How two Dubai and Netherlands based Kids took $30m — the Zkasino Exit Scam

The scam that cost $30m

Writing an article about this was really not something I thought I’d have to do. But then I saw how even crypto native outlets reported on it, not looking at any details, playing right into the founders’ cards and portraying the situation as if there was “controversy” or “uncertainty” around whether this project was a scam or not and whether the main founders had acted in bad faith. So I couldn’t help myself. There deserves to be a public record that accurately describes what happened and calls out these clowns.

So, let me say it in no uncertain terms: As of April 23rd, 2024, Elham N., also known as Derivatives_Ape on Twitter and his co-conspirators Ildar I. A., also known as XBT_Prometheus/lethimdev and Lyor, also known as Sigman0X committed premeditated fraud and stole $30m from over 10,000 victims. As to the exact nature of the crime, I cannot say that as I am not a lawyer, but wire fraud, fraud, money laundering, unregistered securities sales and embezzlement certainly come to mind. That is my opinion, but it’s a well-researched one.

In writing this story, I try to adhere to what I believe to be journalistic principles in the broadest sense. I will write what has been confirmed to me by someone close to the founders or found out by victims and posted in public channels (such as Twitter or Telegram) if there is enough reason to believe in its validity. In that sense, I will write about what I believe to be facts, but I cannot take responsibility regarding the accuracy of individual aspects. I will also refrain from stating full names or in other ways using the identity documents that have already been unearthed by victims. All data I am using is publicly available.

Here is the story…

Elham and Ildar are a “known commodity” in the crypto space to some degree. Elham runs a very large Twitter account with 47k followers, both have conspired before and have, allegedly, scammed people since 2020 as one lawyer put it to me. They are also the founders of Syncus DAO, a DeFi platform and previously worked for Zig Zag Exchange, a DEX. Zig Zag, by the way, alleges that the two of them raised $15m for Zig Zag, but essentially stole most of that money as well. Aside from that, which came out after the below scam had already begun, well known crypto researcher ZachXBT warned about the shady business conducted by Elham, aka Derivatives_Ape in December 2023:

Nonetheless, as is often the case in an entirely open financial system (which has a lot of advantages, but also drawbacks), the warning was not seen by a lot of people and Derivatives_Ape and XBT_Prometheus know to play their game quite well. They funded Zkasino with allegedly stolen money from Zig Zag and went on to build a Twitter account called zkasino_io with over 80k followers. I cannot talk too much about the history of that account and the project, as it is not really relevant to what took place in March and April 2024. I will only comment that they portrayed zkasino as a project with high revenues and user numbers, which (in hindsight) were probably just lies.

In early 2024, Zkasino announced the launch of an Ethereum L2, dedicated to gaming with a new gas token called $ZKAS that would be the underpinning of the new chain, which would house their allegedly high revenue gaming applications. They designed their tweets to catch some of the large airdrop farming KOLs on Twitter and signed a few other KOLs to SAFT agreements (using the Zig Zag name, btw).

The “bridge to earn” scheme

On March 15th they announced a launch scheme for their new chain that resembles the one employed by Blast L2 where people would be able to “bridge”, but in essence just deposit $ETH into their smart contract and would earn a share of the 25% of $ZKAS token reserved to the community. This “Deposit to Earn” scheme was supposed to end with the launch of the Zkasino mainnet 30 days after the opening of the bridge, when depositors were promised to receive their $ZKAS token, as well as all of their “bridged”/”deposited” Ethereum back in their wallets.

This last point is very critical, so I will briefly elaborate:

• In a Twitter Spaces event, both Derivatives_Ape, and XBT_Prometheus confirmed personally speaking that the deposited Ethereum would be received back at the end of the 30 day period. The recordings can still be found here.
• Derivatives_Ape tweeted himself that this was not a pre-sale for $ZKAS token, but that “all funds can be bridged back 1:1 ratio” after the 30 days

• Finally, the website was exceedingly clear. On the Bridge Deposit page, which can still be found on the Internet Archive, it clearly noted in the bridging process that “At the end of the bridging period…Ethereum will be returned and can be bridged back at this point”

• In the project documentation of that time, it was also mentioned that the bridged Ethereum would be returned when mainnet goes live

So it is important that we establish that the contractual relationship between the Zkasino team and its users clearly stated that Ethereum will be returned after the 30 days. This is not a “controversy”, nor is it “unclear”.

How the Project gained steam

Despite the large following on Twitter, these actions likely would not have gotten the team a haul of $30m, had they not continued to lie about their intentions and used the good name of other KOLs in the process. I believe the key to their success was this tweet from March 19th. It was the reason I deposited some money as well:

The Zkasino team announced in a tweet that they had raised financing at a fully-diluted valuation of $350m and, importantly, linked 5 large Twitter accounts as people who allegedly invested in this round.

