RIFT Protocol:
the engine that lost money
on the day it paid out

What this is, in four sentences

RIFT tells its members that deposits join a 24-hour earning cycle which “compounds yield from the protocol’s market-making flow”, and shows them a live feed of real trades as proof. The trades are real. On 15–16 August 2026, during the exact cycle in which one investor was credited +$1.67, the trading account those trades belong to closed two positions for a realised loss of $14.26 — while $131,419 of new deposits arrived at the same account.

Across eleven weeks that account never had more than $5,844.88 at risk at any one moment, against a balance of $2.7 million — and its own explorer page shows nothing staked, nothing lent, nothing in any vault. Every user deposit and withdrawal is also subject to an undisclosed 0.5% charge on both legs, paid to four collection addresses that appear in none of the platform’s published fee schedules.

What rests on what

This report separates four kinds of evidence, and says which is which throughout.

• The operator’s own documents. RIFT’s Terms of Service, its presentation slides and its recorded calls. Quoted verbatim. Nothing here depends on trusting us.
• Blockchain records. Transaction exports from Hyperliquid, Arbitrum and Base, reproducible by anyone with the addresses printed in section L.
• Screen captures supplied by the investor. The app-side figures come from screenshots taken by the depositor and passed to an anti-fraud investigator on 19 August 2026. They reconcile to the blockchain to the cent, which is strong corroboration — but they are still his screenshots, not ours.
• Inference. Clearly marked wherever it appears, and kept out of the findings.

The evidence base behind every figure in this report

This audit drew on four separate bodies of material: raw blockchain exports across five networks, the operator’s own published documents, recordings of its community calls, and screen captures supplied by a depositor. The panel below sets out the scale of each.

$200, one earning cycle, reconciled to the cent

A New Zealand investor deposited into RIFT on 15 August 2026 to test the platform. His app recorded five events over the following 30 hours. Every one has a matching blockchain record.

Set the app’s own figures against the chain. New Zealand runs twelve hours ahead of UTC, so every app timestamp is the UTC time plus twelve.

Three independent quantities — timestamp, gross amount and fee — agree to four decimal places. This is the same investor, the same money, seen from both sides.

Now the cycle itself

His money was in Alpha Flow from 10:18 UTC on 15 August to 10:30 UTC on 16 August. We took the full trading record of the account that RIFT’s own app attributes those trades to, and measured what it did in exactly those hours.

Real trades, real hashes, and a scale that cannot work

RIFT shows every member a live feed labelled Engine Activity — on-chain trading activity, each row carrying a transaction hash. Promoters point to it as proof. We tested it.

We read 21 trades off these screens and matched them against the trading account’s own export. All 21 match — price to four decimals, size to the unit, and the full 64-character hash identical in every case.

What the account actually holds

The advertised pool cannot be located

The app shows members a Pool TVL of $8.92 million. The platform’s own explorer page points to exactly four addresses: the trading account and its three labelled subaccounts. We checked all four.

Each subaccount holds one thousand dollars — $1,000.00 exactly, the figure unchanged since the day it was opened — with no transfers, no transactions and no open positions. On the trading account itself, Lending, Vault and Staked all read $0.00.

Two measurements settle the question of scale.

The account, day by day

The panel below is built from the same 1,528 fills. Drag the handles to select any period, or use the presets. Green bars are the value traded each day; the amber strip beneath the axis marks customer deposits arriving; the shaded band is the fifty quiet days.

And it went quiet for fifty days

For fifty days the account traded on 13 days and averaged $18 a day — twenty-five trades and $892 of turnover in total — while members were credited a return every 24 hours throughout. The longest single gap between trades was 8.5 days, and there were five gaps longer than three days.

The engine was reconfigured, not switched off

The execution timestamps carry a signature. Automated systems fire on a schedule, and the minute each trade lands on tells you which schedule was running.

Through the quiet period the system was not offline. Something ran on the hour at :22 and placed a single small trade — 23 of the 25 trades in fifty days landed on that minute. Position size fell from a $124.53 median to $34.27, then recovered.

