RSF.Support Investor Alert: Forensic Review of BYDFIPTO.com, Related Domains and Reported Cryptocurrency Transfers

OSINT review date: July 12, 2026
Case classification: Reported relationship-based cryptocurrency investment operation
Primary domain reviewed: bydfipto.com
Reported exposure: US$208,500
Assets involved: USDC and USDT

Executive Summary
RSF has received a detailed report concerning a cryptocurrency investment operation presented through bydfipto.com, a website that appeared to use the name, visual identity and market positioning of the established digital-asset platform BYDFi.

The reporting party states that an individual using the name George Gu (顧春辰) established a personal relationship, represented himself as an artificial-intelligence engineer living in San Jose, California, and later introduced cryptocurrency perpetual-contract trading.

According to the submitted account, the reporting party was instructed to open accounts with legitimate cryptocurrency businesses, including Coinbase, Kraken and Crypto.com. Funds were then converted into stablecoins and transferred from a self-controlled wallet to external blockchain addresses described as deposit addresses for the trading website.

Between March and June 2026, the reporting party states that approximately US$208,500 was committed to the operation. A relatively small withdrawal was reportedly permitted during the early stages. When a substantially larger withdrawal was later requested, the platform allegedly demanded identity documents and an additional payment equal to 20% of the displayed account value.

That additional demand was described as an 85,317-USDT "risk verification deposit."

The conduct described in the submission closely corresponds with an investment-fraud sequence documented by the FBI's Internet Crime Complaint Center: trust-building, direction to use reputable exchanges, conversion into specified cryptocurrencies, transfer to an external platform, display of apparent profits, authorization of an early withdrawal and imposition of new taxes or fees when the user seeks to withdraw the main balance.

RSF's open-source review also identified a material inconsistency between representations reportedly displayed through the questioned website and a public notice issued by the established BYDFi platform.

The questioned material reportedly characterized BYDFi as a Singapore-based platform operating under Singapore regulatory standards. By contrast, BYDFi stated in a March 2025 security notice that it had never promoted or conducted business operations in Singapore. In that same notice, BYDFi warned that unaffiliated websites were imitating its design and directed users to access bydfi.com directly.

RSF has not determined who registered, controlled or financially benefited from the questioned domains or receiving wallets. This publication documents a submitted complaint, observable technical indicators and relevant public information. It is not a judicial determination against any named person or organization.

Key Findings

The review produced the following principal findings:
1.The questioned domain is not the primary domain identified by BYDFi.
BYDFi publicly directs customers to www.bydfi.com and provides an official-channel verification facility.

2.BYDFi has previously warned about brand imitation.
Its March 2025 security notice states that unauthorized sites have used similar design elements to mislead users.

3.The Singapore narrative conflicts with BYDFi's own public statement.
The questioned platform reportedly described BYDFi as a Singapore-based operation. BYDFi publicly stated that it had never promoted or conducted business operations in Singapore.

4.The reported funding route follows a recognized investment-fraud methodology.

The reporting party was allegedly directed to use legitimate exchanges, acquire cryptocurrency, move it through a private wallet and deposit it into a separate platform introduced by a personal contact. The FBI specifically identifies this sequence as a warning pattern.

5.A small early withdrawal was reportedly followed by larger deposits.
The FBI advises that controlled early withdrawals may be used to create confidence before substantially larger payments are solicited.

6.The requested "risk verification deposit" is a critical danger indicator.
The FBI identifies demands for additional taxes or fees to unlock an investment as a defining final-stage warning sign.

7.The submitted transaction schedule requires reconciliation.
The listed stablecoin transfers total approximately 204,977.326034 USDC and USDT, while their stated contemporaneous dollar equivalents total $204,912.24. Neither figure fully reconciles with the separately claimed loss of $208,500.

8.Some transaction hashes require technical correction.
Several were submitted across multiple lines, and at least one appears to contain an invalid or incomplete character sequence. Direct export from the relevant exchange or blockchain explorer is recommended before those hashes are treated as fully validated indicators.

The Reported Approach

The reporting party states that contact occurred between approximately March 20 and June 5, 2026.

