Steam Exchange (STEAMX) / Rails Network - Full Investigation

1

Executive Summary

Steam Exchange Inc. (Ontario corp #002846823, Vaughan, ON) operates a crypto project claiming to build a hybrid exchange on their custom "Rails Network" blockchain (Chain ID 6278). Our investigation reveals a project built on misleading explorer data, automated wash trading, investor fees sent to a gambling casino, and a geth fork marketed as a "revolutionary" custom blockchain.

What They Claim

193,823,272 transactions on blockchain
28,634,064 wallet addresses
$1,807.68 token price (explorer)
"Innovative PoWbA consensus mechanism"
~17,000 engaged Twitter followers
FINTRAC registered MSB
"Security on every level"

What We Found (Live Verified)

302,456 actual transactions (explorer shows Blockscout default placeholder: 193M)
4,718 actual addresses (explorer shows Blockscout default placeholder: 28M)
$0.061 actual price (explorer shows Blockscout default placeholder: $1,807)
Renamed geth fork with 2 centralized nodes
~2,800 real followers, 62% fake/botted
MSB expired Sept 2, 2023 (2.5+ years ago)
Node accounts + keystore paths exposed on public RPC, all admin/debug modules open
"USDC" on Rails is team-minted, not Circle-issued. Real money extracted on BSC -> Stake.com

2

@Steam_Exchange Follower Quality Analysis

62%

Fake / Bot / Alt

16,743

Claimed Followers

~2,800

Estimated Real

17% Real (~2,800)

21% Inactive (~3,643)

62% Fake/Bot/Alt (~10,300)

Engagement Rate

0.37%

Healthy: 2-5%

Avg Likes/Post

37

Expected at 2%: ~234

Avg Views/Post

~1,700

10% of followers see posts

Follower:Following

229:1

16,743 / 73 following

Website Visitors

0/month

Domain Rating: 6/100

Total Tweets

697

~0.38/day over 5 years

Account Age

~5 years

Created May 2021

Blue Verified

Yes

Paid subscription

Cross-Platform Reality Check

If 16,743 followers were real, engaged people, these platforms would show proportional activity:

Platform	Actual	Expected (if real)	Gap
Telegram members	1,726	~5,000+	-65%
Telegram (historical peak)	was ~9,000 -> now 1,726	--	-81% loss
Reddit subscribers	1,837	~2,500+	-27%
Discord members	1,614	~3,000+	-46%
Website monthly visitors	0	~1,000+	-100%
24h trading volume	$766	~$50,000+	-98.5%
GitHub stars	1	~50+	-98%
CMC watchlist adds	33,887	--	Inflated?
Trustpilot reviews	9	~50-100+	-90% (7 coordinated)
Exchange listings	0 CEX	1-3+	None

Post Engagement Samples (Verified)

Date	Post	Likes	Reposts	Replies	Views	Eng%
2025-08-27	P2P Market launch (best post)	99	49	20	4,194	1.00%
2026-01-20	Scam warning (fake airdrop)	47	30	17	2,216	0.56%
2025-08-13	Support reply (migration)	0	0	0	222	0.00%
2025-08-06	Migration thread replies	1	0	0	119	0.01%

Their BEST post (a major product launch) got 99 likes from 16,743 "followers." At a healthy 2% engagement rate, that should have been ~234 likes minimum. The average post gets 0-47 likes.

The Math Doesn't Work

If followers were real:

* 16,743 followers at 2% engagement = ~335 likes per post

* 16,743 followers at 15% view rate = ~2,511 views per post

* 16,743 followers at 30% Telegram ratio = ~5,023 TG members

* 16,743 followers visiting site = ~1,000+ monthly visitors

* 16,743 followers trading = meaningful volume ($50K+/day)

What actually happens:

* Average 37 likes (0.37% rate -- 5.4x below threshold)

* Average ~1,700 views (10% -- below healthy 15%+)

* Telegram: 1,726 (10.3% -- down 81% from 9K peak)

* Website: 0 visitors (literally zero)

* Trading: $766/day (98.5% below expected)

Even Their Own Community Noticed

Reddit user on r/SteamExchangeToken: "Anybody know why the twitter is botted?"

Bot Network Evidence

* Zero Google-indexed replies -- Google has not indexed a single reply to @Steam_Exchange. For a 16K follower account, this means replies are too low-value for Google to bother indexing.

* Losing ~6 followers per day (CertiK tracking) -- consistent with X purging bot/inactive accounts.

* Peaked at ~20,300 followers (2021), now ~16,700 -- 15-17% decline over the project's lifetime.

* No crypto analytics tools index STEAMX -- Sorsa/TweetScout, Kaito AI, LunarCrush all show no data. These tools index any project with real engagement.

* CMC defender sockpuppets: @rs1d68trulvn and @q3xxkapixpev are randomly generated handles with zero web presence. Throwaway accounts.

* @holdtowin61: 15,150 tweets / 301 followers = 50:1 ratio. Airdrop farmer promoting $TOBY, $SOMO, $AIX alongside $STEAMX.

* 2021 hashtag farming: Early tweets used #SAFEMOON #bscgems #BSC -- classic BSC pump-era bot engagement hashtags.

* Trustpilot reviewer "Alin Cristian" = Twitter @alincristi87885 (8 tweets, 23 followers -- bot-like). Used "PoWbA" in his review (insider-only term). Steam Exchange team replied to 5 reviews within hours -- they were expecting them.

* "PoWbA" exists NOWHERE outside STEAMX materials -- zero in blockchain literature, Twitter, or academia. Anyone using this term is directly connected to the project.

* Vote botting confirmed: 6,165 CoinVote votes + 951 CoinSniper votes from a community of ~25 real people. Also listed on CoinScope, CoinLaunch, CoinAlpha, CryptoNextGem.

* ZERO quote tweets of any STEAMX post indexed by Google. "$STEAMX" + "LFG"/"WAGMI"/"bullish"/"just bought" returns nothing. Nobody organically engages.

* Claimed "3 major media commercials - 2 Radio, 1 TV - associated with NBA and NHL teams" per Blockcast interview. Zero evidence these ever aired.

* #FullSteamAhead hashtag: Neville's LinkedIn uses it, but zero usage found on Twitter. Nobody outside the inner circle promotes this.

* Complete network mapped: 62 accounts across all platforms. Only 25-28 ever publicly interacted. Only 5-7 genuinely independent. 32 forum members. StockTwits: 5,130 watchlist but EMPTY discussion. Instagram: 1,314 followers, 9 posts. ZERO YouTube, TikTok, BitcoinTalk, Discord, or independent journalism. ~17,000 X "followers" but the identifiable real audience is under 30 people.

Verdict: Majority of Followers Are Not Genuine

Four independent signals converge: (1) engagement rate 5.4x below suspicious threshold, (2) zero organic website traffic, (3) cross-platform community sizes 50-100% below expected ratios, (4) $766/day trading volume from "17K followers." The real engaged audience is approximately 2,800 accounts. The remaining ~10,300 (~62%) are fake, botted, purchased, or completely dead accounts that never interact with the project in any way.

Methodology: Multi-factor analysis combining engagement-based estimation, view-to-follower ratio, cross-platform triangulation (Telegram, Reddit, Discord, website traffic), and trading volume correlation. Confidence: HIGH (4/4 independent data sources available).

3

Blockchain Analysis: Rails Network

Chain ID: 6278 | Client: Grails/rpcjson/v1.1.2 (geth fork) | Go 1.20.7 (~3yr old)

Metric	Explorer Frontend	Explorer API (Real)	Discrepancy
Total Transactions	193,823,272	303,418	638x
Wallet Addresses	28,634,064	4,718	6,069x
Token Price	$1,807.68	$0.061	29,558x

What happened: The explorer frontend shows Blockscout's stock placeholder data (hardcoded defaults that ship with every Blockscout installation, including Ethereum-like values). Due to a React Query hydration bug and running in development mode, the real API data never replaces the placeholders. The API itself returns correct numbers. This is a configuration error the team has never fixed -- not deliberate number injection. However, it means anyone visiting the explorer sees numbers that are 638x-29,558x higher than reality, and the team either doesn't know or doesn't care enough to fix it.

Source: explore.steamexchange.io/api/v2/stats (real data) vs frontend display (Blockscout defaults). Verified April 5, 2026.

Validators

2

net_peerCount: 1

Empty Blocks

86%

0 transactions

Net Utilization

0.04%

Ghost chain

Total Tokens

8

Inc. test tokens

Validator Addresses (Live Verified)

V1: 0x62780E457a5295518b40917430984eBcA3116b54 (6,357,303 validations)

V2: 0x62780E658bdE13bC4b8235F02E8CFfF9652c3daC (6,275,386 validations)

Both share 0x62780E prefix (= Chain ID 6278). Both funded by same address with exactly 100 STEAMX on June 24, 2024. Combined rewards: ~$893. Neither has ever withdrawn.

3b

Telegram Channel Evidence

All 20 messages from the official Steam Exchange Announcements channel collected and analyzed. The channel confirms centralized chain control, security incidents, and project abandonment.

Last Announcement

Oct 29, 2024

~18 months of silence

Official Chat Members

228

@SteamExchangeToken

Rails Network TG

5

Subscribers. Dead.

Centralized Chain Control -- Admitted in Their Own Words:

Security Incident #1 -- Transaction Reversal

"All funds have been successfully recovered, and all malicious transactions have been reverted."

A real decentralized blockchain cannot "revert transactions." This confirms single-party chain control.

Security Incident #2 -- Chain Halted, RPC Killed, Prices Reversed

"110% unauthorized price pump occurred. RPC node stopped, new security protocols implemented on STEAMX/WSTEAMX, enhanced PoWbA consensus, cross-chain restrictions added. Transaction reversal completed to pre-attack price level."

They stopped the entire chain, rolled back prices, and reversed all transactions. Hashtag response: #CheckMate #TooSoonJr

Chain Reset + Balance Restoration

"We are pleased to announce that we are now back online..." -- describes chain reset, RPC issues, balance restoration. Recommends clearing MetaMask activity data.

Balances were "restored" after a chain reset. On a real blockchain, you cannot simply reset and restore balances.

Neville Divecha Forwarding Security Messages Personally

"YOUR FUNDS ARE SAFE!" + "Our domain is https://steamexchange.io/ if you see any links that do not have that domain, it is a scam."

Neville personally forwarding "your funds are safe" messages while funds were being sent to Stake.com.

Dead Ecosystem Confirmed:

Channel / Project	Members	Status
Announcements Channel	Unknown	Silent since Oct 2024
Official Chat (@SteamExchangeToken)	228	Private, private/inaccessible
Rails Network TG	5	Dead
Fantasy Friends / Portfolio Wars	100	Rebranded, effectively dead
Discord Server	1,614	No public content found
Forum (forum.steamexchange.io)	--	Last post Nov 2025
Website Monthly Visitors	0	BitDegree: "untracked" due to inactivity

Jb6111 Confirmed as Ecosystem Builder

Official Telegram post: "X Space scheduled with project owner Jb6111. '.rails or .steamx domain' feature enabling custom wallet addresses." -- This confirms JB's role as Rails Name Service owner, announced by the official Steam Exchange account.

Trustpilot Review Timing

All 9 Trustpilot reviews for steamexchange.io appeared in August 2025 -- approximately 3 months after the CryptoFlan article was published. All 4-5 stars with language emphasizing "transparency" and "long-term commitment." No reviews before or after.

Zero Response to Investigation

Despite the CryptoFlan article (May 2025) and this investigation, no public response has been found from Steam Exchange, Neville Divecha, or Chris Beckford on any platform -- no Medium rebuttal, no forum post, no tweet, no Telegram message.

Source: Public Telegram channel t.me/s/SteamXchangeAnnouncements. All 20 messages collected April 2026.

4

Wash Trading Proof

81.1%

of ALL chain transactions are automated wash trades

Bot Address	Transactions	% of Chain	Pattern
0x3ea13064...d4c4	86,835	28.7%	WSTEAMX/USDC swaps q30-60s
0xe8e68C5B...45FB	85,274	28.2%	WSTEAMX/USDC swaps q30-60s
0xA1b48375...b45D	73,239	24.2%	WSTEAMX/USDC + deployed contracts
TOTAL BOTS	245,348	81.1%	All send fees to 0x0Fe858A6...
Real organic activity	~57,108	18.9%	Over 22 months of operation

Source: Explorer API address data. All bot addresses verified via transaction pattern analysis showing identical automated WSTEAMX/USDC swaps every 30-60 seconds, 24/7.

Ultimate Smoking Gun

Investor Fees Were Funneled to Stake.com -- A Crypto Gambling Platform

7% of every transaction (4% "platform" + 3% "marketing") was converted to BNB and sent to a single consolidation wallet, which deposited 100% of outgoing funds into Stake.com. ~2,694 BNB (~$700K-$800K) across 310 outgoing transactions over 17 months. Zero BNB to any other destination.

INVESTORS buy/sell STEAMX (13% tax on every transaction) | v TOKEN CONTRACT (0xc0924e...63b5) |-- 4% BNB --> PLATFORM WALLET (0xb52f30...5c55) [672 tx] --+ |-- 3% BNB --> MARKETING WALLET (0x2e2791...e28f) [691 tx] --+ |-- 4% --> LP (PancakeSwap -- NOW DRAINED: $8.31 left) | |-- 2% --> Reflections to holders | v CONSOLIDATION WALLET (0x516bb0...0Bdb) [1,857 transactions] | v STAKE.COM 6 (GAMBLING) (0xFa5001...2741)

Sampled Stake.com Deposits (partial -- 38 pages of transactions exist):

Date	BNB	~USD
2024-01-24	100.353	~$59,600
2024-01-16	88.613	~$52,700
2024-01-04	87.623	~$52,100
2023-08-31	96.726	~$41,000
VERIFIED TOTAL (all 38 pages summed)	~2,694 BNB	~$700K-$800K

310 outgoing transactions. 100% to Stake.com. Zero BNB sent to any other wallet, exchange, or individual. Every single wei went to gambling.

Period

Aug 2022 - Jan 2024

17 months continuous

Outgoing to Stake.com

310 transactions

~2,694 BNB total

All wallets now

EMPTY ($0)

Extraction complete

Translation: Investors bought STEAMX on BSC with real BNB. 7% of every trade was automatically converted to BNB and routed to a gambling casino. This continued for 17 months across 1,857 transactions. All wallets now drained to zero. LP drained to $8.31. Then they migrated investors to their own private chain, gave them fake "USDC" the team minted themselves (not issued by Circle), and a worthless STEAMX token on a 2-node geth fork. Real money extracted. Fake tokens in return. Bridge shut down so nobody can test if anything is backed.

Verified Transaction Hashes (click to view on BscScan):

Date	BNB	Tx Hash (click to verify)
2024-01-24	100.35	0x333f14c7...
2024-01-16	88.61	0x5f1c6a45...
2024-01-04	87.62	0xe78bf6f5...
2024-01-02	101.77	0x13d14e82...
2023-12-25	92.82	0xeaf932a8...
2023-12-16	76.93	0xdefa624d...
2023-08-31	96.73	0x34fb5477...

7 of 1,857 transactions shown. Full history: View all 38 pages on BscScan

Consolidation Wallet Platform Wallet Marketing Wallet Stake.com 6 (Verified Label)

No-KYC Exchanges Used for Fund Obfuscation

* FixedFloat (no-KYC instant swap) sent funds INTO the consolidation wallet -- adding a layer of obfuscation before the Stake.com deposits

* ChangeNOW (no-KYC exchange) received $8,912 (15 BNB) from a connected "Exchange" wallet (0x975d9Bd9...) on Nov 21, 2024

* These are privacy-focused swap services specifically designed to avoid KYC requirements -- their use in this context suggests deliberate fund trail obfuscation

Deployer Funding Chain (3 hops traced)

0xbAF9A5d4... (origin, 47 tx, still active March 2026, deploys contracts via 1inch) |-- sent 970 BNB ($576K) v 0xd72e8010... (466 tx, dormant since Aug 2022) |-- sent 6 BNB ($3,565) on July 4, 2021 v Steam Exchange: Deployer (0x0542Df7d...) |-- funded Platform wallet, Marketing wallet, + 3 other connected wallets |-- funded 0x76e6a920... which funded the #3 holder (bridge deployer + wash bot funder)

The origin wallet (0xbAF9A5d4...) is still active as of March 2026 and deploys contracts via 1inch Router. Law enforcement can subpoena exchange records for the KYC identity behind the Binance withdrawals that funded the migration contract creator.

