“After my loss with BG Wealth Sharing/DSJ  Exchange, I was persuaded to invest in a new investment scheme called Northcrest Capital, which was presented as a partnership with NexusX. The opportunity was promoted as a way to recover my previous losses.”

That was the email that started this investigation. The person who contacted me is a fellow New Zealander who says they had already suffered losses through BG Wealth Sharing/DSJ  Exchange.

They were subsequently introduced to Northcrest Capital, alongside NexusX, and told the opportunity could potentially help them recover what they had previously lost.

They deposited US$500.

According to the investor, what they discovered after joining was very different from the polished investment story presented online. They say recruiting other people affected how much of their investment they could recover or the compounding benefits available to them. They refused to recruit friends or family and continued with their own US$500 instead.

Their account subsequently displayed a US$5 trading profit.

Then their account was closed.

The explanation they say they received was that they had failed to communicate through BonChat. Along with their account of what happened, they supplied me with four cryptocurrency wallet addresses they say were provided for deposits into the operation.

So I started investigating Northcrest Capital.

On the surface, it presents itself as a substantial international financial company. Northcrest talks about artificial intelligence, quantitative strategies and institutional investment expertise, while its website claims more than 500,000 active clients worldwide. Across YouTube, Instagram, TikTok and X, it also presents a sizeable social-media footprint.

But when I started working backwards through the company’s history, the picture became considerably more complicated.

The deeper I looked, the more I found myself asking whether Northcrest Capital’s public image was supported by the corporate history, financial infrastructure and independently verifiable evidence that should exist behind a company operating at that scale.

What Northcrest Capital Says It Is

Northcrest Capital presents itself as a sophisticated investment organisation operating at the intersection of artificial intelligence, quantitative trading and institutional asset management.

Its public material talks about AI-powered analysis, market-neutral strategies, risk management and technology designed to bring institutional-style investing to ordinary investors. Northcrest also promotes a relationship with NexusX, where the proposition appears to involve automated or copy trading connected to stocks listed on major US exchanges including the New York Stock Exchange and Nasdaq.

Taken at face value, this creates the impression of a substantial financial operation backed by sophisticated technology and professional market infrastructure.

Northcrest’s website goes considerably further, claiming more than 500,000 active clients worldwide.

That number matters. An investment organisation genuinely serving half a million active clients should leave behind an equally substantial and independently verifiable footprint: identifiable executives and investment professionals, regulatory history, established financial counterparties, corporate records and evidence showing how the business developed to that scale.

Those are not unreasonable expectations when people are being asked to trust an organisation with their money.

So rather than judging Northcrest Capital by the sophistication of its website or the language used to describe its investment technology, I started working backwards through its history to see what I could independently verify.

NexusX Reveals How The Opportunity Actually Works

Finding nexusxtrading.net changed this investigation considerably.

Until this point, I had been trying to understand exactly where NexusX fitted into the Northcrest Capital operation. The website answers that question very directly.

NexusX describes itself as “Northcrest Capital’s core strategy execution and trading research team” and repeatedly presents the two operations together as “NexusX × Northcrest Capital.” The website claims Northcrest provides the trading infrastructure, compliance systems, risk controls and “bank-level fund custody” behind the platform.

More importantly, the NexusX material explains how ordinary participants are actually encouraged to make money.

And this is where the proposition starts looking very different from the sophisticated institutional investment company presented elsewhere.

Participants are told they can start with US$500, allow an alleged AI-powered system to conduct copy trading for them, receive returns every trading day and then increase their earning potential by recruiting other people into the opportunity.

The presentation I obtained could hardly be clearer.

It tells prospective members:

“Share this presentation with 3 people you know this week and start earning referral rewards immediately.”

Another slide says:

“Your income multiplies as your team grows.”

The compensation structure then progresses through multiple levels based substantially on team size and direct referrals.

At Level 1, participants require three direct referrals. By Level 5, the presentation describes a team of 300. Level 8 requires a total team of 5,000, while Level 10 describes a network containing 20,000 members.

The presentation attaches increasingly large financial rewards to those levels, culminating in a claimed US$10,000 rank-up reward and US$15,000 10-day stage reward at Level 10. Leaders who build teams exceeding 5,000 members are even shown a US$65,000 Mercedes-Benz GLE incentive.

This is not something I have inferred from the compensation model. NexusX itself is presenting recruitment as a significant component of the earning opportunity.

