Theresleo.com Scam Investigation: LEOxChange, $471,566 Investor Warning and 20% Withdrawal Demand

Theresleo.com, a purported cryptocurrency trading platform also operating under the names LEO and LEOxChange, has been identified in an official investor warning issued by the Washington State Department of Financial Institutions (DFI).

The warning, published April 30, 2026, describes a Washington investor who opened an account on LEOxChange after communicating with an individual through WhatsApp.

The investor initially deposited a small amount and successfully withdrew money.

After this successful withdrawal, the investor made several larger deposits.

However, when the investor later attempted to withdraw the investment, the platform reportedly claimed that the account had been frozen because of an anti-money-laundering warning.

The investor was allegedly instructed to pay a 20% security deposit to an entity described as an “online financial regulatory department” before the funds could be released.

According to Washington DFI, the investor remained unable to withdraw the investment.

The regulator lists a reported loss of $471,566 and categorizes the complaint as involving cryptocurrency scams, pig-butchering scams, and advance-fee scams.

Washington DFI has not independently verified the complaint allegations or reported financial loss.

This Cyb3rsect investigation examines Theresleo.com, the LEOxChange platform, the reported withdrawal restrictions, and the warning signs associated with purported regulatory security deposits.

What Is Theresleo.com?

Theresleo.com was identified by Washington DFI as a purported cryptocurrency trading platform.

The regulator states that the operation also used the names LEO and LEOxChange.

According to the complaint, the investor opened a trading account on the LEOxChange investment platform.

The public warning does not establish the legal identity of the platform’s operator, its regulatory registration, or whether genuine cryptocurrency trading took place.

The names LEO and LEOxChange should therefore be understood in the context of this specific complaint.

They should not automatically be associated with unrelated businesses, cryptocurrency tokens, or legitimate services that use similar names.

For investors, the central question is whether the particular platform receiving deposits can independently verify its legal identity, trading activity, and custody arrangements.

Washington DFI’s Official Warning

On April 30, 2026, Washington DFI’s Securities Division published an alert titled Alleged cryptocurrency trading platform Theresleo.com may be fraudulent.

The regulator identified three subjects:

• Theresleo.com
• LEO
• LEOxChange

The warning describes an investor who communicated with an individual through WhatsApp before opening a trading account.

The investor reportedly made a small initial investment, successfully withdrew funds, and then made larger deposits.

When the investor attempted to withdraw the later investment, the platform allegedly claimed that an anti-money-laundering warning had caused the account to be frozen.

The investor was told to pay a 20% security deposit before withdrawing the money.

The regulator recorded a reported loss of $471,566.

However, the alert is based on a complaint and supporting materials whose factual details have not been independently verified by DFI.

How the Investor Encountered LEOxChange

According to Washington DFI, the investor communicated with an individual through WhatsApp before creating an account on LEOxChange.

The public warning does not identify that individual by name.

It also does not explain how the original conversation began.

There is no confirmed account of whether the contact originated through a dating application, social media advertisement, investment group, or another channel.

These details should not be assumed.

Nevertheless, the use of private messaging to introduce an investment opportunity is relevant.

A person may establish trust through repeated conversations before directing someone to an unfamiliar trading website.

An investor may then rely on the person’s assurances rather than independently verifying the platform.

In this case, the initial WhatsApp conversations could contain important evidence about how the investment was presented and what representations were made.

The Initial Successful Withdrawal

One of the most significant details in the complaint is that the investor successfully withdrew money after making a small initial deposit.

A successful withdrawal can make an unfamiliar trading platform appear reliable.

The investor may conclude that the platform is holding genuine assets and that future withdrawals will be equally straightforward.

However, a small successful withdrawal does not prove that all displayed account balances correspond to actual cryptocurrency holdings.

It also does not establish that the platform will honor larger withdrawals.

Washington DFI reports that the investor made additional, larger deposits after the initial withdrawal.

The warning does not specify the amount of the first deposit or withdrawal.

Those figures would need to be established using the investor’s original records.