20+ interconnected wallets mapped across BSC, Rails Network, Binance, FixedFloat, ChangeNOW, Squid/Axelar, Hyperlane, MEXC, and PancakeSwap. Full transaction history (38 pages)

Irrefutable Evidence Chain (every link proven with tx hashes)

Each step below is independently verifiable on BscScan. Click any tx hash to see the proof.

1

Contract fee structure (hardcoded in Solidity)

V2 contract verified source: _platformFee = 4, _marketingFee = 3 (7% combined, sent as BNB). Owner can change wallet addresses via setPlatformAddress() and setMarketingAddress().

Verify: BscScan contract source code

2

Contract distributes BNB to fee wallets (~6,900 internal tx)

Every trade triggers swapAndLiquify which converts STEAMX to BNB and sends ~0.041 BNB to platform wallet, ~0.055 BNB to marketing wallet.

Example tx: 0x9f2d9f19...

3

Fee wallets forward 100% to consolidation wallet

Platform wallet (672 tx) + Marketing wallet (684 tx) both send every BNB received to 0x516bb07d.... Zero BNB retained in either wallet.

Example tx: 0x7a323f05... (0.58 BNB platform→consolidation)

4

Consolidation sends 100% to Stake.com 6 (gambling casino)

310 outgoing transactions, ~2,694 BNB total. 100% to Stake.com. Zero to any other destination. Zero returns ever received. Wallet now drained to $0.

Example tx: 0x333f14c7... (100.35 BNB → Stake.com 6, Jan 24 2024)

5

Stake.com = Licensed Gambling Casino (verified)

Operator: Medium Rare N.V. (Company #145353, Curacao). License: OGL/2024/1451/0918 (Curacao Gaming Authority). Founded 2017 by Edward Craven & Bijan Tehrani. BscScan name tag: "Stake.com 6" under category: "Exchange". Holds 3,608 BNB (~$2.1M) and $10.2M+ in tokens.

Verify: BscScan "Stake.com 6" label | Wikipedia: Stake (online casino)

Every single link is independently verifiable. The contract code is verified on BscScan. The internal transactions are public. The wallet-to-wallet transfers are public. The BscScan name tag "Stake.com 6" is visible to everyone. Stake.com's gambling license is public. The deployer is labeled "Steam Exchange: Deployer." There is no ambiguity, no interpretation, no assumption. Investor money → 13% tax → BNB → fee wallets → consolidation → gambling casino. On-chain. Permanent. Irrefutable.

Gambling Behavior Analysis: Classic Loss-Chasing Pattern

We analyzed 22 of 38 pages of the consolidation wallet's history. Zero BNB was ever returned from Stake.com. Not a single satoshi. This was 100% one-way gambling -- every bet was either lost or re-gambled until lost.

Smallest Bet

0.08 BNB

~$20

Largest Single Bet

134 BNB

~$40,000

Returns from Stake

$0

Zero. Nothing. Ever.

Est. Volume Taxed

~$10M-$13.5M

38,486 BNB total trades

Escalation Timeline (investor money → gambling)

Aug-Sep 2022

0.26 - 4.9 BNB

Oct 22-Mar 23

0.08 - 9.9 BNB

Apr-Jun 2023

Up to 64.9 BNB

Jul-Aug 2023

Up to 87 BNB

Sep-Nov 2023

Up to 134 BNB

Dec 23-Jan 24

100+ BNB until $0

* Bet sizes escalated 500x+ over 17 months (0.26 BNB → 134 BNB)

* 92.82 BNB gambled on Christmas Day 2023

* Multiple same-day deposits (Jul 1, 2023: two bets totaling 151 BNB)

* Final act: 100.35 BNB to Stake.com on January 24, 2024. Then silence. Wallet empty.

* ~$10M-$13.5M in total investor trading volume was taxed at 7%, feeding this gambling habit

Smoking Gun #2

The Infrastructure Deployer Directly Funded the Wash Trading Bots

On-chain transaction analysis proves the wash trading is an inside operation:

Bridge Deployer -> Bot Wallet A

From: 0x2454Cd61...1337

To: 0xA1b48375...b45D

Amount: $78,757.91 USDC

Date: Sept 12, 2025

Bridge Deployer -> Bot Wallet B

From: 0x2454Cd61...1337

To: 0x3ea13064...d4c4

Amount: $20,000 USDC (2 transfers)

Date: Sept 6-8, 2025

Additionally:

Bot Wallet A is the SOLE liquidity provider -- holds 100% of all LP tokens (882,262 out of 882,262 total supply). LP provider count: 1.
Admin wallet minted USDC to itself in multiple transactions (2024), distributing to bridge proxy and LP pool. Total USDC on chain: ~$522K across 476 holders with $221K concentrated in the DEX LP pool.
Central deployer (0x76e6a920...1337) created the DEX factory + router, funded the genesis wallet, AND holds test tokens ("AAA", "mainnettest1") -- one entity controls everything.
Genesis distribution sent 99.8% of all tokens to ONE wallet (0x1b8EeF88...) -- 2,594,862 STEAMX. The other ~47 wallets got exactly 100 STEAMX each.

This is not speculation. The on-chain data proves the team deployed the infrastructure, minted the stablecoins, funded the bots, and provided 100% of the liquidity. The "trading activity" on Rails Network is entirely self-dealing.

5

Security Vulnerabilities (Live Verified)

These affect the CURRENT live chain

Verified on mainnet.steamexchange.io (Chain ID 6278), April 5, 2026. Live production chain, actively producing blocks. All user funds below are on this chain.

Real Money Extracted (BSC)

~$700K-$800K

Verified -> Stake.com

BSC LP Drained

$8.31 left

Was significant liquidity

BSC Holders Stranded

19,228

At $0.0003, no liquidity

Bridge Down

18 months

No exit from Rails

Claimed value on Rails (not real): The chain shows ~$522K "USDC" (476 holders) and ~$452K in WSTEAMX (125 holders) -- a claimed ~$974K total. But this "USDC" was minted by the admin wallet, not by Circle. It has no verified backing. The WSTEAMX price is set by wash trading bots. These numbers create the appearance of value, but the real money was already extracted on BSC and sent to Stake.com.

Latest block verified: 12,494,346 (live)

Block miner: 0x62780E457a...6b54 (Validator 1)

Block difficulty: 591,341 (trivially low)

Network utilization: 0.043% (effectively idle)

CRITICAL ALL 8 RPC Modules Publicly Exposed

Both mainnet and testnet expose admin, debug, personal, and txpool modules. This enables:

debug_setHead - Can rewind the entire blockchain

admin_peers - Dumps full network topology with IPs

personal_sendTransaction - Accepts calls on mainnet

txpool_content - Dumps all pending transactions

Verify: POST to mainnet.steamexchange.io with {"jsonrpc":"2.0","method":"rpc_modules","params":[],"id":1}

HIGH 3 Node Accounts + Server Filesystem Paths Exposed on Public RPC

personal_listWallets exposes keystore file paths, account addresses, and creation timestamps to anyone:

0xf04c0194...febe17 path: /rails/data/keystore/UTC--2024-01-26... (genesis day)

0x1cbb77fc...13b4c path: /rails/data/keystore/UTC--2026-03-31... (4 days ago)

0xc773b34e...d20a path: /rails/data/keystore/UTC--2026-03-31... (18 min later)

Accounts are password-locked (--allow-insecure-unlock not set), so transactions can't be signed remotely without the password. But the exposure leaks the server directory structure (/rails/data/keystore/), confirms active account management (2 accounts created days ago), and combined with the exposed admin/debug modules creates a dangerous attack surface if passwords are ever compromised. Testnet exposes 4 accounts. All hold zero balance.

Verify: POST {"jsonrpc":"2.0","method":"personal_listWallets","params":[],"id":1} to mainnet.steamexchange.io

CRITICAL All Server IPs Exposed - Hetzner Cloud

5.78.82.119 Mainnet RPC

5.161.104.217 Mainnet Depot

5.161.122.169 Testnet RPC

5.161.118.108 Testnet Miner 1

5.161.115.147 Testnet Miner 2

5.161.146.61 Testnet Depot

Discovered via admin_nodeInfo RPC calls. All Hetzner Cloud Germany. nginx/1.18.0 (Ubuntu 20.04 era, outdated with known CVEs).

CRITICAL V2 Smart Contract Backdoor

The V2 BSC contract (0xc0924e...) contains an unlock() function that allows the previous owner to reclaim ownership after a timelock expires, even after "renouncing." The SourceHat audit only covered V1 - this backdoor was NEVER AUDITED. Ownership is NOT renounced on either V1 or V2.

Source: SourceHat Audit + V2 contract code on BscScan

CRITICAL V1 "Liquidity Fee" Was a Team Extraction Mechanism

The SourceHat audit (July 4, 2021) explicitly documented that the V1 contract's "5% liquidity fee" does NOT add liquidity to the LP:

"The function converts half of the contract's $STEAMX balance to BNB, and then sends that new amount of BNB to the 'SX Wallet'"

Investors were told 5% of every trade went to "liquidity." It went to a team wallet as BNB. The V2 contract made this explicit with 4% Platform Wallet + 3% Marketing Wallet (7% to team as BNB), plus owner-callable setter functions to change all wallet addresses and fee percentages at any time: setPlatformFeePercent(), setMarketingFeePercent(), setPlatformAddress(), setMarketingAddress()

Source: SourceHat Audit — "SwapAndLiquify" function analysis. V1 Contract

6

Team & Persons of Interest

Gary Bard FILED LAWSUIT

Founder & CEO -- filed a Statement of Claim for constructive dismissal (per Telegram Post #36). Didn't just leave -- was forced out and sued. Last tweeted ~May 2022. Complete silence since.

X: @bard_gary (since Feb 2013) | Education: York University (Toronto) | LinkedIn: gary-bard-9a0655212
Claims to have "run one of the largest AION mining pools in the world, from his basement" (unverified). Named spokesperson on Rails Network press releases. Uses paid Newsfile Corp distribution to syndicate to Yahoo Finance, Benzinga. Bio: "Helping Create a Safe Space in the Crypto Ecosphere." No other corporate registrations found.

Neville Aspi Divecha

President & Co-Founder, Head of Operations

X: @NevDivecha | GitHub: divechan (confirmed via corporate email in commits) | FB: neville.divecha
Career (self-reported): Bell Canada (Network Admin) -> WSIB -> IBM ("Senior Analyst" — actual duties: managing RSA databases, administering static PINs, writing process docs for Windows 7 re-imaging and VPN testing = junior IT work) -> DHL International (Senior Infrastructure Specialist) -> Steam Exchange (2021)
Education: Seneca College of Applied Arts and Technology (likely diploma, not bachelor's -- specific program unknown), ITIL Foundations certified
Email: neville.divecha@steamexchange.ca (verified in GitHub commits) | Phone: 1-833-783-2691 (FINTRAC filing)
GitHub: 8 repos, ALL forks (Blockscout, Uniswap V3 docs, Graph Node), zero original code. Bio: "Focusing"
CertiK Skynet: Score 77.04 (BBB) — but NOT actually audited, team NOT verified, only 2 users and 2 txs in 7 days
Family (Parsi-Zoroastrian heritage, Thornhill/Markham area): Father was Aspi Sorabji Divecha (owned Vivid Jewelry, downtown Toronto, obituary). Brothers: Narius Aspi Divecha (Sr. Business Systems Analyst at CIBC, also Seneca College and IBM, listed as one of the engineers who started Steam Exchange) and Pete ("Shaun") (@OnlyPetes, Steam Exchange co-founder per his own X bio, identified as Neville's brother by multiple STEAMX investors in March 2026 CMC posts). A "Shaun Divecha" is confirmed as co-plaintiff in the Astrals NFT $11M settlement alongside Viraf Chapgar.
Note: Armand Divecha (AD3 Ventures) and Dinshaw Divecha (Quickplay) are NOT Neville's brothers -- they're from the Eros Elevators/Mumbai branch. Narius Aspi Divecha (CIBC, Seneca College, IBM) is Neville's confirmed biological brother (father: Aspi Sorabji Divecha, Toronto). Pete/@OnlyPetes = Shaun Eric Divecha (342 E Tujunga Ave, Burbank CA; father: Behram Keki Divecha, Medina OH) — a different Parsi family connected through the crypto/Parsi diaspora and Viraf Chapgar. Not biological siblings. Shaun is a confirmed lead plaintiff alongside Viraf Chapgar in the Astrals NFT $11M lawsuit. Extended family connection: Adrian Divecha (Shaun's brother) and Phiroze Divecha (associated with a Houston Neville Divecha) both work at Pivotal Talent.
Red flags: Accused of edited audit images, inflated infra costs ($27K/mo vs <$1K). Co-founded The NFT Arcade with Jayde Herrick (Melbourne, Australia - ranked last among 1,930 competitors, unfunded, sells "SteamX NFTs" -- Herrick is CEO, Neville was Co-Founder/Head of Operations). Multiple titles across sources (CEO Operations, President, Co-CEO, Head of Operations) suggests inflated positioning.

Christopher Beckford, PMP

Co-Founder, VP & Head of Infrastructure -- co-hosted Rails Network podcast Feb 2025 (still involved at that time, contrary to CMC investor claims)

LinkedIn: cwbeckford | Location: Whitby, Ontario | 500+ connections
Career: IBM (Manager of Service Delivery, Operations Lead, Incident Coordinator, Senior Tech Analyst) -> FIS (Project Manager) -> Rogers Communications (PM Specialist) -> Steam Exchange
PMP certified. 15+ years data center consolidation and network infrastructure security.
Note: Different person from Chris Beckford of Virginia (US Marine Corps) and Chris Beckford-Tseu (ex-NHL).
Likely operates both validator nodes on Hetzner Cloud (5.78.82.119 + 5.161.104.217).

Viraf Sam Chapgar

Head of Marketing & PR — Marriott full-time since 2017 (UK-based, STEAMX was a side venture) — "citizen and resident of Canada" (court filing) — Lead Plaintiff in $11M Astrals NFT lawsuit

Marriott: Strategy & Planning Manager, F&B Operations, EMEA (TheOrg)
Location: United Kingdom (while Steam Exchange is Ontario, Canada)
NOT listed as one of the 3 founding officers in corporate registration (those are Bard, Divecha, Beckford). Named as media contact on press releases (marketing@steamexchange.ca). At Marriott since June 2017 -- Steam Exchange was always a side venture alongside his full-time hospitality career.

Astrals NFT Connection: Viraf is a court-appointed lead plaintiff in the Astrals NFT $11M settlement (Case 1:23-cv-21912-FAM, S.D. Florida) against Shaquille O'Neal, alongside Daniel Harper, Daniel Koch, Micky Scott, Shaun Eric Divecha (Pete/@OnlyPetes), and Timo Walter. $11M settlement approved April 1, 2025. Two Steam Exchange co-founders as co-plaintiffs in the same NFT lawsuit.

Maariz Almamun

Blockchain Developer (Hidden from team page)

GitHub: maarizalmamun (12 repos, website: steamexchange.ca) | Email: ****@steamexchange.ca
Education: McMaster University - Electrical & Biomedical Engineering (2020)
Prior work: Ontario Power Generation (Electrical P&C Engineer), Arkus Technologies (Software Engineer), NLS Engineering (SCADA systems for solar/battery), McMaster Solar Car Project (HV Board lead)
Side projects: Co-Founder of ModLearn (modlearn.ai - micro-learning platform, unfunded). ResearchGate profile.
The actual builder. Legitimate engineering background, but all blockchain repos are forks (BSC fork, Blockscout fork). Not publicly credited on the team page despite being the primary technical person. Worked at BOTH Steam Exchange AND The NFT Arcade (Jayde Herrick's company) — confirming a direct personnel link between Herrick and STEAMX.

