Aurum Foundation & NEYRO:
the “AI trading bot” that doesn’t trade

What this is, in three sentences

Aurum sells “NEYRO” as a non-custodial AI trading agent earning 12–18% per month. In reality there is no AI and no trading: your stablecoins are dropped into an ordinary liquidity pool earning about half a percent a year, sitting in a contract that only the operator can withdraw from. The operator siphons the money out and sprays it across hundreds of throwaway wallets into a no-ID swap service where the trail is designed to go cold — and, as of tonight, they are still taking new deposits.

Their promise vs. their code

This is how Aurum markets NEYRO on its own website — the exact claims our on-chain findings disprove. We quote them verbatim so there is no question of paraphrasing them unfairly.

The “AI trading bot” is 35 lines and cannot trade

Aurum published and verified its own contract on BSCScan — meaning this is their code, not a guess or a decompile. Stripped of the standard libraries, the entire “AI bot” is three functions. None of them trade, and none of them let a user take money out.

// Verified "Exact Match" on BSCScan. Excluding imported libraries,
// the whole contract is these three functions:

function setTokenId(uint256 _tokenId)  onlyRole(ADMIN)   // admin picks the pool position
function increaseLiquidity(uint256 amt) internal       // one-way: adds funds, amount1Desired:0
function loop()                        onlyRole(OPERATOR) // pushes ALL user USDT into the pool

// There is NO withdraw(), NO deposit(), NO redeem() —
// nothing a depositor can call. Only the operator moves money.

On TRON, they didn’t even pretend

The TRON version drops the liquidity-pool costume entirely. Its one function sweeps the whole balance to the operator’s wallet and emits an event they literally named Swept.

function loop() external onlyOwner {
    // send the entire USDT balance to the operator's wallet
    transfer(externalWallet, balance);
    emit Swept(externalWallet, amount);   // no pool, no trading, just a sweep
}

Deposits in, laundering out — $31.7M through one wallet

Every branch runs the same cycle. Money is collected out of the pool to a dedicated cash-out wallet, then broken into round tranches and scattered across hundreds of fresh addresses that all funnel into FixedFloat, a no-identity swap service where the public trail deliberately ends.

Arkham visualiser, cash-out wallet 0x02ee…05D9c: a tight green inflow on the left (money collected from the pool), exploding into a red fan of hundreds of outbound wallets on the right. The shape is the laundering pattern. (Illustrative — all figures in this report are sourced to BSCScan data, not the graphic.)

The TRON leg tells the same story, cleanly

• $1,157,558 deposited by 215 real people (1,015 deposits, typical size just $145) — ordinary retail victims.
• $1,115,306 swept out — 96% of it — every last transfer to a single operator wallet, then dispersed across 65 addresses to FixedFloat.
• No pool, no wash-trading noise: on TRON the money simply comes in and leaves. Net loss to users ≈ the gross figure.

This is not history — it’s running tonight

The USDC branch (branch 4) is live. Its payment contract was still accepting victim deposits at 09:38 UTC on 21 July, and pushing them into the pool as recently as 21:14 UTC the same evening. Since the source investigator’s 14 July cut-off, another $817,855 flowed in from 343 fresh depositors.

Nine contracts, made to look independent — one funder

The operation is split across six BSC contracts and three TRON contracts, each with its own deployer and its own cash-out wallet, so no single address looks too big. But the disguise breaks at the source: four of the five BSC deployers and the TRON owner were all funded from the same FixedFloat wallet.

• Branches 3 and 4 were funded 83 minutes apart, from the same wallet, with near-identical amounts (0.089445 vs 0.089440 BNB) — a difference of five millionths. That’s the same hand, funding “by recipe.”
• All branches use the same pool, the same contract template, and end at the same exit. The fragmentation is cosmetic.

The dashboard confesses in its own numbers

The source investigator decrypted the app’s hidden traffic (it was “protected” with a hard-coded password left in the code). The figures the server hands out are self-incriminating:

• The “Quantum Alpha” agent reports $31.3M profit on ~$245k of capital — a mathematically impossible ~12,700%.
• It shows a negative number of available slots (−6,604) — claiming more slots used than exist — a fake scarcity so broken it went negative.
• The referral plan has 15 commission tiers up to 18.5% on network turnover — a recruitment pyramid, written into their own backend.
• The advertised “AI model” is GPT-4 + DeepSeek Claude — not a real model, just popular AI names strung together.

Regulators across seven jurisdictions already agree

Our on-chain findings sit inside a wall of independent official warnings about Aurum Foundation:

• New Zealand — FMA issued a public caution and blacklisted the site (14 May 2026). fma.govt.nz ↗
• Hong Kong — SFC declared its licence claims false and listed it as a risk (23 June 2026), contradicting CEO Bryan Benson’s “licensed in Dubai and Hong Kong” statement.
• France — AMF blacklisted its domains (12 June 2026); Belgium — FSMA named it unauthorised (6 July 2026).
• Bank of Russia flagged pyramid-scheme characteristics; Nigeria — SEC warned on “Aurum Bot” (22 Jan 2026); Poland’s KNF referred suspected fraud to prosecutors.

The method, step by step

Every figure here was reproduced from public blockchain data. Nothing depends on trusting us — or the source — on faith.

1. Started from the source package. The anonymous investigator supplied verified contract addresses, transaction hashes, CSV exports and a decrypted backend — with a stated hierarchy of what was solid vs. supporting.
2. Re-derived the money totals from raw exports. We loaded the BSCScan & Tronscan CSVs ourselves and re-summed every flow, de-duplicated by transaction, from and to. Our numbers matched the package to the dollar.
3. Read the contract from the chain, not the write-up. We pulled the verified contract interface live from BSCScan and confirmed there is no user-withdrawal function — the custody claim fails in code.
4. Checked the pool positions live. We inspected each PancakeSwap position’s current state to confirm which branches are drained, dormant, or actively cycling.
5. Traced tonight’s deposit to its exact position. We read the live event log to confirm the money is looping into the same mapped position — no hidden branch — and is running today.
6. Ruled out a false lead. An Arkham graph appeared to show a third chain (Base). We checked the address on BaseScan directly, found nothing genuine, and set the mislabel aside rather than overstate the case.
7. Cross-checked against regulators. We confirmed the picture against independent official warnings from seven jurisdictions.

Every claim, one click away

These links open the exact on-chain records behind this report. No account needed.

What we did — and did not — claim