The whole story of the collapse of the Xinkangjia DGCX scam: Where did the 13 billion yuan of funds go?

Author: Lisa&Keywolf

Editor: Liz

background

According to reports, on June 26, 2025, an online investment platform called Xinkangjia DGCX suddenly closed all withdrawal channels, and a large number of users found that their assets in their accounts were frozen or cleared, and they could not withdraw their funds. The incident quickly fermented on social media platforms and attracted widespread attention. Although no authoritative agency has yet released accurate data on the number of victims and financial losses, according to investors, the incident may involve a fund size of RMB 13 billion and the number of victims may exceed 2 million.

According to some public information disclosure, as early as 2019, Xinkangjia sold oil filtration equipment worth 200,000 yuan to a certain enterprise. After that, the transaction was packaged as "signing a five-year strategic cooperation agreement with Sinopec"; in March 2021, the project began to operate under the name of Guizhou Xinkangjia Big Data Co., Ltd. Although the company claimed to have a registered capital of 30 million yuan, the actual payment amount was zero, and it had long been included in the list of abnormal operations, which meets the characteristics of a "shell company."

In May 2023, the platform launched DGCX Xinkangjia Big Data Exchange, claiming that it is the "official branch of Dubai Gold and Commodities Exchange (DGCX) in China", and claimed to have reached cooperation with many state-owned enterprises such as PetroChina and COSCO Shipping. The platform endorsed by publishing forged contracts, official letters, official website screenshots and other materials to strengthen its "regular army" image.

In fact, the platform has no affiliation or business relationship with DGCX, and the entire qualification system is disguised as "international finance". The real DGCX has publicly issued articles many times, denying any authorization or cooperation with it, and warning users to guard against fake platforms.

It is rumored online that the founder Huang Xin left a message in the members' WeChat group after fleeing overseas. Although the authenticity of the content could not be independently verified, it was widely circulated in the community, further exacerbating investors' anger.

MistTrack on-chain analytics

Regarding the on-chain fund flow of the Xinkangjia DGCX project, we used SlowMist's anti-money laundering tracking and analysis system MistTrack (https://misttrack.io/) to conduct in-depth tracing of the on-chain addresses related to the case. The on-chain behavior shows that the project may have built a complex multi-level fund structure, with funds flowing in from a centralized entrance and then flowing out after multiple transfers, which initially possesses the common on-chain operation characteristics of a Ponzi scheme.

At present, we have analyzed and identified about 800,000 user recharge addresses, involving a fund scale of up to 1.5 billion US dollars. It should be emphasized that the data in this section is based on technical analysis and mining of public chain information, and cannot represent the entire fund path and final facts of the project. The statistical results may have errors and are for reference only. Some inferences are based on the current on-chain behavior and do not constitute a fact finding in the legal sense. Further data support and multi-party verification are still needed.

1. User funds inflow

Analysis found that the source of funds almost all came from the hot wallets of centralized exchanges, and these funds were subsequently distributed to many addresses in integer amounts (such as 1000, 2000 USDT, etc.). Considering that the project requires users to join with USDT, users must first convert RMB into USDT and then recharge it to the designated address. Therefore, it is speculated that this may be the operation of the project to collect RMB from users, and then withdraw and distribute USDT from the exchange. These integer amounts are consistent with the alleged "membership fee" model of the project, and there is also the possibility of recharge and deposit. The platform is suspected of adopting a management method of centralized currency control and allocation of recharge addresses, that is, the platform provides users with addresses for participating in the project, and users do not directly control private keys.

2. Internal fund aggregation of the platform

After multiple "user addresses" receive USDT, they transfer the funds through 1-2 layers to the pooling address controlled by the platform. The pooling address shows the following characteristics:

• The number of income transactions is significantly higher than the number of expenditure transactions;

• Pooling funds from multiple “user addresses”;

• Then transfer the money to the new "next hop" address.

The above behavior indicates that these addresses may exist as a "relay layer" or "aggregation node", responsible for collecting users' "recharge funds"/"membership fees".

3. Withdrawal and handling fees

The pooling address will disperse the funds to one or more addresses. Some of these addresses are only active for 1 to 2 days. It is speculated that the funds on the address may be used up and then rotated to another address, or it may be to reduce the risk of being blacklisted. This short-cycle, high-frequency operation mode also shows that the project maintains a certain "rotation rhythm" at the level of fund operation. No matter how complicated the path is, most of the funds eventually return to the user deposit addresses of some exchanges, presenting a one-to-many form, suspected of users' profit withdrawals. More significantly, in most transfers, the amount received by the target address is about 10% less than the initiating amount. For example, 800 USDT was issued and 720 USDT was actually received, which may mean that there is some kind of "withdrawal fee".

4. Permission authorization mechanism

Through further on-chain data analysis, we also observed that there is authorization of custom permissions between a large number of TRON addresses. Some addresses involved in fund pooling authorized custom permissions to 3 to 5 addresses, with a threshold of 3, and can perform Transfer TRC10 and Trigger Smart Contract (generally used to transfer TRC20 Token) operations.

These addresses involved in fund collection and authorized addresses have repeatedly shown such authorization phenomena, as shown in the following table:

It can be indirectly inferred that the main address (pooling address) and the authorized address belong to the same entity, and in the context of the closely intertwined capital paths, it is reasonable to suspect that the project operator has adopted a batch authorization control mechanism for the convenience of automated program operation. This structure is also closer to the platform's permission management method.