The individual involved reportedly used the following identity and contact details:
●Name used: George Gu
●Chinese characters supplied: 顧春辰
●Claimed profession: Artificial-intelligence engineer
●Claimed location: San Jose, California
●WhatsApp number: +1 415-216-7745
●Additional telephone number: +1 415-841-5587

These details are published as reported identifiers only. RSF has not independently established that the supplied name represents the individual's legal identity, that the telephone subscriber was physically located in California, or that the person controlled the questioned domains or blockchain addresses.

Telephone numbers, profile photographs, occupations and locations can be falsified, reassigned or used without the knowledge of the genuine owner. Investigators should therefore treat the supplied identity as a lead requiring corroboration rather than proof of attribution.

The reporting party describes the relationship as initially personal or romantic. Cryptocurrency investing was allegedly introduced after trust had been established.

The individual reportedly claimed knowledge of trading and provided step-by-step instructions for opening accounts, purchasing digital assets and transferring them to a separate trading environment.

This progression is consistent with the FBI's description of relationship-based investment fraud. According to the FBI, operators may begin through social media, texting, dating services or messaging applications; construct a persuasive persona; claim investment expertise; and then guide the target through the mechanics of purchasing and transferring cryptocurrency.

Use of Legitimate Exchanges as Funding Gateways

The report does not allege that Coinbase, Kraken or Crypto.com operated the questioned website.

Instead, those established exchanges were reportedly used as fiat-to-cryptocurrency gateways. The reporting party was instructed to open accounts, deposit conventional currency, acquire cryptocurrency and convert the assets into USDC or USDT.

The stablecoins were then transferred away from those exchanges, through a self-controlled on-chain wallet, to blockchain addresses associated with the externally introduced platform.

This distinction is important.

The appearance of a recognized exchange at the beginning of a payment chain does not validate the destination website or receiving wallet. Once assets are withdrawn to an external address, the exchange generally does not control that address and may be unable to reverse the transfer.

The FBI describes this precise operational structure: a target is instructed to create an account with a reputable exchange, fund it from a bank account, convert the money into a specified cryptocurrency and then transfer the assets into a separate investment platform or private wallet.

The Federal Trade Commission similarly warns that cryptocurrency investment operations may direct users to apparently professional online accounts while ultimately preventing withdrawals or conditioning them on high additional payments.

Website and Brand-Impersonation Assessment

Primary questioned domain

The principal domain identified in the report is:

bydfipto.com

The reporting party states that the trading interface was accessed through an on-chain wallet browser.

The platform reportedly displayed an announcement dated February 26, 2026, claiming that maintenance performed on February 21 had been completed. The announcement identified several supposed access points:

●bydfiit.com/syn/
●bydfipto.com/syn/
●bydkit.com/syn/

It also referenced the following domains as continuing to provide service:

●bydfies.com
●bydpx.com
●bydhyc.com

The use of multiple rotating or alternative domains can complicate user verification. It may also make it more difficult for customers, hosting providers and investigators to maintain a stable record of the service being accessed.

Alternative domains are not inherently unlawful. However, when a financial platform uses numerous lookalike domains while the established brand publicly identifies a different primary address, users should pause and independently verify the relationship before connecting a wallet or sending assets.

Current accessibility observations

During RSF's open-source review on July 12, 2026, an automated request to bydfipto.com received an HTTP 403 Forbidden response. This means the server declined the research tool's request. It does not, by itself, establish the purpose or legitimacy of the domain.

The addresses bydfiit.com/syn/ and bydkit.com/syn/ responded with pages titled "BYDFi," but the research tool did not retrieve substantive page text from either address.

Because online infrastructure can be changed, restricted or removed at any time, these observations represent a time-specific OSINT snapshot rather than a permanent finding.

Official BYDFi guidance

The established BYDFi service currently presents its trading platform through:

bydfi.com
In a security alert updated on March 21, 2025, BYDFi warned that unauthorized websites had imitated its design. It advised users to access www.bydfi.com directly and to use its official verification feature when checking channels or links.

This creates a significant verification issue for any website that uses "BYDFi" in its domain while operating outside bydfi.com.

RSF found no public statement from BYDFi, among the materials reviewed, identifying bydfipto.com, bydfiit.com, bydkit.com, bydfies.com, bydpx.com or bydhyc.com as authorized customer-access domains.

Absence from the reviewed materials does not conclusively prove that no relationship exists. Nevertheless, users should not infer affiliation from branding or domain similarity alone. Confirmation should come directly from the established company through a known official channel.