Why Larger Deposits Increase the Risk

After the initial withdrawal, the investor reportedly deposited larger amounts into LEOxChange.

This sequence is important because financial exposure can increase substantially once a platform appears trustworthy.

An investor may become more comfortable transferring money after seeing a successful transaction.

However, the ability to withdraw a small amount is not equivalent to independently verifying the platform’s financial condition, legal status, or trading operations.

The DFI warning does not provide a complete schedule of deposits.

It also does not publish the receiving wallet addresses or transaction hashes associated with the investment.

An independent investigation would need to reconstruct the deposits using bank statements, cryptocurrency exchange records, and any relevant blockchain transactions.

The Reported $471,566 Loss

Washington DFI’s scam tracker lists a reported loss of $471,566.

This is a substantial amount, but it should be described accurately.

The regulator has not independently verified the loss.

The public warning does not provide a detailed breakdown showing how much cryptocurrency was deposited, whether any profits were displayed, or how the reported amount was calculated.

It also does not establish whether the figure includes the value of the initial successful withdrawal.

A case-specific investigation should distinguish confirmed financial transfers from account balances displayed by the trading platform.

Original transaction records are necessary to determine the actual amount transferred and the destination of the assets.

The Anti-Money-Laundering Account Freeze

According to Washington DFI, the investor was told that the LEOxChange account had been frozen because of an anti-money-laundering warning.

Anti-money-laundering rules are genuine requirements in the financial industry.

Financial institutions and certain cryptocurrency businesses may be required to monitor transactions, verify customer identities, and respond to suspicious activity.

However, the existence of legitimate AML regulations does not mean that every website invoking those rules is acting lawfully.

A platform may use regulatory language to make a withdrawal restriction sound authoritative.

In the Theresleo complaint, the platform allegedly relied on an AML warning to explain why the investor could not access the money.

The public alert does not identify a genuine regulator that ordered the freeze.

It also does not provide an official AML enforcement notice.

Therefore, the account freeze should be described as a claim reportedly made by the platform, not as an independently confirmed regulatory action.

The 20% Security Deposit Demand

The central warning sign in the Theresleo complaint is the reported requirement to pay a 20% security deposit.

According to Washington DFI, the investor was told to pay this amount to an “online financial regulatory department” before the investment could be withdrawn.

The public alert does not identify a legitimate government authority responsible for this demand.

It also does not establish that the supposed department existed as a recognized regulator.

A requirement to transfer a large additional payment to unlock an existing investment is a serious warning sign.

Legitimate compliance procedures may involve identity verification, documentation, or account reviews.

However, a purported regulator’s demand for a separate percentage-based deposit should be independently verified before any payment is made.

The DFI warning does not state that the investor actually paid the 20% deposit.

That distinction matters.

The confirmed complaint narrative describes the demand and the inability to withdraw, not a verified payment of that additional amount.

How Much Would a 20% Deposit Represent?

A 20% requirement can create substantial additional financial exposure.

For illustration, 20% of $100,000 is $20,000.

On a hypothetical balance of $500,000, the payment would be $100,000.

These examples explain the scale of a percentage-based demand.

They do not establish how LEOxChange calculated the actual security deposit requested from the investor.

Washington DFI does not identify the account balance used to determine the required payment.

Therefore, it would be inaccurate to calculate 20% of the reported $471,566 loss and describe that figure as the actual demand.

The relevant evidence would be the original message or notice explaining the amount requested and the account balance on which it was supposedly based.

Why the Regulatory Department Claim Matters

The phrase “online financial regulatory department” is a distinctive feature of the complaint.

It suggests that the platform presented the withdrawal restriction as a compliance matter involving a financial authority.

However, the warning does not identify the name, jurisdiction, or legal authority of the purported department.

Investors should not assume that a regulatory-sounding title represents a government agency.

A genuine financial regulator should be independently identifiable through official government or recognized regulatory channels.

A suspicious trading platform may provide a fabricated certificate, notice, or contact address to support a payment demand.

