers are made to new "next hop" addresses.

The above behavior indicates that this batch of addresses may exist as "relay layers" or "aggregation nodes," serving the purpose of unifying the collection of user "deposit funds"/"membership fees."

3. Withdrawals and Fees

The aggregation address will disperse funds to one or more addresses, some of which are only active for 1-2 days. It is speculated that these addresses rotate after the funds are exhausted, possibly to reduce the risk of being blacklisted. This short-cycle, high-frequency operational model also indicates that the project maintains a certain "rotation rhythm" in its fund operations. Regardless of how complex the paths are, most funds ultimately return to some trading platform's user deposit addresses, presenting a one-to-many form, suspected to be users' profit withdrawals. More notably, in most transfers, the amount received by the target address is about 10% less than the initiated amount; for example, sending 800 USDT results in a receipt of 720 USDT, which may indicate some form of "withdrawal fee."

4. Permission Authorization Mechanism

Through further on-chain data analysis, we also observed that there are custom permission authorization behaviors among a large number of TRON addresses. Some addresses participating in fund aggregation authorize custom permissions to 3-5 addresses, with a threshold usually set at 3, allowing for Transfer TRC10 and Trigger Smart Contract (generally used for transferring TRC20 Tokens) operations.

These addresses participating in fund aggregation and the authorized addresses have repeatedly exhibited such authorization phenomena, as shown in the table below:

It can be indirectly inferred that the main address (aggregation address) and the authorized addresses belong to the same entity, and in the context of tightly interwoven funding paths, it is reasonable to suspect that the project operators, for the convenience of automated program operations, have adopted a batch authorization control mechanism, which is also more aligned with the platform's permission management approach.

Fraud Model

This project is suspected to be a "Ponzi core + pyramid scheme structure" fund, using virtual asset investment as a pretext, stablecoins as a payment method, and raising funds through a "recruiting" membership model. Specific methods include:

1. Multi-level Pyramid-style Recruitment Mechanism

To achieve the goal of "recruiting," XinKangJia established a military-style 9-level structure, with ranks from top to bottom being Commander, Army Commander, Division Commander, Brigade Commander, Regiment Commander, Battalion Commander, Company Commander, Platoon Leader, and Squad Leader, and set clear promotion standards and rebate ratios. For example, after participants pay to become members, they can be promoted to Squad Leader by recommending 3 people, with a reward of 10 USDT for each successful recommendation; to be promoted to Commander, one must develop a team of nearly 20,000 people and 50 direct subordinates, earning a recommendation reward of 150 USDT per person and a guaranteed monthly salary of 12,000 USDT. This mechanism presents a typical pyramid-type dissemination path, incentivizing participants to continuously develop subordinates and driving continuous fund inflow through promotion rewards.

2. False Transactions and Backend Manipulation

XinKangJia displays various false trading interfaces on its official website and app, including gold, crude oil, indices, etc., claiming to provide international market data and real-time profits and losses, guiding users to deposit USDT for high-leverage trading, while all account data is controlled by the platform's backend.

3. High Returns and Rebate Bait

The platform claims to utilize big data technology to conduct futures trading in gold, oil, and foreign exchange in the Middle East, promising investors returns of up to 2% daily. For example, a member investing 100,000 USD could earn 2,000 USD daily, totaling 60,000 USD monthly. "Recover capital in 3 days, double in 7 days," "100% profit commission," and "VIP internal arbitrage signals" are the main phrases used to attract users to continue investing. The platform also regularly fabricates screenshots of successful withdrawals and investment "profit rankings" to create an atmosphere of "real profit-making," forming a strong herd effect.

4. Layered Withdrawal Thresholds

According to investor feedback, on June 25, XinKangJia experienced withdrawal issues, and the next day confirmed that the system was paralyzed. The platform's response was that "the company was defined by regulatory authorities as tax evasion, and all account funds were frozen, making withdrawals impossible." Users wishing to withdraw must pay a tax of 10% of their holding amount, and withdrawals over 100,000 yuan must queue for more than 30 working days. After paying taxes, a daily return of 1% can be generated, and withdrawals can be made after accumulating 100 USDT, with a withdrawal fee of 50%. Before the collapse, the platform also threw out bait activities: "Invest 500,000 to get a Tesla," which actually induced users to leverage their investments to scam more money before the crash. XinKangJia suddenly closed withdrawal channels after raising funds, customer service went silent, and it was rumored that the platform transferred about 1.8 billion USDT to offshore shell company accounts in the Cayman Islands through Tornado Cash within just 48 hours before the collapse.

In fact, before the platform's collapse, multiple local public security agencies and financial regulatory bodies had issued risk warnings, including the Public Security Bureau of Pingshan County, the Public Security Bureau of Yangshan County, the Public Security Bureau of Taoyuan County, HeYuan Rural Commercial Bank, and the Financial Office of the Hunan Provincial Party Committee, all indicating that the platform was suspected of illegal fundraising and high-risk trading.

However, due to the platform's implementation of an invitation code system to control registration, it has widely penetrated through WeChat group fission, offline lectures, and other methods, combined with phrases like "national-level project" and "central enterprise cooperation," a large number of middle-aged and elderly people and users in sinking markets have become deeply involved, leading to continuous fund inflow even after regulatory warnings were issued in various places. Currently, it is rumored that some core technical personnel and leading agents of the platform have been controlled by public security agencies, which have sealed several asset accounts involved in the case, freezing funds of about 120 million yuan.

Summary

The XinKangJia DGCX incident is a typical digital financial fraud combining digital assets, Ponzi schemes, and pyramid selling mechanisms. The core of such funding schemes lies not in innovation but in the precise use of a hybrid model of on-chain payments + offline promotion, combined with false foreign identities and fake government endorsements to create a sense of cross-border legitimacy.

SlowMist reminds users:

High returns come with high risks. Legitimate financial products do not promise short-term high returns, nor do they use "doubling rebates" or "recovering capital in 3 days" to attract investments.

• Recruitment models are essentially pyramid schemes. Any platform that requires you to recommend others to make money is highly likely to be a funding scheme that relies on continuously absorbing new funds to maintain operations.
• Do not blindly trust packaging and promotion. Contracts, official website screenshots, CCTV interviews, luxury car displays, celebrity photos—these can all be forged. What is truly trustworthy is the fund security mechanism and independent third-party supervision, not superficial excitement.

The collapse of XinKangJia is a painful lesson learned by many investors with real money. It is not the first, nor will it be the last. In this era of information overload and increasingly complex fraud methods, it is essential to remain rational, improve financial literacy, and actively question "things that seem too good to be true." Any platform that uses high returns as a gimmick and requires recruiting others to profit should be approached with extreme caution.

Article link: https://www.hellobtc.com/kp/du/07/5957.html

Source: https://mp.weixin.qq.com/s/L3vInWtBNZD5IZn4Z5Loaw

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。