https://paragraph.com/@investigated undefined Thu, 02 Jul 2026 17:11:06 GMT https://validator.w3.org/feed/docs/rss2.html https://github.com/jpmonette/feed en All rights reserved https://paragraph.com/@investigated/legendz-casino tAhBa4uifNDsLCTUCp5Q Thu, 25 Jun 2026 12:55:10 GMT Key Findings Legendz.io and Legendz.com Are Owned by the Same People Behind a $400 Million Memecoin Pump and Dump Network Legendz.io and Legendz.com — a crypto casino and sweepstakes brand operating across 43 U.S. states and internationally — trace their ownership to a group of Swedish iGaming veterans whose documented business history connects directly to the CEO of Finixio and ClickOut Media, the London-based marketing conglomerate responsible for over $400 million in memecoin presale losses. The connection is not theoretical. It is documented in joint press releases, Swedish corporate filings, and archived business media spanning 2016 to 2018. Henrik Persson Ekdahl — co-founder of Legendz and former CEO of Catena Media, one of the world’s largest iGaming affiliate companies — was the investment partner of Adam Grunwerg, the CEO of Finixio, for two formative years. Ekdahl’s fund, Optimizer Invest, acquired a significant stake in Grunwerg’s company, Investoo Group, for $2 million in December 2016. The two men made coordinated acquisitions together, issued joint press releases, and appeared in Swedish business media as partners through 2017 and 2018. Grunwerg left Investoo in September 2018 and founded Finixio two months later. The memecoin empire was born immediately after. There is no shared corporate structure between Legendz and Finixio today — no overlapping directors, no shared shell companies, no joint infrastructure. The companies are structurally independent. But the founders are not strangers. They were investor and CEO partners who built a crypto-gambling affiliate business together, using the same Malta/Cyprus corporate playbook they each employ today. That shared history has never been disclosed to Legendz users or memecoin investors. Whether it translates into ongoing commercial coordination — shared affiliate networks, referral agreements, informal deal flow — cannot be confirmed from public records. What can be confirmed is that the people behind Legendz and the people behind $400 million in memecoin losses have a documented, business partnership that neither side acknowledges publicly. The Finixio/ClickOut Media Memecoin Empire: 25+ Projects, $400M+ Extracted, Zero Success Since 2021, Finixio and its successor ClickOut Media have launched 25+ memecoin and crypto presale projects, extracting over $400 million from retail investors. Pepe Unchained ($74M raised, -98% collapse), Dogeverse ($17M, -99.7%), Solaxy ($58M, -86.6%), Wall Street Pepe ($57.67M), and Crypto All-Stars ($21M) represent the confirmed portfolio. Every project follows an identical arc: manufactured viral hype across 100-300+ controlled media outlets, timed presale with off-chain fund collection, brief exchange listing with artificial “whale” purchases, then collapse. Not one has delivered a functional product or sustained token value. CrypTegridy Blockchain Security independently concluded the tokenomics and vesting schedules constitute a “slow rug pull protocol” — engineered to maximize extraction while technically avoiding the instant disappearance of crude scams. Blockchain Evidence Confirms Systematic Fund Extraction On-chain forensics trace a single Ethereum wallet — 0xeccf6E64c46c87d422558bdAB9bC4051D38f7569 — receiving funds across multiple projects, with documented inflows exceeding $46.9 million. Funds are swept in large, rapid transactions to Binance Hot Wallet 14. CrypTegridy Blockchain Security assessed this pattern as consistent with money laundering methodology. James Fennell’s personal wallet (jfennel.eth) directly funded the FightOut smart contract deployer, tying a named Finixio executive to project financial flows on-chain. The architecture spans 25+ shell companies across seven jurisdictions — the UK, Malta, Cyprus, BVI, Cayman Islands, Bulgaria, and Estonia. Industrial-Scale Deception and Legal Intimidation Finixio/ClickOut Media control an estimated 100 to 300+ publisher websites — including outlets posing as independent financial journalism — to manufacture the illusion of third-party validation. Leaked Ahrefs dashboards show 60+ domains managed from a single account labeled “Adam’s workplace.” An AI content factory produces synthetic articles under fabricated personas. When journalists investigated, Finixio responded with legal aggression — five claims against Timothy Genach, cease-and-desist demands to @CryptoRugMuncher, suppression of Rachel Wolcott’s and Richard MacManus’s reporting. A former employee stated: “95% of these projects are scam.” Thirteen regulatory actions across seven jurisdictions have failed to dismantle the core operation. Conclusion This investigation documents a direct line from a crypto casino brand to a $400 million memecoin extraction machine. The connection is personal — two founders who were business partners for two years — not corporate. But in an industry where trust is the only currency, the undisclosed relationship between the people behind Legendz and the people behind the most prolific memecoin pump-and-dump network in Europe is a material omission. The evidence that follows is extensive, sourced from corporate registries, blockchain explorers, leaked internal documents, and the perpetrators’ own press releases. ## 1. The Ownership Connection Legendz.io and Legendz.com are owned by the same people behind a $400 million memecoin pump and dump network. This chapter documents how that connection works — not through shared corporate filings or overlapping shell companies, but through a documented, two-year business partnership between the founder of Legendz and the CEO of Finixio, the network responsible for 25+ collapsed memecoin projects. 1.1 Who Owns Legendz? 1.1.1 The Corporate Structure Legendz operates through a multi-jurisdictional corporate structure typical of the iGaming industry: Entity Jurisdiction Function Chaincrest Ventures Ltd Costa Rica (3-102-936132 S.R.L.) Operates Legendz.io crypto casino Platinum Panther LTD Malta (C111924) Operates Legendz.com sweepstakes casino Silver Swan LTD Cyprus (HE 445300) Payment and affiliate processing The Legendz.com sweepstakes platform launched in November 2024 across 43 U.S. states . Legendz.io — the crypto casino variant accepting Bitcoin, Ethereum, USDT, Solana, and TRON — went live in May 2026 on the Swedish Cubeia Nano platform . The casino’s Terms of Service explicitly name Chaincrest Ventures as the operator 1. 1.1.2 The Founders Legendz was founded by three Swedish iGaming executives with decades of combined industry experience : Henrik Persson Ekdahl — Former interim CEO of Catena Media (one of the world’s largest iGaming affiliate companies), former CEO of Betsafe and Betsson Group, co-founder of Optimizer Invest — a Malta-based investment fund backing iGaming IPOs with over EUR 1 billion in completed mergers 6. Mikael Harstad — Co-founder of Optimizer Invest with Ekdahl in 2012, Chairman of Gentoo Media, board member of Gaming Innovation Group 6. George Westin — Founder of Hero Gaming (sold to Paf in 2021), co-founder of Casumo, one of Europe’s most recognizable online casino brands 6. These are not anonymous crypto promoters. They are established industry figures who have built and exited major gambling companies. Their careers are documented across Swedish corporate filings, iGaming industry press, and official press releases. 1.2 Who Runs the Memecoin Operation? 1.2.1 Finixio/ClickOut Media The memecoin pump-and-dump network operates through Finixio Ltd (UK company 11705811, founded November 2018) and its successor ClickOut Media, both controlled by the same leadership team : Adam Grunwerg (born February 1989) — CEO and co-founder, 25-50% owner via Companies House - Samuel Miranda (born June 1989) — Co-founder, equal 25-50% partner 8- Scott Ryder — Head of Business Development, also CEO of Lucky Block casino - Suresh Chandra Joshi — Owns Josh Consultancy Ltd (£12,810 capital, runs 2,000+ Google Ads for Finixio projects) - James Fennell — Linked to Block Labs, Best Wallet; personal wallet jfennel.eth traced to FightOut presale funding This team has presided over 25+ memecoin projects since 2021, extracting $400 million+ from retail investors. Every project collapsed 86-99.99% after launch. Not one delivered a functional product. 1.3 The Connection: Ekdahl Was Grunwerg’s Investor and CEO Partner The thread connecting Legendz to Finixio runs through a single documented relationship: from 2016 to 2018, Henrik Persson Ekdahl’s investment fund was the primary backer of Adam Grunwerg’s company, with Grunwerg serving as CEO. 1.3.1 The $2 Million Investment: December 2016 In December 2016, Optimizer Invest — the fund co-founded by Ekdahl, Harstad, and Andre Lavold — acquired a significant stake in Investoo Group for $2 million USD . Investoo Group was founded and led by Adam Grunwerg, who served as its CEO. Optimizer Invest described the deal as backing “a strong team in a niche with high growth potential” 13. 1.3.2 Two Years of Coordinated Operations: 2017–2018 For the next 18 months, Ekdahl and Grunwerg operated as visible business partners. The evidence trail is extensive: April 2017: Joint press release — Investoo acquires 100ForexBrokers.com. Attribution: “Adam Grunwerg, CEO of Investoo Group” and “Henrik Persson Ekdahl, partner of Optimizer Invest” . September 2017: Joint press release — Investoo acquires SocialTradingGuru.com. Grunwerg: “This is a strategically very important acquisition.” Ekdahl: “This creates a new platform in our portfolio” . October 2017: Joint press release — Investoo acquires RoboAdvisors.com for $1 million. Ekdahl describes Investoo as “the company we have invested in to be the leading comparison site” — explicitly naming Grunwerg’s company as the vehicle for Optimizer’s fintech strategy . November 2017: Swedish business publication Breakit.se features Grunwerg discussing an 80 million SEK expansion loan. The photo caption identifies Ekdahl as “partner at Optimizer Invest” — confirming the fund was the financial engine behind Grunwerg’s growth . 1.3.3 The Split: Grunwerg Leaves, Finixio Is Born The partnership ended in 2018. Grunwerg resigned from Investoo Group in September 2018 . Two months later, in November 2018, he co-founded Finixio with Samuel Miranda 8. The memecoin empire traced in this report began immediately after that departure. While Grunwerg built Finixio — which would go on to launch 25+ memecoin projects and extract $400 million from retail investors — Ekdahl continued in the iGaming investment space before launching Legendz in 2024. Both men used the same Malta/Cyprus multi-jurisdictional corporate playbook they had employed together at Investoo. 1.4 Corporate Separation Today 1.4.1 No Shared Structure Despite the founder relationship, searches across UK, Malta, Cyprus, and Costa Rica corporate registries confirm zero corporate overlap between Legendz and Finixio as of 2026 1. No Finixio-linked individual appears in any Legendz entity. Legendz does not appear in leaked Finixio SEO dashboards 11. The companies use different payment processors (Uniwire vs. Web3Payments), different platforms (Cubeia Nano vs. white-label), and different media networks . 1.4.2 The James Bason Link One individual connects the networks at single-degree separation: James Bason served as Head of R&D at Catena Media during Ekdahl’s CEO tenure, and later became CPO at Finixio . This is incidental overlap in a tight-knit Scandinavian iGaming executive circle — but it demonstrates that the world Ekdahl and Grunwerg inhabit is small, interconnected, and poorly disclosed to the public. 1.5 Assessment What the Evidence Shows Legendz ownership Chaincrest Ventures / Platinum Panther / Silver Swan — standard iGaming structure 1 2 Finixio ownership 25+ shell companies across 7 jurisdictions — obfuscation architecture 10 Founder relationship Ekdahl’s fund invested $2M in Grunwerg’s company; 2+ years as investor-CEO partners with joint press releases 13 17 Corporate overlap today Zero. No shared directors, shareholders, or infrastructure 1 Shared methodology Both use Malta/Cyprus/Costa Rica structures — the standard playbook they employed together 2 3 Public disclosure None. Ekdahl’s profiles omit the Investoo-Optimizer-Grunwerg-Finixio connection chain entirely The connection between Legendz and the $400 million memecoin network is not corporate — it does not run through shared companies or overlapping directors. It runs through shared people: Henrik Persson Ekdahl, the public face of Legendz, was Adam Grunwerg’s investor and CEO partner for two formative years at the exact moment both men were building their crypto-gambling affiliate businesses. They issued joint press releases. They made acquisitions together. They appeared in Swedish business media as partners. Then Grunwerg built the most prolific memecoin pump-and-dump operation in Europe, and Ekdahl built a casino brand targeting the exact same audience — without ever publicly acknowledging their shared history. ## 2. Finixio/ClickOut Media: The People Behind the Curtain Every corporate fraud has its architects. The Finixio network — a vertically integrated machine that has extracted an estimated $200–400 million from retail crypto investors across two dozen memecoin projects — did not emerge from the ether. It was built, over seven years, by a tight circle of individuals who moved from student housing in northern England to boardrooms in London, Malta, and the British Virgin Islands. This chapter names the principals, traces their corporate fingerprints, and maps the shell-company architecture they used to keep the operation opaque. 