The first sign that something had gone terribly wrong came on May 2. An avatar named “Professor Stephen Beard” appeared in a video, calm and confident as ever, telling his followers that DSJ Exchange was about to launch an IPO — a milestone that would, he said, finally reward their patience and loyalty. There was just one catch: to participate, or even to withdraw the money they already had on the platform, users would need to pay a 12% “regulatory compliance tax” on their total balance.
That was the moment the curtain fell. What followed in the next 72 hours was one of the most coordinated financial crime countermeasures the crypto industry has ever seen.
On-chain investigator ZachXBT confirmed on May 5, 2026 that $41.5 million in funds linked to the DSJ Exchange (DSJEX) / BG Wealth Sharing Ponzi scheme has been successfully frozen — a landmark intervention involving Tether, Binance, OKX, and U.S. law enforcement acting in unison. Of the $92 million laundered between April 27 and May 3, ZachXBT’s analysis showed approximately $63 million was routed to the custody provider Cobo, while around $30 million flowed to OKX-linked addresses — context that helps explain how a freeze of this size was even possible.
But for the thousands of ordinary people who trusted this platform with their savings — often after being recruited by friends or family — the real question is more personal than institutional: is any of this money actually coming back to them?
The Scheme: How “Professor Beard” Built a $150 Million Lie
DSJ Exchange / BG Wealth Sharing was not a crude or hastily assembled scam. It was a carefully constructed fraud that ran for well over a year, operating since 2025, blending two of the most psychologically potent manipulation techniques in modern financial crime.
The first layer was classic “pig butchering” — a slow-burn confidence scheme in which victims are cultivated over weeks or months before being encouraged to invest. The second layer was a textbook Ponzi structure: early investors were paid using money from newer recruits, creating a self-sustaining illusion of profitability that kept everyone loyal and quiet.
The scheme was not a standalone operation. It was allegedly part of a larger fraud network known as TXEX, which regulators have linked to hundreds of related fraudulent platforms operating under different brand names. New Zealand’s Financial Markets Authority alone has documented over 800 associated websites and 30+ shell entities tied to this network.
At the center of the operation sat the fabricated persona of Professor Stephen Beard, a fictitious CEO whose video appearances and “trading signals” were used to lend the scheme an air of academic credibility. The daily “trading signals” were distributed through BonChat, a messaging app based in Hong Kong, alongside Telegram and WhatsApp groups. The platform itself, DSJ Exchange, was marketed as a sophisticated trading environment. To an outside observer, it looked almost legitimate.
The financial promises were staggering: daily returns of 1.3% to 2.6%. Even calculated as simple non-compounded returns, those rates work out to somewhere between 475% and 950% annually. Compounded daily, which is how the platform actually presented its growth, the math becomes absurd: 1.3% compounded daily for a year exceeds 11,000%. For comparison, the S&P 500 averages around 10% per year. Those numbers alone should have been a flashing warning sign, but for investors swept up in the social proof of seeing others supposedly profit, the logic of skepticism is easy to override.
The network grew through aggressive referral commissions and rank-based bonuses, turning existing victims into unwitting recruiters. Friends brought in family. Families brought in their communities. By the time the fraud unraveled, over $150 million had been funneled in from thousands of retail investors across multiple continents. The scheme particularly targeted diaspora communities— Tongan, Samoan, and Filipino populations across New Zealand, Australia, the United States, and the Pacific — including overseas Filipino workers (OFWs) who were recruited through tight-knit social networks. By the time the fraud unraveled, over $150 million had been funneled in from thousands of retail investors across multiple continents.