Material Conflict Concerning Singapore

The questioned website reportedly contained the following narrative:

●BYDFi was described as a Singapore-based digital-asset platform.
●It was said to be operated by BYDFi Pte Ltd.
●It was represented as adhering to Singapore regulatory standards.
●It referenced the Singapore Accounting and Corporate Regulatory Authority.

That presentation conflicts with BYDFi's own March 2025 security notice.

In its public warning, BYDFi stated that although it was established as BitYard in 2020 and rebranded as BYDFi in 2023, it had never promoted or conducted business operations in Singapore.

This is not a minor wording difference. Geographic location and regulatory status are material considerations when consumers assess a financial platform.

A website presenting itself as an access point for a known platform should not make corporate or jurisdictional representations that contradict that platform's public statements.

Prospective users should independently verify:

●the legal entity operating the website;
●the jurisdiction of incorporation;
● the regulator responsible for oversight;
●the precise service covered by any registration;
●the domain to which the registration applies; and
●whether the registered company actually controls the website being used.

Regulatory Claims Require Careful Interpretation

The questioned website reportedly referenced:

●a United States MSB registration number;
●a Canadian FINTRAC MSB registration number;
●Singapore corporate or regulatory standards.

Such references can create an impression of government approval. That impression may be misleading if the registration belongs to another entity, has expired, does not cover the website in question or is presented without explaining its limited scope.

A money-services-business registration is not equivalent to an investment endorsement, a guarantee of solvency, approval of a trading strategy or certification that every domain displaying the registration is authorized.
FINTRAC maintains a public registry through which users can examine the current status of money-services businesses and foreign money-services businesses.

Any licensing claim should be checked against the official registry using:
●the exact legal entity name;
●registration number;
●registration status;
●address;
●listed activities;
●initial registration date;
●expiry date; and
●associated trade names.

Most importantly, the user should confirm that the registered entity acknowledges ownership or operation of the precise website being accessed.

Displaying a genuine registration number does not prove that the website displaying it belongs to the registrant.

Reported Trading Environment

The platform allegedly offered cryptocurrency perpetual-contract trading.

Perpetual contracts are leveraged derivatives that may remain open without a fixed expiry date. They are complex and high-risk even when offered by an authentic, properly operated platform.

A professional-looking interface can display:

●account balances;
●open positions;
●profit-and-loss figures;
●trading histories;
●customer-service messages;
●compliance notices; and
●withdrawal controls.

However, an interface alone cannot establish that trades were actually executed on a market.

In deceptive investment environments, displayed balances may consist only of database entries controlled by the website operator. Apparent gains may not correspond to assets held in custody, and the platform may have no independent liquidity from which withdrawals can be paid.

The most reliable evidence is not the number displayed on a dashboard but independently verifiable custody, transaction execution, corporate identity and withdrawal performance.

Small Withdrawal and Confidence Building

The reporting party states that approximately $3,574 was successfully withdrawn on March 27, 2026.

A successful early withdrawal can appear to validate both the platform and the person who introduced it. It may cause the user to conclude that:

●the displayed balance is genuine;
●the trading process works;
●customer support is functional;
●funds remain under the user's control; and
●future withdrawals will also be honored.

The FBI specifically warns that investment-fraud operators may permit an early withdrawal to create an appearance of legitimacy and encourage larger deposits.

Accordingly, a small successful withdrawal should not be treated as conclusive evidence that a platform is financially sound or that its displayed profits are authentic.

The critical test is whether the user can withdraw the principal and purported earnings without being required to make an unrelated additional payment.

The 85,317-USDT "Risk Verification" Demand

The reporting party states that a larger withdrawal request was made on or around June 5, 2026.

Customer support allegedly responded that the account could not be unlocked unless the user:

●provided images of both sides of a government-issued identity document; and
●paid a "risk verification deposit" equal to 20% of the account value.

The additional amount requested was reportedly:

85,317 USDT

A request for additional cryptocurrency as a precondition to releasing an existing balance is one of the strongest warning indicators in this case.

The FBI advises that when a target attempts to withdraw the main balance, operators may freeze the account and impose arbitrary taxes or fees. The agency warns that these payments do not normally unlock the funds and instead create an additional loss.

The FTC likewise warns that users of deceptive cryptocurrency investment sites may be unable to withdraw money unless they first pay high fees.