Tomas Vorobjov

Team Member (LinkedIn only, role unknown)

Discovered on the Steam Exchange LinkedIn company page. Not mentioned in any press release, website, or other public material. Role and involvement unclear. Another hidden team member not publicly disclosed.

Shaun Divecha & Dino Landzo

Associated Individuals

Shaun Eric Divecha / "Pete" / @OnlyPetes -- "citizen and resident of Canada" (sworn court filing, Amended Complaint ¶14). Confirmed Astrals NFT $11M lead plaintiff alongside Viraf Chapgar (also "citizen of Canada" per ¶15). Father: Behram Keki Divecha (Medina, OH). Brother: Adrian Divecha (Burbank). Different Parsi family from Neville's — connected through Viraf Chapgar, crypto circles, and Parsi diaspora. Co-founder B.O.T. NFT. Every associated project dead.

Dino Landzo (@low_low416) -- Toronto-area promoter linked to Shaun via community reports. Alleged involvement in a separate BOT scam with funds routed to personal wallets.

@Papa_RNE -- Identified by investors as a project defender/"bootlicker." Connected to the promoter network.

Corporate & Regulatory Status

Corporation:

Steam Exchange Inc., Ontario #002846823

Registered Office:

500-7030 Woodbine Ave, Markham, ON (Regus virtual mailbox)

Founding Officers:

Gary Bard (CEO), Neville Divecha (President), Chris Beckford (VP)

Trademarks:

CIPO #2164884, #2164885

FINTRAC MSB:

M21770262 - EXPIRED (June 30, 2024). FINTRAC revoked 51 MSBs on March 24, 2026 in a crackdown — STEAMX's expired registration is in the crosshairs.

OSC Registration:

NOT REGISTERED. Claimed "working toward compliance" since 2021.

5 Years In:

No centralized exchange launched. No OSC compliance. MSB expired. Core product never shipped.

Press Distribution:

Paid Newsfile Corp syndication to Yahoo Finance, Benzinga (not editorial coverage)

Related: Armand Divecha (Neville's brother) is director of AD3 Ventures Ltd. (Ontario #17075782, registered June 2025). The NFT Arcade (Melbourne, Australia, founded 2023, unfunded, ranked 1,930/1,930 on Tracxn) is a Neville side project selling "SteamX NFTs." UWaterloo partnership (Nov 2022) was legitimate but no follow-up publications found.

7

All Red Flags (35)

CRITICAL81.1% of chain activity is wash trading by 3 bot addresses

HIGHExplorer shows Blockscout default placeholder data (193M tx / 28M addresses / $1,807 price) instead of real stats -- misconfiguration left unfixed for months

CRITICALALL 8 RPC modules exposed publicly (admin, debug, personal, txpool)

HIGH3 node accounts + keystore paths exposed on public RPC (password-locked but paths leaked)

CRITICALAll 6 server IPs exposed via admin_nodeInfo (Hetzner Cloud)

CRITICALGeth fork (Grails) marketed as "innovative custom blockchain"

CRITICALnet_peerCount = 1: Entire network is 2 machines

CRITICALTop 3 addresses hold 90.65% of WSTEAMX supply

CRITICALV2 contract backdoor: unlock() restores ownership (never audited)

CRITICALFINTRAC MSB expired Sept 2, 2023 (2.5+ years), operations continue illegally

CRITICAL~62% of 16,743 followers are fake/botted (~10,300 accounts)

CRITICALZero organic website traffic despite 17K claimed followers

CRITICAL$766/day trading volume from 17K followers

CRITICALEdited/manipulated audit images with pixel anomalies

CRITICALTeam associates linked to separate BOT scam

CRITICALdebug_setHead accepts calls - could rewind entire chain

CRITICALpersonal_sendTransaction accepts calls on public mainnet

CRITICALFalse regulatory compliance claims for 5+ years

CRITICALPoWbA is non-functional: eth_mining=false, eth_hashrate=0

HIGH4 BSC contracts found - multiple migrations stranding holders

HIGHRegus virtual office, not a real business location

HIGHNeville runs The NFT Arcade with identical branding

HIGHHead of Marketing works full-time at Marriott

HIGHOnly 8 tokens on entire chain (includes test tokens)

HIGHBridge used by exactly 1 address (deployer) - 102 tx total

HIGHTelegram dropped 80% (9K to 1,726 members)

HIGHCoordinated fake Trustpilot reviews (6/9 same day)

HIGH$27K/month claimed infra costs vs <$1K actual

HIGHPromoter network tied to other rug pulls

HIGHnginx 1.18.0 (2020) with known CVEs across all infra

HIGHZero security headers on main website

MEDIUMICOholder team verification: 0%. Deployer inactive since June 2024

8

What Rails Network Actually Is

A technical breakdown of what was built, what it cost, and how long it takes -- vs what they claim

The Entire "Blockchain" is 5 Free Open-Source Forks + 2 Rented Servers

Component	What They Call It	What It Actually Is	Setup Time	Cost
Blockchain	"Rails Network" with "innovative PoWbA consensus"	go-ethereum (geth) fork renamed "Grails". Changed chain ID to 6278, genesis nonce to 0x6278006278006278. PoW config with 2 hardcoded miners. Zero original consensus code.	1-3 days	$0 (MIT license)
Explorer	"Rails Network Explorer"	Blockscout fork. Running in DEVELOPMENT mode. Shows stock placeholder data (193M tx, $1,807 price) instead of real API data (~303K tx, $0.061) due to React Query hydration bug they never fixed.	4-8 hours	$0 (open source)
DEX	"Steam Exchange DEX"	Uniswap V2 fork (UniswapV2Router02 + Factory). Neville's GitHub literally contains a fork of the Uniswap interface.	2-4 hours	$0 (GPL license)
Subgraph	"Rails Subgraph"	The Graph Protocol fork. Neville's GitHub contains a fork of graph-node and graph-tooling.	2-4 hours	$0 (open source)
Documentation	"Technical Docs"	Docusaurus (Facebook open-source docs framework) hosted free on Netlify.	1-2 hours	$0 (free tier)
Infrastructure	"Enterprise-grade" ($27K/month claimed)	6 Hetzner Cloud VPS servers (5.78.x.x / 5.161.x.x range). nginx 1.18.0 (2020). Let's Encrypt SSL. Cloudflare free tier for CDN. Static sites on Netlify free tier.	2-4 hours	~$60-120/mo
Token (BSC)	"STEAMX Ecosystem Token"	Standard BEP-20 reflection token (SafeMoon-style). 13% tax: 4% platform, 3% marketing, 4% LP, 2% reflection. Common template.	1-2 hours	~$5 deploy gas
Wash Trading Bots	"Active ecosystem" / "trading volume"	3 bot wallets running automated WSTEAMX/USDC swaps every 30-60s. Simple ethers.js script. Produces 81.1% of all chain transactions.	2-4 hours	~$0 (gas on own chain)
TOTAL ESTIMATED BUILD			2-4 weeks	~$60-120/mo

What a Real L1 Blockchain Looks Like (for comparison)

Real L1 Development

Original consensus mechanism with formal mathematical proofs
100,000-500,000+ lines of original code
20-200+ full-time engineers over 2-5 years
$10M-100M+ in development funding
Multiple independent security audits ($500K-2M each)
Public testnets running 6-12+ months before mainnet
Bug bounty programs ($100K-1M+ pools)
100% open-source with active contributor community
Hundreds/thousands of independent validators
Formal governance with on-chain voting

What Rails Network Did

Forked geth, changed chain ID and genesis nonce
~0 lines of original blockchain code (all forks)
1 developer (Maariz Almamun, part-time, also at NFT Arcade)
Unknown funding, $27K/month claimed infra (actual ~$100)
SourceHat audit on V1 token only (not the chain, not V2)
No public testnet history before mainnet launch
Zero bug bounty program
Closed-source: no GitHub repos for chain code
2 team-controlled validators on 2 rented servers
No governance: team has total unilateral control

Developer Analysis: What the GitHub Actually Shows

divechan (Neville Divecha) - 8 repos, all forks

Forks of: Uniswap interface, Uniswap docs, Blockscout frontend, Graph Protocol (2 repos), safe-singleton-factory, ethereum-lists (to add chain 6278). One original repo: "brandkit" containing logos and JSON configs. Zero original blockchain development. Zero smart contract code. Only configuration changes and branding assets.

maarizalmamun (Maariz Almamun) - 12 repos

McMaster Electrical & Biomedical Engineering grad. Repos include: "fiat-smart-chain" (BSC fork), "fsc-explorer" (Blockscout fork), ssam-interface, multisig-wallet-solidity, election_solidity_smartContract. Some Solidity experience visible, but blockchain work is entirely fork-based. No original consensus mechanism, no novel protocol code.

SteamExchange (org user) - 3 repos

steamx.sol (BEP-20 token contract - standard reflection template), assets fork, tokens fork. 11 total commits. 1 star. 0 forks. Created June 2021.

SteamExchangeInc (org) - 3 repos

depot.steamexchange.io (React frontend by 0f0crypto, Australian contractor), cra-template-steamx (React template), Rails-Network-Blacklist (by divechan). No blockchain core code. Just web frontends and configs.

Bottom Line

Across all 5 GitHub entities (44 total repos), there is zero original blockchain protocol code. Everything is forked from existing open-source projects (geth, Blockscout, Uniswap V2, The Graph, BSC). The token contract is a standard SafeMoon-style reflection template. A competent developer could reproduce the entire Rails Network setup in 2-4 weeks using the same public repositories. The claimed "$27K/month infrastructure" runs on 6 Hetzner VPS servers costing approximately $60-120/month total.

Would You Trust These Developers With Your Money?

A forensic analysis of every public GitHub repo associated with Steam Exchange.

Metric	Ethereum	Solana	Steam Exchange (ALL combined)
Public repos	308	116	6
Main repo stars	50,966	14,852	1
Main repo forks	21,878	5,603	0
Contributors	1,226	Hundreds	1 (contractor)
Custom consensus code	Millions of lines	Millions of lines	Zero lines
Tests	Extensive	Extensive	Zero
CI/CD	Multiple pipelines	Multiple	None
Code reviews	Mandatory	Mandatory	None (self-merged)
Original commits	Hundreds of thousands	Hundreds of thousands	~40-50 total

Neville Divecha (divechan) -- 8 repos, ALL forks

His ONLY "original" repo is "brandkit" -- a folder of JPEGs, PNGs, and logo files. Zero lines of code. Not a single function. Not a single script. He submitted 6 pull requests to add Rails Network to the ethereum-lists ChainList repo. All 6 were REJECTED and closed without merging. All other repos (Uniswap, Blockscout, Graph Protocol) are bare forks with no visible original commits.

Maariz Almamun (maarizalmamun) -- 12 repos, mostly forks

"fiat-smart-chain" is literally BSC with a README change. Description still says "A Binance Smart Chain client." All commits from BSC upstream devs. "ssam-interface" (the DEX UI) is an unattributed Uniswap clone -- top contributors are moodysalem (297 commits), NoahZinsmeister (128), ianlapham (128) -- all Uniswap core devs. Maariz contributed 6 of 100+ commits. Original work: 2 trivial Solidity contracts (1 commit each, 1KB each) + a university Verilog project (hardware, not blockchain).

SteamExchange account -- steamx.sol (the token contract)

1,256 lines. 11 commits. All in June 2021. Then abandoned. Standard SafeMoon reflection template (5% LP, 5% redistribution, anti-whale). This is the same copy-paste template used by hundreds of 2021 BSC tokens. No tests. No CI/CD. No documentation. No license. No pull requests. 0 forks. 0 code reviews. Last update: June 24, 2021.

0f0crypto (Australian contractor) -- The ONLY person who wrote any functional code

Built 100% of the depot frontend and CRA template. Bus factor: 1. If this one external contractor leaves, there is zero in-house development capability visible on GitHub. Their personal repos include forks of: Discord spam bots (discord-spam-bots), Discord selfbot tools (Discord-S.C.U.M), Telegram group tools (TeleGram-Scraper), and a PancakeSwap trading bot. The sole developer of your "blockchain exchange" frontend has Discord spam tools and Telegram data tools on their GitHub.

The Complete Picture

The entire public code output of Steam Exchange across 5 GitHub accounts and 44 total repos amounts to: one copy-paste token template (abandoned after 3 weeks in 2021), one compiled frontend (built by a contractor whose personal repos contain spam bot tools), and a folder of JPEGs.

~40-50 original commits. Zero tests. Zero CI/CD. Zero code reviews. Zero original blockchain code. Zero custom consensus mechanism. Zero original smart contracts beyond a standard 2021 template.

Rails Network was rejected 6 times from ChainList. This is the team claiming to have built an "innovative L1 blockchain with a novel consensus mechanism" worthy of $27,000/month in infrastructure costs and your investment.

Actual Cost vs Claimed Cost

They Claim

$27,000

per month infrastructure

Actual Estimated

$80-150

per month (6 Hetzner VPS + domains)

Overstatement

180-340x

cost inflation factor

Service	Estimated Monthly Cost
Hetzner CX31 VPS x2 (mainnet RPC + depot)	~$22
Hetzner CX21 VPS x4 (testnet nodes)	~$24
Domain registration (steamexchange.io + .ca)	~$3
Cloudflare (free tier)	$0
Netlify (free tier for static sites)	$0
Let's Encrypt SSL (free)	$0
Discourse forum (self-hosted)	~$0 (on existing VPS)
TOTAL	~$49-80/month

Based on Hetzner Cloud pricing for CX21/CX31 instances (2-4 vCPU, 4-8GB RAM), which is more than sufficient for a chain processing 0.04% network utilization. Even generously doubling for bandwidth/storage overhead puts the ceiling at ~$150/month.

9a

In Their Own Words

What they told investors vs what we proved. Every quote is from official press releases, interviews, and their own website.

"Homegrown Canadian Crypto Startup, Steam Exchange, Takes on Binance and Other Major Players"

-- Newsfile Corp press release headline, August 2021. Source

Reality: Binance processes billions in daily volume. Steam Exchange processes 2-5 transactions per day on a chain with 0.00% utilization.

"We are working towards being 100% compliant with OSC regulations, and regulations around the world."

-- Neville Divecha, Blockcast interview, 2021. Source

Reality: 5 years later -- not registered with OSC. FINTRAC MSB expired Sept 2023. Fabricated "pending alignment with FINTRAC entity framework" language.

"We crushed our deadlines with Stage 1 and were able to show our community the fully functional and operational exchange platform; live nodes, active trading pairs, KYC integration, you name it."

-- Neville Divecha, Newsfile Corp, August 2021

Reality: 4 years later, the exchange is still in "Closed BETA v1.0" (announced April 2025). 2 nodes. $766/day volume. No KYC integration live.

"After months of development, we're at our ALPHA testing stage where we put the network through multiple stress tests under heavy load and volume."

-- Gary Bard (CEO), Newsfile Corp, April 2022. Source

Reality: Network utilization 0.04%. 86% of blocks empty. The "heavy load" is 3 wash trading bots doing automated swaps.

"We've oriented our Rails Network blockchain around a unique 'Proof-of-Work-by-Authority' (PoWbA) mechanism that features the best of both methodologies."

-- Gary Bard (CEO), Newsfile Corp, April 2022

Reality: A renamed geth fork. eth_mining=false, eth_hashrate=0. PoW is non-functional. CryptoFlan: "PoWbA is not a true consensus mechanism but a centralized gatekeeping process masquerading as one." CryptoFlan's full analysis

"This will be facilitated by our physical locations across Canada, as well as online resources; offering exposure and training for all things crypto." ... "across Asia"

-- Newsfile Corp press release, August 2021

Reality: Zero physical locations. Not in Canada. Not in Asia. Not anywhere. Ever.

"Security remains paramount as we work through this endeavor - the safety of our community is most important."

-- Chris Beckford (VP), Newsfile Corp, March 2022. Source

Reality: Node accounts and keystore paths exposed on public RPC. All 8 geth modules open (admin, debug, personal, txpool). debug_setHead can rewind the chain. 6 server IPs exposed. No audit. Development mode on production. nginx from 2020.