With this round, which gave the token a price of $0.04 per $ZKAS, depositing early into the bridge all of a sudden became a very high return opportunity. Not too high to be suspect in the world of Crypto, but just right, so that people could say to themselves “well, if it even trades at 1/4th, I will still make 30% on my deposit”. This, together with using the names of well-known influencers and linking them, did wonders.

Most of the major airdrop hunters picked it up and posted a thread about it. The tagged accounts acted very poorly in retrospect, by not clearly stating that they did not invest in this round. In my opinion, these influencers deserve the benefit of the doubt. Some of them confirmed to me that they had invested in Zig Zag but not in Zkasino and were told by Elham and friends that it was now a part of their investment. Others, like Pentosh1 and MEXC actually invested directly to get tokens and got scammed themselves. MEXC even had a listing planned for the token. You can be sure they lost money on it. It is not likely any one of them knew what Elham and Ildar had planned. Nonetheless, in the future, I hope these accounts have learned to immediately contradict reports of an investment if untrue.

Aside from this, Zkasino also used the playbook from previous L2s, announcing an ecosystem fund of $40m, pretended they were building on Eigenlayer, launched a testnet and attacked anyone who was posting negatively on them as FUDsters, like the Zig Zag Exchange account. To be honest, when I saw the ecosystem Fund, which was just too large, I got suspicious, but I had already invested so no way to retrieve my staked $ETH before the 30 day period ended.

Towards the end of the depositing period, the team even managed to convince Apeterminal to hold an IDO on their platform for the token. Amongst other things it revealed a 5% cliff and monthly vesting for $ZKAS token earned from the deposit to earn/bridge to earn scheme, which was news to the community. Nonetheless, the fact they were holding an IDO on Apeterminal and even this vesting arrangement certainly made their story more believable. It should be noted that Apeterminal later refunded all participants in this IDO their commitment and some extra money for gas spent as they realized Zkasino was a scam.

Suffice to say their strategy worked well. Deposits into the “Deposit to Earn”/”Bridge to Earn” scheme rose to over $30m in $ETH from over 10,000 depositors. The inflows can be seen here.

The fraud takes place

It was all looking a bit like I would hopefully be getting back my $ETH at the end of the 30 days and maybe make a bit of a profit on the $ZKAS I would receive. Then, a few days after the deposit period had ended with no news, I noticed a significant change on the website, also documented on the Internet Archive. The sentence explaining that Ethereum would be returned was gone:

At that point, I realized that I had probably lost my money. Of course, I was still hopeful (and I remain hopeful these two young punks see the light and return the funds), but I was pretty sure they would take the money and run by then. I connected with some of the people who were involved and also the KOLs tagged in the investor post over the next few days to understand if they had invested at all. Of course, none of them had invested in the Series A announced specifically.

April 20th came the announcement from Zkasino by way of Medium post.

Instead of allocating $ZKAS token to all depositors and returning the Ethereum deposited as had been announced beforehand, the team decided to “convert” the deposited $ETH at some arbitrary USD value to entirely useless $ZKAS token on their L2 with no liquidity and, importantly, no functioning bridge to return assets to mainnet.

So, instead of receiving the amount of $ZKAS token people were promised on their bridge website AND receiving back their $ETH deposited, users received 5% of a new ratio of $ZKAS token without any trading liqudity, some vesting tokens and their $ETH was stolen. Of course, in retrospect, the fact their contract did not really allow for withdrawals even in the future tells us it was premeditated.

It should also be noted that, when the team announced their Zkasino mainnet was live, it had not produced a block for 4 days and it turns out it was a very simplistic Arbitrum Nitro deployment that probably took them about 10 minutes to spin up (if that). There was never the intention to actually build anything. They had a bridge website up that used another project’s interface and backend, as well as documentation and was entirely useless. Despite this obvious exit scam, Derivatives_Ape went on to insult people on Twitter for calling them out and to this day, the Zkasino account pretends that nothing happened and postures as if the team was “continuing to build”, sadly shining a very bad light on that expression often used by other teams.

At this point, not everyone I was in contact with was convinced. One of the people I spoke to suggested it was just a “marketing stunt”. That changed for all of them, when the 3/4 multisig that governed the bridge/deposit contract moved the funds to a new address and converted them into wrapped, Lido staked $ETH (a form of $ETH that earns staking rewards). The transaction can be found here, the wallet holding all of the stolen funds as of this moment (April 23rd) is this one.

In retrospect, we should have known tha there was never any intention to pay back the funds from the start. The smart contract used to collect funds was not set up to ever have a claim function. It also did not distribute IOU tokens. This was premeditated.

Update: on April 29th, the criminals proceeded to move funds to the following addresses:

1) 1/3 to 0x42dC91cAA486A1Cbf921a8009404A590414285A3

2) 1/3 to

0x0Ab4a19Ab20Bd1Dde51a5d302721fcc30F34094d

3) 1/3 to

0x4c36340d7d3610106AA1402A277b9D39c77D146d

Update: On May 9th funds were moved back to the second original multisig wallet (0x7911FeA7b36Fbd58a771bbf907aAd2ef4BDCC491 ), but one out of the signers was removed.