2.1 Adam Grunwerg — CEO and Co-Founder Adam Robert Grunwerg was born in February 1989 and grew up in Sheffield, South Yorkshire. He attended Birkdale School before reading BSc Economics at the University of Manchester between 2007 and 2010 . The Grunwerg name carries commercial weight in Sheffield: his family owns I.Grunwerg Limited, a seventy-year-old cutlery and kitchenware wholesaler founded by his grandfather Otto Grunwerg, a refugee from Vienna. Adam became a non-executive director of the family firm in September 2021 — a curious footnote for the CEO of a company whose turnover reached £59.9 million in 2023 . Grunwerg’s formal power over the Finixio empire rests on precise legal foundations. Companies House records for Finixio Ltd (UK 11705811) list him as holding 25–50% of shares, 25–50% of voting rights, and the right to appoint or remove directors . He shares this control structure equally with Samuel Miranda, meaning no major decision can be made without both men’s consent. Grunwerg also controls ARG Media Limited (Company 08242192), which holds 75% or more of its own shares and serves as the parent of ARG Ventures Ltd . Through ARG Media, he is the named shareholder — alongside Miranda’s SBM Holding Group — of ClickOut Media Ltd in Malta . The corporate paper trail reveals Grunwerg’s preference for dissolving entities once they attract scrutiny. He has held directorships in eight UK-registered companies, of which four — Psychic Ventures Ltd, Betting Ads Ltd, UK Betting Sites Ltd, and Dino Ventures Ltd — are now dissolved . Psychic Ventures is particularly significant: Grunwerg’s email finance@psyventures.com appears as the registered account in leaked Finixio SEO dashboards controlling domains including Techopedia, 99Bitcoins, CryptoNews.com, and CoinCasino 11. The entity may be legally dead, but its digital infrastructure lived on. Grunwerg first attracted mainstream investigative attention in December 2020, when the Organized Crime and Corruption Reporting Project (OCCRP) and Swedish newspaper Dagens Nyheter published a joint investigation into fake celebrity crypto endorsements. The report documented how Finixio’s funnels falsely claimed that celebrities including financial journalist Martin Lewis, television presenter Jeremy Clarkson, Manchester United footballer Marcus Rashford, and singer Adele endorsed Bitcoin investment schemes 9. Grunwerg admitted to running “bitcoin landing pages” but blamed “brokers that other advertisers work with” 9. The Guardian subsequently exposed Finixio for using Rashford’s name and charitable free-school-meals campaign without permission. Grunwerg dismissed the violation as a minor lockdown error generating “0.001% of company revenues” . The Australian Communications and Media Authority (ACMA) was less forgiving, issuing a formal warning in June 2022 after finding Finixio’s SafeBettingSites property “knowingly” facilitated prohibited gambling services to Australian residents . 2.2 Samuel Miranda — Co-Founder Samuel Broadbent Miranda, born in June 1989, is Grunwerg’s equal partner in every meaningful sense. He studied BA History at the University of Sheffield from 2008 to 2011 . The two men — both Birkdale School alumni, both born in 1989 — have shared a correspondence address at Tower 42, 25 Old Broad Street, London since at least 2022 24. Miranda’s Companies House record mirrors Grunwerg’s: 25–50% of Finixio shares, 25–50% of voting rights, director appointment power 24. He controls SBM Holding Group Ltd (Company 14155578) — the initials are his own — which holds 75% or more of shares and voting rights and serves as shareholder of ClickOut Media Ltd in Malta . Miranda has expanded his personal holding structure to include SBM Stocks Ltd and SBM Investment Properties Ltd, both incorporated in January 2023 31. Where Grunwerg’s operational signature is serial incorporation and dissolution, Miranda’s is the Estonian detour. He served as board member of Profitoro OÜ (Estonian company 16024451), a company with €2,500 share capital and €0 turnover that was deleted from the Estonian commercial register on 22 March 2024 for failure to submit annual reports . The timing is instructive: Haines Watts, Finixio’s auditor, had flagged the relationship between Finixio and Profitoro OÜ in its resignation letter, citing “unclear” arrangements and potentially “misrepresented transactions” . The Estonian entity vanished within weeks of that letter becoming public. Miranda’s parallel universe of “SBM” companies suggests a systematic effort to partition assets outside the audited Finixio entity — a structure that becomes significant when one considers that Finixio’s declared cash in the bank fell 72% in the year the auditor resigned 23. 2.3 The Extended Leadership Network Beyond the two founders, a small cadre of senior operators manages the network’s day-to-day machinery. Each occupies a distinct functional role; several maintain overlapping positions that create conflicts of interest visible from their own public profiles. Scott Ryder — Head of Business Development at Finixio, CEO of Lucky Block. Scott Daniel Ryder, born December 1987, serves simultaneously as Head of Business Development at Finixio and CEO of Lucky Block, a crypto lottery platform 21. Lucky Block’s own whitepaper explicitly names Finixio as its “marketing partner” — meaning Finixio marketed Lucky Block’s presale, which raised approximately $5.7 million, while its Head of Business Development ran the client company. An Athena Intelligence due diligence report noted that “the team has received criticism over the fact that it mostly has a background in sales and marketing, which may indicate that the team may be better at selling and marketing the product than developing a functional product” 21. Tajinder Dhanjal (“Tony”) — Director and CFO. Tony Tajinder Dhanjal, born July 1974, was appointed director of Finixio Ltd on 3 May 2024 . His country of residence is Cyprus — a jurisdiction the network uses for regulated entities including ForexTB, to which Finixio funnels traffic 36. Within weeks of his appointment, Dhanjal incorporated ClickPay Consultancy UK Ltd (Company 15798799), in which he holds 25–50% of shares alongside Lucas Alexander Davison, a Finixio employee who holds 50–75% . The entity appears to handle payment processing for the group. Dhanjal’s appointment coincided with significant changes to Grunwerg and Miranda’s Persons with Significant Control filings, suggesting a formal restructuring of financial governance as regulatory pressure mounted. Suresh Chandra Joshi — Head of Performance Marketing, Owner of Josh Consultancy Ltd. Suresh Chandra Joshi, born September 1976, directs the network’s advertising through Josh Consultancy Ltd (Company 14829738), a shell he incorporated in April 2023 with just £100 in share capital and only £12,810 in total reserves . Despite this capitalization, Google’s Ads Transparency Center shows Josh Consultancy running over 2,000 active campaigns promoting Solaxy, Best Wallet, ReadWrite, CryptoNews, ICOBench, 99Bitcoins, and hundreds of other Finixio-connected properties 11. A consultancy with £12,810 in capital cannot fund a multi-million-pound advertising operation; the entity exists to channel Finixio’s ad spend through a nominally independent vehicle. Joshi is also co-founder of Battle Infinity, a metaverse platform that launched a $5 million hard-cap presale in July 2022 and subsequently faded without delivering a working product . James Fennell — Blockchain Infrastructure Link. James Fennell’s name appears in connection with Block Labs and Best Wallet. Blockchain investigators traced a personal Ethereum wallet, jfennel.eth, to funding flows connected with FightOut, another Finixio-promoted presale 33. The wallet provides rare documentary evidence linking a named individual to on-chain financial flows in the network. Fennell is also linked to JEF Holdings and Best Wallet — a project flagged by the UK FCA, Spain’s CNMV, and Bulgaria’s FSC . Name Role in Finixio/ClickOut Key Entities Jurisdictions Year Joined Adam Grunwerg CEO & Co-Founder; PSC 25–50% Finixio Ltd, ARG Media, ARG Ventures, Psychic Ventures (diss.) UK, Malta 2018 Samuel Miranda Co-Founder; PSC 25–50% Finixio Ltd, SBM Holding Group, Profitoro OU (del.) UK, Malta, Estonia 2018 Scott Ryder Head of Business Development Finixio Ltd, Block Media (Cayman), Gadget Geek Online UK, Cayman Islands ~2019 Tajinder Dhanjal Director / CFO (from May 2024) Finixio Ltd, ClickPay Consultancy UK, Cyprus 2024 Suresh Joshi Head of Performance Marketing Josh Consultancy Ltd, Battle Infinity UK ~2019 James Fennell Linked to Block Labs / Best Wallet Block Labs (Bulgaria), Best Wallet, JEF Holdings UK, Bulgaria ~2022 Lucas Davison Head of People; Advisor Finixio Ltd, ClickPay Consultancy, Betting Ads Ltd (diss.) UK ~2021 The pattern in this table is unmistakable: fewer than ten people at the core hold multiple, overlapping positions across nominally independent entities. Scott Ryder runs business development for the marketing company while serving as CEO of its largest client. Suresh Joshi directs paid media for Finixio while owning the ad agency that places its campaigns and co-founding a presale project those campaigns promoted. Tajinder Dhanjal joins as CFO and immediately co-founds a payment processing company with a Finixio employee. These are not arms-length commercial relationships. They are the operational sinews of a single enterprise deliberately fragmented across corporate boundaries. 2.4 Corporate Network Map The Finixio network’s corporate architecture serves one overriding purpose: to make the operation appear smaller, more fragmented, and more legitimate than it is. At least 25 entities have been identified across seven jurisdictions, each handling a different risk exposure. The UK Layer: Respectability and Revenue. Finixio Ltd (Company 11705811) is the flagship, reporting £59.94 million turnover in 2023 and approximately 72 employees 23 34. Beneath it, Grunwerg controls ARG Media and ARG Ventures, while Miranda controls SBM Holding Group, SBM Stocks, and SBM Investment Properties 25 31. Josh Consultancy Ltd and ClickPay Consultancy UK Ltd handle advertising and payments respectively 38 37. The dissolved entities — Psychic Ventures, Betting Ads, UK Betting Sites, Dino Ventures — testify to a pattern of creating and killing companies as operational needs and regulatory threats shift 27. Malta: The Marketing Hub. ClickOut Media Ltd (Registration C 103525) functions as the network’s operational headquarters for marketing 26. Its shareholders are ARG Media Ltd and SBM Holding Group — the respective holding vehicles of Grunwerg and Miranda — confirming direct founder control. Maltese director Alan Attard appears in the ICIJ Offshore Leaks database and holds positions in numerous Malta companies, providing the local legal presence required by Maltese corporate law 26. Three additional Malta holding companies — Heide Holding Ltd, Cerp Holding Ltd, and Gaet Investment Holding Ltd — form a secondary layer connecting Grunwerg and Attard to a broader Maltese corporate ecosystem 26. British Virgin Islands: The Payment Black Box. KG Token Holdings Ltd (BVI registration 2150785) trades as Web3Payments and operates payment infrastructure across Finixio-backed crypto presales 33. The BVI offers no public beneficial ownership register, making it impossible to determine who controls the payment rails through which investor funds flow. Cayman Islands: The Token Wrapper. Block Media Limited, registered in Grand Cayman, is the legal entity behind Lucky Block 21. Scott Ryder is its sole listed director. The Cayman Islands imposes no corporate tax and maintains no public registry of beneficial owners — ideal for housing the legal shell of a crypto project while operational teams sit in London and Sofia. Bulgaria: The Development Back Office. Block Labs is registered at 9 Tsarigradsko Shose, Sofia — an address shared by Tamadoge and Best Wallet 33. Best Wallet’s Bulgarian company was incorporated with 1 EUR capital and describes its activity as “mobile game development,” bearing no relation to its actual function as a crypto wallet serving as default storage for Finixio-promoted tokens 33. Estonia: The Deleted Trail. Profitoro OÜ, Miranda’s company, was deleted from the Estonian register in March 2024 for non-filing after the auditor flagged its relationship with Finixio 32 33. Cyprus: The Financial Services Gateway. Dhanjal’s residence positions him at the centre of the network’s regulated financial services activities, leveraging Cyprus’s EU financial services passport while maintaining distance from UK scrutiny 36. Entity Jurisdiction Registration Status Controller / Director Function Finixio Ltd UK 11705811 Active Grunwerg, Miranda, Dhanjal Parent