23 websites, one blueprint: what to watch on an unlicensed crypto platform

An unlicensed crypto platform gives itself away in two places, and both can be checked in a few minutes: the provider is missing from the financial regulator's register, and its advertising copy appears word for word on dozens of other sites. On 14 October 2026, Germany's BaFin put exactly that pattern on the record. The subject of the warning this time is a whole run of near-identically built websites.

The name on the landing page is therefore the least useful piece of information such a site offers. Name, colour scheme and domain ending are interchangeable; the construction and the sales copy stay the same. Learn the construction and you will also recognise the twenty-fourth address in the same run, the one that appears on no list today.

BaFin names 23 addresses built to a single blueprint

The regulator published a consumer notice on 14 October 2026 headed with the address GainLiteX(.)co and listing 23 further websites in the body. Its reasoning is set out in the notice itself: according to the authority's findings, the operators offer financial and crypto-asset services on these websites without a licence, and the respective operators are not supervised by BaFin.

The form of the notice is what makes it unusual. An ordinary warning names one provider and its domain. This one describes an identifying feature shared by every site in the run first, then attaches the list of known addresses. The authority writes the addresses in defanged form, with a bracketed dot, so that no clickable link appears when they are read. We keep that convention:

• Acmedividends(.)com
• alphasharesmarket(.)com
• aoextrades(.)live
• cloudtinvt(.)pro
• cmetrustgroup(.)com
• copyexpresstrades(.)com
• crownxcapitals(.)com
• dreammfx(.)net
• elitetradehub(.)net
• gifxpartnersltd(.)com
• globalcapitalshares(.)com
• globalmaxinvestment(.)com
• greenpointsllc(.)org
• octapayvest(.)com
• securedcryptoassets(.)com
• sratumcypher(.)com
• standardcapitalfinance(.)ltd
• titanedgefx(.)trade
• trademarketoptionsltd(.)com
• valorstream(.)com
• westgateinvestments(.)org
• zealprimefinance(.)com
• zenithwealthglobals(.)org

The order is alphabetical and the endings run from .com through .org and .net to .live, .pro, .trade and .ltd. Several names carry building blocks that sound like established asset management: capital, trust, wealth, global, dividends, prime. That choice of words belongs to the kit and is no accident.

Licensing duty: which crypto-asset services BaFin has to approve

The law behind the warning is simpler than the official wording suggests. Anyone offering financial and investment services in Germany needs a BaFin licence to do so. The same has applied to crypto-asset services since the European crypto regulation MiCAR took effect, meaning the operation of a trading platform, the exchange of crypto-assets for euros, the custody of crypto-assets belonging to others, and the brokerage of and advice on either.

The term crypto-asset service describes a commercial service around crypto-assets that a provider performs on behalf of third parties. That last part carries the weight. Converting your own money into Bitcoin requires no licence. Taking in, holding or exchanging other people's money requires one in every case.

Germany implements these duties through the Crypto Markets Supervision Act. What role the act plays in the regulator's warning practice is set out in our piece of 4 October 2026 on the Crypto Markets Supervision Act and its licensing duty. The duties facing authorised firms are collected in our overview of the obligations attached to a MiCA licence.

Two sales sentences as the fingerprint of an entire platform run

The most useful part of the notice is a detail the usual warnings leave out. BaFin quotes two formulations that recur across the sites in the run. The first promises comprehensive financial advice and investment services tailored to the individual needs of the client. The second invites the visitor to become part of "the world's leading provider of financial investments".

Both sentences share a property that makes them useful: no serious institution writes like that. A supervised firm advertises products, terms and risk warnings, because it is obliged to and because it has to stand by them. Superlatives with no substance behind them, by contrast, cost nothing. And because the sentences sit in the template rather than being written afresh for each site, they appear identically across every address in the run.

That yields a move which works without any database at all. Copy a conspicuous half-sentence from an unknown platform's marketing and search for it in quotation marks. If several providers with different names and identical wording come back, a kit is at work. The move also works on a domain that has been reported nowhere yet, and that is precisely where its value lies.

Kit-built design: five marks of a run before the first warning list

The regulator describes the sites as near-identically designed. From the 23 addresses, and from the runs we track in our own records, five marks can be derived that together produce a reliable picture. On its own, none of them is proof.

Word modules instead of a company history

The names are assembled from two or three financial terms that can be combined at will. A genuine corporate history, a documented year of incorporation, a commercial register extract or a traceable registered office are all absent. Whatever stands there as a company history could be copied onto any other address in the run without anyone noticing.

Exotic domain endings behind a European front

Endings such as .live, .pro or .trade cost little and are registered within minutes. A firm that intends to collect client money in Germany and holds a licence to do so usually appears under a national or .com address. The ending alone says nothing; combined with a German-language presence and no German office, it is a signal.

No imprint leading to a company you can get hold of

Matching domain against operator is the hardest of the five points. If the imprint names a company, you look it up in the commercial register and in the regulator's database. If the trail runs into nothing, or to a firm with no connection to financial business, the matter is settled. How far such a trail can be laid is shown by the case of a borrowed identity we reported on 28 September 2026 under BaFin warning over a borrowed company identity.

The same sales sentences under different names

This is where the fingerprint from the section above applies. The longer the half-sentence you search for, the more telling the result: a single stock phrase such as "individual investment strategy" sits on thousands of harmless pages, whereas a complete twenty-word sales sentence sits only where the same template was used. Repeat the search with a second sentence from a different subpage, from the about-us section for instance. If both searches land on the same group of unfamiliar domains, the attribution is as good as certain.

