Morocoin Scam Investigation: Fake Crypto Trading, Security Token Fraud and Recovery Options
Published by Cyb3rsect | October 20, 2026
A cryptocurrency investment platform may look convincing without conducting a single genuine trade. It can display market charts, advertise investment opportunities, provide account statements, and show investors profits that exist only inside its own system.
The allegations surrounding Morocoin Tech Corp. illustrate how this type of deception can be combined with social media recruitment, artificial intelligence investment tips, and fraudulent token offerings.
On December 22, 2025, the U.S. Securities and Exchange Commission (SEC) filed charges against Morocoin Tech Corp., Berge Blockchain Technology Co., Ltd., Cirkor Inc., and four purported investment clubs.
According to the regulator, the defendants operated an elaborate investment confidence scheme that misappropriated at least $14 million from retail investors in the United States.
The SEC alleges that investors were recruited through social media advertisements and WhatsApp groups, where individuals posing as financial professionals promoted investment opportunities.
Participants were eventually directed to purported cryptocurrency trading platforms, including Morocoin, and encouraged to purchase supposed security token offerings.
The regulator alleges that the platforms were fake, the advertised token offerings did not exist, and no genuine trading occurred.
When investors attempted to withdraw their money, they were allegedly confronted with demands for additional payments.
The SEC’s complaint describes a broader operation involving several entities. The reported $14 million represents the alleged combined amount misappropriated by the defendants, not an amount attributed exclusively to Morocoin.
This investigation examines the allegations involving Morocoin, the mechanics of fake security token offerings, withdrawal-related fraud, cryptocurrency tracing, and realistic options for affected investors.
What Is Morocoin Tech Corp.?
Morocoin Tech Corp. was identified by the SEC as one of three purported cryptocurrency trading platforms involved in the alleged investment confidence scheme.
The other two platforms were Berge Blockchain Technology Co., Ltd. and Cirkor Inc.
According to the complaint, the platforms represented themselves as legitimate cryptocurrency investment services and claimed to possess government licenses.
They were promoted through a network of investment clubs that recruited investors using social media and private messaging applications.
The SEC alleges that the platforms were not conducting the trading activity they advertised.
Instead, the supposed investment opportunities were used to obtain money from investors.
This distinction is central to understanding the case.
A cryptocurrency platform may display prices, balances, and investment positions without holding the assets those figures supposedly represent.
The presence of trading software or a professional-looking dashboard is not sufficient to establish that actual transactions have taken place.
Why Morocoin Is Named in an SEC Fraud Case
The SEC filed its complaint in the U.S. District Court for the District of Colorado on December 22, 2025.
The enforcement action names seven entities:
- Morocoin Tech Corp.
- Berge Blockchain Technology Co., Ltd.
- Cirkor Inc.
- AI Wealth Inc.
- Lane Wealth Inc.
- AI Investment Education Foundation Ltd.
- Zenith Asset Tech Foundation.
The SEC alleges that the investment clubs recruited prospective investors and directed them to the purported trading platforms.
The defendants allegedly used false regulatory claims, artificial intelligence investment recommendations, and nonexistent security token offerings to persuade people to transfer money.
The regulator further alleges that the funds were routed overseas through a network of bank accounts and cryptocurrency wallets.
The SEC seeks permanent injunctions and civil penalties against all seven defendants, along with disgorgement and prejudgment interest from the three purported trading platforms.
These are allegations in a civil complaint, not a final judicial finding of liability.
How the Alleged Morocoin Investment Scheme Worked
The SEC describes a multistage operation designed to establish trust before directing investors toward the purported trading platforms.
Stage One: Social Media Advertisements Attracted Investors
According to the complaint, the investment clubs advertised through social media.
The advertisements encouraged people to join groups where they could receive investment information and trading recommendations.
This approach can be effective because an advertisement may initially appear to promote financial education rather than a specific investment product.
Someone interested in learning about cryptocurrency may join a group without intending to transfer money.
Over time, however, the discussion may shift toward particular trading opportunities.
Stage Two: WhatsApp Groups Built Confidence
The SEC alleges that the investment clubs operated through WhatsApp groups.
Within these groups, individuals reportedly posed as financial professionals and shared investment recommendations.
A group containing apparent experts and enthusiastic participants can create the impression of a credible investment community.
However, the identities of group members and the authenticity of their claimed investment results may be difficult to verify.
Investors should not assume that a recommendation is reliable simply because multiple people in a group endorse it.
Stage Three: AI Investment Tips Created an Appearance of Expertise
The investment clubs allegedly promoted tips described as being generated by artificial intelligence.
AI terminology can make an investment strategy appear sophisticated.
But the existence of a trading recommendation does not prove that it came from a functioning algorithm.
Nor does it establish that the recommendation is accurate or that the person providing it has legitimate financial expertise.
The SEC alleges that these purported AI-generated tips helped build investor confidence before participants were directed to the trading platforms.