Warning signs were there for those who looked. By early 2026, 13 financial regulators across five continents had issued public fraud warnings about the platform — including the Alberta Securities Commission, BC Securities Commission, Saskatchewan’s FCAA, the Canadian Securities Administrators (national list), the UK’s Financial Conduct Authority (FCA), New Zealand’s FMA, Australia’s ASIC, the Philippines SEC, and U.S. state regulators in Utah and Washington. The Bahamas, Tonga, Samoa, and Nauru also issued alerts, bringing the total to roughly 13 separate warnings. On April 23, 2026, U.S. law enforcement seized the primary domain, bgwealthsharing.com. The operators simply moved to new URLs and kept going.
The Exit: A 12% Tax That Was Never Going to Be Paid Back
The “regulatory compliance tax” demand was the tell. In fraud investigations, this kind of advance fee requirement is one of the most reliable signals that an exit scam is imminent. The operator is making one final extraction — collecting as much cash as possible from investors who, having already committed so much, are psychologically primed to pay a little more to protect their larger investment.
Within days of the video, between April 27 and May 3, the people behind DSJ moved fast. They pushed $92 million through a deliberately complex laundering route designed to make tracking nearly impossible.
Here is how they tried to disappear the money:
- Tokenlon swaps: Converting assets into different token types to break the audit trail.
- Cross-chain bridging: Moving funds across blockchains via Bridgers, Butter Network, and USDT0 to exploit gaps between separate ledgers.
- Wrapping and unwrapping: Using USDD protocols to further obscure asset origins.
- Hop address consolidation: Funneling money through hundreds of freshly created wallet addresses on the Tron and Solana networks.
- Custody and exchange routing: Approximately $63 million ended up at Cobo-linked addresses on the Tron network, and roughly $30 million reached OKX-linked deposit addresses, the choke points that ultimately made the freeze possible.
It was a sophisticated operation. But it was not invisible.
The Intervention: 72 Hours That Changed Everything
ZachXBT, the pseudonymous on-chain investigator who has built a reputation for tracking crypto fraud with forensic precision, was already watching. He has since said the case came to his attention almost by accident; while reviewing USDD contract flows for an unrelated investigation, he noticed the consolidation pattern and began tracing it. By analyzing the timing of withdrawals and mapping the flow of assets across blockchains, he was able to trace the laundering back to deposit points on two major centralized exchanges: Binance and OKX.
What happened next was a demonstration of what coordinated industry action can actually look like when the will and the information are both in place. ZachXBT shared his findings directly with the security teams at Binance, OKX, and Tether. The response was immediate.
| ACTION TAKEN | RESULT |
|---|---|
| ACTION TAKEN | RESULT |
| Tether Blacklist | $38.4 million in USDT frozen across 19 addresses on the Tron blockchain |
| Exchange Action | $3.1 million+ frozen across Binance, OKX, and additional services |
| Total Frozen | Approximately $41.5 million — recovered within 72 hours |
The mechanism Tether used is worth understanding. As the issuer of USDT, Tether holds a “blacklist” function built directly into the stablecoin’s smart contract. When an address is added to that list, the USDT it holds becomes non-transferable and essentially worthless — digital paperweights. This centralized control over what is often described as a “decentralized” asset has drawn criticism in the past, but in this case, it worked exactly as a safeguard should.
OKX, in a public statement, said they were proud to keep showing up to make the crypto ecosystem hostile to bad actors. It was a rare moment of institutional self-congratulation that, in this instance, felt earned.
The Hard Truth: What $41.5 Million Actually Means for Victims
The freeze is a win. There is no honest way to describe it as anything else. But for anyone doing the arithmetic with a personal stake in this outcome, the numbers are sobering.
Total estimated losses: $150 million. And ZachXBT has stated that this figure is “likely significantly higher” given the scheme has been running since 2025 with thousands of victim withdrawals already identified on-chain. Total frozen: $41.5 million. That is roughly 27 cents recovered for every dollar lost. The remaining $100 million-plus is, for now, gone — laundered across decentralized bridges and privacy mixers that moved faster than any alert system could follow.
The frozen funds are not sitting in a wallet with victims’ names on them. They are effectively in escrow under the control of Tether and the exchanges involved, waiting for legal instruction. The process that comes next is slow, expensive, and uncertain.