Legitimate identity verification may require documents. It should not ordinarily require a customer to transfer a large new quantity of cryptocurrency to demonstrate "risk verification."

Any demand to send additional funds before an existing balance can be released should trigger an immediate halt, preservation of evidence and contact with the relevant exchange and law-enforcement authorities.

On-Chain Funding Address

The reporting party supplied the following as the self-controlled wallet from which the transfers originated:

0xFfC5059EC0F61D951dBcDbB7FBE1140b4884f18e

This is an Ethereum-format address. Ethereum-format addresses may also appear on compatible networks, so the address format alone does not establish the blockchain used.

Correct chain identification is essential because USDC and USDT circulate on multiple networks. Investigators should obtain the network name directly from the withdrawal record or explorer link for every transfer.

Reported Receiving Addresses

Two principal receiving addresses were submitted.

Receiving address A

0x41CB0551B9DAC61e7Ad61f336706a2BfB5e7Edf7

The reporting party attributes one transfer of approximately 3,037.98 USDT to this address.

Receiving address B

0x0B2eBECC6F2F396AE07eE555A9C6aE28520e2F37

The remaining six listed transfers were reportedly sent to this address in USDC or USDT.

The concentration of repeated high-value payments into address B makes it the most significant blockchain indicator in the submission.

However, an address alone does not identify a natural person. Attribution requires additional evidence, such as:

●exchange deposit clustering;
●known service labels;
●transaction flow analysis;
●account records obtained through legal process;
●IP and device data;
●communications connecting the address to the platform; or
●control demonstrated through signed messages or linked withdrawals.

Submitted Transaction Schedule

The reporting party supplied the following schedule. Transaction hashes are reproduced in normalized form where possible, but several require comparison with original exchange exports before final evidentiary use.

Transfer 1

●Asset: USDT
●Token amount: 3,037.98
●Reported dollar value: $3,034.84
●Destination: 0x41CB0551B9DAC61e7Ad61f336706a2BfB5e7Edf7
●Reported block: 24,750,955
●Reported timestamp: March 27, 2026, 19:22:23 UTC
The submitted transaction identifier appears incomplete or malformed and should not be published as verified until retrieved again from the originating wallet, exchange record or block explorer.

Transfer 2

●Asset: USDC
●Token amount: 24,989.856596
●Reported dollar value: $24,984.88
●Destination: 0x0B2eBECC6F2F396AE07eE555A9C6aE28520e2F37
●Reported block: 24,908,408
●Reported timestamp: April 18, 2026, 18:00:23 UTC
●Submitted transaction identifier:
0x5cbc86715c7212f9549a20e00060817713206316810dbbae9e22ca5b6fdb344e

Transfer 3

●Asset: USDC
●Token amount: 19,549.1
●Reported dollar value: $19,545.22
●Destination: 0x0B2eBECC6F2F396AE07eE555A9C6aE28520e2F37
●Reported block: 24,994,805
●Reported timestamp: April 30, 2026, 18:46:35 UTC
●Submitted transaction identifier:
0x4316e61cb4e82a550c748318c213f0b0685a1a2fb146a42d3a2737a8bb60b688

Transfer 4

●Asset: USDT
●Token amount: 9,896.302974
●Reported dollar value: $9,886.08
●Destination: 0x0B2eBECC6F2F396AE07eE555A9C6aE28520e2F37
●Reported block: 25,019,121
●Reported timestamp: May 4, 2026, 04:02:59 UTC
●Submitted transaction identifier:
0x53c7042c83edd0d4a479b5203bdc5846f24b5cf8c3ff89c70f54d580a57f7f19

Transfer 5

●Asset: USDC
●Token amount: 49,260.938126
●Reported dollar value: $49,251.13
●Destination: 0x0B2eBECC6F2F396AE07eE555A9C6aE28520e2F37
●Reported block: 25,073,289
●Reported timestamp: May 11, 2026, 17:14:59 UTC
●Submitted transaction identifier:
0xd63a794d79a8abac787823cbb1270f038ffeba5d9d6385733000116f056649fe