Stage Four: Investors Were Directed to Morocoin and Other Platforms
Once trust had been established, investors were allegedly encouraged to open and fund accounts on Morocoin, Berge, or Cirkor.
The platforms claimed to possess government licenses.
Such claims may have reassured people who were unfamiliar with cryptocurrency regulation.
However, licensing information must be verified independently through the appropriate regulator.
A certificate displayed on a website does not establish that the company is authorized to provide financial services.
Stage Five: Fake Security Token Offerings Were Promoted
The platforms allegedly offered investors opportunities to participate in security token offerings supposedly issued by legitimate businesses.
According to the SEC, those offerings and their purported issuers did not exist.
This was a central element of the alleged fraud.
The investment opportunity was presented as an asset-backed or business-connected digital security, but the regulator alleges there was no genuine offering behind it.
Stage Six: Withdrawal Requests Triggered Additional Payment Demands
The SEC alleges that investors attempting to withdraw money were required to pay advance fees.
This is a particularly concerning pattern.
A person may believe their investment has appreciated significantly, only to discover that access to the displayed balance depends on another payment.
If the underlying trading platform is fictitious, the displayed profits may not correspond to any real assets.
Paying additional fees does not establish that the money will be released.
What Is a Security Token Offering?
A security token offering, sometimes abbreviated as STO, involves digital tokens that may represent securities or investment interests.
Depending on the structure, a token could represent rights associated with equity, debt, or another financial arrangement.
Legitimate tokenized securities may be subject to applicable securities laws.
However, a digital token’s name or appearance does not establish that it represents a genuine asset.
An investor should be able to identify the issuer, the legal rights attached to the token, and the records supporting ownership.
If an offering claims to represent shares or interests in an established business, that relationship should be independently verifiable.
The SEC alleges that the security token offerings promoted through Morocoin and the other platforms were fictitious.
It also alleges that the businesses supposedly issuing the tokens did not exist.
For investors, this means the central question is not whether a token appeared inside an account dashboard.
It is whether the token corresponded to a real security issued by an identifiable legal entity.
Why Fake Security Token Offerings Can Be Difficult to Recognize
Fraudulent investment platforms may borrow terminology from legitimate financial markets.
Words such as tokenization, institutional investment, blockchain settlement, and private placement can make an opportunity sound sophisticated.
A platform may also claim that a token is available only during an early investment period.
This can create urgency and discourage independent research.
An investor may see a token allocation, a rising valuation, or a future listing date displayed in their account.
But those details can be fabricated.
The underlying evidence should include verifiable issuer information, legal offering documents, custody arrangements, and transaction records.
If the platform cannot establish that the token exists independently of its own website, the investment should be treated with caution.
Morocoin Withdrawal Problems: What the SEC Alleges
The SEC’s complaint describes withdrawal-related demands involving the defendants collectively.
According to the regulator, investors who attempted to withdraw funds were asked to pay additional fees.
These alleged demands are important because they can create further losses after the initial investment.
An investor who believes a substantial balance is waiting to be released may feel compelled to pay a relatively smaller amount to access it.
The payment may be described as a tax, verification charge, or administrative requirement.
However, the existence of a withdrawal fee does not prove that the displayed balance is genuine.
Anyone experiencing difficulties accessing money associated with Morocoin should preserve the complete withdrawal history.
That includes requests, dates, account balances, communications, and payment instructions.
Do not send additional funds based solely on an assurance that doing so will unlock an account.
Where Did the Allegedly Misappropriated Money Go?
The SEC alleges that the seven defendants collectively misappropriated at least $14 million from U.S. retail investors.
The regulator states that funds were transferred overseas through a network of bank accounts and cryptocurrency wallets.
This is important because the investigation involves both traditional financial infrastructure and digital assets.
Bank transfers may leave records identifying sending institutions, beneficiaries, intermediary banks, and transaction references.
Cryptocurrency transfers may be recorded on public blockchains.
An investigation may need to examine both types of records to reconstruct the movement of funds.
However, the SEC’s public announcement does not provide a complete transaction history for every investor.
Individual payment records remain essential.
Can Cryptocurrency Sent to Morocoin Be Traced?
Where investors transferred cryptocurrency, blockchain analysis may help establish the path taken by those assets.
A transaction hash can identify a specific transfer on a supported blockchain.
Investigators may examine the receiving address, subsequent transfers, and interactions with identifiable services.
This can help establish whether money moved through multiple wallets or toward a cryptocurrency exchange.
However, blockchain tracing has limitations.
A wallet address does not automatically reveal the identity of its controller.
Transfers may cross networks or involve services that complicate attribution.
And tracing cannot reverse a confirmed cryptocurrency transaction.
The results may support regulatory reporting or legal proceedings, but they cannot guarantee recovery.
For related guidance, readers can consult Cyb3rsect’s article on Blockchain Transaction Tracing.
