NexusX & Northcrest Capital: “Not pooled, not shared, yours”

What this is, in three sentences

A platform marketed as NexusX, presented on its own site and in its own video as operating with Northcrest Capital, promises daily returns of 1.2%, tells members their funds sit in a personal account that is not pooled or shared, and pays rewards for recruiting other people. An investor's $500 deposit was swept out of its address in eight hours, merged into a $13,000 batch four minutes later, and passed into a wallet that has moved $1,477,325 in six months while never holding more than about $67,000. Over the same period roughly $151,000 reached 390 members in payments averaging $149, while about $618,000 left through a separate wallet in sixteen transfers.

The promise the blockchain contradicts

Step one of joining NexusX, as described in the platform's own recruitment video, is to deposit funds. The video is explicit about where that money then sits.

“Your money is held securely in your own personal account on the NCC platform. Not pooled, not shared, yours.”

NexusX recruitment video — verbatim

Section C follows a single deposit. It was pooled within eight and a half hours and shared into a batch four minutes after that. Both movements carry a transaction hash that anyone can open.

And a second claim, denied four times over

The same operation states repeatedly that it has nothing to do with cryptocurrency. The phrase “Zero Crypto. Ever.” appears as a banner on the recruitment site. The FAQ answers the question “Do you trade Cryptocurrency?” with “Absolutely not”, adding that the platform has no involvement with crypto wallets or digital currency products, and inviting readers to report anyone who says otherwise. The footer disclaimer repeats it. The video promises a route to income with “no crypto surprises”.

The investor was given four cryptocurrency deposit addresses: one on TRON, one for USDT on Ethereum, one Bitcoin address, one Ethereum address.

The TRON address was different. It had been used exactly twice.

$500, and the eight hours that followed

The deposit address given to this investor has two transactions in its entire existence. One in, one out, then silence. Every timestamp, block height and hash below opens in a block explorer.

Recruited from the wreckage of an earlier scheme

The four deposit addresses in this report were not recovered later from memory. They were set out in an email the depositor sent to an anti-fraud investigator on 4 August 2026, unprompted, before any of this analysis existed. That email also explains how he came to be there.

He had already lost money in BG Wealth Sharing / DSJ Exchange — a scheme documented separately by this alliance, and the subject of an FCA warning in May 2025. Northcrest Capital was presented to him as a partnership with Nexus and, in his words, promoted as a way to recover those previous losses. He put in $500.

What he was told after joining, but not before

The public materials describe referral rewards as an optional extra — a way to earn more alongside your returns. What he describes is different, and considerably worse. He says he was told that to recover 60% of his own investment he would need to recruit at least two people who each deposited a minimum of $500, and that recruiting five people would unlock daily compounding rates of up to 80%.

If that is accurate, recruitment was not a bonus track. It was the condition attached to getting his own capital back — a structure that appears nowhere in the video or on the website.

He declined. He says he was not willing to encourage friends or family into something he had joined recently and did not fully understand, so he recruited nobody and simply used the platform.

Then the account was closed

He reports earning $5.00 in a day on his $500 — close to the 1.2% daily rate the platform advertises — and then, shortly afterwards, having his account closed without warning. The explanation he was given was that he had not communicated with the administrators through a chat application; closing the account, he was told, was for his own protection.

One wallet, a hundred letterboxes, one exit

The wallet that took the sweep does one thing. In the three months to 15 August 2026 it received $850,126 from more than 100 separate addresses — and sent that money onward to exactly one destination.

No single depositor accounts for more than 0.58% of the money coming in. That is not what a business's receipts look like, where a few large clients usually dominate — it is a crowd of small, similar-sized retail deposits. And a wallet that receives from a hundred sources but pays out to precisely one is not trading, banking or settling anything. It is a funnel.

It was running a year before the rest of the network

The distribution wallet made its first transaction on 9 February 2026. The investor deposited in June 2026. This collection wallet was already working in March 2025 — roughly eleven months before the distribution wallet existed, and fifteen months before that deposit.

$1.46 million in, $1.46 million out, nothing kept

The wallet at the centre of this network handled 447 transfers between 9 February and 16 August 2026, every one successful, almost all USDT. It received $1,477,325 and sent $1,458,203. Its closing balance was around $18,000; the highest it ever reached was roughly $67,000.