Transfer 6

●Asset: USDC
●Token amount: 49,363.462069
●Reported dollar value: $49,353.63
●Destination: 0x0B2eBECC6F2F396AE07eE555A9C6aE28520e2F37
●Reported block: 25,137,434
●Reported timestamp: May 20, 2026, 15:46:23 UTC
●Submitted transaction identifier:
0x074bcd820118b8002630bc44dbf793a49c962bcc7a1ca3abf7b24b4dcd3a3c20

Transfer 7

●Asset: USDC
●Token amount: 48,879.686269
●Reported dollar value: $48,856.46
●Destination: 0x0B2eBECC6F2F396AE07eE555A9C6aE28520e2F37
●Reported block: 25,223,666
●Reported timestamp: June 1, 2026, 16:17:11 UTC
●Submitted transaction identifier:
0x0f0a9d64de078319c1a2b9e60dbef0b18136018fdbca8253844dc5dad606a30e

Financial Reconciliation

The submitted report states a total loss of:

US$208,500

The seven listed transfers total:

●204,977.326034 units of USDC and USDT; and
●$204,912.24 using the dollar equivalents supplied beside each transaction.

This produces an unreconciled difference of:

●$3,587.76 between the stated $208,500 loss and the supplied dollar-value total.

The reported successful withdrawal of $3,574 is numerically close to this difference, but the relationship cannot be assumed.

There are several possible accounting explanations:

●the $208,500 figure may represent gross deposits before withdrawal;
●the listed dollar values may exclude exchange or network fees;
●one or more transactions may be missing;
●the stated loss may include bank-transfer or purchase costs;
●the stablecoins may have been valued at different times;
●the withdrawal may have been included or excluded inconsistently; or
●one of the reported amounts may contain a transcription error.

Before publication or submission to law enforcement, the case file should include a reconciliation table showing:

1.every bank transfer to an exchange;
2.every cryptocurrency purchase;
3.every exchange withdrawal;
4.every self-custody wallet transfer;
5.every platform withdrawal received;
6.all exchange and network fees; and
7.the final net loss.

A precise financial schedule will improve credibility and help investigators follow the complete movement of funds.

Operational Pattern Assessment

The reported sequence contains multiple characteristics identified by U.S. authorities as indicators of relationship-based cryptocurrency investment fraud.

1. Trust established before the investment proposal
The contact reportedly cultivated a personal relationship before introducing trading.
The FBI states that operators frequently create persuasive identities, express romantic interest and build trust before presenting an investment opportunity.

2. Claimed expertise
The individual allegedly represented himself as an AI engineer and portrayed himself as knowledgeable about cryptocurrency trading.
The FBI notes that operators often describe themselves or close associates as investment experts.

3. Use of reputable exchanges
The reporting party was reportedly directed to established exchanges to purchase cryptocurrency.
The FBI identifies this as a common first funding step.

4. Transfer away from the reputable exchange
Assets were then moved to a self-custody wallet and onward to externally supplied addresses.
This removed the funds from the immediate custody of the original exchanges.

5. Separate website supplied by the contact
The questioned platform was not discovered through independent financial research. It was reportedly supplied by the person promoting the investment.
The FBI cautions that such platforms may closely imitate legitimate sites and include professional-looking dashboards and customer-support portals.

6. Early withdrawal permitted
A small withdrawal was reportedly completed before substantially larger transfers were made.
The FBI identifies this as a confidence-building mechanism.

7. Large withdrawal obstructed
The main withdrawal was reportedly blocked after the user had committed significant funds.

8. Additional payment demanded
The platform allegedly required another 85,317 USDT to unlock the account.
This closely matches the FBI's warning concerning arbitrary taxes and fees imposed at the withdrawal stage.

Risk Assessment
Based on the totality of the submitted evidence and public information reviewed, RSF assesses the questioned operation as presenting a critical consumer and investor risk.

That assessment is based on the combination of:

●a relationship-led investment introduction;
●guided acquisition of cryptocurrency;
●transfer to externally controlled addresses;
●a website using branding associated with an established exchange;
●multiple alternative domains;
●corporate claims inconsistent with the established platform's public notice;
●authorization of a small initial withdrawal;
●obstruction of a larger withdrawal;
●demand for a substantial additional payment;
●pressure to submit identity documents; and
●incomplete transparency concerning the website operator.

No single indicator is determinative. Together, however, they form a highly concerning pattern.

RSF recommends that users refrain from sending funds, identity documents, wallet approvals or authentication information to the questioned domains unless ownership and authorization can be independently established through the recognized BYDFi service and relevant regulators.