CryptoFlan's Verdict (Full Article)

"The project's future depends on increased adoption, transparency, and successful CEX implementation. Current indicators suggest it is not yet a revolutionary player in the blockchain space and a load of red flags! Stay clear I say!"

9

5 Years of Broken Promises

What they promised vs what was delivered after 5+ years of development.

Promised: Physical Locations Across Canada

"Walk into any Steam Exchange location to open and manage your account." "Physical locations will bridge the gap on trust." "Currently on the hunt for their first physical location in Toronto."

Status: ZERO physical locations opened. Not a single one.

Promised: Centralized Exchange (CEX)

The core product. A hybrid CEX/DEX. "Canada's first hybrid digital asset trading platform." Founding purpose of the company.

Status: NOT LAUNCHED after 5 years. Still in "closed beta."

Promised: Educational Metaverse (Sheridan College)

Sheridan College partnership (May 2022): "Open-World Educational Metaverse Focused on Digital Assets" using Honours Bachelor of Game Design. Promised "initial version accessible in the upcoming months."

Status: No metaverse exists. No product shipped. Sheridan College's own website has ZERO mention of Steam Exchange (site:sheridan.ca returns nothing). Steam Exchange's current ecosystem page doesn't even mention Sheridan anymore. Press release only.

Promised: AI-Driven Gamified Learning

UWaterloo partnership (Nov 2022): "First results expected Winter 2023." Funded by Steam Exchange and Mitacs. Source

Status: No follow-up publications found. No product shipped.

Promised: Mobsters Staking Protocol

NFT-based gamified staking and mining. Featured in marketing materials and on the website.

Status: Still labeled "Coming Soon." Never launched.

Promised: Rails Wallet, Launchpad, Full DEX

All listed as products in the ecosystem. Launchpad has "launchpadtest" token on chain (0 holders).

Status: Wallet never shipped. Launchpad still testing. DEX has 1 pair, $766/day.

The NFT Arcade / Jayde Herrick (Partnership DISSOLVED Dec 2023)

Neville co-founded The NFT Arcade (Melbourne, Australia) -- a marketplace for "SteamX NFTs" with only 20 NFTs ever created on OpenSea. Partnership formally dissolved December 2023 (per Telegram announcements). His partner was Jayde Herrick (@JaydeHerrick_), a former professional Australian cricketer (Victoria, Melbourne Renegades, 77 First-class wickets). Herrick's LinkedIn lists The NFT Arcade. He's now CEO of iPFi on ApeChain. Connected projects include Takashi Warriors (500 Solana NFTs, 65 owners, dormant) and Green Lung Genetics (cannabis NFT project on Solana, ~222 holders, distributes crop profits as USDC) -- likely the "NFT weed store" that CMC user @remaptools accused of stealing community money. The partnership reportedly ended in a falling out over investments.

Fantasy Friends (First Rails Project): Built on Dead Platform

Announced January 2024 as the "first project on Rails Network" -- a Social-Fi platform built on Friend.tech integration. Problem: Friend.tech itself shut down. Developers abandoned it, renounced smart contracts. Daily users dropped to single digits. Fantasy Friends was built on dead infrastructure. No evidence of actual users. 6 likes on the forum post, zero follow-up.

Gary Bard's Credential: "One of the Largest AION Mining Pools"

Bard claims he ran "one of the largest AION mining pools in the world from his basement." AION's CEO and COO abandoned the project in 2020. Binance delisted AION on February 27, 2023. Token: $11.31 peak -> $0.00026 today (-99.997%). Zero independent evidence Bard's pool existed -- AION mining pool stats list pools like aionpool.tech, none connected to Gary Bard. This is his blockchain credential.

Project Silent Since October 2024

The last public Telegram announcement was October 29, 2024 (LandXchange). 5+ months of complete silence. No updates, no development, no announcements. Their Medium account stopped posting in January 2023 (only 7 posts total, 3+ years ago). CoinMarketCap lists STEAMX as a "preview listing" -- not even a full listing. DeFi Llama and DappRadar do not list Rails Network at all.

The pattern: Announce partnerships and features -> Use them for press releases and marketing -> Never deliver -> Move on to the next announcement. After 5 years: no exchange, no physical locations, no metaverse, no gamified learning, no Mobsters, no wallet. Their first project (Fantasy Friends) was built on a platform that died. Their CEO's only blockchain credential is a mining pool for a coin that lost 99.997%. Medium posts stopped January 2023 (only 7 total). Project silent since October 2024.

CoinMarketCap Community Accusations

Real investors documenting fraud allegations on CoinMarketCap. These posts confirm multiple findings from our investigation.

@remaptools March 17 & 26, 2026 993 views, 21 comments, 8 reposts

Key Accusations (direct quotes, summarized):

1. Gary (CEO) LEFT: "Gary, the CEO with no technical background, left suddenly without any prior notice."

2. Viraf & Chris GONE: "Viraf was promoted to executive role and later abandoned the project. Chris is no longer present or involved."

3. Pete (Shaun) CONFIRMED: "Pete (Shaun), an admin in several Solana crypto projects, remained active in pump-and-dump communities despite holding an executive role in the so-called 'Binance Killer.'"

4. Bridge DOWN -- $522K USDC Stranded: "He has confirmed - by accident - that the liquidity would be drawn if he puts the bridge online. At least 150k will be wiped out instantly. That's why the bridge is down." [Verified: Bridge last processed a transaction Oct 2, 2024 -- 18 months inactive. Backend still syncing (healthcheck confirms). 476 holders with ~$522K USDC have no viable exit path. Not a classic honeypot (contract burns properly) but effectively stranded funds on an abandoned network.]

5. $250K BNB Missing: "250k (while still in BNB) was reportedly moved into a vault, yet only screenshots were provided, no wallet transparency."

6. LandX/Phygital $200K Stolen: "He 'paid' from our money 200k to them and they 'stole' them. Did they split the earnings? Of course, they did."

7. JB's 3 Partnered Projects Vanished: "JB, the owner of 3 projects (NFTDamn, MetaOps and RNS) who used to try to pump the chat day-in day-out - Is he working in the shadows now?"

8. BSC Fees Never Returned: "Token holders were promised fee-based returns, which never materialized. They rewarded none!"

9. TuneX Ukrainian Partner Vanished: "A Ukrainian company with similar exchange UI was introduced as partner (TuneX), after the war began the connection was lost."

10. UAE/EU License Shell Game: "How many times did he assure you he will launch in Canada, now in UAE but suddenly it's difficult and he will need EU license?"

11. Admins Disappeared: "Mark, JB, Iceland and the rest admins who suddenly disappeared after investing tons of thousands each! Soon: 'We tried but we failed, ciao'."

@iknowwwww (coldbrew) March 15, 2026 334 views, 6 comments, 4 reposts

"watch this shit dump and this team of frauds get away with the stuck funds. Waiting for the bootlickers tom, papa rne, and other cocksuckers to come say i'm a fudder without ever giving out arguments because they have none. When you are too busy blowing neville and his brother, you have no time to do your research"

Note: "papa rne" = @Papa_RNE, a known project promoter/defender.

@8b9xnf32zgm6 (Justice World) March 16, 2026

"how do we sue the team man? They are not getting away like this. We need our USDC out."

@The_Long_Haul March 16, 2026

"How much proof do you want after 6 years? nothing accomplished for this assumed binance killer. And stealing funds is a fact, they had thousands BNB; where did it go? Alledgedly scammed (by Neville himself probably) and you morons believe everything he says."

What These CMC Posts CONFIRM From Our Investigation:

* Shaun = Pete (Neville's brother) -- community confirms, active in Solana pump-and-dumps

* Bridge intentionally offline -- prevents USDC withdrawals, effectively a honeypot

* Gary Bard LEFT the project -- CEO departed without notice

* Viraf and Chris both gone -- only Neville remains active

* $250K BNB unaccounted for -- only screenshots shown, no wallet proof

* $200K allegedly paid to LandX/Phygital -- money disappeared

* @Papa_RNE is a known "bootlicker" -- identified as promoter/defender

* Multiple partnership CEOs vanished -- JB (3 projects), TuneX, others

Sources: CMC Post 374994299. Additional posts visible within the CoinMarketCap community section for STEAMX. Accounts @rs1d68trulvn and @q3xxkapixpev appear to be defenders/possible team alts -- responding with emojis and ad hominem attacks rather than addressing specific allegations.

10

Documented Complaints & Incidents

SMOKING GUN December 22, 2022

$500 to Sick Kids. ~$700K to Stake.com.

Donated to Sick Kids

$500

Claimed, unverified

Gambled at Stake.com

~$700K-$800K

On-chain verified

Ratio

1:1,400

$1 charity per $1,400 gambled

On December 22, 2022, Steam Exchange announced a "Holiday Giveaway" with 53 participants and claimed a $500 USD donation to Toronto Sick Kids Hospital (CRA Charity #108084419RR0001). The Telegram message explicitly stated: "If there are not enough participants, we will do a second donation to Toronto Sick Kids" — treating a children's hospital charity as a consolation prize for low engagement. The $500 was leftover prize money, not a planned charitable act.

The donation is unverifiable by any public means. SickKids Foundation has no public donor database. Minimum recognition thresholds: $25K (individual) / $50K (corporate). SickKids receives ~$208M/year in donations — the $500 represents 0.00024% of annual revenue. No press release was issued (5 press releases went to Newsfile Corp for other activities costing an estimated $3,125-$4,000+). The "proof" was a Telegram image that cannot be verified.

The $500 came from investor trading fees. The V2 token contract charges 13% tax on every trade: 4% to Platform Wallet + 3% to Marketing Wallet = 7% auto-swapped to BNB and sent to team-controlled wallets. The SourceHat audit confirmed the V1 "liquidity fee" also didn't add to LP — it converted to BNB and sent to the "SX Wallet." The owner can change all fee percentages and recipient addresses at any time via setter functions.

Meanwhile, approximately ~2,694 BNB (~$700K-$800K) from these same investor trading fees went to Stake.com gambling casino. For every $1 to sick children, ~$1,400 went to gambling.

The Virtue Signaling Machine:

* $500 Sick Kids donation — leftover prize money, unverifiable, no press release issued about it
* 5 Newsfile Corp press releases ($3,125-$4,000+) — spent 6-8x more on self-promotion than on sick children. Syndicated to Yahoo Finance, Bloomberg, AP
* "Safe Space" branding — Press release: "providing a safe space for individuals to foster, and groom their own crypto journeys." Bard bio: "Helping Create a Safe Space in the Crypto Ecosphere"
* Sheridan College (May 2022) + UWaterloo (Nov 2022) — press release factories, zero deliverables from either partnership
* "Made in Canada, for the world" — leveraging Canadian regulatory reputation while FINTRAC MSB expired
* Trustpilot reviews — 7/9 posted August 5, 2025, all 4-5 star, same language patterns
* ICOHolder — 0% verification for all 4 listed team members

Giveaway Fraud Pattern — None Verified as Paid:

Giveaway	Prize Pool	Winners Announced?	Paid?
Holiday 2022	17 prizes + $500 SickKids	17 names listed	Unverifiable
CrossRails June 2024	$3,500+ (extended +50%)	No evidence	No evidence
Launchpad Sept 2024	$10,250+	No evidence	No evidence
$5 Bridge Bonus	$5 per qualifying wallet	No evidence	No evidence

Both the CrossRails and Launchpad giveaways required participants to make purchases to qualify — extracting real money while promising STEAMX token prizes.

Comparison: VirgoCX (Legitimate) vs Steam Exchange

VirgoCX ran a multi-week "Crypto for Charity" campaign with SickKids: virtual benefit concert, 7-day charitable auction, multiple sponsors (Stablecorp, GDA Capital, MNP, 3iQ), SickKids Foundation publicly acknowledged the partnership, press releases through PR Newswire.
Steam Exchange posted a Telegram message claiming $500. No SickKids acknowledgment. No press release. Donation was leftover prize money from a giveaway with 53 people.

Telegram Messages 71-73 SourceHat Audit (V1 fee deception) SickKids Donor Wall ($25K+ min) SickKids CRA Registration All 5 Press Releases ($3,125+) "Safe Space" Press Release

SECURITY BREACH March 23, 2024

Official Steam Exchange tweet: "Recently, we encountered a security incident at SteamX involving unauthorized sell transactions triggering alerts in our monitoring systems. We immediately took action, temporarily halting some tools."

Source: x.com/Steam_Exchange/status/1771653054128910633

CENTRALIZED CONTROL PROOF June 2024

An unauthorized transaction caused a 110% price pump. The team's response -- in their own words from Telegram:

"RPC node halted immediately"

"We have decided to reverse the unauthorized transaction... necessary to uphold the principles of fairness and security"

"Chain reset performed" due to high block height -- "all balances temporarily went to zero"

A real blockchain cannot have transactions reversed, chains reset, or RPC nodes shut down by a central authority. This is a centralized database with blockchain aesthetics. They admitted it themselves.

Source: Telegram Announcements

Migration Disaster: 3.6M Tokens Became 6,000

User andrew_parker: "After Migration, I lost 3.6 million SteamX coin" -- balance dropped from ~$400 to less than $1. Team explained a "550:1 split" was applied. User boggs: "544,000 SteamX all gone." User Kim_Arjero_Carino: "from 655,000 to 1.191... OMG."

Source: forum.steamexchange.io

No official team member responded to any of these complaints on the forum.

Trustpilot Review Manipulation

All 9 reviews posted in a 5-day window: August 5-8, 2025 — approximately 3 months after the CryptoFlan article. All 4-5 stars. Same language patterns: "transparent," "trustworthy," "devs doxxed." Zero negative reviews despite documented user complaints on the forum and BSC token showing ZERO daily transfers. Textbook coordinated review stuffing.

Source: Trustpilot

15% Fee on Migration Transfers

Users attempting to move old tokens from Trust Wallet to MetaMask were limited to one token at a time with 15% lost on each transfer due to built-in tax. With 550 tokens to migrate, cumulative losses were enormous.

Source: forum.steamexchange.io

Anti-Whale Sell Restrictions Lock Users In

Contract enforces: holders with 0.5%+ of supply can only sell 20% of their balance at a time, then must wait 24 hours. Transactions exceeding 0.1% of total supply are blocked entirely. Combined with 13% sell tax, exiting a position is extremely punitive.

Source: SourceHat Audit

Reddit User Reports (cited in CryptoFlan investigation)

"Steam tokens disappearing from Trustwallet. I looked at Bscan and it is showing up in another wallet"

"Anybody know why the twitter is botted?"

"I have $50k of steamx in my coinstat app.. I can't find the coin in my trustwallet"

"I've been trying to sell my STEAMX tokens for weeks, but every time I try, the transaction fails"

"I can see STEAMX token in my account but I do not see any value of this token.. Value shows Zero."

The Scam Mechanics: Real Money In, Fake Tokens Out

BSC (where real money was)

19,228

holders. LP drained to $8.31. Fees -> Stake.com

Rails (where fake tokens are)

476

given team-minted "USDC" (not real Circle USDC)

The "USDC" on Rails is not real USDC. It was minted by the admin wallet -- not by Circle (the actual USDC issuer). There is no proof it's backed by anything. The bridge is down 18 months so nobody can redeem it. Investors gave real BNB on BSC, which was extracted to Stake.com. In return they received worthless tokens on a private chain the team fully controls. The $221K "USDC" in the DEX LP is also team-minted -- the entire chain's "economy" is play money.

BSC Holders Stranded Across Both Token Versions

V1 (0xf6d4...): 2,061 holders with worthless tokens. V1 LP was drained by the deployer (confirmed Remove Liquidity transactions Oct-Dec 2023). V1 holders were NOT automatically migrated -- left behind.

V2 (0xc092...): 19,228 holders at $0.0003. LP drained to $8.31 -- only 1 LP token holder remains (the deployer). Zero 24h transfers. Migration tool reported broken by multiple users. Listed on ZERO centralized exchanges.