Because the case involves international actors and U.S.-based stablecoin infrastructure, restitution will most likely move through U.S. Federal Courts via civil forfeiture or restitution orders. Based on comparable cases, that process typically takes between 6 and 24 months — and that assumes law enforcement can identify and charge the perpetrators in the first place.
Many victims are still in denial. Some are holding onto the belief that the IPO is real, that the compliance tax will lead to a payout. It will not. The only thing paying that 12% tax guarantees is losing more money. In the days after the original “tax” demand failed, the operators reportedly pivoted to a “we got hacked” narrative; this is a classic stalling tactic used by fraudsters. The truth is that there are no hackers; the money is gone.
If You Were Affected: What to Do Right Now
Timing matters in fraud recovery. The steps below are not optional formalities — they are the difference between being included in future restitution distributions and being left out entirely.
- File a police report immediately. Report the theft in your local jurisdiction. This establishes an official legal record and is required for most compensation processes.
- Report to the FBI (U.S. victims). Submit a detailed complaint at ic3.gov — the FBI’s Internet Crime Complaint Center. Include all amounts, dates, and platform communications.
- Preserve every piece of evidence. Screenshots of your DSJ or BG Wealth Sharing account, transaction IDs (TXIDs) from your deposits, and any messages from “Stephen Beard” or platform support will all be critical to establishing your claim.
- Stop paying immediately. The 12% IPO compliance tax is a theft mechanism, not a processing fee. Any “verification fees,” withdrawal unlocking charges, or compliance payments are additional frauds layered on top of the original one. The same applies to any “recovery agents” who reach out unsolicited, offering to retrieve your funds for a fee — these are nearly always secondary scams targeting known victims.
The Bigger Picture: What the Industry Needs to Learn
The DSJ takedown demonstrates something genuinely important: blockchain transparency, when combined with skilled forensic investigators and cooperative institutions, can make crypto fraud increasingly hard to sustain. The anonymity that scammers rely on turns out to be far more fragile than they count on.
But it also exposes the gaps that still exist. The $100 million that slipped through did so because decentralized bridges and privacy protocols can still move money faster than any alert can be raised. And the broader TXEX network of which DSJ was just one node continues to operate under new names and freshly registered domains (some of which appeared within days of the collapse). The industry conversation that needs to happen centers on three areas:
- Proof of solvency standards for smaller exchanges. DSJ operated as what experts call a “shadow exchange” — a platform with no verifiable on-chain proof of reserves. Without mandatory transparency requirements, retail investors have no way to distinguish between a legitimate platform and a sophisticated fraud.
- Cross-protocol circuit breakers. Researchers like ZachXBT are doing invaluable work, but they are reacting to laundering in progress. An industry-wide flagging system that could trigger voluntary delays on suspicious high-volume transactions across decentralized bridges would give investigators time to catch up.
- Long-horizon source-of-wealth tracking. Exchanges are being urged to flag future inflows that correlate with known DSJ-linked addresses — even if those addresses go quiet for years. As the Bitfinex hack recovery showed, stolen crypto becomes harder to cash out with every passing year as KYC standards tighten globally.
What Comes Next
The Crypto Times will continue tracking the legal proceedings around fund distribution and the investigation into the identities behind DSJ Exchange. The perpetrators have not yet been publicly named or charged, and the $100 million gap remains the central unresolved question in this case.
For now, the $41.5 million freeze stands as proof of what coordinated action can accomplish. It is not enough — not for the people who lost their savings — but it is not nothing either. And in a space where scams of this scale have historically gone entirely unpunished, that distinction matters.
If you were affected by DSJ Exchange or BG Wealth Sharing, you can share your experience — anonymously if preferred — through the CryptoTimes secure tip line. We protect our sources. The more detail we have on how this scheme operated on the ground, the better we can serve victims and hold perpetrators accountable.