The deposit levels reinforce that structure.

Prospective members are offered starting deposits of US$500, US$1,000, US$3,000 or US$5,000. The presentation says the person referring them can receive US$20, US$70, US$240 or US$450 respectively, while the new member also receives a “deposit reward.”

There are even time-based recruitment incentives. Bring somebody in within ten days and the presentation promises an additional US$20; within 20 days, US$10; and within 30 days, US$5.

That makes the experience described to me by the New Zealand investor considerably more significant.

They told me they deposited US$500, discovered that recruiting other people affected the benefits available to them, refused to involve friends or family, saw only a small trading profit and subsequently lost access to their account.

The NexusX presentation now independently establishes that US$500 is indeed promoted as the minimum entry amount and that recruitment is explicitly built into the opportunity.

The Return Claims Deserve Particular Attention

The investment claims are equally extraordinary.

NexusX presents an example in which US$1,000 supposedly grows to approximately US$2,926 in just 90 days, based on an average return of approximately 1.2% per day compounded.

The presentation does include the disclaimer that the calculation is illustrative, actual returns vary and the result is not guaranteed.

But that disclaimer sits underneath a graphic depicting US$1,000 almost tripling within three months.

Elsewhere, NexusX estimates daily copy-trading returns of approximately US$6 from a US$500 deposit, US$12 from US$1,000, US$36 from US$3,000 and US$60 from US$5,000.

The recorded presentation goes considerably further, describing NexusX as a “structured, predictable wealth-building system” and telling viewers:

“The people who commit to building their team don’t just earn, they build a legacy.”

The transcript also describes NexusX as an “SEC regulated investment platform”, claims “SEC and FinCEN regulatory oversight”, and the presentation itself displays language including “SEC-Regulated Platform” and “SEC + FinCEN.”

Those are not vague marketing statements. They are specific regulatory representations that can be independently checked.

Then There Is BonChat

One of the most striking discoveries was buried in the instructions explaining how members communicate.

The presentation tells participants:

“Join BonChat.”

It describes BonChat as an important bridge for staying connected with the team and says a person identified as Jason Miller, described in the presentation as a co-owner/co-founder, will connect with members and help them understand the copy-trading process.

That immediately caught my attention because the investor who originally contacted me had already told me that BonChat was central to their experience. They say their Northcrest account was ultimately closed because they had failed to communicate through BonChat.

So we now have two separate pieces fitting together: the investor’s account and NexusX’s own presentation instructing members to join BonChat.

For anyone familiar with the earlier BG Wealth Sharing/DSJ  Exchange operation, that combination deserves scrutiny. I am not saying the organisations are operated by the same people merely because they employ similar methods. But the pattern is difficult to ignore: an investment platform, purported trading activity, recruitment incentives, team structures and communications being moved into a separate messaging application.

Who Are Ethan Carter, Jason Miller And Jackie Glover?

The material also gives us three names that require further investigation.

Ethan Carter is presented as NexusX’s founder and Chief Strategy Officer. The presentation claims he has more than 15 years’ experience in global investment strategy and previously held senior roles at Morgan Stanley, Credit Suisse, JPMorgan Chase and Goldman Sachs. It also claims he holds a bachelor’s degree in finance from Wharton and an MBA from the University of Chicago Booth.

The presentation says he founded NexusX in 2024.

Jason Miller is described during the presentation as a co-owner/co-founder who communicates with members through the BonChat ecosystem.

And the website identifies Jackie Glover as the referrer behind invite code 333J7T, telling prospective participants that the code connects them to “Jackie’s NexusX team” and activates their eligibility for the “community growth incentive program.”

Those identities, employment histories and roles now need independent verification.

The Claimed Ten-Year Northcrest Agreement

Perhaps the clearest connection between the two operations appears in another NexusX slide.

It claims that on 10 March 2025, NexusX and Northcrest Capital entered into a ten-year strategic cooperation agreement, supposedly covering technical support, compliance operations and risk management until 2035.

The presentation even displays what appears to be an “Agency Cooperation Agreement” as evidence of that relationship.

That is important because this is no longer simply somebody informally claiming NexusX works with Northcrest.

The NexusX marketing material itself expressly represents Northcrest Capital and NexusX as contractually connected for ten years.

A Very New Website For A Supposedly Global Opportunity

There is another problem.