Team tokens: 24.91% (24.91B tokens) on 6-month Unicrypt vest ending ~Jan 2022. After unlock, deployer executed hundreds of small PancakeSwap swaps (0.03-0.08 BNB each) -- a systematic drip-sell strategy. Ownership never renounced despite audit recommendation.

11

Investigation Timeline

2021-05

Steam Exchange Inc. founded (Ontario #002846823)

X account @Steam_Exchange created. BSC V1 token launched (0xf6d4...) with 10% tax. FINTRAC MSB registered (M21770262). Regus virtual office in Markham.

2021-07-04

SourceHat Audit (V1 only)

Audit passes V1 contract with no external vulnerabilities. Recommends renouncing ownership. Ownership never renounced. V2 contract with backdoor unlock() function is NEVER audited.

2021-09

STEAMX hits all-time low: $0.000059

Token crashes 99%+ from launch price.

2022-01

V2 BSC Token Deployed (0xc092...)

New contract with 13% tax (up from 10%). Contains unlock() backdoor function. 100B supply. Pink AntiBot enabled. Ownership NOT renounced. Deployer: 0x0542Df7d...

2022-08-06

GitHub accounts created (same day)

SteamExchangeInc org created at 20:35:01 UTC. divechan (Neville) created 7 minutes later at 20:42:27 UTC. All repos are forks.

2022-11

University of Waterloo partnership announced

Gamified crypto education research with Stratford School. Funded by Steam Exchange and Mitacs.

2024-01-26

Rails Network genesis block created

Genesis nonce: 0x6278006278006278. Client: Grails (geth fork). Chain ID 6278. Only 2 validators configured. PoWbA = standard geth PoW with permissioned access.

2024-03

Migration chaos + Security breach

BSC to Rails migration begins. 550:1 split applied. Users report losing 99.8% of token count. Forum flooded with complaints. Simultaneously, team admits "unauthorized sell transactions" security incident. Tools halted.

2024-06-24

Validators funded + Chain infrastructure deployed

Both validators funded with exactly 100 STEAMX from genesis wallet (0xD79e...). 99.8% of genesis tokens sent to single wallet. DEX factory + router deployed by 0x76e6a920...1337.

2024-06-26

BSC deployer wallet goes INACTIVE

Last transaction from 0x0542Df7d... (official deployer). Wallet holds 666K STEAMX (~$40K) and 0 BNB. Never active again.

2024-06-30

FINTRAC MSB registration EXPIRES

Registration M21770262 expires. Operations continue without renewal. Operating an unregistered MSB in Canada is a federal offense.

2024-07-01

Admin wallet mints $2,300,000 USDC

Address 0x6278A5a4... mints 2.3B micro-USDC ($2.3M) to itself in a single transaction. Immediately sends to bridge proxy contract (0x...627803).

2025-05-19

CryptoFlan publishes investigation on Medium

"A Critical Examination of Steam Exchange's Rails Network." Documents 2 validators, 0% utilization, empty blocks, no whitepaper. Concludes "Stay clear I say!" Steam Exchange never responds.

2025-08-05

7 coordinated Trustpilot reviews posted on same day

7 of 9 total Trustpilot reviews posted within hours. All 5-star. All praise "transparency." Nearly identical language patterns. Posted ~2.5 months after CryptoFlan's critical article.

2025-09-06 to 12

Bridge deployer funds wash trading bots

0x2454Cd61...1337 sends $78,757 USDC to Bot A and $20,000 USDC to Bot B. Wash trading begins immediately. 3 bots execute automated swaps every 30-60 seconds, producing 81.1% of all chain activity.

2024-12

Users still unable to migrate (1 year later)

User Bala posts on forum: 1.8M tokens showing zero value, still needs migration help. No team response received.

2026-04-04

Full investigation published (this report)

Analyzer69000 investigation confirms all findings via live RPC probing, Explorer API analysis, on-chain transaction tracing, and public records verification. 67 findings, 32 red flags.

12

Website & Infrastructure Security Audit

All findings from publicly-served HTML that any browser receives when visiting these sites.

Technology Stack (from public HTML)

Subdomain	Server	Framework	Version	Last Updated	Issues
steamexchange.io	Cloudflare	Bootstrap 5 + vanilla JS	Font Awesome 6.0.0-beta3	Jan 2025 (15mo old)	og:image = "UPDATE ME"
depot.steamexchange.io	nginx/1.18.0 (exposed)	React (CRA)	Unknown	May 2024 (2yr old!)	Zero security headers. No CDN.
swap.steamexchange.io	Cloudflare+Netlify	Next.js + Tailwind	Unknown	Unknown	HSTS present
docs.steamexchange.io	Cloudflare+Netlify	Docusaurus v2.0.0-beta.17	4-year-old BETA	Unknown	Beta from 2022, current is v3.x
forum.steamexchange.io	nginx (hidden ver)	Discourse 3.2.0.beta4-dev	Dev build + git commit exposed	Unknown	Exact commit hash public: 2477bcc...
explore.steamexchange.io	nginx/1.18.0 (exposed)	Next.js + Blockscout v1.32.0-alpha	Alpha build	Unknown	DEVELOPMENT MODE on prod!

Explorer Running in DEVELOPMENT Mode

The Blockscout explorer's public envs.js file reveals:

NEXT_PUBLIC_APP_ENV: "development"

NEXT_PUBLIC_SENTRY_DSN: [error tracking URL exposed]

NEXT_PUBLIC_WALLET_CONNECT_PROJECT_ID: "f190b2d10d8ddbdba24986ec2ab614cb"

NEXT_PUBLIC_NETWORK_RPC_URL: "https://mainnet.steamexchange.io"

NEXT_PUBLIC_GIT_TAG: "v1.32.0-alpha"

Development mode on production = verbose errors, no optimizations, potential debug endpoints. Sentry DSN and WalletConnect ID exposed to every visitor.

Also exposed: Marketplace config points to eth-goerli.json (wrong network!), Airtable form URL, all brand asset URLs from divechan's GitHub. 38 total environment variables publicly readable.

Server Memory Stats Publicly Exposed (debug_memStats)

The debug_memStats RPC method returns live server memory data to anyone who asks:

Heap Alloc: 706 MB

OS Memory: 918 MB

Total Alloc: 43.9 GB

GC Cycles: 1,022

This reveals the exact server memory layout, garbage collection behavior, and allocation patterns. Combined with admin_nodeInfo (which already exposed all server IPs), an attacker has a complete profile of the server's hardware and software state.

Pending Transaction Pool Publicly Exposed (txpool_inspect)

25 unique addresses with ~45 pending transactions visible to anyone. Reveals:

* Real-time wallet activity and transaction amounts

* Gas price strategies of active users

* Contract deployments in progress

* Most-targeted address: 0xba01646C... (appears in many pending tx -- likely the DEX router)

The go-ethereum documentation explicitly states: "Never enable debug, admin, personal, or txpool APIs on a publicly accessible node."

Outdated Software: Known Vulnerability Exposure

Their entire infrastructure runs on software versions with known security issues. This is the chain that holds $522K in user USDC.

Software	Their Version	Current Stable	Age	Risk
nginx	1.18.0	1.27.x	6 years (Apr 2020)	HTTP request smuggling, buffer overflows. Multiple CVEs since 1.18 including CVE-2021-23017 (DNS resolver crash), CVE-2022-41741/41742 (mp4 module memory corruption)
Go	1.20.7	1.23.x	~3 years (Aug 2023)	50+ security fixes since 1.20.7. Includes HTTP/2 rapid reset DoS (CVE-2023-44487), path traversal, TLS vulnerabilities
go-ethereum	Fork from Jun 2024	v1.14.x (2026)	~2 years behind	Multiple consensus and p2p security advisories since their fork date. Never patched.
Docusaurus	v2.0.0-beta.17	v3.7.x	4 years (early 2022)	Running a BETA from 2022. Multiple XSS and dependency vulnerabilities patched in stable releases
Discourse	3.2.0.beta4-dev	3.4.x stable	Dev build	Running a dev build with git commit hash exposed publicly (2477bcc...)
Blockscout	v1.32.0-alpha	v6.x stable	Alpha build	Alpha on production. APP_ENV="development". Sentry DSN + WalletConnect ID exposed.

Every component is outdated, unpatched, or running pre-release builds. This infrastructure handles real user funds. No security audits. No bug bounty. No incident response plan.

For comparison: Ethereum mainnet validators run the latest geth within days of security releases. Legitimate exchanges patch within hours of critical CVEs.

Outdated & Beta Software Everywhere

* Docusaurus v2.0.0-beta.17 -- from early 2022. Current stable is v3.x (4 years behind)

* Blockscout v1.32.0-alpha -- alpha build on production infrastructure

* Discourse 3.2.0.beta4-dev -- dev build with exact git commit hash exposed publicly

* nginx 1.18.0 -- from Ubuntu 20.04 (April 2020), 6 years old

* Go 1.20.7 -- their geth fork built with Go from August 2023, ~3 years old

* Font Awesome 6.0.0-beta3 -- beta version on the main website

Every major component runs on beta, alpha, or severely outdated software. This is not enterprise-grade infrastructure.

The og:image "UPDATE ME" Tells the Story

The main website's Open Graph image meta tag -- used when the site is shared on Twitter, Facebook, etc. -- is literally set to the placeholder text "UPDATE ME". After 5 years of development and claimed $27K/month infrastructure costs, they never filled in a basic meta tag. This is the level of attention to detail being applied to a project that holds people's money.

Security Headers Comparison

Header	Main Site	Depot	Explorer	Forum
HSTS	Missing	Missing	Missing	Yes
CSP	Missing	Missing	Missing	Yes
X-Frame-Options	Missing	Missing	Yes	Yes
X-Content-Type	Missing	Missing	Yes	Yes
Referrer-Policy	Missing	Missing	Yes	Yes

The main website and depot have ZERO security headers. The forum (Discourse) has the best security -- because it's an off-the-shelf open-source product that configures them by default. The team's own code has none.

13

Legal & Regulatory Exposure

FINTRAC: Operating an Unregistered MSB is a Criminal Offense

MSB Registration Status

EXPIRED

Registration M21770262

Registered: September 2, 2021

Expired: September 2, 2023

Time since expiry: 2 years 7 months

Verify: opengovca.com/money-service/M21770262

Criminal Penalties (PCMLTFA s.77.4)

Summary conviction: Up to $250K-$1M fine AND/OR up to 2 years less a day imprisonment

Indictment: Up to $500K-$2M fine AND/OR up to 5 years imprisonment

Admin penalties: Up to $500,000 per violation for corporations

Source: fintrac-canafe.canada.ca/pen/5-eng

Their Own Fabricated Language

Steam Exchange's docs state they are "currently in Expired Status pending alignment with FINTRAC entity framework."

FINTRAC has NO such concept as "pending alignment with entity framework." This is entirely fabricated language designed to normalize their non-compliance. The official FINTRAC registry simply shows: EXPIRED.

FINTRAC Is Actively Enforcing (2024-2026)

* $177M penalty: Xeltox/Cryptomus (Oct 2025) - largest in Canadian history

* $19.5M penalty: KuCoin (July 2025)

* 23 Notices of Violation issued in 2024-25 totaling $25M+ (record year)

* 51 MSB registrations revoked on March 24, 2026 alone

* Proposed Strong Borders Act (Bill C-2) would increase max penalties to $2.5M-$20M

Source: fintrac-canafe.canada.ca/pen/4-eng

Ontario Securities Commission (OSC)

Steam Exchange does NOT appear on the OSC's list of registered crypto trading platforms, NOR on the list of platforms that have filed Pre-Registration Undertakings. Since March 29, 2021, all crypto platforms operating in Ontario must contact OSC staff to initiate registration or face enforcement.

Recent OSC Enforcement Against Unregistered Platforms:

CoinField (2025): Permanently banned + $2.4M penalty + $537K disgorgement

Bybit (2022): ~$2.5M fine + stop accepting Ontario accounts

KuCoin (2022): Permanent market participation ban

Verify: OSC Registered Platforms List

Employment Claims: None Independently Verified

Every claimed position on Neville Divecha's profile (Bell Canada, IBM, DHL, WSIB, Seneca College) traces back to his own LinkedIn, ZoomInfo (which indexes LinkedIn), or self-authored press releases. No independent source confirms any of these roles. This does not mean the claims are false -- only that they cannot be verified through public sources beyond his own statements.

14

Third-Party Security Scores

CertiK Skynet

75.68

BBB Rating

Code Security10%

Fundamental Health15%

Operational Resilience20%

Community Trust40%

Governance Strength5%

Market Stability15%

KYC: NOT verified. Bug bounty: $0. Audit: NOT by CertiK.

Flags: mint function, proxy contract, external call risk, owner privilege x5, trading constraint x5

CoinGecko / cer.live

38%

Security Score

Insurance0%

Bug Bounty0%

AuditN/A

CoinCarp Aggregate

3.2/5

Security Rating

CertiK3.7/5

Cyberscope2.7/5

Trustpilot Reviews (Coordinated Campaign)

4.2/5 from 9 reviews SUSPICIOUS: 7/9 SAME DAY

7 of 9 reviews posted on August 5-6, 2025. Nearly identical language praising "transparency." Posted 2.5 months after CryptoFlan's critical Medium article. 5 of 7 reviewers have ONLY 1 review on their entire Trustpilot profile (classic sock puppet indicator). Reviewers span 6+ countries (Argentina, Canada, Spain, Philippines, Indonesia, UK) but all posted the same day. NONE of these names appear on the Steam Exchange community forum -- complete disconnect from actual users.

*****Ruud Brouwer - Aug 8, 2025

"Fantastic team for 4 years since I joined STEAMX. Definitely one of the most transparent projects..."

*****Adrian - Aug 6, 2025

"Very pleased with all the devs that are building out this amazing L1. Non-custodial cex incoming..."

*****Maldios - Aug 5, 2025

"Steam exchange saved my funds from a hacker attack, they were very helpful in the process..."

****Chino - Aug 5, 2025

"I've been following the SteamX project for 4 years. The entire team from the top down are top notch..."

*****Rai - Aug 5, 2025

"One the most transparent team in the crypto sphere. All milestones and set backs are announced..."

*****Vand - Aug 5, 2025

"Trustworthy, based, friendly and helpful developers, well mannered and helpful mods..."

*****Alin Cristian - Aug 5, 2025

"L1 EVM compatible blockchain, POWbA consensus mechanism, non-custodial CEX..."

****Abdulbasit Amin - Aug 5, 2025

"This is an under the radar Blockchain with a novel consensus mechanism..."

Verify: trustpilot.com/review/steamexchange.io

Paid Promotion & Manufactured Credibility

*Newsfile Corp paid press releases syndicated to Yahoo Finance, Benzinga, Street Insider, Digital Journal. At least 3 identified (Aug 2021, Apr 2022, Nov 2022). These are paid placements, not editorial coverage -- but create the appearance of mainstream media attention.

*Celebrity AMAs: UFC fighter Vince Morales and actor Cameron Bright. Celebrity AMAs in low-cap crypto are a well-documented paid promotion tactic. (Source)

*MetaOps $100 SteamX giveaway -- cross-promotion with crypto FPS game. Documented on Coindar.

*Meme Coin Central feature -- likely paid placement calling it "one of the more successful projects in the BSC space" (during 2022 hype phase).

*Trustpilot reviewer "Abdulbasit Amin" also appeared as a contest winner on the Shillit App platform, winning $100 in $SHILL tokens -- confirming participation in paid crypto promotional activities.

*ICOholder: 0% team verified despite being publicly "doxxed." The team exists on LinkedIn but has zero independent verification or crypto track record.

Pattern: Pay for press releases -> pay for celebrity AMAs -> pay for review site features -> coordinate Trustpilot reviews -> use all of this to claim "legitimacy" and "transparency" to investors.