It received from 23 addresses and paid out to 159. Its largest supplier is the collection wallet, at $1,230,030 across 106 transfers — 83% of everything in. Its second-largest, $119,356 over ten transfers, is a labelled cross-chain bridge, meaning some money entering this network arrives from other blockchains.

The network, month by month

Each frame extends the date window by roughly a month. Volume through the wallet tells the same story: $22,694 in February, $52,317 in March, $132,421 in April, $334,484 in May, $371,436 in June, $408,879 in July — an eighteen-fold increase in five months.

to Feb to Mar to Apr to May to Jun to Jul

Green lines are money in, red lines money out — the visualiser's own convention. Labelled exchange deposit addresses are present in the earliest frame. The route out was in place from the beginning.

What members received, and what left by the other route

Money leaving the distribution wallet goes to two very different kinds of address. We pulled the complete transfer history of the largest example of each.

Over the same period, roughly $151,000 reached 390 people in payments averaging $149, while about $618,000 left through eleven addresses. Four times as much money exited by the second route as reached members by the first.

The payments match the published rewards, to the dollar

Those $50 and $100 payments are not arbitrary. The platform publishes exactly what it pays and when, in the recruitment video and on a slide within it. Two things in that schedule map straight onto the ledger.

First, the ten-day rhythm

The video describes a ten-level rank ladder in which members advance by recruiting. At level one — reached with three direct referrals — a member receives a rank-up reward plus “$50 in stage rewards every 10 days”. Higher levels scale: a team of 300 pays $1,000 every ten days, a team of 5,000 pays $5,000, and the top level, requiring 20,000 team members, pays $15,000.

Measured on-chain, across 621 gaps between repeat payments to the same address, the median interval is 10 days. The most common payment is $50, appearing 573 times. The schedule says every ten days in as many words, and the ledger does it.

Second, the deposit tiers

The slide sets out four entry points and what each pays. Every advertised daily return is exactly 1.2% of the deposit — a flat rate across all four tiers.

Those four amounts account for 912 of the 1,011 payments — 90.2%. The next most common values fit the same rule at tiers the slide doesn't list: $200 appears 46 times, $600 twenty-seven times, $1,000 seventeen times.

The return itself

1.2% a day is 438% a year simple, or roughly seventy-eight times your money compounded. The video makes the compounding explicit, contrasting $1,000 left in a bank for 90 days — about $1,012 — with the same $1,000 on the platform reaching about $2,926. That figure implies 1.2001% a day compounded: the same rate as the tier slide, arrived at independently. The claim is internally consistent. It is the consistency of a model, not of a market.

The claims that can be checked against public registers

The video and the recruitment materials make several specific, checkable assertions. We set out what we found and, just as importantly, what we could not find.

• “An SEC regulated investment platform”, with “SEC and FinCEN regulatory oversight”. We located no SEC registration for Northcrest Capital. Readers can search the SEC's own Investment Adviser Public Disclosure database at adviserinfo.sec.gov and reach their own conclusion. Note that registering a company with a US state — the Colorado entity behind this name was incorporated in 2019 under a different name and renamed in 2025 — is not a licence to offer investment services to the public.
• A founder with a Wall Street CV. The video names a founder and chief strategy officer with fifteen years at four named investment banks and degrees from Wharton and Chicago Booth. We found no independently verifiable record of this person in financial-services registers or credible professional sources. The same name appears on a second company website with a different job title, and in a July 2025 press release distributed through a paid newswire — a service that publishes what it is given and does not verify it. We are not asserting the person does not exist; we are reporting that the biography appears only in the operation's own materials.
• “Over 200 analysts” and, in the press release, “over 200,000 active users”. No independent corroboration located.

Not two groups, but three

It is tempting to divide everyone here into victims and operators. The ledger does not support that. Money leaving this network is distributed very unevenly, and the shape of that distribution is the shape of the scheme itself.

Most people received less than they could have put in

The payments wallet paid 390 addresses a combined $150,762. Of those, 323 — 83% — received under $500 in total, which is less than the minimum advertised entry deposit. Only 64 received more than $500 across the entire period.

Eight addresses took nearly a quarter of everything paid out. The top fifty took 63.7%. The largest single recipient received $8,700 across thirteen payments.