company; £59.9M turnover ARG Media Ltd UK 08242192 Active Grunwerg (PSC 75%+) Grunwerg holding vehicle ARG Ventures Ltd UK 14473273 Active Grunwerg, Allan Venture investments SBM Holding Group Ltd UK 14155578 Active Miranda (PSC 75%+), Mills Miranda holding vehicle SBM Stocks Ltd UK 14607166 Active Miranda Investment vehicle SBM Investment Properties Ltd UK 14607464 Active Miranda Property holdings Josh Consultancy Ltd UK 14829738 Active Suresh Joshi (Dir/Sec) Ad agency shell; 2,000+ campaigns ClickPay Consultancy UK Ltd UK 15798799 Active Dhanjal, Davison Payment processing Chander Joshi Consulting Ltd UK 15808074 Active H.C.J. Joshi Related consultancy Psychic Ventures Ltd UK 11391292 Dissolved Grunwerg, Miranda, O’Reilly Predecessor entity; SEO infrastructure Betting Ads Ltd UK 14274459 Dissolved Grunwerg, Miranda, Davison Gambling marketing UK Betting Sites Ltd UK 15258808 Dissolved Grunwerg Gambling portal Dino Ventures Ltd UK 12257956 Dissolved Grunwerg Early venture entity I.Grunwerg Ltd UK 00541251 Active Grunwerg family Family cutlery business Block Media Ltd (UK) UK 13488499 Active Jewitt, Parish Related UK entity ClickOut Media Ltd Malta C 103525 Active Attard (dir); ARG Media + SBM Holding (shareholders) Marketing HQ Heide Holding Ltd Malta C 103862 Active Attard, Grunwerg Malta holding structure Cerp Holding Ltd Malta — Active Grunwerg-linked Malta holding structure Gaet Investment Holding Ltd Malta — Active Grunwerg Malta investment vehicle KG Token Holdings Ltd BVI 2150785 Active Undisclosed Web3Payments operator Block Media Limited Cayman Islands — Active Scott Ryder (sole director) Lucky Block legal entity Profitoro OÜ Estonia 16024451 Deleted (Mar 2024) Samuel Miranda (former board) Shell; flagged by auditor Block Labs / Block Media Labs Bulgaria Sofia address Active Fennell-linked Development back office Tamadoge operator Bulgaria Sofia address Active Undisclosed Token project; shared address Best Wallet operator Bulgaria Sofia address Active Fennell-linked Wallet project; FCA-flagged ClickPay / ForexTB nexus Cyprus — Active Dhanjal (resident) Financial services gateway The architecture in this table is not accidental. It is a deliberate engineering of regulatory distance. The UK entity presents a respectable face with real turnover. Malta provides an EU-regulated marketing hub. The BVI and Cayman Islands host payment and token infrastructure behind opaque veils. Bulgaria supplies low-cost development under misleading SIC codes. Estonia offered easy incorporation until the auditor’s questions made deletion expedient. Cyprus positions a director in an EU financial centre with passporting rights. When one jurisdiction acts — the FCA issues a warning, an Australian regulator writes a formal letter — operations shift weight to another node. The January 2023 resignation of auditor Haines Watts, citing “breakdown in trust and confidence,” “mischaracterized transactions,” and “unethical business practices” including “clickbait and potentially libelous celebrity endorsements,” should have triggered regulatory intervention 33. It did not. Finixio continued operating without a replacement auditor and, within eighteen months, launched its most aggressive memecoin promotion phase yet. That silence — the gap between a professional auditor screaming warnings and any meaningful regulatory response — is the regulatory void in which this network has thrived. ## 3. The Memecoin Portfolio: 25+ Projects, $400M+ Raised, Zero Success The question that drives this chapter is deceptively simple: what did Finixio and ClickOut Media actually build? The preceding chapter mapped the people — Adam Grunwerg, Samuel Miranda, Scott Ryder, and the network of developers, marketers, and shell company directors who made the operation possible. This chapter examines the product. Across twenty-five separate cryptocurrency presale projects launched between 2022 and mid-2026, the Finixio network has extracted more than $400 million from retail investors. Not one project has delivered on its promises. Not one has maintained its launch price. The collective collapse ranges from 86% to 99.99%, with the majority of tokens now trading at or near zero volume, many with daily turnover measured in single-digit dollars. What follows is the first complete inventory of this portfolio, assembled from blockchain data, presale records, price trackers, and corporate documentation. 3.1 The Confirmed Projects (Chronological) 3.1.1 Early Projects (2021–2023): Establishing the Playbook The earliest projects in the Finixio portfolio date to 2022, when the basic mechanics of the operation were still being refined. Tamadoge ($TAMA), a play-to-earn gaming platform built around virtual pet NFTs, reached an all-time high of $0.1944 before collapsing to roughly 0.000024-adeclineof99.99LHINU), a subsequent Finixio project that raised $10.2 million in its March-to-May 2023 presale before crashing to near zero. The reuse of personnel across ostensibly independent projects was already a tell. Battle Infinity ($IBAT), co-founded by Suresh Joshi — the same individual behind Josh Consultancy, a Finixio-linked advertising entity — raised 8,250 BNB (approximately $2.5 million at the time) in just 22 days during its 2022 presale. The project promised a play-to-earn fantasy sports platform targeting the Indian market. Today it trades at 0.000019,effectivelyworthless.FightOut(FGHT), launched in late 2022 with a “move-to-earn” fitness concept, raised an estimated $3–5 million before collapsing to a current price of 0.000000047,withzeroreported24-hourtradingvolumeandacirculatingsupplylistedaszeroonmajortrackers.^(48^(^(49^W ) ) ) allStreetMemes(WSM), which ran its presale from May to September 2023, represented a pivot in scale. The project raised approximately $25–30 million and was promoted as “the highest ICO raise in history” in press releases distributed through PR Newswire. It is now trading 99.6% below its all-time high, with a 24-hour volume of $120.79 — less than the cost of a mid-range restaurant dinner. The project was promoted heavily by Sam Cooling, a former ClickOut Media journalist who had by then become the editorial face of CryptoNews, another Finixio-controlled outlet. These early projects established a template that would be replicated with mechanical precision: an anonymous or loosely identified team, a superficially plausible use case (play-to-earn, move-to-earn, vote-to-earn), a presale promoted through Finixio’s own media properties, and a collapse so complete that even blockchain explorers struggle to display the price charts at meaningful scale. 3.1.2 The 2024 Wave: Industrialization If 2022 and 2023 were the apprenticeship years, 2024 was when the operation scaled into an industrial process. Finixio quietly acquired 99Bitcoins in March 2024 — a well-regarded educational platform that immediately became the primary promotional engine for every subsequent presale.20The acquisition was never publicly announced; no buyer was named, the registered address led to a Florida warehouse, and the supposed owner, “Daniel K. Morgan,” has no verifiable online presence or photographs.20Smog ($SMOG), a dragon-themed Solana memecoin launched in February 2024 to coincide with Chinese New Year, surged 4,703% from its launch price to hit an all-time high of $0.3772 and a peak market capitalization exceeding $50 million. The press release announcing these gains listed Gary McFarlane at clickoutmedia.com as the media contact — a direct, documented Finixio connection that investigators would later cite as smoking-gun evidence.53SMOG is now trading 100% below its all-time high, with a 24-hour volume of $14.64 and a fully diluted valuation of 49,670.^(54^S ) lothana(SLOTH) followed in March and April 2024, raising $15 million using the "send SOL, receive airdrop" fundraising format that had become popular on Solana.^55^The project was promoted through multiple 99Bitcoins videos. Sealana ($SEAL), explicitly modeled on Slothana’s “success,” raised 5millionbetweenAprilandJune2024usingtheidenticalpresaleformat-nohardcap,noenddate,justacontinuoussolicitationofinvestorfunds.^(56^(^(57^D ) ) ) ogeverse(DOGEVERSE), launched in June 2024, marked a new scale of extraction. Marketed as “the first multi-chain Doge token” launching across Ethereum, Solana, BNB Chain, Polygon, Avalanche, and Base, the project raised $17 million in its presale and reached an all-time high of $0.0004155 before collapsing 99.7% to $0.00000131.41 Its market capitalization stands at $261,837, and its 24-hour trading volume is 2.70-afiguresolowitsuggeststhetokeniseffectivelydead.^(58^P ) epeUnchained(PEPU) represented the apex of the 2024 wave. The project raised $74 million in presale funds — the largest single raise in the Finixio portfolio — by promising a Layer 2 blockchain specifically for memecoin trading. It launched on Uniswap in December 2024, surged 200% on day one, then lost over 98% of its value.60The original Layer 2 chain, built on infrastructure from provider Conduit, suffered technical failures so severe that the project was forced to execute a full migration to Arbitrum in mid-2025, during which the token supply doubled from 8 billion to 16 billion — diluting existing holders by 50% overnight.60As of early 2026, PEPU trades at $0.00017–$0.00023, down 98% from its all-time high of $0.0112, with daily volume under 100,000.^(60^S ) ponge(SPONGE) completed the 2024 cohort. Its V1 token had hit a $100 million market cap in 2023. The V2 relaunch in February 2024 required holders to stake their V1 tokens to receive V2 allocations — effectively trapping investor capital in a one-way mechanism. SPONGE now trades 99.86% below its all-time high of $0.004219, with a fully diluted valuation of $873,717. #### 3.1.3 The 2025 Escalation: Larger Raises, Deeper Losses The projects launched in 2025 demonstrated that the Finixio operation had not been deterred by the catastrophic failures of its predecessors. If anything, the raises grew larger. Wall Street Pepe ($WEPE), which ran its presale from December 2024 through February 2025, raised $57.67 million — the second-largest raise in the portfolio after Pepe Unchained. Marketed with the promise of providing “financial insights and insider information normally only seen by big whales,” the token’s TGE concluded on February 18, 2025. It reached an all-time high of $0.00032 before crashing to $0.0000046, wiping out the overwhelming majority of presale investor value.65Its market capitalization now sits at approximately 889,000.^(65^M ) emeIndex(MEMEX) took a different approach, marketing itself as “the world’s first decentralized memecoin index.” The project raised $4.5 million in its December 2024 to March 2025 presale but allocated only 3.7% of tokens to liquidity — an allocation so thin that the token dropped over 90% immediately after its April 2, 2025 launch. 20Presale buyers reportedly paid more than the coin’s listing price, meaning they were underwater from the first trade.20MEMEX is now down 94.7% from its peak of $0.005268, trading at 0.00005377.^(66^C ) ryptoAll-Stars(STARS), which promoted a “MemeVault” unified staking protocol, raised $21 million between August and December 2024. The project followed the same trajectory: presale hype, exchange listing, brief pump, sustained collapse. Solaxy ($SOLX) closed its presale on June 23, 2025, having raised $58 million — making it the third-largest raise in the portfolio. Promoted as “the first Solana Layer 2 token,” Solaxy reached an all-time high of BTC0.071320 before falling 86.6%. Blockchain investigators linked Finixio developers James Fennell and Peter Kirkman directly to the project.69Even this comparatively “modest” 86.6% decline makes Solaxy one of the best performers in the Finixio portfolio — a statistic that says everything about the operation’s track record. 3.1.4 Active and Pending Projects As of mid-2026, at least five additional Finixio-linked projects remain in active presale, continuing to solicit investor funds despite the documented collapse of every predecessor. Bitcoin Hyper ($HYPER) has raised 29-32millioninanongoingpresalethathasrunthrough2025andinto2026.^(7^(^(72^T ) ) ) heprojectdisplaysallthestandardFinixiomarkers:Web3Toolkitinfrastructure,BestWalletintegration,andpromotionthrough99BitcoinsandCryptoNews.MaxiDoge(MAXI) has raised 2.5-4millioninitsongoingpresaleandreceiveda95/100FinixionetworkconnectionscorefromScamHoundinvestigators.^(73^(^(74^B ) ) ) TCBull(BTCBULL) has raised 7.87million,^(75^D ) awgzAI(DAGZ) has raised 2.38million,^(76^a ) ndSUBBD(SUBBD) — targeting an $11 million raise — has pulled in $1.5 million since launching its presale in April 2025. These active projects are not exceptions to the pattern. They are continuations of it, operating with the same infrastructure, the same media promotion, and the same structural incentives that produced twenty prior collapses. 