Rfolmax Crypto Investigation: The $58,000 Tax Payment Followed by Another Withdrawal Demand

Publication date: November 1, 2026

A cryptocurrency trading platform may allow an investor to make an initial withdrawal, creating confidence that the service is legitimate. But that experience does not guarantee that larger withdrawals will be processed or that the account balance represents accessible assets.

A consumer complaint recorded by the California Department of Financial Protection and Innovation (DFPI) describes this pattern involving a purported cryptocurrency trading platform operating at web3.rfolmax.com.

According to the complaint, a California resident transferred cryptocurrency to fund an account and initially managed to withdraw a small amount. After the investor believed the account had generated trading profits, a larger withdrawal was attempted.

The platform reportedly demanded a $58,000 payment described as a tax. The consumer paid the requested amount, but the platform then claimed the account had been locked because of suspicious activity. It subsequently demanded another $30,000 to verify the investor’s identity.

The consumer reported being unable to recover the remaining funds. The website was no longer operational, and the DFPI tracker records a reported loss of at least $90,000.

This case highlights an important warning sign: when a platform keeps introducing new payments after a withdrawal request, investors should stop and independently investigate rather than assume the next payment will release their money.

What the DFPI complaint says about Rfolmax

The DFPI Crypto Scam Tracker identifies Rfolmax as a fraudulent trading platform.

The consumer’s complaint describes the following sequence:

• Platform: Rfolmax, operating through web3.rfolmax.com.
• Initial funding: The resident transferred cryptocurrency to fund an account.
• Early withdrawal: The consumer was initially able to withdraw a small amount.
• Apparent trading gains: The investor subsequently believed the account had generated profits.
• First withdrawal obstacle: A larger withdrawal reportedly triggered a demand for a $58,000 tax payment.
• Payment made: The consumer paid the requested $58,000.
• Second obstacle: The platform then claimed the account had been locked because of suspicious activity.
• Additional payment demand: The platform reportedly requested another $30,000 for identity verification.
• Reported outcome: The consumer could not recover the remaining funds, and the website was no longer operational.
• Reported loss: At least $90,000.

An important distinction: the complaint says the consumer paid the $58,000 tax demand but does not say that the additional $30,000 identity-verification demand was paid. The second amount should therefore be described as a demand, not an additional confirmed payment.

The DFPI states that its tracker is based on consumer complaints and that it has not independently verified the reported losses. The complaint should not be presented as a court judgment.

Why an initial successful withdrawal can create false confidence

One of the most significant details in the Rfolmax complaint is that the consumer was initially able to withdraw a small amount.

This can make an unfamiliar platform appear more credible.

An investor who successfully receives a small withdrawal may conclude that the platform is functioning normally. If the account also displays increasing profits, the investor may feel more comfortable committing additional funds.

However, a small successful withdrawal does not prove that:

• The platform is conducting genuine trading.
• The displayed profits represent real assets.
• The operator has sufficient funds to meet larger withdrawals.
• The company is authorized to provide its advertised services.
• Future withdrawal requests will be honored.

Some fraudulent investment operations use small withdrawals to build confidence before encouraging larger deposits or blocking access to a larger balance.

The FBI has warned about cryptocurrency investment fraud in which criminals build relationships with victims, direct them to fraudulent platforms, and display fictitious trading profits. <Cite refs={[“turn716994search1”]}/>

The lesson is simple: verify the platform independently, even if an early withdrawal appears to work.

The $58,000 tax demand: Why investors should question it

According to the complaint, Rfolmax demanded $58,000 described as a tax before processing the larger withdrawal.

Tax obligations involving cryptocurrency can be complex. Depending on the transaction and the taxpayer’s circumstances, cryptocurrency activity may have reporting and tax consequences.

But an unfamiliar trading website cannot establish a legitimate tax liability simply by displaying a payment demand.

Before responding to a supposed tax charge, investors should establish:

• Which tax authority supposedly requires the payment.
• What taxable transaction or obligation the charge relates to.
• Whether the amount can be independently calculated.
• Whether the payment is documented in the original agreement.
• Who will receive the payment.
• Whether the request can be verified through an official tax authority or qualified tax professional.

Be particularly cautious when a platform insists that cryptocurrency must be sent to a separate wallet before the investor can access an existing balance.

A platform’s explanation is not proof that a payment is legally owed.

In the Rfolmax complaint, the consumer reportedly paid the $58,000 demand but still did not regain access to the funds.

The second demand: Another $30,000 for identity verification

The situation reportedly became more concerning after the first payment.

Instead of releasing the funds, the platform claimed the account had been locked because of suspicious activity. It then demanded another $30,000 for identity verification.

Identity checks are a normal part of many legitimate financial services. However, a request to pay a large additional sum simply to verify identity should be treated with caution.

Investors should distinguish between:

Identity documentation: A legitimate service may request documents to establish the account holder’s identity.

Account security checks: A service may temporarily restrict activity while investigating unusual access or transactions.

A separate payment demand: Requiring a new cryptocurrency transfer as a condition of identity verification is a different matter and should be independently examined.

The complaint does not establish the platform’s actual internal procedures. It records the consumer’s account of the $30,000 demand.