Eight recorded claims, set against the account’s own trade record

The auto trading engine was sold on recorded community calls from April 2026. The pre-sale opened on 6 April, with access released in cohorts — 100 users, then 2,000, then 2,000 more, then 10,000. By 9 April the founder told the call that fewer than 600 licences remained. Every trading figure below therefore covers a period in which the product was live and taking customer money.

Each claim is quoted from a dated recording. Each is tested against the same 1,528 fills the app displays to members.

These statements also contradict the operator’s own Terms of Service, which state that RIFT “does not guarantee any profits, returns, performance” (§14.3) and that displayed win rates and P&L “may be inaccurate, incomplete, delayed, or manipulated” (§13.8).

Two statements against interest

“This is the master account in which we are deploying everything on the mainnet.” Founder, RIFT Pre-Sale Kickoff, 6 April 2026

The account examined throughout this report is the one the founder identifies as the master account on a recorded call.

“The formula which shows you the profit is not correct, yes. It is incorrect.” Founder, Auto Trading Demonstration, 9 April 2026

Asked on air why a displayed return did not match the deposits, the founder confirmed the profit calculation shown to members was wrong.

Why one member sees the whole trade

Section D noted that the feed shows a single depositor the account’s entire fill rather than a share of it. The founder explained the mechanism on a recorded call, using three named members as his example: their capital, he said, was deployed in one trade, and at distribution they would receive profits equally.

The recruitment script

On the same 9 April call the founder set out, in terms, who to approach and what to say. The target group is people who have already lost money in earlier schemes.

“This is the chance of every single affiliate marketer to recruit … people who lost money because of you … who have blocked you … who kind of feel awkward to speak to you.” Founder, 9 April 2026

“If you don’t want to even lose two, then you can join auto trading engine — that way you can successfully win 100% trades. That would be the pitch.” Founder, 9 April 2026

He also described withholding the product from view:

“We removed the auto trading engine from the UI totally so that they cannot even see it even when they are not whitelisted.” Founder, 9 April 2026

What the marketing says, and what the contract says

Every RIFT presentation makes the same promise. The video narration is verbatim:

“RIFT is a next-generation futures trading platform that combines intelligent routing, automated execution, and a non-custodial infrastructure … while keeping users in full control of their capital.” RIFT Presentation, RIFT OFFICIAL channel, 8 May 2026

The Terms of Service, which every user accepts, describe something else.

Section 3.6 then states the consequence in the operator’s own words:

“Anyone with access to your private key or seed phrase can control your funds. Because the service holds server-side key material capable of decrypting embedded-wallet backups, possession or compromise of that key material and the encrypted backup creates a sensitive-key custody and security risk, including theft and irreversible loss.” RIFT Terms of Service §3.6 — last updated 16 August 2026

What else members agreed to

0.5% in, 0.5% out, four collection addresses

RIFT publishes a fee schedule: a 0.03% builder fee on trade volume, a 10% success fee on auto-trading profit, and — on the compensation slide — a 5% admin fee on withdrawals of its internal unit. None of those is the charge we found.

Every deposit and every withdrawal on the Hyperliquid side is split. The user receives one amount; a second, small transaction moves to a collection address within seconds. Across 1,618 outbound transfers in the 78-hour window, the pattern is exact:

Three addresses split the main flow almost equally — 343, 327 and 321 collections — which is round-robin load balancing, not incidental. A fourth appears on the deposit hop only.

The compensation plan, from the platform’s own slides

“All earnings are calculated based on active subscriptions. … Rank rewards are paid once the criteria are met: a required minimum number of active directs, minimum team size, minimum team business volume in RUSD only, and at least three legs in a 40:30:30 ratio.” RIFT Compensation Plan Terms — presentation slide, 8 May 2026

The upline is paid whether you win or lose

Commission is drawn from the platform fee charged on a member’s trading activity, and that fee is charged whether the position gains or loses. On a recorded call in April 2026 the founder set this out directly: whether the user makes a loss or a profit, the platform fee is paid — and once it is collected, the upline is paid.

Marida Limited, and what RIFT chose not to tell you

The Terms of Service name the operator four times: “Rift Protocol is a user interface … made available by Marida LTD”. They give no company number, no country of incorporation, no registered address, and no contact except an email address.