Indicators for Investigators and Compliance Teams

Domains reported or identified

●bydfipto.com
●bydfipto.com/syn/
●bydfiit.com/syn/
●bydkit.com/syn/
●bydfies.com
●bydpx.com
●bydhyc.com

Official comparison domain

●bydfi.com

The official comparison domain is included to help distinguish the recognized service from the questioned domains. It is not listed as an adverse indicator.

Reported contact identity

●George Gu
●顧春辰
●Claimed AI engineer
●Claimed San Jose, California resident

Reported telephone indicators

●+1 415-216-7745
●+1 415-841-5587

These numbers should not be treated as proof of identity. Investigators should consider number reassignment, caller-ID manipulation, virtual-number services and unauthorized use.

Originating wallet supplied by the reporting party

●0xFfC5059EC0F61D951dBcDbB7FBE1140b4884f18e

Receiving wallets

●0x41CB0551B9DAC61e7Ad61f336706a2BfB5e7Edf7
●0x0B2eBECC6F2F396AE07eE555A9C6aE28520e2F37

Terms reportedly used by the platform

●"risk verification"
●"risk verification deposit"
●"unlock account"
●"20% of account value"
●"maintenance and optimization"
●"alternative access address"

These phrases may assist investigators searching communications, complaints and platform records for related activity.

Recommended Immediate Actions for Affected Users

Anyone who has transferred cryptocurrency to the listed addresses or interacted with the questioned domains should stop sending further assets.
Affected users should preserve:

●complete WhatsApp exports;
●screenshots of profiles and telephone numbers;
●voice messages and call logs;
●all website screenshots;
●the full URL of every page visited;
●wallet connection records;
●customer-support messages;
●account-balance displays;
●withdrawal-denial notices;
●requests for taxes, verification or unlocking payments;
●exchange statements;
●bank records;
●transaction hashes;
●receiving addresses;
●token contract addresses;
●network names;
●timestamps in UTC;
●device information; and
●any identity documents submitted.

The FBI advises cryptocurrency complainants to provide addresses, asset types, amounts, transaction hashes, dates, domains, telephone numbers and details explaining how contact was established.

Reports should be made promptly to:

●the originating cryptocurrency exchange;
●the receiving exchange, if blockchain tracing identifies one;
●local law enforcement;
●the FBI Internet Crime Complaint Center in applicable U.S. cases;
●the Federal Trade Commission;
●relevant state financial or securities regulators; and
●appropriate authorities in any other affected jurisdiction.

Cryptocurrency transfers are generally difficult to reverse. Rapid reporting may nevertheless improve the possibility of identifying a custodial destination before assets are moved again.

Users should also be cautious of unsolicited recovery offers. The FBI warns against cryptocurrency recovery services that demand advance payments, and the FTC similarly cautions that parties promising recovery in exchange for upfront fees may create a second financial loss.

Guidance for Exchanges and Blockchain-Compliance Teams

Exchanges receiving a report involving these addresses should consider:

●preserving relevant know-your-customer records;
●reviewing linked deposit and withdrawal activity;
●identifying account clusters;
●examining rapid asset conversion;
●tracing movements into bridges, mixers or other exchanges;
●reviewing device fingerprints and IP logs;
●identifying common funding sources;
●preserving support communications;
●checking whether multiple customers referenced the same website or telephone numbers; and
●responding promptly to valid law-enforcement requests.

Stablecoin issuers and relevant blockchain-intelligence providers may also be able to assist competent authorities in mapping subsequent movement, identifying service exposure and preserving attribution leads.

Questions Requiring Further Investigation

The present record does not yet answer several important attribution questions:

●Who registered each questioned domain?
●Were the domains registered using the same email address, registrar account or payment method?
●Do they share hosting, analytics codes, TLS certificates or infrastructure?
●Did they resolve to common IP addresses?
●Are additional domains linked through page source, JavaScript, APIs or wallet-connection logic?
●Which blockchain network carried each reported transfer?
●Which token contracts were used?
●Where did the receiving wallets send the assets next?
●Did downstream transfers reach identifiable exchanges?
●Are the receiving addresses associated with other publicly reported cases?
●Who controlled the telephone accounts during the relevant period?
●Were the profile photographs taken from another person?
●Was the reported name an alias?
●Was any wallet approval signed in addition to the direct transfers?
●Did the platform collect identity documents for further misuse?
●Which entity, if any, owns or operates the questioned websites?
●Were the displayed U.S. and Canadian registration numbers assigned to the operator of those domains?