3.2 Complete Project Inventory The following table presents the full inventory of identified Finixio-linked memecoin projects, including presale amounts, decline from all-time highs, and current operational status. Amounts are drawn from presale disclosures, blockchain records, and price tracker data. Where presale amounts are unknown, the project is marked accordingly — though even these projects generated sufficient market capitalization at peak to suggest meaningful investor losses. # Project Ticker Presale Raised Decline from ATH Confirmation Status 1 Tamadoge TAMA Unknown -99.99% High Collapsed 2 Battle Infinity IBAT $2.5M+ 47 -99.9%+ High Collapsed 3 FightOut FGHT $3–5M -99.9%+ High Collapsed 4 Wall Street Memes WSM $25–30M 51 -99.6% 52 High Collapsed 5 Love Hate INU LHINU $10.2M 45 -99%+ High Collapsed 6 Smog SMOG Unknown -100% High Collapsed 7 Slothana SLOTH $15M -99%+ High Collapsed 8 Sealana SEAL $5M+ -98%+ High Collapsed 9 Dogeverse DOGEVERSE $17M 41 -99.7% 58 High Collapsed 10 Sponge V2 SPONGE Unknown -99.86% 62 High Collapsed 11 Base Dawgz DAWGZ $3.2M -98%+ High Collapsed 12 Scotty the AI SCOTTY $9M -97%+ High Collapsed 13 Flockerz FLOCK $9–10.7M -97% High Collapsed 14 Crypto All-Stars STARS $21M 68 -95%+ High Collapsed 15 Pepe Unchained PEPU $74M 60 -98% 60 High Collapsed 16 Meme Index MEMEX $4.5M 66 -94.7% 66 High Collapsed 17 Wall Street Pepe WEPE $57.67M 64 -98%+ 65 High Collapsed 18 Solaxy SOLX $58M 70 -86.6% 71 High Collapsed 19 MIND of Pepe MIND $10M+ -95%+ High Collapsed 20 Bitcoin Hyper HYPER $29M+ 7 N/A (presale) High Active presale 21 Maxi Doge MAXI $2.5–4M N/A (presale) High Active presale 22 BTC Bull BTCBULL $7.87M N/A (presale) High Active presale 23 Dawgz AI DAGZ $2.38M+ N/A (presale) High Active presale 24 SUBBD SUBBD $1.5M+ 77 N/A (presale) High Active presale — 99Bitcoins Token 99BTC $800K+ -95%+ High Collapsed The arithmetic is brutal. The eighteen projects with confirmed presale figures alone account for over $368 million in investor funds.41 59 55 63 50 66 44 46 67 69 51 47 68 45 70 7 71 75 73 76 49 64 77 62 60 65 81When projects with unknown presale amounts (Tamadoge, Smog, Sponge) and the ongoing raises are included, the true total likely approaches or exceeds $400 million. The decline-from-ATH column reads like a typographical error — negative ninety-nine point nine nine percent, negative one hundred percent — but these are verified figures from CoinGecko and CoinMarketCap, recorded in real time on public blockchains. Several patterns become visible only when the full inventory is laid out in tabular form. First, the scale of extraction accelerated dramatically over time. Early projects raised single-digit millions; by 2024 and 2025, individual projects were pulling in $50–75 million. Second, the Finixio network did not hide its involvement as carefully as it might have — Gary McFarlane’s clickoutmedia.com email on Smog press releases, Sam Cooling’s byline across multiple projects, the same wallet addresses appearing in presale contracts. Third, the concept vocabulary evolves with market trends: “play-to-earn” in 2022, “vote-to-earn” in 2023, “multi-chain” and “Layer 2” in 2024, “AI agent” in 2025. The packaging changes; the mechanism does not. 3.3 The “Slow Rug Pull” Protocol Traditional cryptocurrency rug pulls are crude affairs: a token launches, attracts buyers, and the developers drain the liquidity pool in a single transaction, leaving holders with worthless tokens. Finixio’s innovation — documented across all twenty-five projects — is a more sophisticated approach that investigators have termed the “slow rug pull.” It adds just enough legitimacy infrastructure to pass casual due diligence while ensuring that insiders can extract value over weeks and months rather than in a single explosive event. The protocol operates in seven phases. Phase Objective Mechanism Duration 1 — Token Creation Establish legitimacy surface Anonymous team, superficial audit (SolidProof/Coinsult), functional website, whitepaper 2–4 weeks 2 — Hype Generation Create false consensus 100–300+ controlled media outlets publish simultaneously; influencer KOLs amplify; SEO manipulation targets beginner crypto keywords 2–4 weeks 3 — Presale Fund Collection Extract capital from retail investors Off-chain fund collection (not on public blockchain); presale remains open as long as money flows; high staking APYs advertised as “passive income” 4–16 weeks 4 — Staged Launch Manufacture false momentum Artificial “whale” purchases from recycled wallets; brief 2–5x price pump; KOLs celebrate “early gains” 1–2 weeks 5 — Staking Lock Prevent investor exit High APY staking functions as “roach motel” — tokens enter but cannot exit without penalty or lengthy lock periods; sells pressure suppressed 4–12 weeks 6 — Insider Distribution Gradual extraction Team wallets sell into any remaining liquidity; staged unlocks release tokens to insiders at predetermined intervals; retail investors remain locked 8–24 weeks 7 — Abandonment Reset and repeat Project “team” becomes unresponsive; social media goes quiet; developers move to next “iteration” (internal terminology); repeat from Phase 1 Ongoing Phase one establishes the surface legitimacy. Each project receives a token audit from a second-tier auditor such as SolidProof, Coinsult, or Pashov — auditors whose business model depends on volume rather than reputation. Pepe Unchained, for example, had a Pashov audit, a renounced contract, and locked liquidity, yet still collapsed 98%.60The websites are professionally designed. The whitepapers contain technical-sounding language about Layer 2 solutions, multi-chain bridges, or AI integration. To a first-time crypto investor conducting basic due diligence — checking that a project has an audit, a website, and media coverage — these signals read as credibility markers. Phase two is where Finixio’s vertically integrated media network becomes critical. Following the 99Bitcoins acquisition, every project received simultaneous coverage across what appeared to be dozens of independent outlets: 99Bitcoins, CryptoNews, Techopedia, Coincierge, Business2Community, Bitcoinist, ICOBench, and ReadWrite, among others.20Leaked SEO dashboards revealed that Finixio controlled rankings and placement across this network, ensuring that searches for “best crypto presale” or “new meme coin” returned Finixio projects at the top of results.11A Reddit whistleblower who worked at Finixio for three years confirmed that “each memecoin was pushed for just one to two weeks before the team moved on, referring to them as ‘iterations’ directed by Finixio insiders.”20Phase three — the presale — is where the capital extraction occurs. Unlike legitimate token launches that occur on public decentralized exchanges where every transaction is visible on-chain, Finixio presales collect funds through proprietary interfaces built on Web3Toolkit, Finixio’s in-house development infrastructure.20This off-chain collection means that the full amount raised is not independently verifiable on public blockchains — the $74 million figure for Pepe Unchained, for instance, comes from the project’s own disclosures and third-party trackers like ICO Drops, not from immutable on-chain records. The presales remain open indefinitely, with no hard caps or firm end dates, and are promoted with high staking APYs — sometimes in the triple digits — that function as a “roach motel”: tokens check in but cannot check out without severe penalties or lengthy lock periods. Phase four introduces the theatrical element. At launch, blockchain analysis reveals a consistent pattern of “whale” purchases from wallets that are, in fact, controlled by the same entity running the project. Blockchain investigator Darren Jackson traced these purchases to wallet 0xeccf6e64c46c87d422558bdAB9bC4051D38f7569, identified as the central fund collection point for Finixio-backed tokens.11This wallet receives presale proceeds, sends ETH to subsidiary wallets, which then make large purchases at launch to create the appearance of organic demand. In some cases, wallets sent substantial sums into presale contracts without ever claiming tokens — a pattern Jackson described as “suggesting that presale processes are used not for investment but for masking the movement of funds.”11The resulting 2–5x price pump generates celebratory headlines across the Finixio media network, attracting a second wave of retail buyers who believe they are entering an already-successful project. Phase five locks retail investors in place while insiders prepare their exit. The staking mechanisms advertised during presale — “earn passive income while you hold!” — typically include lock-up periods ranging from 30 to 180 days, during which staked tokens cannot be withdrawn. Unstaked tokens face high sell taxes or vesting schedules that make immediate exit uneconomical. Meanwhile, phase six sees insider wallets distributing their holdings through a series of smaller sales that avoid triggering the dramatic price crashes associated with traditional rug pulls. The slow decline — 5% one day, 10% the next, 15% the week after — normalizes the losses. Investors who bought at the peak tell themselves they are “holding for the long term” while their positions bleed out. Phase seven completes the cycle. The project’s social media accounts go dormant. The “team” stops responding to community questions. The developers, who were never publicly identified to begin with, simply move to the next “iteration” — the internal term Finixio employees used for these projects, according to the Reddit whistleblower.20The infrastructure remains: the same Web3Toolkit codebase, the same media network, the same Best Wallet integration, the same payment processing through Web3Payments. Only the token name, the mascot, and the superficial concept change. The genius of this protocol — if it can be called that — is its resilience to conventional red-flag analysis. A retail investor checking for the standard warning signs of a scam would find: a real audit (Phase 1), positive media coverage from what appear to be independent outlets (Phase 2), a functional website and working product (Phase 1), and liquidity that is initially locked (Phase 4). By the time the staking locks expire and the gradual dump becomes visible (Phases 5–6), the investor has already committed capital. The protocol does not eliminate risk for retail investors; it merely delays the realization of that risk until the insiders have exited. The cumulative result is documented in the table above: $368 million raised, twenty-five projects launched, zero successful outcomes, and collective declines that range from catastrophic to total. The slow rug pull is not a bug in the Finixio model. It is the model. ## 4. Blockchain Evidence: Following the Money Cryptocurrency’s promise of transparency has always been a double-edged sword. Every transaction is recorded permanently on a public ledger, accessible to anyone with the right tools. For Finixio and its network of affiliated projects, that ledger is not an ally—it is an accuser. Blockchain analysis conducted by Darren Jackson of CrypTegridy Blockchain Security has traced tens of millions of dollars in investor funds from memecoin presales through a web of interconnected wallets, all converging on a single destination: a Binance hot wallet where transaction histories are systematically obliterated.12The investigation mapped by journalist Timothy M. (published on fraud-research.com, formerly recleudo.com) reveals a financial infrastructure that operated with industrial precision. Funds entered the system through public presale contracts, circulated through project-linked wallets and intermediaries, and were ultimately swept into centralized exchange accounts. The entire cycle, Jackson concluded, bears the hallmarks of a coordinated money laundering operation—one that used memecoin projects not as legitimate enterprises but as vessels for fund extraction and obfuscation.11### 4.1 The Central Wallet 4.1.1 Address 0xeccf…7569: The Finixio Nexus At the center of the blockchain evidence sits a single Ethereum address: 0xeccf6E64c46c87d422558bdAB9bC4051D38f7569. Jackson identified this wallet as “almost certainly controlled by the Finixio team” and referred to it throughout his analysis as “the Finixio team-controlled address.”12The identification was not speculative. It was based on a pattern of receipts: this address received the primary flow of presale funds from multiple Finixio-backed projects, including Tamadoge, Love Hate INU, and FightOut, among others. No legitimate third-party service provider or independent contractor would plausibly serve as the collection point for such a diverse array of ostensibly separate projects. The wallet’s activity profile is telling. Rather than holding funds as a treasury or deploying them for project development, it functioned as a transit hub. Large sums arrived in bursts corresponding to presale milestones, then departed within days or weeks—almost always to the same destination. This behavior is inconsistent with operational wallets used for genuine project expenses and entirely consistent with a fund extraction mechanism.12#### 4.1.2 One Wallet, Many Projects The same Finixio-controlled address funded contract deployers across multiple projects. The Love Hate INU contract deployer (0x4b9c6933e17A12cf79759c5ec74963B1AB3c71D2) received its initial funding directly from 0xeccf…7569, establishing that what appeared to be an independent memecoin was in fact launched using infrastructure controlled by the same entity that managed Tamadoge’s finances.12The Tamadoge contract deployer (0x56D9e4a0663ea4Fa310887c1ee02a56824C4533b) was itself connected to the Lucky Block deployer (0xD392DdB57211CeD5a5074Ec6311D0af10ff0017B), which received funds from it—linking three ostensibly separate projects through shared wallet infrastructure.12This pattern demolishes any pretense that these projects were independent entrepreneurial ventures. Shared wallet infrastructure across supposedly competing tokens is not standard practice in the crypto industry; it is a red flag indicating centralized control over what was marketed as decentralized, community-driven projects. 