How to Investigate a Suspicious Morocoin Investment
A useful investigation begins with the investor’s original contact.
Who introduced the opportunity?
Was it promoted through an advertisement, WhatsApp group, or private conversation?
What credentials did the promoter claim to possess?
Next, establish the financial representations.
What profits were promised?
Was the platform described as government licensed?
Were investors encouraged to purchase a specific security token?
Then reconstruct the payment history.
Record the dates, amounts, payment methods, receiving accounts, and wallet addresses associated with every transfer.
Finally, compare the account statements with the actual financial records.
The purpose is to distinguish what the platform displayed from what can be independently verified.
Preserving WhatsApp and Trading Account Evidence
The SEC’s allegations highlight the importance of preserving communications.
A WhatsApp group may contain statements about trading strategies, expected returns, regulatory status, and investment opportunities.
It may also contain payment instructions or messages explaining withdrawal delays.
These records can become difficult to retrieve if the group is deleted or participants remove their accounts.
Affected investors should preserve original messages, relevant screenshots, account statements, transaction confirmations, and website addresses.
Where possible, retain timestamps and identifying details.
Avoid altering the original records.
A chronological evidence file can help investigators, financial institutions, and authorities understand the sequence of events.
For additional guidance, see the related Cyb3rsect topic Digital Evidence Preservation.
Morocoin Recovery Options: What Investors Should Know
Recovery depends on the payment method, available assets, legal proceedings, and individual circumstances.
The SEC’s December 2025 lawsuit seeks financial remedies against the defendants.
However, the filing of a complaint does not establish that a compensation fund exists or that investor payments have already been recovered.
Anyone claiming to arrange an official refund should be independently verified.
Investors should begin by preserving their records and contacting the institution used to make the payment.
Where cryptocurrency was transferred through an exchange, the exchange’s fraud or compliance team may be able to review the transaction information.
Victims may also report suspected securities fraud to the SEC and internet-related financial crime to the FBI’s Internet Crime Complaint Center.
Investors outside the United States should consult the appropriate authorities in their jurisdictions.
Qualified legal advice may help where losses are substantial or cross-border transactions are involved.
Beware of Fake Morocoin Recovery Agents
A person who has already lost money to an investment scheme may be approached by someone promising to recover it.
The contact may claim to represent a regulator, law firm, blockchain investigation company, or financial administrator.
They may say that the investor’s money has been located and that an additional payment is required before it can be released.
Some recovery scammers ask for cryptocurrency wallet seed phrases or remote access to devices.
These requests can create further financial and security risks.
Official compensation arrangements should be verified directly through reliable court or regulatory sources.
Do not rely exclusively on contact information provided by an unsolicited caller or message.
No legitimate investigator can guarantee the recovery of cryptocurrency merely because a transaction has been traced.
How Cyb3rsect Examines Fake Trading Platforms
The Morocoin case illustrates why a digital investigation must look beyond the appearance of a trading website.
Relevant evidence may include the identities used in investment groups, claims about government licensing, purported token issuers, financial records, and the movement of investor funds.
At Cyb3rsect, our research focuses on suspicious cryptocurrency platforms, blockchain transaction analysis, online investment fraud, and digital evidence preservation.
An evidence-based approach seeks to establish what can be verified and identify practical steps without promising outcomes that depend on regulators, courts, or financial institutions.
Morocoin, Berge and Cirkor: Why the Connection Matters
The SEC named Morocoin, Berge Blockchain Technology, and Cirkor together in the same enforcement action.
The complaint also identifies four investment clubs allegedly involved in recruiting participants.
This structure matters because investors may have encountered different names while participating in what the regulator describes as a connected operation.
One person may remember the investment club that recruited them.
Another may remember the trading platform where they deposited funds.
A third may remember the name of a supposed security token offering.
Investigators should preserve all those identifiers.
However, the SEC’s allegations should not be expanded to unrelated businesses merely because they have similar names or use comparable technology.
The relevant connections must be supported by evidence.
Final Assessment: Is Morocoin a Scam?
Morocoin Tech Corp. is a defendant in an SEC civil fraud lawsuit filed on December 22, 2025.
The regulator alleges that Morocoin, two other purported trading platforms, and four investment clubs participated in an operation that misappropriated at least $14 million from U.S. retail investors.
The alleged conduct included WhatsApp recruitment, AI-generated investment tips, false government licensing claims, fictitious security token offerings, and additional payment demands when investors sought withdrawals.
The SEC also alleges that no genuine trading occurred on the purported platforms.
These are serious allegations supported by a formal regulatory complaint, although they should not be described as final findings of liability.
For affected investors, the most useful next steps are to preserve communications and payment records, verify developments through official sources, and avoid unauthorized recovery offers.
The Morocoin case demonstrates that a cryptocurrency platform’s apparent sophistication means little unless the underlying trades, assets, token issuers, and financial transactions can be independently verified.