Such documents should be verified directly with the purported issuing authority.

In the Theresleo case, there is no verified evidence in the public DFI alert that a legitimate regulator required the 20% payment.

Why This Resembles Advance-Fee Fraud

Washington DFI categorizes the complaint as an advance-fee scam.

Advance-fee investment fraud occurs when a person is asked to make an additional payment to receive money or another financial benefit that has already been promised.

In cryptocurrency cases, the payment may be described as a tax, compliance charge, security deposit, wallet activation fee, or withdrawal processing requirement.

The investor may already have deposited substantial funds.

That creates pressure to pay more in the hope of protecting the original investment.

However, paying the additional amount does not guarantee that the funds will be released.

The Theresleo complaint illustrates this pattern through the alleged 20% security deposit demand.

The investor reportedly remained unable to withdraw the investment.

Why DFI Also Categorized the Case as Pig-Butchering

The regulator also lists the complaint under pig-butchering scams.

This term commonly describes relationship-based investment fraud in which trust is developed before significant financial transfers are encouraged.

The trust-building process may involve romantic, social, or professional interactions.

In the Theresleo complaint, the investor communicated with someone through WhatsApp before joining the platform.

The initial successful withdrawal may also have reinforced confidence in the investment.

However, the public warning does not describe a romantic relationship or a detailed grooming timeline.

It would therefore be inappropriate to invent a romantic storyline or claim that the investor met the individual through a dating application.

The supported facts are the WhatsApp contact, initial investment, successful withdrawal, larger deposits, and subsequent withdrawal restriction.

Were the Investments Real?

The Washington DFI warning does not independently verify whether genuine cryptocurrency trading occurred on LEOxChange.

A trading platform may display account balances, profits, losses, or transaction histories.

However, those displays do not necessarily prove that actual trades were executed or that the corresponding assets exist.

An investigation should begin with independently verifiable financial records.

If the investor transferred cryptocurrency from an external wallet or exchange, those transactions may provide a starting point.

The investigation can then compare the confirmed deposits with any records displayed by the platform.

The public warning does not establish the amount of any trading profits or the location of the invested cryptocurrency.

Is Theresleo.com Legitimate or a Scam?

The available regulatory evidence raises serious concerns.

Washington DFI has published an official warning identifying Theresleo.com, LEO, and LEOxChange.

The complaint describes an investor who successfully completed a small withdrawal before making larger deposits.

The platform then allegedly froze the account because of an AML warning and demanded a 20% security deposit before releasing the investment.

The investor reportedly remained unable to withdraw funds.

The regulator lists a reported loss of $471,566.

However, the allegations and loss have not been independently verified.

The evidence-based conclusion is that Theresleo.com and LEOxChange are the subjects of a documented regulatory warning involving suspected cryptocurrency investment and advance-fee fraud.

The warning is not a final criminal judgment against an identified operator.

What Evidence Should Theresleo Investors Preserve?

Anyone who interacted with Theresleo.com or LEOxChange should preserve the original evidence.

Important records include:

• WhatsApp conversations introducing the platform
• The exact Theresleo.com website address
• LEOxChange account registration information
• Screenshots of account balances and trading activity
• Records of the initial successful withdrawal
• Bank statements associated with the investment
• Cryptocurrency exchange purchase and withdrawal histories
• Blockchain transaction hashes
• Receiving wallet addresses
• Records of subsequent larger deposits
• Notices concerning the alleged AML account freeze
• Messages requesting the 20% security deposit
• Any documents naming the supposed financial regulatory department
• Customer support communications
• Records of unsuccessful withdrawal attempts

Where possible, preserve complete message histories and original transaction records rather than relying only on screenshots.

Never provide private keys, wallet recovery phrases, passwords, or authentication codes to anyone offering investigative or recovery services.

Can Cryptocurrency Sent to LEOxChange Be Traced?

Cryptocurrency transfers recorded on public blockchain networks may provide useful investigative evidence.

A case-specific review could begin with the investor’s original exchange withdrawal records.