4.1.3 The Binance Sweep From the central Finixio wallet, funds followed a predictable onward path. The next stop was a Binance deposit address: 0x48491f438fCb7B98B97c036627baC7B6AF62d5Ca. Jackson’s analysis documented multiple large withdrawals from the Finixio-controlled wallet to this deposit address, including approximately $10 million in December 2022, $4.6 million in November 2022, and $1.3 million on January 13, 2023.12Once funds hit a Binance deposit address, they were subject to what the industry calls “sweeping”—the automatic aggregation of all deposit addresses into a centralized hot wallet controlled by the exchange. As Jackson explained, “This is a process called ‘sweeping,’ in which an exchange like Binance regularly ‘sweeps’ all deposit addresses into one address… Centralized crypto exchanges make it near-impossible to follow money through them: once your funds go into an exchange like this, their history is gone.”12### 4.2 Documented Fund Flows The blockchain evidence is not a collection of isolated transactions. It is a systematic pattern of fund extraction replicated across project after project. The table below summarizes the major documented flows. Project Amount Traced Wallet Path Destination Tamadoge $19,000,000 12 Presale → 0xeccf…7569 (Finixio) → 0x4849…d5Ca (Binance Deposit) Binance Hot Wallet 14 Love Hate INU $2,000,000+ 12 Presale → 0x4b9c…71D2 (Deployer) → 0xeccf…7569 → 0x4849…d5Ca Binance Hot Wallet 14 Wall Street Pepe 4,000+ ETH (~$10M) 10 Sale Contract → Intermediary (0x570d…deeb) → Pumper Wallet (0xb29d…0523) → Exit Wallet (0x727c…a80f) Binance Hot Wallets FightOut Undisclosed presale total 12 jfennel.eth (James Fennell) → 0x0C7C…6614d → 0x4177…4fea → Presale Contract Circular: back to source Documented withdrawals (Nov 2022–Jan 2023) $15,900,000 12 0xeccf…7569 → 0x4849…d5Ca Binance Hot Wallet 14 Subtotal (documented on-chain) $46,900,000+ These figures represent only what was verifiable through on-chain analysis. The actual total across all Finixio-connected projects—including Pepe Unchained ($73 million raised), Wall Street Pepe ($57 million presale), Meme Index, Dogeverse, Slothana, and dozens of others—likely reaches into the hundreds of millions of dollars. The $46.9 million documented on-chain is the floor, not the ceiling. 4.2.1 Tamadoge: $19 Million Vanishes The Tamadoge presale was the largest and most thoroughly documented flow. Approximately $19 million in investor ETH passed through the Finixio-controlled wallet before being forwarded to the Binance deposit address.12The withdrawals were not subtle: $4.6 million in November 2022, roughly $10 million in December 2022, and $1.3 million in January 2023. These were staggered transfers of enormous sums, each one moving a substantial portion of the total presale raise out of the project’s control and into a centralized exchange where the trail went cold. For context, Tamadoge’s TAMA token launched in September 2022 with heavy promotion across Finixio’s media network. By the time the final $1.3 million withdrawal occurred in January 2023, the token’s price was already in decline from its post-launch highs. Investors who bought during the presale on the promise of a “play-to-earn” gaming ecosystem were, unbeknownst to them, funding withdrawals to a Binance deposit address controlled by the same team promoting the project. 4.2.2 Wall Street Pepe: The Circular Funding Loop Wall Street Pepe (WEPE) introduced a more sophisticated extraction mechanism. Using blockchain visualization tools from Breadcrumbs.app, investigators traced over 4,000 ETH—approximately $10 million—through a circular funding loop designed to simulate market demand.10The pattern worked as follows: the project’s sale contract (0x9a15bB3a8FEc8d0d810691BAFE36f6e5d42360F7) funded an intermediary wallet (0x570d…deeb), which in turn funded a “buyer” or “pumper” wallet (0xb29d…0523). This pumper wallet then executed large token purchases, creating the appearance of organic whale interest. But the same intermediary wallet that funded the “buyer” also sent millions in ETH to hot wallets via an exit wallet (0x727c…a80f).10The loop was closed: presale funds were recycled to buy the project’s own tokens, inflating apparent demand, while the same infrastructure simultaneously extracted millions to exchange hot wallets. To an unsophisticated investor watching the blockchain, WEPE appeared to have genuine whale buyers. In reality, the “whales” were funded by the project’s own presale contract. 4.2.3 FightOut: The Executive’s Paper Trail FightOut provided the clearest direct link between a named Finixio executive and project funding. The personal Ethereum address of James Fennell—registered under the ENS name jfennel.eth at 0x0C7C2C2100985e5f693b27DbB8c2283D62D6614d—directly funded the FightOut presale deployer address (0x417755e3b81d3ff27acff7915ae834b913994fea), which then fed the project’s presale smart contract.12This is not a matter of executive involvement in a legitimate project. It is a direct, on-chain paper trail from a known individual to a project that raised millions in presale funds before its token collapsed. Fennell is described in the investigation as “a key member of several Finixio projects, longtime associate of Adam Grunwerg and Samuel Miranda, and… one of the chosen few Finixio staff who own the real money-making assets.”12The FightOut funding chain places him at the nexus of project finance—not as a promoter or advisor, but as the wallet that literally deployed the contract that collected investor money. 4.2.4 Unclaimed Presale ETH: Investment or Laundering? Perhaps the most damning pattern in the blockchain data involves transactions where wallets sent substantial ETH into presale contracts without ever claiming the tokens they were supposedly purchasing. In several documented instances, including the FightOut presale, wallets deposited large sums and then simply left them—no token claim, no wallet interaction, no further activity.11These unclaimed presale purchases are not the behavior of investors. They are the behavior of operators using presale contracts as laundering vehicles. As the investigation noted, “These unclaimed presale purchases suggest that presale processes are used not for investment but for masking the movement of funds, similar to how centralized exchanges or crypto mixers operate.”11Presale smart contracts, in this model, function as primitive mixers: funds go in from one address, emerge from another, and the intermediate contract provides a veneer of legitimate commercial activity. 4.3 Money Laundering Indicators 4.3.1 Circular Funding: 142 ETH Recycled The FightOut presale contract exhibited a particularly egregious recycling pattern. One wallet was documented receiving exactly 142 ETH, then sending the identical amount to another address, which then forwarded it to the FightOut presale smart contract—where it was blended into the broader pool of investor funds.11As Jackson’s analysis concluded, “repeated transfers of exact ETH amounts, like the 142 ETH loop, are designed to confuse blockchain analysis.”11Additional transactions marked as “0 ETH” on the surface still involved substantial fund movements through internal contract calls, further obscuring the true flow. This is not the behavior of a project building a fitness-to-earn ecosystem. It is textbook fund obfuscation, and it mirrors techniques that blockchain security experts and regulatory bodies have long identified as characteristic of money laundering operations. 4.3.2 Binance Hot Wallet 14: The Final Drain All roads in the Finixio financial network lead to one destination. Binance Hot Wallet 14 (0x28C6c06298d514Db089934071355E5743bf21d60) holds approximately 89,584 ETH—roughly $262 million at the time of analysis—and consistently receives presale revenues from Finixio-connected projects.11The investigation documented that this single wallet handles over 30,000 ETH, equivalent to approximately €92.5 million, and “consistently receives presale revenues from Finixio/Clickout-connected projects, acting as the final drain point in the network.”11Binance Hot Wallet 14 is not a project treasury, not a development fund, and not a staking contract. It is a general-purpose exchange hot wallet that aggregates deposits from thousands of users. The fact that it serves as the consistent terminus for funds raised across a portfolio of memecoin projects is, in itself, evidence of a systematic extraction pattern. 4.3.3 Exchange Mixing: Binance as Functional Mixer The mechanism by which the transaction trail is erased is not complex, but it is devastatingly effective. As the investigation describes: “While some flows originate from public presale contracts such as Fight Out, others are transferred from centralized exchange deposit wallets without visible presale links. These layers of transfers, involving mix-ins from Binance, make tracing the source of funds virtually impossible without internal records. This makes Binance functionally equivalent to a mixer in this setup, concealing the origin of funds before they exit the system. The whole flow cycle begins and ends on Binance. Funds enter the system through Binance hot wallets, circulate through project-linked wallets, and are ultimately swept back into another Binance account, effectively erasing transactional history.”11This is not an accusation against Binance as an institution. There is no evidence that Binance knowingly participated in or facilitated these activities. Rather, the observation is structural: the design of centralized exchanges, which aggregate deposits from millions of users into shared hot wallets, inherently breaks blockchain traceability. Finixio’s operation appears to have exploited this feature systematically. 4.3.4 Expert Assessment: Patterns Consistent with Money Laundering Darren Jackson’s formal assessment, delivered at the IMLPO Annual Financial Crime Conference in April 2024 and based on his analysis using Breadcrumbs.app visualization tools, concluded that the patterns observed across the Finixio wallet network were consistent with money laundering.11 His analysis traced funds from presale participants across multiple Ethereum wallets and back into known Finixio-controlled addresses, mapping what he described as a “financial network” rather than a series of independent project treasuries.11Jackson is not an anonymous commentator. CrypTegridy Blockchain Security is a registered UK company (Company 13894490, verified through Companies House) that has presented at the University of Exeter and the International Money Laundering Prevention Organisation.84 His tools and methods—public blockchain explorers combined with Breadcrumbs.app’s network visualization—are reproducible by any competent analyst. The patterns he identified do not require specialized interpretation; they are visible to anyone who cares to look. The International Organization of Securities Commissions (IOSCO) flagged these exact presale structures as ideal vehicles for money laundering as early as 2017.11What the Finixio blockchain evidence demonstrates is that those theoretical risks have become operational reality. The presale contract—ostensibly a fundraising tool for decentralized projects—has been repurposed as a fund extraction and obfuscation mechanism, with circular funding loops, unclaimed deposits, and exchange sweeping completing a laundering pipeline that moves millions from investor wallets to exchange hot wallets with the press of a button. The blockchain does not lie. It records every transaction, every transfer, every aggregation into the Binance hot wallet. The question is not whether these flows occurred—they are publicly verifiable. The question is whether regulatory authorities and law enforcement will follow the same trail that Darren Jackson and Timothy M. have already mapped. ## 5. The Infrastructure of Deception Every scam needs distribution. Finixio’s innovation was to build not merely a marketing department but an entire media ecosystem — a vertically integrated propaganda machine that manufactured the illusion of independent consensus across hundreds of websites, search engines, and social platforms. This chapter exposes the four pillars of that infrastructure: the media empire that created false validation, the SEO manipulation arsenal that ensured visibility, the captive wallet infrastructure that trapped victims after they bought in, and the self-replenishing victim funnel that guaranteed a never-ending supply of new marks. 