The same entity operates a second product. LquidPay — a Visa crypto card, formerly branded 9Pay — states it plainly in its own terms:

“The terms ‘Company,’ ‘we,’ ‘us’ and ‘our’ refer to MARIDA LTD incorporated in Hong Kong.” LquidPay Terms of Service · lquidpay.finance

With the jurisdiction known, the company is findable. It is on the Hong Kong register.

Located by Agent Z (001) via the Hong Kong Companies Directory record at ltddir.com/companies/marida-limited. For formal purposes the primary source is the Companies Registry’s ICRIS Cyber Search Centre under BR 76783901; the directory is a finding aid, not the register.

A second company, on the UK register

A separate entity carrying the 3FO branding is registered in England.

Both were appointed on 24 September 2025. The officers page is at find-and-update.company-information.service.gov.uk/company/OC458239/officers. Each name above links to that person’s own appointments page. This is the only UK company appointment either man holds — the register records one appointment each, both to this company. The company name matches the branding on 3FO’s own legal documents, which changed from “3FO DAO LLC” to “Affiliate Marketing 3.0 DAO LLC” six weeks earlier.

The 78-hour window, and what leaves it

Within the three days our export covers, the trading account handled 2,000 transfers.

Outbound payments are 112 times the entire trading turnover of the same window. Whatever pays members, it is not the trading.

The Arbitrum sweep matches a pattern documented a month earlier: on 11 July 2026, $31,782 left the same trading account and arrived at an address tagged as a 3FO CORP deposit. Onward from there, the corporate wallets route to Bridgers (≈$1.84m), RhinoFi, Rango, HOT Protocol, RedotPay and card-collateral contracts — and the original funding of the hub arrived through NEAR Intents.

Two named senior promoters are paid from a single corporate wallet. In the first week of August 2026 it sent $284.21 to one and $38.00 then $48.45 to the other — the platform’s top leader. Its largest payment in three weeks was $284. Nearly every amount is a multiple of $4.75, which is a unit-priced commission schedule, not a share of trading profit.

How 3FO and RIFT share one set of addresses, and where the money leaves

RIFT and 3FO are presented to members as two platforms in one ecosystem. On-chain they share infrastructure: the same treasury addresses receive from both, the same payout wallet pays promoters of both, and value leaves through the same handful of exits. The graphs below are taken from Arkham Intelligence, whose entity labels are applied by the platform rather than by us.

Two separate wallets are shown in this section, and they should not be read as one. The first panel below is the RIFT trading account on Hyperliquid, stepped through June to August 2026. The second, further down, is the 3FO CORP deposit address on Arbitrum, stepped through September 2025 to February 2026 — a different wallet, on a different chain, over an earlier period. Each panel states its own dates and address.

Three addresses carry the volume. All figures are filtered to the authentic USDC contract; unfiltered, these exports overstate flows roughly fivefold.

94% of everything reaching 3FO CORP arrives from the Hyperliquid bridge — $6,766,361 across 292 withdrawals. The distribution hub takes $2.36m in and sends $2.36m out, keeping a thousand dollars. Neither address holds funds; both are conduits.

The payout network, forming

The panel below steps through the 3FO CORP address at four points in time, taken from Arkham’s visualiser. Green lines are inbound, red outbound. Almost every outbound node is an exchange deposit address — Binance, MEXC, Bybit, KuCoin, Kraken, OKX, Gate, Coinbase, Bitkub, Nexo, BingX and others appear by name.

What was being launched at the time

The expansion has a stated cause. In a recorded community session in September 2025 — the same month the outbound fan multiplies — the founder announced a weekly yield paid to every holder of the platform’s internal token:

“Today is a very special day, and every Wednesday for the rest of our lives is going to be very special to us, especially for the BTCC maximalists … every Wednesday you will receive yield that comes against your BTCC.” Founder, 3FO community session, September 2025

A payment made to every holder every week produces exactly the structure the graphs show: one narrow inbound corridor, and an outbound side that grows by hundreds of individual recurring payments rather than by transaction size.

Participation required holders to combine the internal token they already held with $500 of fresh Ethereum. The same design reappears in RIFT’s later compensation terms, where legacy holdings are capped at 20% of any licence purchase and the remaining 80% must be new stablecoin.