15

On-Chain Fund Flow Map

GENESIS & SETUP (June 24, 2024) ------------------------------------ 0x76e6a920...1337 (Infra Deployer) |-- Deployed UniswapV2Factory |-- Deployed UniswapV2Router02 |-- Deployed RailsLocker |-- Funded genesis wallet with 5,600 STEAMX |-- Holds test tokens: "AAA" + "mainnettest1" 0xD79e8B8e... (Genesis Distribution) |-- Sent 2,594,862 STEAMX (99.8%) -> 0x1b8EeF88... (single mega-wallet) |-- Sent 100 STEAMX each -> Validator 1 (0x62780E45...6b54) |-- Sent 100 STEAMX each -> Validator 2 (0x62780E65...3daC) |-- Sent 100 STEAMX each -> ~45 other wallets MINTING & BRIDGE (July 2024) ------------------------------------ 0x6278A5a4... (Admin/Owner - holds 33% of WSTEAMX) |-- MINTED $2,300,000 USDC to itself (July 1, 2024) |-- Sent $2.3M USDC -> 0x...627803 (Bridge proxy) |-- Transferred ownership of WSTEAMX, USDC, + 3 other contracts |-- Holds: 2,421,996 WSTEAMX + $120,216 USDC WASH TRADING SETUP (Sept 2025) ------------------------------------ 0x2454Cd61...1337 (Bridge Deployer) |-- Sent $78,757 USDC -> Bot A (0xA1b48375...) |-- Sent $20,000 USDC -> Bot B (0x3ea13064...) |-- Deployed bridge, escrow, RNG contracts WASH TRADING RING (Ongoing 24/7) ------------------------------------ Bot A (0xA1b483...) 73,239 tx | SOLE LP PROVIDER (100%) Bot B (0x3ea130...) 86,835 tx | Bot C (0xe8e68C...) 85,274 tx | All swap WSTEAMX<->USDC q30-60s | | +----> Fee Collector (0x0Fe858...) <----+ (0.001 STEAMX heartbeats) Total bot tx: 245,348 / 302,456 chain total = 81.1%

16

Complete Wallet Directory (Click to Verify on BscScan)

Every wallet in the investigation. Click any address to open on BscScan or the Rails explorer. All addresses are copyable.

Role	Chain	Address (click to verify)	Balance	Tx Count
Stake.com 6 (Gambling)	BSC	0xFa500178de024BF43CFA69B7e636A28AB68F2741	--	--
Consolidation Wallet	BSC	0x516bb07dfb8E550ebbb8d041EC0b23EDfA3B0Bdb	$0	1,857
Platform Fee Wallet	BSC	0xb52f30714d7f1058225190a57544a31e05175c55	$0	672
Marketing Fee Wallet	BSC	0x2e2791c589d4b8f72587b8e5a7fa17b68881e28f	$0	691
V2 Token Contract	BSC	0xc0924edefb2c0c303de2d0c21bff07ab763163b5	~$0	38,262
V1 Token Contract	BSC	0xf6d4caf8fcdd4e71a892edaca009aaf3c5e82eb8	--	--
Deployer (labeled on BscScan)	BSC	0x0542Df7daCc8716653Df3fd9F991520AA2f2D0bc	$40K STEAMX	1,055
Migration Contract (50.9%)	BSC	0xdB6D6C6188AAD23C8443C280BbB53993C4434622	46.6B STEAMX	--
PancakeSwap LP (DRAINED)	BSC	0x2cf62ca075b26656c5dac627ee5533fb6c21aa48	$8.31	72
Validator 1	Rails	0x62780E457a5295518b40917430984eBcA3116b54	7,400 STEAMX	1
Validator 2	Rails	0x62780E658bdE13bC4b8235F02E8CFfF9652c3daC	7,407 STEAMX	1
Admin/Owner (33% WSTEAMX)	Rails	0x6278A5a4E6ca72c502a307D8752F8648c5095232	$120K USDC	1,620
Wash Bot 1	Rails	0x3ea1306419102A868Ad282b8eaD4CD242a67d4c4	--	86,835
Wash Bot 2	Rails	0xe8e68C5Bc3c5FaD8b6d757F7DA204ef4320c45FB	--	85,274
Wash Bot 3 (100% LP)	Rails	0xA1b48375a647960500176846AFd96AF59153b45D	--	73,239
Bridge Deployer (funded bots)	Rails	0x2454Cd61602944B31cfB51654120702EB9a91337	$0	--
Infra Deployer (DEX+all)	Rails	0x76e6a92022bFC3F645419bd776429a8Da1041337	--	--
Genesis Distribution	Rails	0xD79e8B8e37787914e5F5A2a15C20a6c43BA24e76	5,600 STEAMX	71

3 node accounts enumerated on public RPC (password-locked, zero balance): 0xf04c0194...febe17 (genesis day), 0x1cbb77fc...13b4c + 0xc773b34e...d20a (both created March 31, 2026). Server path leaked: /rails/data/keystore/

BSC Token Contracts (4 Found)

Cross-Chain Bridge Infrastructure (from depot JS bundle)

16 hardcoded addresses found in the publicly served JavaScript reveal their entire bridge setup:

Chain	Contract	Address
Ethereum	USDC	0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48
Ethereum	Bridge	0x2Add4242B7eb8Aa167ee374f706B8DB28258C708
BSC	STEAMX Token	0xc0924edefb2c0c303de2d0c21bff07ab763163b5
BSC	Migration	0xdB6D6C6188AAD23C8443C280BbB53993C4434622
Polygon	USDC	0x3c499c542cef5e3811e1192ce70d8cc03d5c3359
Polygon	Bridge	0xbA05AFC65BEF2E2bdfF7E248C7908e4b72e5545C
Rails	USDC	0x0000000000000000000000000000000000627801
Rails	Bridge	0x0000000000000000000000000000000000627803
Rails	Bridge Bonus	0x00fDD1afbF69f2dFC8d668B4A4f64d8aE902C8b6

The bridge is currently offline (intentionally, per CMC community reports -- to prevent $150K+ USDC withdrawals). Despite having contracts deployed on Ethereum, BSC, and Polygon, the bridge has been used by exactly 1 address (the deployer) for 102 total transactions.

BSC Token Contracts (4 Found)

V1 (Original - July 2021) ABANDONED

0xf6d4caf8fcdd4e71a892edaca009aaf3c5e82eb8

Holders: 2,061

Decimals: 2

Tax: 10%

Price: $0.00

Audited: SourceHat

Ownership: NOT renounced

V2 (Current - Jan 2022) BACKDOOR

0xc0924edefb2c0c303de2d0c21bff07ab763163b5

Holders: 19,228

Decimals: 9

Tax: 13%

Price: $0.061

Audited: NEVER

Ownership: NOT renounced + unlock() backdoor

unlock() allows previous owner to reclaim ownership after timelock. Anti-whale: 0.5%+ holders can only sell 20% with 24h cooldown.

V3 (Test/Clone) UNVERIFIED CODE

0x051c944e29c064477ddb7bf4869b835e8bcb26ce

Holders: 14

Source code: NOT verified

Variant (Different Deployer) SUSPICIOUS

0xb5540a68b0e40da35bca38a86621d9f1433038b0

Holders: 6

Supply: 1 QUADRILLION

Deployer: DIFFERENT (0x254ed2...)

Symbol: STEAM-EXCHANGE

Verification Sources

Explorer API /v2/stats (real metrics) Explorer Frontend (shows placeholder data) BscScan - V2 Token Contract SourceHat Smart Contract Audit BscScan - Deployer Wallet CryptoFlan Investigation (Medium) CoinGecko - WSTEAMX BitDegree - 0 Monthly Visitors Trustpilot (coordinated reviews) FINTRAC MSB M21770262 (expired) OSC - NOT registered ICOholder - 0% Team Verified GitHub - divechan (Neville) GitHub - maarizalmamun (hidden dev) Forum - Migration Losses Viraf at Marriott - TheOrg @Steam_Exchange on X The NFT Arcade (sister project) CertiK Skynet - 75.68 BBB CoinCarp - Security 3.2/5 BscScan - V1 Token (2,061 holders) BscScan - V3 Token (14 holders) BscScan - Variant (1Q supply, 6 holders) Security Breach Tweet (March 2024) Forum - Broken Migration Tool Forum - 15% Migration Fee Newsfile - Original Press Release CIPO Trademark #2164884 GitHub - SteamExchangeInc org Tracxn - The NFT Arcade Telegram Announcements (public) CoinGecko DEX - $766/day volume V2 Contract Source Code (unlock backdoor) IsThisCoinAScam - Steam Exchange

G

What Does This All Mean? (Plain Language)

Not everyone speaks blockchain. Here's what the key technical terms mean in simple English.

Geth Fork

Geth (go-ethereum) is the free, open-source software that powers the Ethereum blockchain. Anyone can download it and run their own blockchain in minutes. A "fork" means they copied it and renamed it. Steam Exchange copied geth, renamed it "Grails," changed the chain ID number, and called it an "innovative custom blockchain." It's like downloading WordPress, changing the logo, and claiming you invented a new content management system.

Wash Trading

Wash trading is when someone buys and sells the same thing to themselves to create fake trading volume. Imagine going to a yard sale, buying your own items with your own money, then telling the neighborhood you had a "busy sales day." On Rails Network, 3 bot wallets execute the same swap every 30-60 seconds, 24/7. 81.1% of all chain activity is this fake trading. It makes the chain look active when it's actually dead.

RPC Endpoint / Admin Modules

An RPC endpoint is like the front door to a blockchain node -- it's how wallets and apps talk to the chain. "Admin" and "debug" modules are special controls meant ONLY for the server operator (like having the master key to a building). Steam Exchange left ALL these controls exposed to the public internet. It's like leaving your house unlocked with the security cameras, alarm codes, and safe combination taped to the front door. The official geth docs say "NEVER do this."

LP (Liquidity Pool) Drained

A liquidity pool is a pot of money that makes trading possible on a decentralized exchange. When you buy or sell a token, you're trading against this pool. "LP drained to $8.31" means someone removed virtually all the money from this pot. With no money in the pool, nobody can sell their tokens. The 19,228 BSC holders are stuck with tokens they literally cannot sell -- there's no buyer, no money, no exit.

Smart Contract Backdoor (unlock())

When a token creator "renounces ownership," they're supposed to permanently give up control -- like throwing away the master key. Steam Exchange's V2 contract has a hidden function called unlock() that lets the previous owner get the key back after a timer expires. It's like "throwing away" your house key but keeping a spare hidden under the mat. The owner can reclaim full control at any time, change where fees go, or modify the contract -- even after claiming they gave up control.

Fake "USDC" on Rails

Real USDC is a stablecoin issued by Circle, backed by actual US dollars in bank accounts. The "USDC" on Rails Network is NOT real USDC -- the admin wallet just created a token, named it "USDC," and gave it to people. It has no backing, no reserves, no connection to Circle. It's like printing your own dollar bills on a home printer and calling them real money. The bridge to convert this fake USDC to real money has been down for 18 months.

MSB / FINTRAC Registration

In Canada, any business that handles money transfers or currency exchange must register as a Money Services Business (MSB) with FINTRAC (Canada's financial crime watchdog). Steam Exchange's MSB registration expired September 2, 2023 -- over 2.5 years ago. Operating without this registration is a criminal offense that can result in up to $2 million in fines and 5 years in prison. It's like running a bank without a banking license.

13% Transaction Tax

Every time someone bought or sold STEAMX, 13% was automatically taken. Of that, 7% (4% "platform" + 3% "marketing") was converted to BNB and sent to team wallets. Those wallets forwarded everything to a consolidation account, which deposited it all into Stake.com -- a crypto gambling casino. Think of it like a store that charges 13% sales tax but instead of sending it to the government, the owner takes it to the casino.

P

Connected Persons of Interest

Individuals connected to the Steam Exchange network flagged for further investigation. Claims listed are from community reports and require independent verification.

Jayde Herrick "letzgoyo"

Former Pro Cricketer / NFT Arcade Co-Founder

Former professional cricketer (Victoria, Melbourne Renegades, 77 First-class wickets). CEO of The NFT Arcade (which partnered with both Steam Exchange AND SKALE Network). Now CEO of iPFi (ApeChain) with CTO Aaron Guyett -- the same @Guyett who launched Fantasy Friends on Rails. Also connected to Ciphera, Silencio Network, N3BU_LAA, The_VIMY, HectorsFantasy. Middle name Matthew (JMH not JB). Had falling out with Neville over investments.

NEW: Connected to Puffsterz network. BILL-E (@NFTpromoKING420), an artist in the Puffsterz/VibeTribe network, publicly tagged Jayde as a "real builder on SOL" alongside other network members. This connects the STEAMX investigation to the Puffsterz investigation through a second path (first path: Pete/@OnlyPetes → Swiss/@SWISS_SOL).

@JaydeHerrick_ LinkedIn Wikipedia iPFi Proposal SKALE Partnership

@Papa_RNE / "TheAccountant" / goingconcern.eth "RNE, CPA"

STEAMX Super-Promoter / ENS Wallets Traced / Web3 Comics LLC (Maryland) / Multiple False Claims

X account created Aug 5, 2020 (940 tweets, 436 followers). Timeline is almost entirely STEAMX promotion. Also goes by "TheAccountant", holdtowin61, and "JB" (Jb6111) per investor reports. "Going concern" is an accounting term -- perfectly matching the "CPA" credential claim.

ENS Wallet Trail:
* goingconcern.eth resolves to 0xC1da309F85eD397A942f9bF212cdd63110E61515
* theaccountant.eth resolves to 0x7aeaDE1363Cc42334EF87e3Bf0e5fb227c3658b4
* goingconcern.eth wallet active on Polygon: holds Meta Motor Friends Key (MMFK), Meta Motor Keys (MMK), Metakrew NPZ, Mythical Beings, Nanoverse NFTs + MMF, ROLL, WMATIC tokens
* No BSC activity -- connection to STEAMX is as a promoter, not directly on-chain
* Holdtowin (7ADD) Token deployed on Ethereum: 0xEd36...DF92

Web3 Comics LLC -- Maryland:
* Registered address: 8 Eastern Avenue, Annapolis, Maryland 21403 (waterfront condo, sold July 2024 for $3.275M)
* Trademark attorney: Ashley D. Johnson, Dogwood Patent and Trademark Law, Raleigh NC
* USPTO trademarks: CYBERHORNETS (serial #97382396), WEB3 COMICS (serial #97382406) -- both filed April 26, 2022
* Separate: "Cyber Horner LLC" (note spelling) trademark for ATMs: USPTO #90870128

Claims debunked:
* "Purchased MetaOps" -- FALSE. MetaOps was always owned by Jacob Sloan / Open Portal Studios LLC (Spring, TX). Co-founded with Patrick Ryan Schulte. Sold to Ceden Network July 2024, reacquired by Open Portal Studios July 2025.
* "Owned a gold mine" -- Zero evidence found.
* "Owned Web3 Comics" -- Web3 Comics LLC registered in Maryland. Papa_RNE displays CPA credentials consistent with the "goingconcern.eth" ENS name. Connection plausible but owner name not in public USPTO records.
* "Owned CyberHornets" -- CyberHornets Colony Club: 8,888 Ethereum NFTs, floor 0.0052 ETH (dead project). Published by Web3 Comics LLC. Contract: 0x8210...bea2. Deployer wallet: 0x3f8f...f834 (labeled "Cyber Hornets Colony Club: Deployer" on Etherscan). Artist: Elliot Fernandez (DC/Marvel credits). Celebrity endorsements: NBA's Tobias Harris, NHL's Zack Boychuk. Founder persona @cryptoQUEEN_Q (SUSPENDED) -- internally known as "The Queen."

@Papa_RNE on X X Profile goingconcern.eth Wallet theaccountant.eth Wallet Polygon Activity Web3 Comics Trademark CyberHornets OpenSea Web3 Comics Wallet Holdtowin (7ADD) Token CHCC Deployer Wallet CHCC Deploy TX

Active investigation. ENS wallets traced. LLC at 8 Eastern Ave, Annapolis MD (waterfront condo sold $3.275M July 2024). CyberHornets deployer wallet identified: 0x3f8f...f834. Next: Maryland SDAT LLC member lookup + CPA license search at Maryland Board of Public Accountancy.