5.1 The Media Machine 5.1.1 Core Crypto Outlets The foundation of Finixio’s media operation rests on cryptocurrency and technology publications acquired between 2022 and 2025. Leaked screenshots from an Ahrefs account labeled “Adam’s workplace” — referring to co-founder Adam Grunwerg — reveal centralized management of Techopedia, 99Bitcoins, CoinCasino, CryptoNews, and Business2Community 11. User accounts listed under the access included emails from @clickoutmedia.com and @finixio.com; Scott Ryder, Finixio’s Head of Business Development, and Samuel Miranda, named in UK corporate filings, appeared among the users 11. The acquisition of 99Bitcoins in March 2024 exemplifies the playbook. The site, a genuine crypto education platform founded in 2013, was purportedly purchased by “Daniel K Morgan” — a person with zero verifiable online presence, no corporate registration records, and a listed Florida address that leads to a food warehouse 20 . Sam Cooling, a former ClickOut Media journalist, became editor, and content shifted to promotional articles pushing Dogeverse, Wall Street Meme, Best Wallet, and Slothana — all Finixio-connected projects, with no ownership disclosure 20. The site’s YouTube channel, with over 700,000 subscribers, pivoted to videos titled “DOGEVERSE IS THE NEXT 100X PRESALE!!” . ReadWrite — founded in 2003 as ReadWriteWeb by Richard MacManus, who sold it in 2011 for approximately $5 million — was acquired by ClickOut Media and repurposed to feature casino content alongside crypto presale promotions 10. MacManus wrote a blog post calling out ClickOut for destroying his former publication; the article has since been deleted, allegedly due to legal pressure 28. Jack Yan, a colleague of MacManus, noted that ClickOut’s founders “even had the cheek to ask Richard to write as a journalist for them — without realizing he was the founder of ReadWriteWeb” 88. 5.1.2 Gaming and Esports Outlets Finixio’s expansion into gaming and esports properties followed the same acquisition-and-repurposing model. The Escapist, Videogamer, Esports Insider, GamesHub, and Adventure Gamers were acquired in 2024–2025 and converted to gambling content vehicles . Videogamer’s tagline was changed to “all about Video and Casino Games” . Staff were laid off and replaced with AI-generated content 91. Google deindexed both Videogamer and Esports Insider in March 2026; the latter collapsed entirely following a manual penalty, with staff laid off . Press Gazette reported that “all editors were let go and replaced by people with no industry experience” . 5.1.3 Poker: From $50 Million to $6.1 Million The poker vertical demonstrates the parasitic pattern with particular financial starkness. CardPlayer.com — an iconic print magazine with 39 years of brand equity — was acquired after its parent company entered liquidation, then filled with “Best Bitcoin Casinos” pages while maintaining a poker facade 50 . PokerScout was redirected from promoting regulated US poker to pushing offshore crypto sites and “no KYC crypto casinos” 44 . Most dramatically, PokerStrategy — the world’s largest online poker community, acquired by Playtech for $50 million in 2013 — was purchased by Finixio/ClickOut in January 2025 for just $6.1 million, an 88% collapse in value, and converted into a crypto casino SEO funnel 44. As one industry analyst observed: “They acquired the website; not the product nor the brand. They want the SEO juice, the traffic” 46. 5.1.4 The Leaked Ahrefs Dashboard: 60+ Domains from One Account The smoking gun for centralized control came from an anonymous internal source who provided screenshots of SEO dashboards. The Ahrefs account labeled “Adam’s workplace” managed 60+ domains 11. An AccuRanker dashboard organized properties into clusters for crypto tokens, presale funnels, geo-targeting (Spain, Japan, Netherlands, South Korea), and brands including 99Bitcoins, Best Wallet, and CasinoBeats 55. The AccuRanker data revealed 79 active crypto presales tracked from a single dashboard — a scale only achievable under unified management 55. Finixio claims to operate “over 100 websites, including 15 leading comparison brands in almost every language you can think of” . A former employee suggested the count approaches 300 95. Table 1: Finixio/ClickOut Media Network — Selected Properties Property Category Status Current Function Key Evidence 99Bitcoins Crypto education Acquired Mar 2024; fake owner 20 86 Promotes Finixio presales; no disclosure Ahrefs dashboard, ex-ClickOut editor 20 CryptoNews.com Crypto news Owned Sponsored presale articles; generic disclosure only Ahrefs dashboard 11 Techopedia Tech reference Deindexed 2024 for reputation abuse Casino content via cloaking Ahrefs dashboard 11 Business2Community Business news Owned SEO presale and casino promotion Ahrefs dashboard 11 ReadWrite Tech news (est. 2003) Acquired by ClickOut Gambling content; founder’s critique deleted 28 88 MacManus, Yan statements 88 The Escapist Gaming news Acquired 2024–2025 Casino + AI content 89 Aftermath investigation 89 Videogamer Gaming news Acquired 2025 Deindexed by Google Mar 2026 94 Staff reports, ResetEra Esports Insider Esports B2B Acquired from Sport Global Deindexed; site collapsed 92 93 Esports Business, Esports Radar GamesHub Australian gaming Acquired May 2025 Gambling + casino content 89 Aftermath 89 CardPlayer.com Poker media Acquired Dec 2024/Jan 2025 Crypto casino affiliate pages; AI authors 50 AffiliateGuardDog 42 PokerScout Poker tracking Acquired ~2024 Redirected to offshore crypto casinos 44 97 PokerFuse 44 PokerStrategy Poker education Acquired Jan 2025 for $6.1M (was $50M) 44 Crypto casino SEO funnel PokerFuse, industry records CasinoBeats iGaming B2B Acquired 2025 (~EUR 15M) 48 Repurposed for affiliate operations iGaming Express Gambling Insider iGaming B2B Acquired Oct 2025 (~EUR 15M) 48 SEO authority harvested; team launched rival 46 iGaming Express 48 The table documents only the most prominent properties. The pattern is consistent: acquire a site with established domain authority, replace editorial staff with AI-generated content or low-cost contractors, load the site with SEO-optimized affiliate articles, extract revenue until Google penalties strike, then abandon or redirect. As former ClickOut writer Blaise Bourgeois described it: “Buy a legitimate website, leave the home page running as if nothing’s changed. Fill the rest with SEO articles and affiliate links. Climb Google rankings. Acquire income via affiliate links. Get de-indexed from Google. Fire employees and abandon the website” 50. 5.2 The SEO Manipulation Arsenal 5.2.1 Parasite SEO: Expired Domains, Redirect Chains, and Cloaking Finixio deploys a systematic parasitic SEO playbook designed to exploit Google’s ranking algorithms. Expired domain repurposing forms the base layer: an AccuRanker cluster labeled “Canonical Repurposed Domains” includes properties like cousinssailingadventure.com and enduromasters.at — once hobbyist pages about sailing and motorsports — now reactivated as casino portals harvesting historical backlink equity 55 63. Cloaking adds technical sophistication. Investigative reporting documented that ClickOut used “advanced cloaking techniques to display harmless content to Google crawlers, ensuring their gambling pages avoided detection” while targeted users saw full gambling content 63. Gambling pages on Techopedia targeting Dutch users were accessible on mobile devices or from outside the Netherlands but hidden on desktops within the country 63. When Google imposed manual penalties in December 2024, the operation demonstrated resilience. Techopedia lost over 64% of its traffic in a month, dropping from six million visits to one million . Business2Community lost roughly 75% 103. Yet within days, “the previously removed pages reappeared” and rankings began recovering 103— achieved through 301 redirect chains transferring authority from penalized domains to alternatives like casinoutanspelpaus.io 63 103. 5.2.2 The AI Content Factory: Fake Personas and Phantom Journalists Content production operates at industrial scale through AI-generated text and fabricated author personas. Bourgeois, a former ClickOut writer, testified that his byline continued appearing on articles months after he left in August 2025 — content he never wrote or reviewed 50. CardPlayer.com now features authors with no verifiable existence: “Malin Sjoberg,” who writes about unlicensed Swedish casinos, has no social media profiles and an AI-generated photo. “Frederik de Koning,” supposedly writing for the Dutch segment, is similarly synthetic 42. These phantom journalists create the illusion of local expertise while ensuring no real human can blow the whistle. 5.2.3 Josh Consultancy Ltd: £12,810 Running 2,000+ Campaigns Finixio’s advertising runs through Josh Consultancy Ltd — a UK-registered company with just £12,810 in declared capital operating over 2,000 Google Ads campaigns 55 61. The sole director is Suresh Chandra Joshi, who simultaneously serves as Partner and Head of Performance Marketing at Finixio 55 56. Google Ads Transparency Center screenshots confirm Josh Consultancy is behind paid media for Solaxy, Best Wallet, ReadWrite, CryptoNews, ICOBench, 99Bitcoins, and hundreds more 55. At a conservative $500 per campaign monthly, this implies over $1 million in Google ad spending flowing through a company with under thirteen thousand pounds in capital. 5.2.4 AccuRanker: 79 Active Presales from One Dashboard The AccuRanker dashboard reveals 79 active presales tracked from a single interface, organized by project type, geography, and brand 55. The traffic architecture follows a deliberate funnel: high-authority sites like 99Bitcoins and Techopedia capture organic search traffic, then route users to lower-authority gambling or presale sites where conversions are completed 55 50. Table 2: SEO Manipulation Tactics — The Finixio Playbook Tactic Method Purpose Evidence Expired domain repurposing Reactivate defunct sites with historical backlinks as casino portals Harvest pre-existing link equity AccuRanker “Repurposed Domains” cluster 55 63 Multiple TLD mirrors Operate .com, .io, .ltd, .org variants of same project Dominate rankings; evade takedowns AccuRanker multi-TLD tracking 55 High-authority acquisition Buy established brands; keep homepage facade; load interior with SEO content Leverage existing domain authority Bourgeois testimony, site analysis 50 Cloaking with geo-targeting Serve safe content to crawlers; gambling content to users; hide by region Evade penalties and regulators Malmros technical investigation 63 301 redirect chains Transfer authority from penalized domains to alternatives post-penalty Preserve rankings after manual actions Traffic analysis 63 103 AI content factory Generate articles under fake personas (“Malin Sjoberg,” “Frederik de Koning”) Eliminate whistleblowers; maintain output Bourgeois testimony; author verification 50 42 Centralized keyword tracking Coordinate 79+ presales across geo-clusters via AccuRanker Synchronize SEO across portfolio Leaked AccuRanker screenshots 55 Shell company ad ops Run 2,000+ campaigns through Josh Consultancy (£12,810 capital) Obscure spend; distance from Finixio Companies House; Google Ads Center 55 61 5.3 The Captive Wallet Infrastructure 5.3.1 Best Wallet: FCA Warning and a 1-Euro Bulgarian Shell If the media network brings victims in, the wallet infrastructure ensures they cannot easily exit. Best Wallet serves as the storage and access control layer in the vertically integrated funnel. On 13 March 2025, the UK’s Financial Conduct Authority issued a formal warning: Best Wallet “is not authorised by us and may be targeting people in the UK” — consumers should “avoid dealing with this firm and beware of scams” 41. Spain’s CNMV and Bulgaria’s FSC followed with their own warnings 66. The corporate structure behind the app is deliberately fragmented. Best Wallet EOOD, the Bulgarian operating entity, was registered on 27 November 2024 with exactly 1 EUR in capital; its stated business activity is “development and launch of mobile device games,” not cryptocurrency services 59. The sole director, Mihail Rachev Nedelchev, received ownership of Best Web3 (the holding company) from Tihomir Todorov — a lawyer also linked to Block Labs, Block Law, and Tamadoge 56. The data controller is Best Wallet LTD, a British Virgin Islands entity, placing user data outside EU GDPR jurisdiction 55. 5.3.2 Web3Payments/KG Token Holdings: The Universal Payment Bridge Every Finixio presale funnels payments through Web3Payments, a trading name of KG Token Holdings Ltd — another BVI-registered entity (company number 2150785) 61. Web3Payments operates Web3Toolkit, the presale infrastructure used across all Finixio-connected projects 67. As one investigation summarized: “Finixio manages all development through companies like Block Labs, Clickout Media for marketing, content publication on media websites they own like 99bitcoins or CryptoNews, and fundraising through crypto launchpads built by Web3Payments” 67. 5.3.3 Data Harvesting: Wallet Addresses, Fingerprints, and KYC Documents The privacy policies reveal aggressive data collection beyond what any legitimate wallet requires. Best Wallet collects blockchain wallet addresses, IP addresses, geo-location, device fingerprints, and may require KYC documents 55. Web3Payments collects device IMEI numbers, MAC addresses, mobile phone numbers, screen resolution, and social media usernames 61. Both reserve broad third-party sharing rights with “marketing agencies,” “data analytics” providers, and vague “third parties with which we cooperate” 55 61. Best Wallet explicitly states data may be transferred to “jurisdictions that may not offer the same level of data protection as your home country” 55. User complaints confirm the practical impact. Best Wallet holds a 2.2 out of 5 rating on Trustpilot, with reviews reporting missing funds and failed withdrawals 50. Multiple Reddit users described the app unexpectedly logging them out and replacing original wallets with new multi-chain wallets, rendering funds inaccessible 50. During the Pepe Unchained launch, Best Wallet users could not claim tokens while insiders sold freely — “the wallet was used to restrict claims and enable insider sales” 44. 