Scam Pattern

The project is suspected to be a "Ponzi scheme + pyramid scheme" fund, which uses virtual asset investment as an excuse, stablecoins as a means of payment, and raises funds by "recruiting people" to join. The specific methods include:

1. Multi-level pyramid scheme recruitment mechanism

In order to achieve the goal of "recruiting people", Xinkangjia has established a corps-style 9-level structure system, from top to bottom, including commander, army commander, division commander, brigade commander, regiment commander, battalion commander, company commander, platoon leader, squad leader, and set clear promotion standards and rebate ratios. For example, after paying to become a member, a participant can be promoted to squad leader by recommending 3 people, and each successful recommendation will be rewarded with 10 USDT; if promoted to commander, it is necessary to develop a team of nearly 20,000 people and 50 direct subordinates, and each person can receive a 150 USDT recommendation award and a monthly guaranteed salary of 12,000 USDT. This mechanism presents a typical pyramid-shaped communication path, which encourages participants to continuously develop downlines and drive continuous capital inflows with promotion rewards.

2. Fake transactions and backend manipulation

Xinkangjia displayed various fake trading interfaces on its official website and APP, including gold, crude oil, indexes, etc., claiming to provide international market conditions and real-time profits and losses, and guiding users to recharge USDT for high-leverage transactions. In fact, all account data is controlled by the platform background.

3. High returns and rebate bait

The platform claims to use big data technology to conduct futures trading of gold, oil, and foreign exchange in the Middle East, and promises investors a daily return of up to 2%. For example, a member who invests $100,000 can earn $2,000 a day, or $60,000 a month. "Return of principal in 3 days, double in 7 days", "100% profit commission", and "VIP internal arbitrage signal" are the main rhetoric to attract users to continue investing. The platform also regularly creates screenshots of successful withdrawals and investment "income lists" to create an atmosphere of "real money making", forming a strong herd effect.

4. The threshold for cash withdrawal is increasing

According to investor feedback, on June 25, Xinkangjia was unable to withdraw cash, and the next day it was confirmed that the system was paralyzed. The platform responded that "the company was defined by the regulatory authorities as tax evasion, and the account funds were all frozen and could not be withdrawn." If users want to withdraw cash, they need to pay taxes according to 10% of the position amount. Withdrawals of more than 100,000 yuan require more than 30 working days in line. After paying taxes, they can generate 1% of income every day. After reaching 100 USDT in total, they can withdraw cash, and the withdrawal fee is 50%. Before running away, the platform also threw out a bait activity: "Invest 500,000 to get Tesla", which is actually to induce users to increase leverage and invest, and cheat more money before the collapse. After Xinkangjia raised funds, it suddenly closed the withdrawal channel and lost contact with customer service. It is rumored that the platform transferred about 1.8 billion USDT to the Cayman offshore shell company account through Tornado Cash in just 48 hours before the collapse.

In fact, before the platform collapsed, many local public security organs and financial regulatory agencies had issued risk warnings, including Pingshan County Public Security Bureau, Yangshan County Public Security Bureau, Taojiang County Public Security Bureau, Heyuan Rural Commercial Bank, Hunan Provincial Party Committee Financial Office, etc., all of which stated that the platform was suspected of illegal fundraising and high-risk transactions.

However, since the platform implemented an invitation code system to control registration, it was widely infiltrated through WeChat group fission, offline lectures, and other means, and with the rhetoric of "national-level projects" and "central enterprise cooperation", a large number of middle-aged and elderly people and sinking market users were deeply involved, resulting in a large amount of funds continuing to flow in after local regulators issued warnings. At present, it is rumored that some of the platform's core technical personnel and head agents have been controlled by the public security organs, and the public security organs have sealed up Ruoguang's asset accounts and frozen funds of about 120 million yuan.

Summarize

The Xinkangjia DGCX incident is a typical digital financial fraud that combines digital assets, a Ponzi scheme and a pyramid scheme. The core of this type of Ponzi scheme does not lie in innovation, but in the precise use of a hybrid model of on-chain payment + offline promotion, combined with fake foreign identities and false government endorsements to create a sense of cross-border legitimacy.

SlowMist would like to remind all users:

• High returns come with high risks. Formal financial products will not promise high short-term returns, nor will they use "double rebates" or "return on investment in 3 days" to attract investment.

• The essence of the "recruiting people" model is a pyramid scheme. Any platform that requires you to recommend others to make money is most likely a Ponzi scheme that relies on constantly absorbing new funds to maintain its operation.

• Don't blindly believe in packaging and publicity. Contracts, screenshots of official websites, CCTV interviews, luxury car displays, and celebrity photos can all be forged. What is truly credible is the fund security mechanism and independent third-party supervision, not the superficial excitement.

The collapse of Xinkangjia is a painful experience that many investors have learned with real money. It is not the first, nor will it be the last. In this era of information overload and increasingly sophisticated fraudulent methods, we need to remain rational, improve our financial literacy, and actively question "things that look too good to be true." We should be highly vigilant against any platform that uses high returns as a gimmick and requires people to attract people to make a profit.