The NexusX website is nexusxtrading.net, yet when I checked the Internet Archive’s Wayback Machine, I found no archived history for the domain.

A URLScan capture I obtained on 16 August 2026 also showed the domain’s TLS certificate had been issued on 9 July 2026 and was valid for three months. That does not establish when NexusX itself began operating, but it provides another independently observable marker showing how recent this particular web presence appears to be.

That sits awkwardly beside marketing telling visitors that “thousands of people around the world are joining right now” and describing NexusX and Northcrest as a global smart investment ecosystem.

The presentation itself says NexusX was founded only in 2024.

So we now have a much clearer picture of what sits behind the polished Northcrest branding.

This isn’t merely a website talking about artificial intelligence and institutional investment strategies. NexusX’s own material describes a US$500 minimum deposit, estimated daily returns, daily compounding, a multi-level team structure, referral payments, rank rewards, recruitment deadlines, a luxury-car incentive and instructions to move members into BonChat.

And that is remarkably close to the experience described by the investor whose email started this investigation.

The next question is no longer simply what Northcrest Capital claims to be.

It is whether the trading, regulatory, corporate and professional credentials being used to support this entire proposition can actually be independently verified.

The Digital History Raises Questions

The current operation uses northcrest-capital.com, but it is not the first Northcrest domain I encountered.

Following the company’s digital footprint led me to northcrestglobal.com. When I checked that address using the Internet Archive’s Wayback Machine, I found it had been saved only six times between 6 March 2025 and 20 August 2025. Other domains have also appeared around the Northcrest operation, with BehindMLM previously identifying addresses including northcrestcapital-bl.com, northcrestcapital-zm.com and northcrestcapital-ol.com.

Changing websites is not evidence of fraud. Companies migrate domains and rebrand. But when a business presents itself as a major international financial organisation serving more than 500,000 active clients worldwide, its historical footprint becomes relevant.

The social-media accounts gave me another way to test that history.

Northcrest Capital’s YouTube channel displayed approximately 50,300 subscribers, 65 videos and 172,245 total views when I examined it. The channel says it joined YouTube on 25 February 2019, which initially appeared to give Northcrest a much longer online history.

Except the oldest publicly visible Northcrest-branded video I could find was only around eight months old.

That does not prove the channel was purchased, renamed or repurposed. Previous videos could have been deleted or made private, or the account may simply have remained dormant. But the distinction is important: a YouTube account created in 2019 is not evidence that Northcrest Capital itself has been operating since 2019.

I went through the visible videos to see what history they actually documented. Rather than years of company announcements, executive interviews, investment presentations or detailed discussions of trading performance, I found a concentrated series of polished promotional videos, generally around one minute long.

The messaging was remarkably consistent: trust, confidence, security, AI, resilience, structure, foresight and long-term investing. Titles included statements such as “Trust is the foundation of every great financial strategy,” “Confidence isn’t borrowed, it’s built,” and “In finance, trust begins with protection.”

The publicly visible channel therefore looked less like an archive documenting years of Northcrest Capital’s development and more like a recent corporate brand-building campaign.

The audience numbers also caught my attention. Despite more than 50,000 subscribers, the channel showed only around 172,000 total views. Many videos I reviewed had roughly 1,400 to 1,800 views, while a handful jumped into the 14,000 to 18,000 range.

Those numbers do not prove Northcrest purchased subscribers or views, and I am not suggesting they do. But they leave a legitimate question: how did a channel with less than a year of publicly visible Northcrest content accumulate more than 50,000 subscribers?

The same substantial audience appears elsewhere. Northcrest’s Instagram account displayed approximately 40,900 followers and 523 posts while following zero accounts. Its TikTok profile showed around 70,200 followers and 45,900 likes, while its X account, @NorthcrestLTD, had more than 5,500 followers and repeated the same corporate message: “Empowering Investors with AI Precision and Institutional Strategy.”

X provided another useful historical marker: the account joined in September 2024.

Taken together, the independently observable timeline is surprisingly recent: X appearing in 2024, northcrestglobal.com appearing in the Wayback Machine in March 2025, the visible Northcrest YouTube content appearing within roughly the last eight months, and multiple domains appearing around the operation.

None of this proves Northcrest Capital did not exist earlier. But for a company claiming more than half a million active clients worldwide, I expected a much deeper independently verifiable history than the one I was able to find.