5.4 The Self-Replenishing Victim Pool 5.4.1 Educational Content as the Bait The Finixio network does not merely target existing crypto investors — it actively creates new ones. Properties like 99Bitcoins rank for beginner search terms: “What is Bitcoin?”, “How to buy Ethereum”, “best crypto wallet for beginners.” This educational content builds trust with visitors entering cryptocurrency for the first time, often with limited technical knowledge and no ability to evaluate investment opportunities critically. 5.4.2 The Trust Transfer The transition from educator to promoter happens within the same site. A visitor learning “What is Bitcoin?” follows an internal link to “5 Best Meme Coins to Buy Now” — a list including Finixio-connected projects like Dogeverse, with no disclosure of shared ownership 33. The illusion of consensus is reinforced through circular citation: CryptoNews cites 99Bitcoins, which cites an ICOBench rating, which gives the project 9.8/10 . To the investor, this looks like independent experts converging. In reality, all sources are controlled by the same entity 11. 5.4.3 Best Wallet: The Final Gate Best Wallet is promoted as the “recommended” storage solution across all Finixio presales — the appearance of ecosystem adoption masking vertical integration 67. Users deposit tokens into a wallet controlled by the same entity that sold them the tokens, promoted the project, published the coverage, and built the presale smart contract. At launch, claim restrictions prevent retail investors from accessing tokens while insiders extract liquidity. The token collapses, leaving users holding assets they cannot sell. The BEST token itself followed this exact pattern: the presale raised approximately $18 million, then the token declined 89% within two months 63. Thirty-five percent of supply was allocated to marketing — not a standard allocation but the operating budget for a data harvesting operation that collects wallet addresses, geo-location, device fingerprints, and KYC documents on every user 63. The funnel is self-replenishing. Newcomers searching “What is Bitcoin?” enter daily. They are educated by Finixio-owned outlets, recommended Finixio-connected tokens by those same outlets, directed to store assets in a Finixio-controlled wallet, and processed through Finixio-built payment infrastructure. When the tokens collapse, the victims may leave — but the educational content remains, ranking in search results, waiting for the next wave of beginners. The infrastructure of deception does not merely facilitate individual scams. It is a perpetual motion machine for extracting wealth from the cryptocurrency newcomer class. ## 6. Silencing Critics: The Legal Intimidation Machine Journalism about Finixio does not stay online for long. Investigators who publish are threatened with lawsuits. Employees who speak up are fired. Articles vanish months later, scrubbed without explanation. Across three years, at least ten individuals — journalists, content creators, SEO professionals, and whistleblowers — have been targeted by a legal intimidation machine that treats suppression of criticism as a core business function. 6.1 Confirmed Cases of Suppression 6.1.1 Timothy Genach: Five Legal Claims and a Danish Lawsuit Timothy Malmros Genach, an SEO specialist who published a six-part investigative series on recleudo.com, has received five separate legal claims from ClickOut Media. The fifth, filed in a Danish court in August-September 2025, was the first to reach litigation, seeking an injunction to force Genach to remove all content about the company and bar him from future publication. The lawsuit characterizes Genach’s blockchain wallet analyses as “speculative” and his statements about money laundering as “unsubstantiated allegations.” 106The four prior claims that never reached court followed an escalating pattern familiar to press-freedom advocates: pre-litigation threats designed to exhaust resources without the risk of an actual trial. The result has been devastating for public access to information. All six episodes of Genach’s original investigative series are “no longer publicly available,” confirmed by editor’s notes on third-party outlets that had published archival summaries. 106#### 6.1.2 @CryptoRugMuncher: A Cease-and-Desist Letter Published in Full On September 8, 2024, the X account @CryptoRugMuncher — which investigates crypto presale scams — posted the complete text of a cease-and-desist letter sent by Friis Advokatfirma, a Danish law firm based in Dubai. The letter, signed by founder Thomas Friis Nielsen on behalf of the memecoin project SlothanaCoin, demanded removal of tweets alleging developer wallet sniping and token dumping, a public retraction, and a commitment to cease all further commentary, with a compliance deadline of September 18, 2024. The account’s response was immediate: “We have received our first cease and desist letter today from an account with 18 followers and based out of Dubai. As you might have guessed, we won’t be ceasing or desisting.” By publishing the full letter, @CryptoRugMuncher triggered the Streisand effect — a legal threat generating more attention than the information it sought to suppress. A matching cease-and-desist letter was subsequently sent to YouTuber NetCrypto; in that letter, according to @CryptoRugMuncher, the firm “listed an entire laundry list of scams they were associated with and demanded he stop covering them.” 107#### 6.1.3 Rachel Wolcott and Richard MacManus: The Disappeared Articles Rachel Wolcott, a Chief UK and European Correspondent at Thomson Reuters Regulatory Intelligence with more than twenty years of experience covering financial crime, published multiple articles on LinkedIn exposing Finixio’s practices. The articles are now gone. As @CryptoRugMuncher documented: “Take Rachel Wolcott from Reuters Business Intelligence Unit. She wrote multiple pieces on LinkedIn shedding light on their shady business practices. Where are those articles now? Gone. Completely scrubbed.” 28The same fate befell Richard MacManus, founder of ReadWriteWeb, who in 2024 published “Why ClickOut Media, a Gambling PR Company, Bought ReadWrite.” By September, the article had been “wiped” from his blog. Jack Yan confirmed the article’s disappearance, noting that ClickOut had even attempted to recruit MacManus as a contributor for the publication he founded. 28#### 6.1.5 Blaise Bourgeois: Fired After Raising Ethics Concerns Blaise Bourgeois, a World Series of Poker Circuit ring winner and veteran poker journalist, was fired from ClickOut Media in 2026 shortly after he “questioned the company’s ethics in a meeting.” In a detailed Substack exposé, Bourgeois recounted how he was dismissed “with no further discussions” despite receiving “beyond expectations” ratings in every area of his performance reviews and earning three promotions during his twenty-one months of employment. He is now pursuing legal action against the company for wrongful termination. Anna Grunwerg — sister of Finixio founder Adam Grunwerg and head of “People Operations” — was present at Bourgeois’s exit interview. ### 6.2 The Legal Playbook The suppression campaign follows a multi-stage protocol that maximizes intimidation while minimizing legal risk. 6.2.1 Jurisdiction Shopping: Dubai, Denmark, and Strategic Distance The cease-and-desist letter sent to @CryptoRugMuncher originated not from a London solicitor but from a Danish lawyer operating out of Dubai. Thomas Friis Nielsen, founder of Friis Advokatfirma, has been based in Dubai since 2018 assisting international clients with UAE company establishment. The client named on the letter was SlothanaCoin — not ClickOut Media — adding corporate distance between the legal threat and the parent company. 107When ClickOut Media escalated to actual litigation against Genach, it filed in Denmark rather than the United Kingdom, where the company is headquartered. This forum-shopping forces defendants to retain foreign counsel, multiplying costs and procedural complexity. 6.2.2 Sequential Escalation: Four Threats Before a Single Lawsuit The pattern against Genach — four pre-litigation claims followed by one court filing — exemplifies SLAPP (Strategic Lawsuit Against Public Participation) tactics. Each successive claim raises psychological and financial pressure without requiring the plaintiff to argue its case before a judge. The Danish lawsuit demands not a correction but a blanket injunction against all future publication about the company. 105 106#### 6.2.3 Timeline of Legal Threats and Outcomes Date Target Action Taken Outcome Nov 2020 OCCRP / Guardian Celebrity endorsement exposé Grunwerg dismissed as “0.001% of revenues” 9 Jun 2022 ACMA (Australian regulator) Formal warning for gambling violations Warning issued; operation continued 29 Mar-May 2024 Richard MacManus Blog post exposing ClickOut’s ReadWrite acquisition Article “wiped” from blog 28 ~2024 Rachel Wolcott LinkedIn articles on Finixio’s business practices “Completely scrubbed” 28 Sep 8, 2024 @CryptoRugMuncher C&D letter from Friis Advokatfirma (Dubai) Full letter published; account refused to comply 107 ~2024 NetCrypto (YouTuber) Matching C&D letter Video published about the threat 107 ~2025 @BinanceStuff (YouTuber) UK video restrictions applied Content restricted in UK 28 Aug-Sep 2025 Timothy Genach 5th legal claim; 1st actual lawsuit filed (Denmark) Pending; all 6 recleudo.com episodes removed 105 ~2025 recleudo.com All 6 investigative episodes “No longer publicly available” 106 Jun 2026 Ivana Flynn LinkedIn account suspended Suspended after sharing Press Gazette investigation 108 Apr 2026 Blaise Bourgeois Fired after ethics meeting Wrongful termination claim filed 109 The table reveals a clear escalation arc. Early responses to criticism relied on public relations dismissal — Adam Grunwerg’s characterization of the OCCRP investigation as representing “0.001% of company revenues” 9— accompanied by the deletion of critical articles through pressure on individual publishers. By 2024, the strategy had formalized into cease-and-desist letters from a Dubai-based law firm. By 2025, it culminated in an actual lawsuit seeking a permanent gag order. The progression suggests that as investigations penetrated deeper into the corporate structure, the cost of tolerating public criticism exceeded the cost of litigation. 6.3 Whistleblower and Victim Testimony 6.3.1 The Reddit Whistleblower: “95% of These Projects Are Scam” In 2025, a Reddit user posted to r/CryptoScams describing approximately three years at the company. The post was notable for its specificity: the whistleblower listed exact project names (SUBBD, Bitcoin Hyper, Solaxy, LiquidChain, Pepenode, MaxiDoge, Snorter, Wall Street Pepe, Best Wallet Token), named casino brands (WinMega, MegaDiceCasino, LuckyBlock, CoinCasino), and identified senior management. “A large part of the work (literally 99%) involved promoting online casinos and new cryptocurrency (meme coins) projects are scam,” the post stated. “95% of these crypto projects are meme coins that were heavily marketed and hyped through affiliate websites and SEO articles.” The whistleblower acknowledged reliable payment and flexible conditions but drew a moral distinction: “Working with them for about 3 years. Payments are always on the promised date, never late, all legit. Good bonuses. 100% Flexibility and very…” The post was subsequently referenced across multiple subreddits. 110#### 6.3.2 Glassdoor Reviews: “Shady Company Built on Finixio” On Glassdoor, ClickOut Media has attracted reviews from verified employees that corroborate the Reddit testimony. One November 2025 review described the company as a “shady company” that “marketed scam cryptobots,” adding that management “bought major sites such as Techopedia and Cryptonews and basically brought them down.” Another praised the “absolute freedom” while acknowledging the firm’s history with scam promotion — suggesting employees understood the ethical framework but remained for the compensation. The portrait is of a company where competent staff were gradually replaced by AI-generated content, and ethical objections were quietly filtered out. 6.3.3 Named Victim: Ingrid Hernvall Behind the corporate architecture and legal threats are human beings who lost life savings. Ingrid Hernvall, a 57-year-old ceramic artist in Stockholm, was scrolling through Facebook when she encountered what appeared to be a legitimate news article featuring two of Sweden’s biggest television personalities endorsing a cryptocurrency investment. She invested the proceeds from the sale of her house — over $300,000 in total. It took her four months to realize she had been deceived. 