These may identify the cryptocurrency asset, blockchain network, transaction hash, receiving address, and amount transferred.

Subsequent blockchain activity may provide additional leads.

However, wallet addresses do not automatically identify their controllers.

Funds may also pass through custodial services that maintain records outside the public blockchain.

Washington DFI does not publish wallet addresses or transaction hashes associated with the Theresleo complaint.

It would therefore be misleading to claim that the reported $471,566 has already been traced to a specific wallet or individual.

Blockchain tracing does not guarantee recovery.

What to Do If LEOxChange Demands a Security Deposit

If a trading platform claims that your investment has been frozen because of an AML warning and demands additional money, do not assume that the request is legitimate.

Preserve the notice, payment instructions, and related messages.

Independently verify any claimed regulatory action through the relevant regulator’s official website and contact channels.

Do not rely solely on contact details supplied by the platform.

Contact the bank or cryptocurrency exchange involved in your transfers to report suspected fraud.

If you shared account credentials or identity documents, review the security of your financial and email accounts.

Report the incident to the appropriate financial regulator or law-enforcement agency.

U.S. investors may submit internet-enabled fraud reports to the FBI’s Internet Crime Complaint Center.

Washington residents may also submit complaints to Washington DFI.

Be cautious of anyone subsequently promising guaranteed cryptocurrency recovery in exchange for another upfront payment.

How Cyb3rsect Can Assist With a Theresleo Investigation

Cyb3rsect provides digital-investigation and blockchain-forensics services relevant to suspected cryptocurrency investment fraud.

For a Theresleo or LEOxChange-related case, an evidence review may begin with the investor’s WhatsApp communications, deposit records, and withdrawal notices.

The objective is to reconstruct the timeline of investment solicitation, the initial successful withdrawal, later deposits, and the reported AML-related account freeze.

Where transaction hashes and receiving addresses are available, relevant blockchain activity may be examined for additional investigative leads.

The analysis should distinguish verified financial transfers from unsubstantiated platform balances and regulatory claims.

It should also document the exact evidence supporting each conclusion.

A forensic investigation may assist with evidence preservation and reporting, but it cannot guarantee recovery.

Contact Cyb3rsect About Theresleo.com

If you invested through Theresleo.com, LEO, or LEOxChange and experienced withdrawal restrictions, preserve your original records.

Cyb3rsect can assess the available digital evidence and determine whether further examination may be appropriate.

Useful starting information includes cryptocurrency transaction hashes, exchange withdrawal confirmations, WhatsApp messages, account screenshots, and notices demanding a 20% security deposit.

Never provide private keys, wallet recovery phrases, or account passwords.

Contact Cyb3rsect to discuss an evidence-based review of a suspected cryptocurrency investment incident.

Final Assessment

The April 30, 2026 Washington DFI warning identifies Theresleo.com, LEO, and LEOxChange in a complaint involving suspected cryptocurrency investment fraud.

The investor reportedly opened an account after communicating with an individual through WhatsApp.

A small initial investment was followed by a successful withdrawal.

The investor then made larger deposits.

When the investor attempted to withdraw the investment, the platform allegedly claimed that an anti-money-laundering warning had frozen the account.

A 20% security deposit was reportedly required before withdrawal.

The investor remained unable to access the investment.

Washington DFI lists a reported loss of $471,566 and categorizes the complaint as involving cryptocurrency scams, pig-butchering scams, and advance-fee scams.

The regulator has not independently verified the allegations or reported loss.

The case illustrates how an initial successful withdrawal can be followed by substantial financial exposure and how regulatory language may be used to justify additional payment demands.

For affected investors, preserving original communications and financial transaction records is essential.

Official Source

https://dfi.wa.gov/alerts/alleged-cryptocurrency-trading-platform-theresleocom-may-be-fraudulent

Editorial notice: This article summarizes a public regulatory complaint. It does not claim that Cyb3rsect independently verified the reported loss, identified the operator of LEOxChange, established the existence of an official AML freeze, or traced the cryptocurrency transfers described in the warning.