The social-media numbers created the appearance of an established financial brand. The history behind that appearance was much harder to establish.

Who Is Behind Northcrest Capital?

With Northcrest presenting itself as a global investment company serving more than 500,000 clients, the next question should have been straightforward: who actually runs it?

One name appearing in Northcrest’s public material is Ethan Carter, described as the company’s “Chief Strategic Innovation Officer.” During my research, however, I was unable to establish enough independent professional history to verify his identity, qualifications or long-term involvement with Northcrest Capital. That does not mean Ethan Carter is fictitious; it means I could not independently authenticate the executive profile being presented.

Then another name appeared somewhere considerably more official.

An entity called NorthcrestCapital LTD filed a Form D with the U.S. Securities and Exchange Commission on 19 May 2025. That filing identifies Mark Omorowa Segun Eddo as an executive officer and director and describes NorthcrestCapital LTD as a Colorado entity formed in 2025.

The filing concerned a proposed US$5.5 million equity offering under Rule 506(c). At the time it was submitted, NorthcrestCapital LTD reported US$0 sold and zero investors.

This is where an important distinction needs to be made. A Form D appearing in the SEC’s EDGAR Database is not SEC approval of Northcrest Capital or its investment platform. It is a notice associated with an offering relying upon an exemption from full securities registration. The existence of that filing does not establish that the SEC has audited Northcrest, approved its trading claims or verified that investor money is being used as represented.

More importantly, the filing describes an equity offering.

That is not what the New Zealand investor described to me. They did not tell me they purchased shares in NorthcrestCapital LTD through a private securities offering. They described depositing US$500 in cryptocurrency, participating in a trading system associated with NexusX, seeing apparent trading profits and encountering recruitment requirements.

Those could be entirely separate arrangements, but if they are, the obvious question is: what relevance does the SEC Form D have to the Northcrest investment opportunity currently being promoted?

The filing nevertheless gives us something useful: a named executive and a legal entity that can be investigated further.

It also creates another question for Northcrest. If Mark Omorowa Segun Eddo is an executive and director of the Northcrest entity making securities filings in the United States, how does he relate to Ethan Carter and the people actually operating the platform, controlling investor deposits and making decisions about customer accounts?

For a business asking people to trust it with their money, the chain of responsibility should not be difficult to establish.

The NexusX Opportunity And The Recruitment Question

The investor who contacted me did not describe Northcrest Capital as operating alone. They said the opportunity was presented alongside NexusX and, importantly, as a possible way of recovering from their previous BG Wealth Sharing/DSJ  Exchange losses.

The proposition appears to revolve around automated or copy trading, with claims connected to stocks traded on major US exchanges. But according to my source, another component became apparent after they deposited their US$500: recruitment.

They say they were told that recruiting at least two people who each deposited US$500 would allow them to recover 60% of their investment through the platform’s compounding system. Recruiting five people was allegedly associated with further benefits described to them as reaching as high as 80%.

I want to be careful with those percentages. At present, they are the investor’s account of what was represented to them, and I want the original BonChat messages, compensation material or presentation showing precisely what “60%” and “80%” meant before treating those figures as established Northcrest policy.

The underlying issue, however, is difficult to ignore.

Why should bringing new investors into a trading platform affect someone’s ability to recover their own money?

The investor refused to recruit. They told me they were not prepared to encourage friends or family to deposit money into something they had only recently joined and did not properly understand themselves.

Instead, they continued using their own account. It subsequently displayed a US$5 profit from what was presented as trading activity.

That small profit does not independently establish that a corresponding stock trade actually occurred. If Northcrest and NexusX are genuinely generating returns through NYSE or Nasdaq-listed securities, there should be an identifiable broker, custodian and transaction trail behind those numbers.

This is the central issue I want Northcrest and NexusX to address: show where the trading revenue comes from and explain separately how the recruitment component is funded.

Because if genuine external trading generates the returns, bringing two or five new depositors into the system should not be necessary to prove it.

Then The Account Was Closed

The investor says their account appeared to be working normally. They had deposited US$500, followed the trading procedures and watched an apparent US$5 profit appear.

Then their account was closed.

When they asked administrators why, they say they were told it was because they had failed to communicate through BonChat and that shutting down the account was necessary for its “protection and security.” The investor says they had not understood that communicating through BonChat was mandatory and had received no warning that failing to do so could result in losing access.