And above them, a layer paid far more

Set aside the three wallets that are plainly infrastructure, and the distribution wallet still paid 156 addresses a combined $943,261 directly. Forty-six of them received $10,000 or more. The largest took $36,000; others took $30,000, $30,000, $25,000, $21,000, $21,000, $20,000.

No published tier explains those sums. The highest advertised entry is $5,000, returning about $60 a day. Amounts of this size are consistent with the upper rungs of the rank ladder described in section G — where income is a function of how many people are beneath you.

The exchange endpoints, in that light

The outbound side of this network reaches deposit addresses at Binance, OKX, Bybit, CoinEx, Bitget and MEXC — the labelled nodes in the graphs above.

Many of these will be ordinary members converting small payments into spendable money — an entirely legitimate act, and not something anyone should read as evidence of wrongdoing. Others sit downstream of the larger recipients described above. And separately from both, the extraction wallet moved $618,277 in sixteen transfers to a handful of addresses: $218,590 to one, $134,223 to another, $133,218 to a third.

Those three we have not traced. Whether they end at an exchange, a bridge, or another layer of wallets is unresolved, and this report does not claim to know.

The wallet that looked important and wasn't

One address appeared prominently in the early graphs, receiving 968 separate transfers from inside the network. On a network diagram that looks like a major destination. It is not.

This is a commercial service. On TRON, sending USDT costs a fee that can be reduced by renting network resources rather than burning them, and this address rents them to more than a hundred unrelated customers. The 968 transfers total around $6,000 across four months — an operating expense, not investor money.

The method, step by step

1. Started with what the investor supplied. Four deposit addresses and an account of how they were recruited. No payment was made to this platform to obtain evidence, and no account was opened.
2. Checked all four addresses on public explorers. Three had no transaction history at all. One had exactly two transactions.
3. Followed the sweep. The outgoing transfer identified the collection wallet by hash; the timestamps established how long the money sat there.
4. Exported the full transfer history of every wallet in the chain and re-summed each flow from the raw records, checking the direction of every transfer against its From and To fields rather than relying on any tool's summary.
5. Tested the alternative explanation. Round-number payments are also what deposits look like. We confirmed direction from the raw rows — the wallet is the sender in 573 of 576 $50 transfers — and checked whether recipients ever sent money back. One of 390 did.
6. Compared the ledger with the published schedule. The rank ladder, the tier table and the advertised daily rate were taken from the operation's own video and slide, then tested against the payment amounts and intervals actually recorded on-chain.
7. Ruled out a false lead. The high-frequency address in section J was profiled, identified as a commercial energy-rental service, and excluded from all figures.
8. Checked the checkable claims against public registers, and recorded where we found nothing as carefully as where we found something.

Every address, one click away

These open the exact records behind this report. No account needed. If you cannot reproduce a figure from these, tell us and we will correct it.

What we did — and did not — claim

• The link to the platform is testimonial, not on-chain. That these addresses were issued by the platform rests on the depositor's account. It is contemporaneous and was given to a third party before any investigation began, which is considerably stronger than a later recollection — but the blockchain cannot show who put an address on a web page. This remains the one link not independently verified.
• What he was told privately is his account alone. The recruitment condition attached to recovering his capital, and the reason given for closing his account, come from his email. We report them as his account, not as established fact.
• We do not say these wallets are owned by any named company or person. We describe a structure and a set of flows. Ownership is a matter for evidence we do not hold.
• We do not assert that any named individual is fictitious. We report that a biography could not be independently verified. Those are different statements and we mean the weaker one.
• $1.46 million is a floor. It is what passed through one wallet, and only from February 2026. The collection wallet was taking deposits in March 2025 — eleven months earlier. A separate supplier of $298,277 into the extraction wallet has not been traced, so at least one other collection line exists.
• “100+ deposit addresses” is a display cap, not a count, over three months rather than the full period. The true figure is higher.
• “March 2025” is read from a chart, not from a transaction. It is the first activity visible on the full-range view.
• The payments are payments. The chain shows direction, amount, timing and recipient, and those match a published schedule. It does not label which reward each payment represents.
• An exchange deposit is not proof of who benefited. It identifies an off-ramp.
• Graphics are illustrative. Every figure comes from explorer records, cross-checked against raw transaction exports. Where the graph and the ledger disagreed — as with the energy-rental address — we went with the ledger.
• We did not fund the scheme. No deposit was made, no account opened. Everything here is public chain data or content served to any visitor of a public website.