What is Elham, Ildar and Lyor’s plan?

Right now, the Zkasino account continues to pretend that nothing happened. It recently announced the formation of a DAO, which is an obvious attempt by the founders to deflect responsibility and prepare a way out legally. At least, that is what they likely believe it is (Spoiler: it’s not).

Next steps aren’t clear, but it is very likely that the founders either stop their charade (the bridge website is already offline) or just continue with a fake DAO where they control all the votes that then stages a fake vote where the stolen $ETH gets “washed” in the sense of a DAO proposal that either designates some of it as liquidity for the $ZKAS token, for operating expenses or even bribes victims with the hope of receiving their money back after 9–12 months in exchange for 9–12 months of $ETH staking yield collected by the scammers. All of this is possible. There could even be a sort of “Stockholm Syndrome” where victims, in the hope of receiving back some of their money, vote for a proposal where some $ETH is used for liquidity or similar.

None of it should distract anyone looking at this situation or any of the victims from this simple fact: even if they somehow return something to users at some point — they stole the money. Plain and simple.

Update: Elham N. was arrested by Dutch investigators April 29th and is now in detention, but may get out on May 13th after a 14 day hold. Right now the scammers are trying to make it look as if nothing happened – they replaced the docs on their website with a new version that pretends everything is fine, probably hoping mainstream media and the justice system fall for it.

What can victims do?

There are Telegram groups where victims communicate with each other and post information they found about the scammers:

https://t.me/zkasino_legal_task_force (main English Speaking)

Currently, these groups together have a total of around 3500 members, representing approximately 1/3 of the scam victims who lost a total of more than $30m.

There are several suggestions made in these groups. Amongst other things you can find a summary document that contains most of the evidence collected, a google doc with more links and a number of reporting websites for crime agencies world wide. I refrain from re-producing this content here, as I do not own any of these groups and cannot publicly post the identity documents that have already been dug up by the victims. They are publicly available though and have been posted to Twitter and other platforms.

The most sensible thing for everyone to do, in my personal opinion, is:

1. Find the summary document (it is a pdf) in one of these groups. It is among the pinned messages of all groups.
2. Using the template in that summary document, report the crime to your LOCAL crime agency. It could be the FBI, it could be your local police station. This is key, because they will contact Dubai authorities if there is enough pressure. For reasons I do not wish to elaborate here, but which will become obvious with a bit of research, especially those of you living in the Netherlands and Norway should report locally.
3. Contact Dubai police with the same template at mail@dubaipolice.gov.ae, but also (and especially) if you are a local, please try to physically go to a police station to report the crime. It is more than obvious from Twitter posts and what people have found out that the two main criminals were in Dubai at the time of the crime and habitually live there in hotels and other residencies.
4. Of course, there is the point of Derivatives_Ape having a large Binance account that is likely to be KYC’d as well. So some pressure on Binance would also make sense. You can tag their new CEO @_RichardTeng on Twitter — he took the position promising to be a good corporate citizen, so this is a good opportunity.
5. Report @Derivatives_Ape, @zkasino_io and @XBT_Prometheus on Twitter for spam/Financial fraud. These are young guys who have probably never had to face the consequences of their actions and believe themselves to be invincible. Taking away their audience hurts them more than anything else at this point. The reporting is accurate and if Twitter acts, it will prevent them from scamming more people. And no, it is not more valuable to let them continue to speak on these accounts, because they will just use that to manipulate you furhter.
6. Support each other and don’t attack each other

Victims that have lost large $ amounts are looking at legal avenues and have hired lawyers and private investigators already as far as I know or are hoping to do so soon from what I can see in several of these chatgroups. Those are likely the most important efforts AFTER the case has been logged in Dubai, which is why the above steps are so critical. The more people complete these steps, the likelier it is that something will come of it.

Above all, do not lose hope. If you had made a list of 10 people in crypto that should be in jail in 2022, the likelihood is high hat 8 of them are currently in jail. At least that is true for my list. This will end no different, but it will take time. And patience.

One thing is abundantly clear though: there is no “controversy”, there is no “continuing to build”, there is no “uncertainty” regarding the Funds and these are not “in custody of the DAO”. The funds were stolen and the project is a scam. Any efforts by the team to obfuscate this with more twitter posts or fake governance does not change this.

Disclaimer: as always, everything I write is my personal opinion. I can be wrong. I have based my writing on publicly available information and have been careful not to include anything that I believe to be unlawful disclosure which is why I use first names only and also do not directly show the evidence that has been collected by other victims. If there should be anything in this article that you believe to be contradicting this statement, let me know and I will take it out if true.