That explanation needs to be tested against Northcrest’s own terms. If BonChat is compulsory, where is that disclosed before somebody deposits money? What warnings are issued before an account is terminated? And, most importantly, what happens to the investor’s money when the account is closed?

This is where the difference between a displayed balance and money under an investor’s control becomes very real.

The platform could show that this investor had US$505. But once access disappeared, the important question was no longer what appeared on the screen.

Could the investor actually get their money back?

Northcrest should be able to answer that question directly and explain what happened to this particular US$500 deposit.

Fortunately, the investor gave me something else to investigate beyond what had appeared on their dashboard.

They gave me the cryptocurrency wallet addresses being used for deposits.

Following The Cryptocurrency

Along with their account of what happened, the investor supplied four cryptocurrency addresses they say were presented for deposits into the Northcrest operation:

USDT TRC-20: TTQLs49PhUF51rTYFGNnxu3FsimCmpmW8M
USDT ERC-20: 0x87f9d70331b1f6a952f9cf1743a2b9f44fbf890a
Bitcoin: 15FrL1CGsq1ofXiUwCF6sqZSTmdPPxCojs
Ethereum: 0xb79b06d4b2eb5ff67e8d38b94638c8a94b2e58d8

These addresses are potentially important because they give me something that exists outside Northcrest’s own website and trading dashboard: a blockchain trail.

I am not yet describing these as wallets owned or controlled by Northcrest Capital. Before making that attribution, I want the investor’s deposit screenshots, transaction hash and any instructions showing exactly how the wallet address was supplied to them.

Once that connection is established, the blockchain may tell us much more. We can examine how much cryptocurrency has moved through the relevant address, where funds were subsequently sent, whether deposits from multiple investors converge on common wallets and whether money eventually reaches identifiable exchanges or other services.

It may also allow these addresses to be compared with wallets connected to other investment operations.

That becomes particularly relevant because the person who contacted me had already lost money through BG Wealth Sharing/DSJ  Exchange before being introduced to Northcrest Capital and NexusX.

If there is any financial connection between those operations, the blockchain may be one of the places where that connection leaves a trace.

The Blockchain Tells A Different Story

The four cryptocurrency addresses supplied by my source gave me something that existed outside the Northcrest and NexusX websites, presentations and trading dashboards: a public blockchain trail that could be independently examined.

Avengers Anti-Fraud Alliance

Avengers Anti-Fraud Alliance

So I asked CrYptO G, an on-chain forensic investigator with the Avengers Anti-Fraud Alliance, to follow the money.

What followed was a detailed 24-page forensic investigation tracing the investor’s US$500 deposit through the TRON blockchain and examining the wider network of wallets surrounding it.

The findings are significant because NexusX’s own presentation makes a very specific representation about what supposedly happens to investor money:

“Your money is held securely in your own personal account on the NCC platform. Not pooled, not shared, yours.”

The blockchain activity documented by CrYptO G raises serious questions about that claim.

One Deposit Led To A Much Bigger Network

The investigation began with the US$500 USDT deposit made by the New Zealand investor whose experience started this investigation.

According to the forensic report, the US$500 arrived at the deposit address on 24 June 2026 at 19:13:51 UTC.

That address had only two transactions in its entire history: US$500 arriving and the entire US$500 leaving.

Approximately eight hours and 24 minutes later, the complete balance was transferred into another address identified in the report as a collection wallet.

Then something particularly important happened.

Just four minutes and nine seconds later, that collection wallet transferred US$13,000 to another wallet.

By that point, the investor’s individual US$500 was no longer sitting separately at the address originally supplied to them. It had entered a larger flow of funds.

That appears difficult to reconcile with the representation:

“Not pooled, not shared, yours.”

The investigation then expanded beyond one investor.

CrYptO GThe collection wallet identified by CrYptO G had received approximately US$850,126 from more than 100 separate addresses during the three-month period examined.

No individual source represented more than approximately 0.58% of the incoming money.

Almost everything leaving that wallet subsequently travelled to one central distribution wallet.

CrYptO G describes the pattern as resembling a collection funnel: numerous smaller addresses feeding money into a centralised financial pathway.

There was another interesting detail.

The collection wallet had been active since approximately March 2025.

NexusX’s own presentation separately claims its ten-year cooperation agreement with Northcrest Capital began in March 2025.