Asked during the same period where reward money came from, a promoter answered plainly:

“The direct commissions [are] coming from the pay-in of the people. If you bring in a person you get 10% of the $500. It’s coming from the $500.” Promoter, 3FO community session, September 2025

Where value leaves

Outbound routes are consistent and, with one exception, do not require an account or identity check. Arkham resolves each of the following by entity label:

Where it goes when it leaves for an exchange

Arkham tracks, separately from the raw transfers, how much an address sends to venues it can identify. For the 3FO CORP deposit address over 137 days — 6 April to 21 August 2026 that comes to $362,100:

The same wallet pays both platforms’ promoters

Within 48 hours in August the 3FO CORP payout address paid the two most senior named promoters in the community — $284.21 to one, and $38.00 then $48.45 to the other — alongside exchange deposit addresses at Binance, MEXC and Bybit, and card-collateral contracts. Payment amounts cluster on multiples of a single unit: $9.50, $19.00, $28.50, $47.50, $95.00. That is a commission schedule priced per licence, not a distribution of trading returns.

Four leads that did not survive checking

A report is only as good as the claims it declines to make. These were investigated and excluded.

• “The trade hashes are fake.” Widely repeated, and wrong. All 21 tested hashes are genuine Hyperliquid transactions. Excluded, and corrected in section D.
• A $2 million credit facility on Base. Two contracts in the deposit path were initially read as RIFT’s own lending infrastructure. Reading the verified source showed them to be Credit Cooperative Spigot and SecuredLine contracts — a third-party, venture-backed protocol. Lender, borrower, admin and escrow are all addresses unconnected to this network. Excluded entirely.
• A “$26–28 million subscription aggregator”. Traced to Rain crypto-card collateral settlement — not RIFT deposits. That figure must not be attributed to this platform.
• An exchange deposit address recorded as personal. Entity data identifies it as belonging to a non-KYC swap service, shared among all its customers. It cannot be attributed to any individual.

Every address behind every figure

These open the exact records. No account needed. If you cannot reproduce a number from them, tell us and we will correct it.

Method, in order

• Started with what the investor supplied. Screenshots of his own account and a transaction export. No money was paid to the platform and no account was opened by us.
• Reconciled the app against the chain. Each app event was matched to a blockchain record by timestamp, amount and fee. The twelve-hour New Zealand offset was identified and applied; before that correction, nothing matched.
• Rebuilt the trading record from raw fills. Positions were paired first-in-first-out to produce completed round trips, then filtered to the exact hours of the investor’s cycle.
• Measured peak exposure, not turnover. Turnover invites the answer “we trade fast”. Simultaneous open position value does not.
• Verified the trade hashes. 21 read off screenshots, all matched to the account export over the full 64 characters.
• Filtered every token export by contract address. These datasets are heavily contaminated with counterfeit tokens using look-alike characters — 18% of records in one case. Unfiltered, they overstate flows roughly fivefold.
• Read the contracts rather than the labels. Four addresses previously identified by name turned out to be third-party infrastructure. All four were removed. Section K records them.
• Quoted the operator’s documents verbatim, with dates, so every clause can be checked against the live text.

What we did — and did not — claim

• The deposit and withdrawal picture covers 78 hours. Trading data spans eleven weeks; transfer data spans 14–17 August 2026 only. Every flow figure describes that window.
• We do not state how much customer money is at risk. No total deposits figure is available to us. The $8.92m “Pool TVL” is a number displayed in the app, not a measured balance.
• The app-side figures are the investor’s screenshots. They reconcile to the chain to the cent, which is powerful corroboration, but they were supplied by him.
• The trades are real. We say so plainly. Our case rests on their scale and timing, not on any allegation that they are fabricated.
• We do not allege that any named person committed an offence. This report describes documents, flows and contradictions. Ownership, intent and liability are matters for evidence we do not hold.
• Promoters are not assumed to be knowing participants. Recruiting into something you sincerely believe in looks identical, on-chain, to recruiting into something you know to be false.
• Regulatory characterisations are the shape of an argument, not legal advice. Whether conduct engages any particular provision is for the regulators to determine.
• One entity detail remains at one remove. Marida Limited’s record was read from a Hong Kong companies directory rather than the registry itself. Directors and shareholders sit behind the registry’s own paywall and are not published here.