9The article was part of a marketing funnel that the Organized Crime and Corruption Reporting Project traced to Finixio in its December 2020 “Fraud Factory” investigation. Finixio-linked marketing emails automatically enrolled her with offshore forex brokers who applied relentless pressure to invest more. Another Swedish victim told investigators: “They were pressuring me to invest so hard I could not breathe. They were calling all the time. At one point I watched the movie ‘Wolf of Wall Street’ and I realized that this is just like that movie — it’s even worse than ‘Wolf of Wall Street.’ They ruined my life.” 9When confronted by OCCRP reporters, Adam Grunwerg dismissed the fake celebrity endorsements as an oversight: “This seems to have been missed on occasion by the team since working remotely in lockdown.” He added the now-infamous statistic: the offending emails “generated 0.001% of company revenues.” 9Hernvall, who lost her home, was not mentioned. ## 7. Regulatory Landscape and Exposure The Finixio/ClickOut Media network has drawn regulatory fire across seven jurisdictions, yet no single enforcement action has penetrated the core of its memecoin operation. This chapter catalogues every confirmed intervention and examines why the network’s architecture has proven so resistant to prosecution. 7.1 Confirmed Regulatory Actions 7.1.1 UK FCA: Best Wallet and Web3Payments Warnings On 13 March 2025, the Financial Conduct Authority warned that Best Wallet was “not authorised or registered by the FCA,” alerting consumers that they would lose access to compensation and ombudsman protections. The warning echoed FCA guidance from November 2024 that explicitly flagged non-custodial wallet providers illegally issuing financial promotions. Spain’s CNMV and Bulgaria’s FSC issued parallel warnings. A second FCA warning targeting Web3Payments followed in March 2026. 7.1.2 UK FCA: ForexTB Fined £276,100; 24Options Passporting Removed In June 2020, the FCA removed passporting rights from Rodeler Ltd (24Options) — the first time it had ever exercised that power — after finding the firm used fake celebrity endorsements to solicit UK investors into contracts for difference. Finixio’s websites were documented funnelling users directly to these brokers, and CEO Adam Grunwerg admitted the connection.9The FCA subsequently fined ForexTB £276,100 in August 2024 for unfair customer treatment and unauthorised investment advice. #### 7.1.3 Cyprus CySEC: Rodeler Ltd Licence Suspension and €280,000 Fine Following the FCA’s lead, CySEC fully suspended Rodeler Ltd’s authorisation in June 2020, ordering it to “cease all regulated activities entirely.”117 In August 2020, CySEC announced a €280,000 settlement for CIF licence violations. Rodeler later voluntarily renounced its licence.125#### 7.1.4 Netherlands KSA: Instant Casino Penalty Order up to €840,000 In August 2025, the Kansspelautoriteit imposed a penalty order on EOD Code, operator of Instant Casino, for offering gambling services without a Dutch licence. The penalty escalated at €280,000 per week up to €840,000. A KSA supervisor registered on the site using a Dutch phone number, confirming active market targeting.126#### 7.1.5 Australia ACMA: Instant Casino Blocking and Formal Warning to Finixio Ltd ACMA requested ISP blocking of Instant Casino in February 2025, adding it to over 1,150 illegal gambling sites blocked since 2019. More consequentially, ACMA had formally warned Finixio Ltd on 22 June 2022 for contraventions of the Interactive Gambling Act 2001 through its Safe Betting Sites service, finding the company “knowingly concerned in and an intentional participant in” prohibited gambling services to Australian consumers.29 #### 7.1.6 EU Europol: International Affiliate Marketing Takedown In November 2025, Europol and Eurojust coordinated a two-phase operation against a crypto fraud network laundering over €700 million. Phase one brought nine arrests across Cyprus, Germany and Spain on 27 October 2025. Phase two, on 25–26 November, targeted the “affiliate marketing infrastructure that supports these online scams” — companies behind fraudulent social media campaigns using deepfake content.131 While Europol did not name specific firms, the operation’s focus on affiliate marketing infrastructure — ClickOut Media’s core business — represented the first coordinated cross-border strike against the exact operational pillar sustaining networks like Finixio’s. 7.2 Regulatory Gap Analysis 7.2.1 No Single Regulator Can Address the Full Network The Finixio/ClickOut footprint spans at least seven jurisdictions — UK, Malta, BVI, Cayman Islands, Bulgaria, Estonia, and Cyprus — with each entity handling a different risk exposure. The UK entity presents a respectable commercial facade (£59.9 million turnover); a Bulgarian company with €1 in capital operates wallet infrastructure; a BVI entity holds data controller responsibilities. When one regulator acts, operations shift elsewhere. The KSA’s €840,000 maximum penalty functions as a cost of doing business for a network that has extracted an estimated $200–400 million. 7.2.2 Memecoins Fall Outside SEC Jurisdiction On 27 February 2025, the SEC’s Division of Corporation Finance stated that many meme coins “fall outside SEC jurisdiction” because they do not involve investment contracts. The SEC noted that “fraudulent conduct related to the offer and sale of meme coins may be subject to enforcement action or prosecution by other federal or state agencies.”134This gap means Finixio’s core memecoin operations are not directly regulable by the SEC as securities, leaving enforcement to agencies with less crypto expertise. 7.2.3 Auditor Resignation Should Have Triggered Scrutiny In 2023, auditor Haines Watts resigned from Finixio citing ethical concerns and mischaracterised transactions. Auditor resignations on ethical grounds are vanishingly rare and typically signal fundamental disagreements about financial reporting integrity. Finixio continued without immediately securing a replacement. By any standard of oversight, this should have triggered immediate regulatory inquiry. That it did not — with Finixio proceeding to its most aggressive memecoin fundraising phase in 2024–2025 — represents a significant failure of supervisory vigilance. 7.3 Table: Complete Regulatory Action Summary Jurisdiction Regulator Target Entity Action Date Status UK FCA Best Wallet Unauthorised firm warning Mar 2025 Active 113 114 UK FCA Web3Payments Unauthorised firm warning Mar 2026 Active UK FCA ForexTB (FXTB) £276,100 fine + trading ban Aug 2024 Enforced 120 121 122 123 UK FCA Rodeler Ltd / 24Options Passporting rights removed Jun 2020 Enforced 117 118 119 Cyprus CySEC Rodeler Ltd / 24option Full licence suspension Jun 2020 Enforced 117 124 Cyprus CySEC Rodeler Ltd €280,000 fine Aug 2020 Settled 125 Netherlands KSA Instant Casino (EOD Code) Penalty order up to €840K Aug 2025 Active 126 Australia ACMA Instant Casino ISP website blocking Feb 2025 Enforced 127 128 129 Australia ACMA Finixio Ltd Formal warning (IGA violations) Jun 2022 Enforced 29 130 EU Europol / Eurojust Affiliate marketing networks International takedown (Phase 2) Nov 2025 Ongoing 131 132 133 Sweden Police ForexTB Criminal complaint filed 2020 Historical 9 Denmark Courts Timothy Genach SLAPP lawsuit (ClickOut Media) Sep 2025 Active The pattern is telling: twelve confirmed enforcement actions across seven jurisdictions, yet each struck only a single node. The FCA fined ForexTB but never pursued Finixio for the funnel sites delivering customers. CySEC suspended 24Option but took no action against the UK marketing network generating leads. ACMA warned Finixio Ltd in 2022 and blocked Instant Casino in 2025, but the affiliate engine kept running. Only the November 2025 Europol operation — with its simultaneous targeting of affiliate marketing infrastructure across Belgium, Bulgaria, Germany and Israel — approached the coordinated, cross-border enforcement necessary to address a network deliberately architected for regulatory evasion. ## 8. Conclusions and Assessment This investigation set out to trace the connection between Legendz.io/Legendz.com — a crypto casino and sweepstakes brand — and the Finixio/ClickOut Media memecoin pump-and-dump network accused of extracting over $400 million from retail investors. The connection exists. It is not corporate — no shared companies, no overlapping directors, no joint infrastructure. It is personal. It runs through Henrik Persson Ekdahl and Adam Grunwerg, two men who were investor and CEO partners for two formative years, who built a company together in the crypto-gambling affiliate space, and who then went on to build separate empires without ever publicly acknowledging their shared history. 8.1 The Legendz-Finixio Thread Ekdahl was Grunwerg’s backer. From December 2016 to September 2018, Ekdahl’s investment fund — Optimizer Invest — held a significant stake in Grunwerg’s company, Investoo Group. They made coordinated acquisitions together — 100ForexBrokers.com, SocialTradingGuru.com, RoboAdvisors.com — issuing joint press releases with dual attribution throughout 2017 13 14 15. Swedish business media photographed them together as partners 17. Grunwerg left Investoo in September 2018 and founded Finixio two months later 18 8. Ekdahl went on to build Legendz 6. There is no shared corporate structure today. Zero director overlap. Zero shared infrastructure. Zero cross-promotion. Legendz uses Uniwire and Cubeia; Finixio uses Web3Payments and white-label platforms 19 20. The companies are structurally independent. But the undisclosed relationship is material. Ekdahl’s public profiles present him as an independent iGaming veteran with no connection to the memecoin world. That presentation omits a two-year business partnership with the man who would go on to lead a network of 25+ pump-and-dump schemes. Whether any ongoing coordination — shared affiliate channels, referral agreements, informal deal flow — exists between Legendz and Finixio today cannot be confirmed from public records. But the omission of their shared history from Ekdahl’s public narrative creates a gap that investors on both sides — Legendz users and memecoin buyers — have a right to know exists. 8.2 The Scale of the Finixio Operation If the Legendz connection is a thread, the fabric it connects to is vast. Finixio and ClickOut Media have constructed a vertically integrated fraud machine controlling every layer of the memecoin value chain: coin creation through Web3Toolkit and Block Labs, manufactured hype through 100-300+ controlled media outlets, wallet lock-in through Best Wallet, payment processing through Web3Payments, and systematic fund extraction through blockchain wallets terminating at Binance 11 20 113. The numbers are staggering. 25+ confirmed projects 60 64 70. $400 million+ in presale funds extracted from retail investors 51 41 59. Zero percent success rate — every launched project has collapsed between 86% and 99.99% 43 54 65. 100,000+ estimated victims, many first-time crypto buyers drawn in by educational content on the same sites that promoted the scams 110. The self-replenishing victim pool is perhaps the most insidious element: sites like 99Bitcoins rank for “how to buy ethereum,” build trust with newcomers, then promote Dogeverse or Pepe Unchained as “the next big opportunity.” The newcomer buys in. The insider exits. The cycle repeats. Blockchain evidence confirms systematic extraction. Wallet 0xeccf6E64c46c87d422558bdAB9bC4051D38f7569 received $19 million in Tamadoge proceeds alone, plus millions from Love Hate INU and FightOut, before sweeping funds to Binance Hot Wallet 14 12 11. James Fennell’s personal wallet (jfennel.eth) directly funded the FightOut smart contract deployer, tying a named executive to project financial flows on-chain 12. The documented on-chain total exceeds $46.9 million; the gap between traced funds and self-reported $400M+ raises suggests significant off-chain extraction 12. 8.3 Why This Matters The Finixio operation represents an evolution in financial fraud — vertically integrated, jurisdiction-hopping, AI-powered, and self-perpetuating. It controls every point of contact with the victim from first Google search to final fund withdrawal. It spans 25+ shell companies across the UK, Malta, BVI, Cayman Islands, Bulgaria, Estonia, and Cyprus so no single regulator can see the full picture 10. It replaces human journalists with AI-generated personas to manufacture consensus while eliminating potential whistleblowers 95 20. Its legal intimidation campaign — five claims against one journalist, C&D letters from a Dubai-based law firm, silenced reporters — is a budgeted operating function, not reactive damage control 105 106 107. Thirteen regulatory actions across seven jurisdictions have failed to penetrate the core 120 126 131. The SEC has stated that many meme coins “fall outside SEC jurisdiction” 134. An auditor resigned in 2023 citing ethical concerns — a signal that should have triggered scrutiny but did not 10. The operation continues, with active presales still soliciting funds as of mid-2026 7 73 75. The result is a machine that has extracted an estimated $400 million from retail investors with near-total impunity, using infrastructure that remains intact and capable of producing new “iterations” indefinitely.

]]> investigated@newsletter.paragraph.com (Crypto Investigator)