Pressure on the first payment

The faster a platform pushes towards the first deposit, the more personal hand-holding it offers over messaging apps, and the less time it leaves for a check, the clearer the picture becomes. An authorised provider has no interest in your leaving its authorisation unverified, because that authorisation is its strongest selling point.

The company database keeps a separate category for crypto-asset service providers

The actual check is the regulator's register, and a detail hides there that many guides miss. BaFin's company database searches several categories separately from one another. Alongside credit institutions and investment firms, the selection field also holds the entries crypto-asset service providers, crypto custodians, crypto securities register administrators and MiCAR issuers.

That separation is why a search sometimes comes back falsely negative. Look for the name of a trading platform under "all institutions" alone and you get an empty answer, even though the provider is listed as a crypto-asset service provider. The correct route is a search under "all companies" or straight through the matching category. We wrote up the path there, field by field, on 12 September 2026 in the guide how to check in three minutes whether a crypto provider holds a licence.

If an authorised trading venue is what is needed at the end of that search, our overview of MiCA-regulated crypto exchanges helps: it lists the providers with an EU licence along with their fees and registered offices.

The database's data cut-off sets a limit on the register

At the top of the search mask sits a field that is easy to read past: the date the data was last updated. When we opened the database for this article, it carried 13 October 2026. The register therefore shows a snapshot with a date attached to it.

Two consequences follow for your check. A freshly granted licence may still be missing from the database even though it is in force. And a platform that went online yesterday is naturally absent, because it never applied for a licence at all. The absence of an entry is exactly what fails to separate those two cases.

The register is therefore the necessary answer, not the sufficient one. A hit in the right category is a strong argument that a supervised firm sits behind the site. A missing hit is a reason to transfer nothing and to work through the remaining marks.

Not supervised and proven fraud are two different findings

This distinction belongs in every piece written about such a list, and it is rarely drawn. BaFin writes in its notice that the operators are active without a licence and are not supervised. Nowhere does the authority claim that the 23 sites steal client money or invent profits.

The difference is practical rather than academic. Where the licence is missing, everything attached to it is missing too: the ongoing supervision of capital and organisation, the duty to hold clients' crypto-assets separately from the firm's own, the formal complaints channels, and the authority's power to prohibit the business. Whether a particular operator also deceives is a question for the public prosecutor.

In the same notice, BaFin joins the Federal Criminal Police Office and the state criminal police offices in a general warning about financial fraud online, and advises thorough research before investing money over the internet. That advice is general and is no verdict on the individual addresses on the list.

The Crypto Markets Supervision Act and MiCAR frame the licence

The phrase "financial and crypto-asset services" in the warning is a precise doubling. Financial services require a licence under the Banking Act and the Investment Firm Act; crypto-asset services have required one under their own law since MiCAR. A platform offering both needs both. Many sites in the run now reported advertise classic investment services and crypto-assets at the same time, which is where the double wording in the notice comes from.

As a client you notice the difference where complaints are concerned. At an authorised firm, the European crypto regulation provides a route with fixed deadlines. Which they are, and how long an exchange has to answer a complaint, is set out in our article on complaining about a crypto exchange under Article 71 MiCAR. Against a provider without a licence that route does not apply, because it never took on the duties that come with it.

Complaints route and evidence after a transfer

Once money has moved, the order of steps matters. Secure first what can disappear within days: screenshots of the account page with the date visible, the complete correspondence including messenger threads, the bank statements for the transfers and, for payments in crypto-assets, the receiving addresses and transaction IDs. These details are the basis for every later report, and they sit with you alone. If the platform disappears, the account page and the chat history go with it.

After that the route leads to the bank or payment service the payment ran through, and to the police. BaFin takes reports of unauthorised business and runs a consumer helpline for the purpose, reachable Monday to Friday from 8am to 6pm on 0800 2 100 500. Recovering the money is beyond the regulator; its remit ends with prohibiting the business.

The 25th run in a body of 639 domains

The 14 October notice does not stand alone. Our own analysis of this year's BaFin warnings, published on 14 August 2026 under BaFin warnings 2026: 24 crypto platform runs with 639 domains, counted 24 such runs with 639 addresses between them. On that count the current list is the 25th run and the first new one in two months.

Our assessment: the value of this notice lies not in the 23 names but in the two sales sentences. The names will be switched off, re-registered and back online within weeks; the kit behind them stays. The figures from our own analysis support that, 639 addresses across 24 runs inside a year, as does the fact that the authority this time names a textual marker at all rather than a bare list of domains. Against it stands the point that a single sales sentence proves nothing, and that a reputable provider can use a stock phrase once too. The picture only becomes reliable when several of the five marks coincide and the register does not know the provider.

Platform runs: 23 addresses, one blueprint, one register

The warning of 14 October 2026 will be overtaken by the next one within days. What remains is a sequence that also works on the address reported nowhere today.

1. Query the register before every deposit. Search the provider's name in the regulator's company database under "all companies" and watch for the crypto-asset service provider category. If the search stays empty, no money moves. A trading venue with a documented EU licence can be found in our overview of MiCA-regulated crypto exchanges.
2. Bring holdings home from third-party platforms. What sits with an unlicensed provider sits without a segregation duty and without supervision. For larger holdings, self-custody is the safest place; the devices for it are compared in our hardware wallet comparison.
3. Document every movement. Transfers, transaction IDs and correspondence belong on the record without gaps, for a report to the regulator as much as for your tax return. Tools that log transactions automatically are listed in our overview of crypto tax software and portfolio trackers.

The full notice with all 23 addresses sits with the regulator itself: BaFin consumer notice of 14 October 2026. With an unlicensed provider, a total loss of the money paid in is possible at any time.

(As of October 14, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)