"Pete" / Shaun Eric Divecha @OnlyPetes — "citizen and resident of Canada" (sworn court filing)

Steam Exchange Co-Founder / B.O.T. NFT Co-Founder / Astrals $11M Lead Plaintiff / Every Associated Project Dead

X bio: "Co-Founder Of @Steam_Exchange & @B_O_T_NFT" — but NOT listed on any official Steam Exchange team page (only Bard, Divecha, Beckford, Chapgar are). Account created July 2021, 927 followers, 5,500+ tweets, inactive ~8-9 months.

Identity — Shaun Eric Divecha (Confirmed):
* Identified as "Pete (Shaun)" by CMC user @remaptools. Confirmed by community members to have discussed the Astrals NFT lawsuit — and the ONLY "Shaun Divecha" in those court records is Shaun Eric Divecha of Burbank, California.
* COURT FILING PROOF: Paragraph 14 of the Amended Complaint (Case 1:23-cv-21912-FAM, filed Sept 7, 2023): "Plaintiff Shaun Divecha is a citizen and resident of Canada." Sworn under penalty of perjury.
* Paragraph 15: "Plaintiff Viraf Sam Chapgar is a citizen and resident of Canada." — Both STEAMX-connected plaintiffs are Canadian.
* US Business Filings: 342 E Tujunga Ave, Burbank, CA 91502 (townhouse, family owns units 102/103). Likely previous address before moving to Canada, or brother Adrian's address where filings remain.
* Father: Behram Keki Divecha (Medina, Ohio; also works at TI Corp, Vancouver BC)
* Brother: Adrian Jehangir Divecha (Burbank — co-founded Identipop LLC, Divecha LLC, Pivotal Talent LLC)
* Education: BA International Management, Franklin University Switzerland (2010) → MS Management, Babson College (2011-2012)
* Career: Homejoy (SF) → Soothe (Head of Product / interim CTO, LA) → Certemy (Senior PM) → Divecha Corp
* NOT Neville's biological brother — different Parsi families (Behram/Ohio vs Aspi/Toronto). Connected through the Parsi diaspora, crypto circles, and Viraf Chapgar. Community calls them "brothers."

Astrals NFT $11M Lawsuit — Lead Plaintiff:
* Case: Harper v. O'Neal, No. 1:23-cv-21912-FAM (S.D. Florida)
* Shaun Divecha = court-appointed lead plaintiff (1 of 6) alongside Viraf Chapgar (Steam Exchange marketing head)
* $11M settlement approved April 1, 2025 by Judge Federico Moreno
* Plaintiffs' counsel: The Moskowitz Law Firm, PLLC (Adam M. Moskowitz)
* Two Steam Exchange insiders as co-plaintiffs suing Shaquille O'Neal

Astrals Wallet (Partially Identified):
* NFT Plazas reported the community tracked down a plaintiff's wallet containing: DeY00ts NFTs, Not Bored Ape NFT, Okay Gods NFTs, and a .SOL domain name
* Shaun stated under oath he purchased/sold Astrals securities between March 10 - June 15, 2022
* Settlement claim form requires wallet address submission — addresses are in the court record (PACER Case 1:23-cv-21912)
* @OnlyPetes account is still active at x.com/OnlyPetes — inactive ~8-9 months but not deleted. Bio: "Co-Founder Of @Steam_Exchange & @B_O_T_NFT"

Pete's Project Trail — All Dead:
* B.O.T. NFT — Claims "AI trading bot" (Docker Swarm, PostgreSQL, AES-256, OAuth 2.0, JWT, Cloudflare WAF). Website botnft.io lists ZERO team members despite Pete claiming co-founder. No evidence bot ever functioned. NFT not on any marketplace.
* Dworfz — Solana NFTs (5,454 supply, March 2023). Floor 0.02 SOL (~$1.65). Zero transactions. Dead since late 2023.
* Puffsterz — Solana NFTs (1,888 of 4,000 advertised). Run by Karim M. Adhami (former used car salesman, Winter Park Auto Mall) through Puffsterz Smoke Shop LLC, Satellite Beach FL. 7% royalty. Zero daily transactions. 294 holders. Also runs VibeTribe ("youth apparel" from a tobacco/vape shop). Magic Eden
* Moowaan CTO — Meme token with multiple contracts on ETH + Solana (serial rug pattern). $1.56 daily volume. Dev abandoned. 6+ sockpuppet Twitter accounts.

@OnlyPetes on X Astrals Settlement (names Shaun Divecha) Amended Complaint PDF (¶14: "citizen of Canada") Justia Court Docket Burbank Business Filings (previous address) LinkedIn (LA) Crunchbase @B_O_T_NFT botnft.io Dworfz (dead) Public Records

Every project Pete touches dies. B.O.T. NFT = phantom product. Dworfz = worthless. Puffsterz = dead (0 daily txs, used car salesman founder). Moowaan = rugged. Steam Exchange = $700K to Stake.com. @OnlyPetes inactive ~8-9 months.

Dino Landzo @low_low416 / "LowLow.Sol {B.O.T.}"

Mississauga, ON / B.O.T. NFT Inner Circle

X display name: "LowLow.Sol {B.O.T.}" with "@B_o_t_NFT" in bio. Confirmed B.O.T. NFT inner circle member. Operates Landzo Roofing in Mississauga, Ontario. 138 followers, 1,100 tweets, inactive 8+ months. 100 SOL dispute with @crypto_flan referenced. Facebook: "Lowenuff Dino."

Facebook Landzo Roofing (HomeStars) @low_low416 on X

Future investigation target.

"Swiss" / Swiss.P4L [PUFF] @SWISS_SOL — VibeTribe Developer + Event Host / Pete's Right Hand

North Carolina / CNC Machinist / Built Puffsterz & VibeTribe Staking UI / $VAPE Token Creator / Full Puffsterz Report

Confirmed X handle: @SWISS_SOL. Also possibly @NftSwiss (unconfirmed if same person). Based in North Carolina. Background in CNC machining/manufacturing ("Swiss" = Swiss-style CNC lathes, a specific machining trade). Community members describe Swiss as Pete/@OnlyPetes' "right hand man" — they worked together daily, traded together, and were in constant communication.

VibeTribe Core Team — Confirmed:
* @SWISS_SOL identified as the HOST of VibeTribe's "Quarterly Update 2026" event (March 7, 2026 at 1PM). Founders were invited to give project updates at this event.
* Hosting the quarterly community event = core team/admin role, not a casual participant
* VibeTribe is "an extension of Puffsterz Corp" = Swiss is operationally involved in the Puffsterz smoke shop ecosystem

Network position:
* VibeTribe NFT (@VibeTribe_NFT) — hosts quarterly events, core team
* Puffsterz (@puffsterznfts) — connected via VibeTribe being "extension of Puffsterz Corp"
* Pete/Shaun Eric Divecha (@OnlyPetes) — daily trading and working partner
* Likely connected to B.O.T. NFT, Dworfz, and the wider network

The smoke shop → youth pipeline: Swiss hosts events for the VibeTribe project that markets "youth apparel & sponsorships" under the same LLC as Puffsterz Smoke Shop (tobacco/vape retailer). This potentially violates 21 CFR 1140.34 and the Family Smoking Prevention and Tobacco Control Act.

Identity leads: "swiss.sol" may be a Solana Name Service domain — check sns.id/domain/swiss for wallet ownership. NC business records may reveal real name if involved in Puffsterz Corp operations. Real name unknown — not doxxed publicly.

@SWISS_SOL on X @NftSwiss (possibly same person) @VibeTribe_NFT swiss.sol SNS Lookup

Active investigation target. Real name unknown. Confirmed VibeTribe event host (March 2026). NC machinist background. Swiss.sol domain may reveal wallet address.

Karim M. Adhami Puffsterz Smoke Shop LLC / VibeTribe

Satellite Beach, FL / Former Used Car Salesman / Smoke Shop → Youth NFTs

President of Puffsterz Smoke Shop LLC (FL Doc# L22000460562, filed Oct 26, 2022). Address: 252 Highway A1A (Jimmy Buffett Memorial Hwy), Satellite Beach, FL 32937. EIN: 92-0865025.

Previous career: Financial Director at Winter Park Auto Mall (used car dealership, Orlando FL). Education: Valencia College. Also has an IMDb page ("No Charge," 2011).

Runs the entire Puffsterz ecosystem: Smoke shop (@LetzVape on X, with Bitcoin ATM), NFT collection (1,888 Solana NFTs, 7% royalty, zero daily transactions), VibeTribe NFT ("youth apparel & sponsorships"), streetwear store selling youth clothing to "active kids," $CRUMBS token (vaporware), Task-to-Earn (FTC warns: $220M lost to task scams H1 2024), "Puffsterz Pad" (doesn't exist), Society3 apparel. Facebook self-categorizes as "Clothing Brand" AND "Tobacco Store."

Critical issues:
* Operating "youth apparel & sponsorships" (VibeTribe) under the same LLC as a tobacco/vape shop
* Websites STILL advertise 4,000 NFTs while only 1,888 were minted — active misrepresentation on puffsterz.io and puffsterz.xyz
* +69% price gain in 30 days with ZERO daily transactions — mathematically impossible without wash trading
* Bitcoin ATM in smoke shop during FBI-reported $333M in crypto ATM scams (2025)
* $CRUMBS token: complete vaporware (no listing on any exchange, DEX, CoinMarketCap, or CoinGecko)
* Puffsterz Pad launchpad: does not exist anywhere on the internet
* Task-to-Earn: zero verifiable earnings by anyone. FTC warns about task scams
* Streetwear store: 5.0/5.0 rating with 1 total review (likely self-generated). Zero independent reviews
* Average holder owns 6.4 NFTs — concentrated ownership suggesting insider bags
* Used car salesman → smoke shop → NFT "Corp" CEO with zero blockchain background
* On-chain wallets found: Update authority/deployer: 7Emey6uWBFYuD8PASf5cbatpzBC4wbrQANjphVa6UjSY. 50/50 royalty split between TWO creator wallets: 7jQVPGxETvzPPaVyC19EGTNFEUmAVgY83cgnfkR5vUFu (50%) + nxnR96r36UZiR3e7ftrgGc778Gq49RA8zXrd7Weo835 (50%). Two people getting paid — Karim + who? (Swiss? Pete? Mary Assaf?)
* Dworfz has DIFFERENT deployer wallets — not the same on-chain infrastructure, but same promotional network
* Winter Park Auto Mall complaints: Undisclosed frame damage on sold vehicles, cars breaking down first day, "glued-on hoses," misrepresentation of repaints. NOT BBB accredited. (DealerRater)
* Additional entities: Baraka Investment Properties LLC + Artistic Charm LLC (both at 8322 Lake Serene Dr, Orlando — shared residential address)
* Society3 "apparel service" = FREE CANVA SITE (society3.my.canva.site). Zero clients. Zero portfolio.
* VibeTribe "youth sponsorships" = ZERO evidence. No named athletes, no named events, no sponsorship documentation found anywhere.
* Whitepaper: does not exist. Referenced in Linktree but nowhere to be found.
* "Marketing Agency" (Twitter bio): zero clients, zero portfolio, zero case studies.
* VibeTribe NFT on Magic Eden: Collection address 4SrWuzamZG6e5YwBgVoDvZJzKhbDwX9A7odW9Gp5jSNr. 1,581 NFTs, 181 holders, floor 0.65 SOL, all-time volume 402.73 SOL. Created June 6, 2024. Website: vibelabz.app. Description: "A 1.6K Collection built on Solana under the Puffsterz™ umbrella." (Magic Eden)
* $CRUMBS token: Two dead pump.fun tokens found. Token #1: 5LCwvLjYHpGa2XrFiy9i35UigZisuUqnkQs14RBcpump ($1.3K FDV, $0 volume). Token #2: CBrxz6oLUrqP1kTPwQy4nq6mUwybzX2gCHF6Bufppump ($3.8K FDV, $0 volume). Puffsterz sells $CRUMBS merchandise. No $PUFF, $P4L, or $VAPE tokens found connected to Puffsterz.
* 25 Facebook likes for a self-described "Global Brand." ZoomInfo classifies as "Convenience Stores, Gas Stations & Liquor Stores" under $5M revenue.
* Tobacco permit: UNVERIFIED. Could not confirm required Florida RTPD permit.

LinkedIn (Puffsterz) LinkedIn (Auto Mall) CorporationWiki Puffsterz (Magic Eden) @VibeTribe_NFT (youth) @puffsterznfts @LetzVape (smoke shop) Facebook ("Clothing + Tobacco") Youth T-Shirt Product Page

"JB" / Jb6111 Confirmed in Official Telegram

Rails Name Service Owner / DAMNFT / Vanished / Investors say = Papa_RNE / TheAccountant

Confirmed from Steam Exchange's official Telegram announcement channel: Jb6111 introduced as "project owner" of Rails Name Service in an X Space announcement. The exact Telegram post reads: "X Space scheduled with project owner Jb6111. '.rails or .steamx domain' feature enabling custom wallet addresses. 'BeardedWizard.rails is already reserved.'"

CMC investors identify JB as the same person as Papa_RNE / TheAccountant / holdtowin61. JB's role: running RNS and DAMNFT -- both "planned" Rails ecosystem projects that never launched. "Pumped the chat day in day out" then disappeared. The MetaOps connection is false (real CEO: Jacob Sloan, Open Portal Studios LLC, co-founded with Patrick Ryan Schulte).

Telegram Announcements (source) MetaOps (real, unrelated) Open Portal Studios

Active investigation target. "Jb6111" has zero footprint across all public platforms -- Telegram-only handle. Investors claim JB = Papa_RNE = TheAccountant = holdtowin61 = goingconcern.eth.

Connected Projects

Require Investigation

* Green Lung Genetics -- Cannabis NFTs on Solana (~222 holders). Likely the "NFT weed store" from CMC. Magic Eden

* Takashi Warriors -- 500 Solana NFTs, 65 owners, dormant

* CyberHornets Colony Club -- 8,888 NFTs, floor 0.0052 ETH (dead). Published by Web3 Comics LLC, Annapolis MD. Artist: Elliot Fernandez. Celebrity endorsements: Tobias Harris (NBA), Zack Boychuk (NHL). Founder persona @cryptoQUEEN_Q (SUSPENDED). Contract: Etherscan

* CyberHornets Animus -- 6,666 NFTs by Elliot Fernandez. Magic Eden

* Web3 Comics LLC -- Maryland LLC, 8 Eastern Ave, Annapolis MD 21403. Owns both CYBERHORNETS and WEB3 COMICS trademarks. Attorney: Ashley D. Johnson, Dogwood Patent and Trademark Law.

* MetaOps -- Papa_RNE claims to have "purchased" it (debunked: owned by Jacob Sloan & Patrick Ryan Schulte / Open Portal Studios LLC, Spring TX)

* Fantasy Friends / Portfolio Wars -- "First project" deployed on Rails. Announced Jan 2024 via Telegram. Rebranded to "Portfolio Wars." Telegram group has 100 members. Status: effectively dead.

* @holdtowin61 -- Airdrop farmer/shill. 15,150 tweets (16/day avg!) with 301 followers. 50:1 tweet-to-follower ratio. Promotes $TOBY, $SOMO, $AIX, $STEAMX. Inactive ~1 year. X profile

* @rs1d68trulvn + @q3xxkapixpev -- CMC defender accounts. Randomly generated handles. Zero web presence anywhere. Textbook sockpuppet throwaway accounts created solely to defend Steam Exchange against criticism on CoinMarketCap.

* "Tom" -- Defender named by CMC investors. Identity unknown. Not found on X/Twitter. Likely operates in Telegram/Discord only.

B.O.T. NFT -- "Builders of Tomorrow" (@B_O_T_NFT)

The "BOT scam" from CMC. Solana-based NFT project promising an AI algorithmic trading bot via Drift Protocol + Jupiter + Raydium + Serum + CEX platforms. Co-founded by Pete/Shaun Divecha (@OnlyPetes, bio confirms) with Dino Landzo (@low_low416, display name: "LowLow.Sol {B.O.T.}", bio: "@B_o_t_NFT"). Website botnft.io lists ZERO team members. Claims Docker Swarm, PostgreSQL, Prometheus+Grafana, AES-256, OAuth 2.0, JWT, Cloudflare WAF -- zero proof any of it exists. NOT listed on OpenSea, Magic Eden, or Tensor. Tier system: 1-10 NFTs = 10% fees, 21+ NFTs = 1-8%. All accounts inactive 8+ months. 100 SOL dispute with @crypto_flan referenced.