These questions require deeper blockchain analytics, historical DNS data, registrar records, hosting-provider cooperation and, in some instances, compulsory legal process.

Public Warning

Do not rely on a trading platform merely because:

●it displays the logo of a recognized company;
●its domain contains a familiar brand name;
●it cites a regulatory number;
●its interface shows profits;
●customer support responds quickly;
●a contact appears knowledgeable;
●an early withdrawal succeeds; or
●the person introducing it claims to care about your financial future.

Verify the exact domain through the established organization's official website. Confirm the legal entity independently. Search official regulatory databases. Test withdrawals cautiously. Never send a large "verification," "tax," "liquidity," "margin," "security" or "unlocking" payment merely to release funds already shown in an account.
A displayed account balance is not proof that recoverable assets exist.

Call for Information

RSF is seeking additional reports concerning:

●bydfipto.com
●bydfiit.com
●bydkit.com
●bydfies.com
●bydpx.com
●bydhyc.com
●the telephone numbers listed in this alert;
●the reported identity "George Gu" or 顧春辰;
●the two receiving addresses; and
●demands for an 85,317-USDT or 20% "risk verification" payment.

Individuals submitting information should include original records wherever possible. Sensitive personal information should not be posted publicly. Unredacted identity documents, seed phrases, private keys and account passwords must never be shared.

Methodology and Limitations

This alert is based on:

●information submitted to RSF;
●transaction details supplied by the reporting party;
●publicly accessible BYDFi materials;
●current website-access tests;
●official FBI and FTC consumer guidance; and
●arithmetic review of the listed transfers.

RSF did not have access to:

●domain registrar account records;
●historical passive-DNS databases requiring specialist access;
●hosting-provider subscriber information;
●telephone carrier records;
●exchange account ownership records;
●private blockchain-attribution systems;
●the questioned platform's internal ledger;
●original unbroken exports for every transaction hash; or
●a court or law-enforcement attribution finding.

The inability to access these records limits any conclusion about the real-world operator.
Website availability and blockchain balances can change after publication. Readers and investigators should record the date and time of their own observations.

Right of Reply

RSF welcomes verifiable corrections from any person or entity identified in this report.

A meaningful response should include documentary evidence addressing:

●ownership of the questioned domains;
●authorization to use the BYDFi name;
●the legal entity operating the service;
●the basis for the Singapore representations;
●the relationship between the domains and bydfi.com;
●custody of customer assets;
●execution of purported trades;
●the purpose of the 20% verification demand;
●control of the listed receiving addresses; and
●the mechanism through which users can withdraw without sending additional funds.

Corrections supported by reliable evidence should be incorporated into the public record.

Publication Disclaimer

This article reports allegations, technical indicators and open-source findings for public-awareness and investigative purposes.

The reported identity, contact details, domains and wallet addresses have not been adjudicated by a court. Publication does not establish criminal responsibility, beneficial ownership or control by any particular person.

Names and telephone numbers may be falsified, impersonated or used without authorization. Blockchain addresses are pseudonymous and do not independently identify their controller.

The established BYDFi platform is discussed because the questioned websites reportedly used similar naming and representations. This report does not allege that the recognized service at bydfi.com, Coinbase, Kraken or Crypto.com operated or endorsed the questioned activity.

Readers should conduct independent due diligence and provide relevant evidence to qualified law-enforcement, legal and blockchain-forensic professionals.

Report Link: https://rsf.report/form

Website Reputation Checker: https://rsf.report/reputationchecker

Press contact:
Dale Olson
2710 Alpine Blvd, Suite K
Alpine, CA 91901-2276
United States
Phone: +1 (657) 274-8769
Email: support@rsf.report

RSF provides AI-assisted fraud detection and digital forensic services designed to help organizations and individuals identify suspicious financial activity, analyze transaction patterns, and support investigations into potential financial misconduct. By combining advanced analytics with experienced forensic methodologies, RSF aims to enhance financial security, improve investigative efficiency, and promote informed decision-making through evidence-based analysis.

This release was published on openPR.