The important warning is the sequence: a tax payment was made, the withdrawal remained blocked, and another payment was then requested.

Do not assume that paying a second demand will resolve the first problem.

Rfolmax wallet addresses recorded by the DFPI

The DFPI tracker lists two wallet addresses associated with Rfolmax:

• Bitcoin address: 1Ev7RDRL2PNzZZmRYELtJHRTqHRTqHb7DbGVb
• Ethereum address: 0x0F16E4832AEcDb8f207502F6C94455541Dd995e7

These addresses are useful investigative leads because they may help researchers examine transactions associated with the complaint.

However, an address appearing in a consumer complaint does not independently establish who controls it or prove that every transaction involving it belongs to the same operation.

A responsible blockchain investigation should examine:

• The transaction history associated with the address.
• The dates and amounts of relevant transfers.
• The blockchain network used.
• Whether funds moved to additional addresses.
• Whether any receiving addresses interact with identifiable exchanges or services.
• Whether the transfers can be connected to records supplied by the affected investor.

Wallet analysis should also distinguish between confirmed on-chain movements and assumptions about the real-world identity of the wallet operator.

Cyb3rsect’s Blockchain Transaction Tracing guide explains how transaction records can help establish the movement of cryptocurrency.

How to investigate a Rfolmax-related cryptocurrency transfer

If you interacted with Rfolmax, begin by preserving records that establish how the account was funded and what happened when you attempted to withdraw.

1. Preserve the original platform records

Save screenshots of the account dashboard, displayed balance, deposit instructions, trading history, and withdrawal attempts.

If the website is no longer operational, retain browser history, saved screenshots, emails, and downloaded statements.

2. Document every payment demand

Preserve the original messages requesting the $58,000 tax payment and the subsequent $30,000 identity-verification payment.

Record the dates, amounts, payment instructions, wallet addresses, and explanations provided by the platform.

3. Collect transaction hashes

For every cryptocurrency transfer, record the transaction hash, sending address, receiving address, network, timestamp, and amount.

Do not rely only on a screenshot of a transaction. Preserve the underlying transaction identifier wherever possible.

4. Separate paid amounts from unpaid demands

Create a timeline showing:

• Initial deposits.
• Any small withdrawals received.
• The $58,000 payment reportedly made.
• The later $30,000 identity-verification demand.
• Any other transfers that can be independently documented.

This prevents a requested payment from being incorrectly included as money already lost.

5. Preserve account and communication records

Keep emails, chat messages, support conversations, and any contact information used by platform representatives.

Do not delete the original records, even if the website has disappeared.

For further guidance, see Digital Evidence Preservation.

What to do if a cryptocurrency platform demands another payment

If a platform blocks a withdrawal and requests additional money, take time to verify the demand before responding.

Stop sending funds. Do not make another payment simply because the platform claims it is required for taxes, identity verification, account restoration, or release processing.

Contact the service used to transfer cryptocurrency. Notify the exchange or payment provider and supply the transaction details. Ask what reporting or protective options may be available.

Secure accounts and devices. Change compromised passwords, protect your email account, and review any applications or remote-access tools installed at the platform’s request.

Preserve the evidence. Keep the withdrawal requests, payment demands, transaction hashes, and platform records.

Report the incident. California residents can consult the DFPI’s consumer resources. Suspected cryptocurrency investment fraud can also be reported to the FBI’s Internet Crime Complaint Center at IC3.gov.

Be cautious of recovery solicitations. A person claiming to have located your cryptocurrency or promising guaranteed recovery may be attempting to exploit the situation. Never disclose private keys or seed phrases to a supposed recovery agent.

How Cyb3rsect can help examine a suspected Rfolmax case

A suspected Rfolmax incident may involve several separate evidence sources: the trading website, cryptocurrency transfers, payment demands, account records, and communications with platform representatives.

Cyb3rsect provides cybersecurity and digital-investigation assistance that may include:

• Reviewing suspicious domains and available website records.
• Organizing platform communications and withdrawal demands.
• Examining transaction hashes and associated wallet activity.
• Comparing documented deposits and withdrawals.
• Separating actual payments from requested but unpaid fees.
• Preparing an evidence timeline for reporting or further professional review.

The objective is to establish what the available evidence supports, identify relevant investigative leads, and explain realistic next steps.

Blockchain tracing does not automatically establish the identity of a wallet owner or guarantee that transferred cryptocurrency can be recovered. A responsible assessment should explain those limitations clearly.

Final thoughts: A second payment demand is a reason to stop

The Rfolmax complaint illustrates how a small successful withdrawal can create confidence before a larger withdrawal becomes blocked.

The consumer reportedly paid $58,000 after the platform described the amount as a tax. The platform then demanded another $30,000 for identity verification, while the investor remained unable to recover the funds.

For anyone using an unfamiliar cryptocurrency platform, the lesson is to verify withdrawal conditions before depositing money and to question unexpected payment demands.

If you have already encountered this situation, preserve your original communications and transaction records. Do not assume that another payment will unlock an account simply because the platform promises it will.

Cyb3rsect encourages anyone facing suspicious cryptocurrency withdrawal restrictions to prioritize evidence preservation, independent verification, and realistic investigative next steps.