@B_O_T_NFT (tweets deleted) botnft.io

Pete/Shaun's Serial Project Network — The Pattern

Pete/Shaun Divecha (@OnlyPetes, inactive ~8-9 months) and his circle promoted, partnered with, or launched a cluster of Solana projects that share suspicious commonalities. Community members report these projects were pushed by the same group of people operating as partners under different brand names.

Project	Chain	Launch	Team Doxxed?	Status	Delivered?
B.O.T. NFT	Solana	Jan 2023	No (zero team on site)	Dead	No — bot never existed
Dworfz	Solana	Mar 2023	No	Dead (0.02 SOL floor)	No — "gamified tools" never built
Puffsterz	Solana	May 2023	Partially (LLC filing)	Dead (0 daily txs)	Smoke shop only. NFT utility = nothing.
VibeTribe	Solana	Sept 2023	No	Near-dead	"Youth apparel" from a vape shop
Moowaan	ETH + SOL	Oct 2024	No	Dead ($1.56/day)	Dev abandoned (CTO)
Steam Exchange	BSC → Rails	Jun 2021	Partially	Zombie (0 daily txs)	~$700K-$800K → Stake.com

The pattern: Anonymous teams. Grand promises. Zero delivery. Dead within months. Same group promoting across all projects. Every single one failed — except Steam Exchange, which extracted ~$700K-$800K before going zombie.

Shared characteristics: All Solana-based (except STEAMX). All launched within 18 months (Jan 2023 - Oct 2024). All have anonymous or hidden teams. All promised elaborate utility that was never delivered. All are dead or near-dead. All were promoted through the same Twitter/Discord circles centered around @OnlyPetes, @B_O_T_NFT, @low_low416, and their associates.

The smoke shop → youth pipeline (POTENTIALLY ILLEGAL): Puffsterz is run by Karim M. Adhami through Puffsterz Smoke Shop LLC (Satellite Beach, FL) — a tobacco/vape retailer. Its sub-project VibeTribe explicitly targets "youth apparel & sponsorships" while operated by the same LLC. The streetwear store sells youth-sized clothing (IzaVibe/ItzAVibe). This is textbook "brand stretching" — the WHO-identified tactic of putting tobacco brand names on non-tobacco products to circumvent advertising bans.

The evidence chain: Puffsterz Smoke Shop LLC → Twitter: @LetzVape (literally "Let's Vape") → Facebook self-categorizes as "Clothing Brand" AND "Tobacco Store" → puffsterz.xyz lists "Vape Shop & Cigar Lounge" → Sells Youth ItzAVibe T-Shirts ($24.99-$36.99) marketed to "active kids" and "young urban trendsetters" → Vibe Tribe branded youth clothing → No age verification on store → Accepts cryptocurrency

Federal laws potentially violated:
* 21 CFR 1140.34 — Prohibits marketing, licensing, or selling any item bearing a tobacco brand name including t-shirts and caps. Also prohibits tobacco-brand sponsorship of events.
* Family Smoking Prevention and Tobacco Control Act (2009) — Gives FDA authority to regulate tobacco marketing with specific youth protections. Bans branded merchandise and event sponsorships.
* Master Settlement Agreement — Bans distribution/sale of apparel with tobacco brand-name logos. Bans youth targeting in advertising, promotion, or marketing.

Precedents for enforcement:
* JUUL — $1.1B+ in settlements across 48 states for youth marketing tactics FAR less explicit than "youth apparel & sponsorships from a smoke shop"
* Joe Camel — $10M settlement, campaign terminated for cartoon mascot on merchandise
* R.J. Reynolds — $20M MSA violation fine for youth targeting
* FL Attorney General (Jan 2026) — Actively suing smoke shops for marketing to youth
* Big Tobacco MSA — $246 billion settlement for decades of youth marketing via merchandise and sponsorships

Additional legal exposure: NFT sales to minors create voidable contracts. Solana ToS requires users 18+. COPPA (updated Jan 2025) prohibits monetizing children's data. VibeTribe's Task-to-Earn platform requires Twitter login = potential data collection from underage users. If NFTs were promoted as investments, they could constitute unregistered securities (see SEC vs Impact Theory: $6.1M penalty).

The question: Were B.O.T. NFT, Dworfz, Puffsterz, VibeTribe, and Moowaan all operated or coordinated by the same group? The identical playbook (anonymous team, Solana NFTs, utility promises, rapid death) and the overlapping promotion network suggest yes. On-chain wallet analysis would confirm if deployer wallets share funding sources.

* DAMNFT / NFTDamn -- NFT marketplace promising "DamShares" with 6-12% monthly dividends (= 72-144% APY = textbook Ponzi promise). 1 billion tokens over 8 years. Listed as "Pending" on Rails ecosystem. Never launched. damnft.biz

* LandXchange -- Real estate investment platform using "$1-pegged token." Last project announced on Telegram (Oct 2024). landxchange.ca = placeholder. Never launched.

* Rails Mobsters -- "Gamified staking and mining." mobsters.io exists. Largely inactive per on-chain data.

* Sheridan College Partnership (May 2022) -- Promised "open-world educational metaverse." Press release on Yahoo Finance. Never produced a deliverable.

* UWaterloo "Rails Network Academy" (Nov 2022) -- Funded by Steam Exchange + Mitacs. Press release exercise. No accessible product found.

* Dworfz -- Solana NFTs (5,454 + 333 Abbathor sub-collection). Free mint March 24, 2023. Floor 0.02 SOL (~$1.65). Zero transactions in 24h/7d/30d. Anonymous team. Promised "gamified tools for marketing and gaming" + "revenue sharing" for Abbathor holders — none delivered. Dead since late 2023. Magic Eden

* Puffsterz -- Solana NFTs (1,888/4,000 minted). Run by Karim M. Adhami (Puffsterz Smoke Shop LLC, Satellite Beach FL). Former used car Financial Director. 7% royalty. Zero daily transactions. Sub-project: VibeTribe NFT (@VibeTribe_NFT) — "youth apparel & sponsorships" from a tobacco/vape retailer. Also runs: $CRUMBS token ($4.36K mcap), Society3 apparel, Task-to-Earn, "Puffsterz Pad" launchpad (doesn't exist). Magic Eden | FL Sunbiz (L22000460562)

* Moowaan CTO -- "Moo Deng's older sister" meme token. Multiple contracts on ETH (0x0044..., 348 holders) + Solana (at least 2-3 pump.fun launches). $1.56/day volume. Market cap ~$5K-$21K. Dev abandoned (CTO = Community Takeover). 6+ sockpuppet Twitter handles. Empty GitHub. Dead.

* @RAILS_NETWORK -- NOT an official account (18 followers, 19 tweets, bio says "Investor"). Impersonator or fan account.

R

Risk Score Breakdown

91 / 100

CRITICAL RISK

Based on 9 weighted categories with verified evidence. Fund misappropriation and market manipulation carry highest weight as they represent direct financial harm to investors.

Category	Evidence	Weight	Score
Fund Misappropriation	~2,694 BNB to Stake.com gambling. 100% one-way, zero returns. 500x bet escalation. Loss-chasing. LP drained. Team tokens drip-sold.	20	20/20
Market Manipulation	81.1% wash trading. 3 team-funded bots. Sole LP provider. Fake volume on private chain. ~$10M-$13.5M trading volume taxed.	15	15/15
Regulatory Violations	MSB expired 2.5+ years (up to $2M fine + 5yr prison). Not registered with OSC. Fabricated "FINTRAC entity framework" language.	15	15/15
Centralized Control	2-node geth fork. Halted chain, killed RPC, reversed all transactions (admitted on Telegram: "#CheckMate #TooSoonJr"). Chain reset with balance restoration. Fake "USDC" minted by admin. 99.8% of genesis to 1 wallet.	10	10/10
Smart Contract Risk	V2 unlock() backdoor (never audited). Ownership not renounced. 13% tax. Owner can change all wallets. Anti-whale for investors only.	10	9/10
Security Posture	All 8 RPC modules exposed. 6 server IPs leaked. Keystore paths. nginx 6yr. Go 3yr. Dev mode on prod. Zero security headers.	10	9/10
Team Integrity	CEO left. VP left. Marketing left. Sole operator. Brother in pump-and-dumps. Career unverified. Virtual office. Promoters fabricate credentials.	10	8/10
Social Manipulation	62% fake followers. 0 website visitors. All 9 Trustpilot reviews appeared Aug 2025 (3mo after CryptoFlan article). Paid press only. Sock puppet CMC defenders. BitDegree: "untracked" due to inactivity.	5	4/5
Product Delivery	5 years: CEX just entered "Closed BETA v1.0" (April 2026) after 5 years of promises. DEX has $5K daily volume with 1,886 automated bot txs ($2.76 avg). CrossRails cross-chain swap non-functional. Wallet, RNS, DAMNFT, LandXchange all "Coming Soon." Reddit: 1,837 subscribers, zero searchable posts in 5 years.	5	5/5
TOTAL RISK SCORE		100	91/100

All scores based on verified evidence as of April 5, 2026. Categories scoring 10/10 or above threshold have on-chain proof or confirmed public records.

For Law Enforcement & Legal Action

17

Criminal & Regulatory Case Summary

Summary of potential offenses with corresponding evidence, applicable laws, and verification links.

OFFENSE 1 Misappropriation of Investor Funds to Gambling Platform

What Happened:

13% tax collected on every STEAMX transaction. The 7% designated for "platform" (4%) and "marketing" (3%) was converted to BNB and systematically funneled through a consolidation wallet to Stake.com, an online crypto gambling casino, over 17 months (Aug 2022 - Jan 2024). 310 outgoing transactions totaling ~2,694 BNB (~$700K-$800K at average prices). 100% of all outgoing BNB went to Stake.com -- zero to any other destination. All wallets now drained to $0.

Applicable Law:

Criminal Code of Canada s.380 (Fraud over $5,000: up to 14 years). Criminal Code s.332 (Criminal breach of trust). Potentially PCMLTFA offenses if funds were laundered through gambling.

Evidence:

Consolidation wallet (1,857 tx) | Stake.com 6 (BscScan labeled) | Sample: 100.35 BNB to Stake.com

OFFENSE 2 Operating an Unregistered Money Services Business

What Happened:

FINTRAC MSB registration M21770262 expired September 2, 2023. Steam Exchange continued operating (token trading, bridging, DEX) for 2.5+ years without renewal. Their claim of "pending alignment with FINTRAC entity framework" is fabricated -- FINTRAC has no such concept.

Applicable Law:

PCMLTFA s.77.4: Knowingly operating unregistered MSB. Summary: up to $1M fine + 2 years. Indictment: up to $2M fine + 5 years imprisonment.

Evidence:

FINTRAC registry (expired) | Their fabricated compliance claim | FINTRAC penalties page

OFFENSE 3 Operating an Unregistered Crypto Trading Platform in Ontario

What Happened:

Steam Exchange operates a DEX and bridge facilitating crypto trades from Ontario, Canada. Since March 29, 2021, all crypto platforms in Ontario must register with the OSC. Steam Exchange has never registered and never filed a Pre-Registration Undertaking.

Applicable Law:

Ontario Securities Act. Precedents: CoinField permanently banned + $2.4M penalty (2025). KuCoin permanent market ban (2022). Bybit ~$2.5M fine (2022).

Evidence:

OSC registered platforms (not listed) | Active trading platform

OFFENSE 4 Grossly Misleading Blockchain Metrics (Negligence)

What Happened:

The Rails Network explorer displays Blockscout's stock placeholder data (193M transactions, 28M addresses, $1,807 price) instead of real numbers (303K tx, 4,718 addresses, $0.061). This is a configuration bug the team never fixed -- the explorer runs in development mode and real API data fails to replace the defaults. Whether intentional or negligent, anyone visiting the explorer sees numbers 638x-29,558x higher than reality. The team has left this unfixed for months while using the explorer as their public-facing chain metric source.

Applicable Law:

If investors relied on these numbers: Criminal Code s.380 (Fraud by misrepresentation). Ontario Securities Act (misleading statements). Even if unintentional, displaying grossly inflated metrics on a financial platform constitutes negligence.

Evidence:

Explorer API (real numbers) vs Explorer frontend (placeholder defaults)

OFFENSE 5 Market Manipulation via Wash Trading

What Happened:

81.1% of all Rails Network transactions (245,348 of 302,456) come from 3 bot addresses executing automated wash trades. The infrastructure deployer directly funded these bots with $98K+ USDC. One bot holds 100% of all LP tokens. This creates false appearance of trading activity to mislead investors.

Applicable Law:

Criminal Code s.380 (Fraud). Ontario Securities Act s.126.1 (Market manipulation). CSA guidance on wash trading in crypto markets.

Evidence:

Explorer API address data | Bot 1: 86,835 tx | Bot 2: 85,274 tx

OFFENSE 6 Liquidity Removal / Rug Pull (BSC)

What Happened:

The PancakeSwap LP pool for STEAMX has been drained to $8.31 in WBNB (from significant liquidity). CoinGem flagged this as "liquidity removed." 19,228 BSC holders cannot sell their tokens. The project migrated users to their private blockchain where fund flows cannot be publicly traced, while the bridge is kept intentionally offline.

Applicable Law:

Criminal Code s.380 (Fraud). Criminal Code s.322 (Theft). Breach of implied contract with token holders.

Evidence:

Drained LP pool ($8.31 remaining) | 19,228 stranded holders

Jurisdiction & Entities

Corporate Entity:

Steam Exchange Inc., Ontario Corporation #002846823
500-7030 Woodbine Ave, Markham, ON L3R 6G2 (Regus virtual office)

Primary Jurisdiction:

Ontario, Canada (RCMP, OSC, FINTRAC)

Named Individuals:

Gary Bard (CEO, departed), Neville Aspi Divecha (President, sole remaining operator), Christopher Beckford (VP, departed), Viraf Sam Chapgar (Marketing, departed)

Relevant Authorities:

FINTRAC | Ontario Securities Commission | RCMP Integrated Market Enforcement Team | Canadian Anti-Fraud Centre

V

How to Verify This Yourself

You don't have to take our word for anything. Here's how to check the key claims yourself in under 5 minutes.

1. Verify the Stake.com Money Trail

1. Open this BscScan link

2. Look at the "Transactions" tab

3. Every outgoing transaction goes to an address labeled "Stake.com 6"

4. Click any transaction to see the amount sent

5. Click the Stake.com 6 address to confirm the BscScan label

2. Verify the Explorer Data Discrepancy

1. Visit explore.steamexchange.io — note the numbers shown

2. Open explore.steamexchange.io/api/v2/stats in a new tab

3. Compare: the API returns the real numbers (303K tx, 4,718 addresses, $0.06 price)

4. The frontend shows 193M tx, 28M addresses, $1,807 — Blockscout placeholder data

3. Verify the RPC Modules Are Exposed

1. Open a terminal or use any HTTP tool (curl, Postman, etc.)

2. Send this POST to mainnet.steamexchange.io:

{"jsonrpc":"2.0","method":"rpc_modules","params":[],"id":1}

3. Response shows all 8 modules: admin, debug, personal, txpool, eth, net, rpc, web3

4. Verify the MSB Is Expired

1. Visit opengovca.com/money-service/M21770262

2. See: Steam Exchange Inc., registration date Sept 2, 2021, status: Expired

3. Visit the OSC registered platforms list — Steam Exchange is not on it

5. Verify the Smart Contract Backdoor

1. Open the V2 contract source code on BscScan

2. Search for function unlock()

3. This function allows the previous owner to reclaim ownership after a timelock

4. The SourceHat audit only covers V1, not V2

6. Verify Pete Co-Founded B.O.T. NFT

1. Visit x.com/OnlyPetes

2. Read the bio: "Co-Founder Of @Steam_Exchange & @B_O_T_NFT"

3. Visit x.com/low_low416 (Dino Landzo)

4. Display name: "LowLow.Sol {B.O.T.}" — bio references @B_o_t_NFT