100,000 euros vanished in an hour. All in crypto. It happened to Tudorel Coman38 years old, a Romanian citizen who has lived and worked in Italy for 20 years in the restaurant sector. “Soon I will become a sommelier, after many sacrifices,” he tells Fanpage.it, “I started investing in cryptocurrencies in 2019, I didn’t think what happened to me could happen to me.”
In the September 2024Tudorel is operated on for appendicitis and, the next day, when he leaves the hospital, still shaken by the operation, he receives a SMS. Sender: a number that is identified on the smartphone screen as Binancethe cryptocurrency exchange platform that the young man uses every day.
It is 4.34pm on September 20, 2024. He is asked to pay stamp duty about his investments and is sent a link to click. It is a plausible request and Tudorel immediately accesses the web address indicated in the message: è the hooking of scammers.
Bitcoin is collapsing, the prophecy of financial genius Michael Burry: “It’s a pattern we’ve seen before”
All steps used to complete the scam
Criminals have used two techniques to get around the young man. The first is it spoofingnamely the masking of the phone number, which appeared as belonging to Binance, even if it was not. The second is theSMS phishing (or Smishing): Sending a text message with a fraudulent link.
As soon as Tudorel clicks on the link, he receives another text message telling him that the functionality of your Binance account were limited and that he would receive a phone call from the support service shortly. After a few minutes, in fact, there is a call to the mobile phone, but it is not from Binance. They are the scammers who also ask him for information on the others platforms it uses.
Tudorel, thinking that it is of legitimate assistancehe replies that he also uses Coinbase. The crooks then inform him that they will email him two QR codes to pay 24 euros in taxes for both exchanges (Binance and Coinbase). After sending the codes, the scammers hang up the phone: they will no longer be reachable at the telephone number from which they called Tudorel. QRs are fraudulent and will be the criminals’ gateway to the future sommelier’s wallets.
The technique used in this case is called QR phishing (or qushing) and consists precisely in creating fake QRs: either to direct victims to websites that aim to steal their credentials; or to download malicious programs (malware), with the intent of gaining control of the victim’s device and emptying their wallets.
Tudorel scans the QR codes and suddenly sees the funds on his cryptocurrency accounts go to zero. “They took control of my cell phone,” explains Tudorel to Fanpage.it. When the young man tries to contact the person he spoke to shortly before, the number does not exist. It’s 5.38pm. In 64 minutes, approximately 80,000 euros disappeared from his Binance account and 20,000 euros from his Coinbase account. A scam organized down to the smallest detail so as not to arouse immediate suspicion in the victim and to steal all the funds in a very short time.
Attempts to recover the money
Tudorel files a complaint with the Postal Police. But in the meantime he wants to try to recover the money and, on Telegram messaging platformhe finds the contact of some hackers who promise to return what was stolen from him. To do so, they ask him for more money and Tudorel, desperate, loses more 5,000 euros: he pays them in advance to the person who guaranteed he could pay them back 100,000 eurosbut then the boasters do not respect the agreement and vanish into thin air.
The young man also contacts a service registered on Telegram under the name “Ledger Wallet Support”, which asks him 4,200 euros as a down payment to then give him back what was taken from him. This time Tudorel doesn’t accept. This is another scam, known as “fake recovery”: someone who gets paid by promising to return cryptocurrencies that have now evaporated, without any hope of success.
The path of the stolen cryptocurrencies
Ultimately, Tudorel turns to society DECRYPTO WORLDwhich tracks all the movements of its cryptocurrencies on blockchains (a sort of shared register of money movements). On 23 April 2025 he brought the results obtained to the Postal Police, integrating them with his previous complaint.
“My funds in different cryptocurrencies (FET, SUI, BTC and SOL) were converted almost instantly into the other cryptocurrency ETHEREUM (for a total of 36.5860 ETHER) and then, after various steps through other intermediate wallets, they ended up on the CHANGENOW platform,” explains the young man to Fanpage.it.
However, from here it is difficult to trace the criminals, because Changenow is based overseas (the legal office is in the Netherlands) and has not yet even frozen the accounts into which the money flowed. ACTA assistance. To prepare the documentation delivered to the Police last April, Tudorel was assisted by the ACTA Association, founded by Iolanda Bonino and committed to fighting emotional scams and cybercrime.
How to recognize online scams
But what can you do to avoid running into such a scam? First of all, we must avoid clicking on links that arrive via email or SMS not only from unknown users but also from apparently known ones and verify that those who contact us are a reliable entity. An immediate verification can be done by checking the domain of the message’s email addressthat is, what is written after the at sign.
Yet it is not easy to stay alert at certain moments, especially if you don’t know the mechanisms with which cybercriminals act, who often take advantage of our moments of distraction.
Once a victim of a cryptocurrency-related scam, how that of Tudorelwe must also avoid falling into the traps of “fake recovery”, because it is very difficult to obtain the amount transferred to other wallets again. There is no reason to believe self-styled experts encountered online.
“I hope people are more aware”
After the events that occurred, Tudorel turned to a lawyer to ask for a refund (even partial) to cryptocurrency platforms due to the scam suffered. The proceedings are still ongoing, but there is no certainty that the judge will decide in favor of the young man.
Meanwhile he continues invest in Binance. “I’m continuing, I still have the wallet. Every month I receive messages with fake links and they keep calling me from abroad. Once I received a phone call from Malta from an individual who pretended to be a general: I hung up immediately.” “I hope that, after reading my story, people are more aware,” concludes Tudorel.