That timing does not establish that Northcrest or NexusX owns the wallet, and CrYptO G is careful not to make that claim.

But the independently observable dates align closely enough to warrant scrutiny.

US$1.46 Million Through The Central Wallet

Following the money further revealed a substantially larger operation.

Between 9 February and 16 August 2026, the central distribution wallet analysed by CrYptO G recorded 447 transfers.

Approximately:

US$1,477,325 came in.

US$1,458,203 went out.

Yet despite almost US$1.5 million moving through the address, its highest balance was only around US$67,000, while its closing balance was approximately US$18,000.

That distinction matters.

If these funds represent money supposedly being professionally managed or deployed into investment strategies, where is the capital actually being held and traded?

CrYptO G characterises the wallet as behaving more like a corridor: money arrives and is subsequently redistributed elsewhere.

The monthly volume also increased dramatically.

The report records approximately US$22,694 in February, US$52,317 in March, US$132,421 in April, US$334,484 in May, US$371,436 in June and US$408,879 in July.

That represents approximately an eighteen-fold increase in five months.

Two Very Different Routes Out

CrYptO G then identified two distinctly different outbound pathways.

One wallet appears to function as a payments wallet. During the period analysed, it distributed approximately US$150,762 through 1,011 transfers to 390 separate addresses.

The median payment was just US$50.

Another route looked very different.

A separate wallet received approximately US$618,277 through only 16 transfers and subsequently sent approximately the same amount onward through 16 transfers to just 11 addresses.

The top four destinations accounted for approximately 87% of those funds.

The contrast is striking.

On one side, approximately US$151,000 was distributed through more than one thousand relatively small payments to hundreds of addresses.

On the other, approximately US$618,000 travelled through a much smaller number of substantially larger transfers.

The blockchain alone does not identify who ultimately controlled those destination addresses, and the report does not claim otherwise.

A wallet address is not automatically a person’s identity.

But the dramatically different patterns of distribution raise an obvious question about what purpose each financial pathway serves.

The Payments Match The Recruitment Programme

This is where the blockchain findings become particularly relevant to the NexusX presentation I had already obtained.

CrYptO G compared payments from the identified payments wallet with the published NexusX compensation structure.

The NexusX material describes recruitment and rank-related rewards, including US$50 payments every ten days at its first recruitment level.

The most common payment appearing on-chain was:

US$50 — recorded 573 times.

CrYptO G also examined the intervals between repeat payments to the same addresses.

Across 621 intervals, the median interval was:

Exactly ten days.

Other frequently observed payments included US$100 and US$300, figures that also appear within the programme material.

Overall, 912 of the 1,011 payments — approximately 90.2% — matched four amounts associated with the advertised programme.

That does not prove the internal purpose assigned to every payment.

The blockchain can show how much money moved, when it moved and where it went. It cannot tell us whether NexusX internally described a particular transaction as a trading return, commission, bonus or rank reward.

But the correlation is difficult to ignore.

The payment amounts and timing observed on-chain closely resemble the compensation programme being presented to members.

Most Recipients Received Less Than The Minimum Deposit

The distribution of those payments also tells an interesting story.

Of the 390 addresses receiving money from the identified payments wallet, 323 — approximately 83% — received less than US$500 in total during the period analysed.

US$500 is the minimum entry deposit advertised by NexusX.

Only 64 addresses received more than US$500.

At the other end of the distribution, just eight addresses received nearly one-quarter of everything paid through the wallet, while the top 50 addresses accounted for approximately 63.7%.

Again, those numbers should not be used to accuse individual recipients of wrongdoing.

Someone promoting an opportunity they genuinely believe is legitimate can receive money on-chain just as someone with greater knowledge of the underlying operation can.

Blockchain analysis establishes financial movements. It does not establish a person’s state of mind.

What the numbers do show is that the money distributed through this wallet was heavily concentrated among a relatively small number of recipients.

“Zero Crypto. Ever.”

Another finding deserves particular attention.

CrYptO G‘s report records NexusX promotional material stating:

“Zero Crypto. Ever.”

The associated material reportedly tells prospective members that the operation does not trade cryptocurrency and has no involvement with crypto wallets or digital currency products.

Yet the investor whose deposit formed the starting point of this forensic investigation says they were supplied with four cryptocurrency deposit addresses:

USDT on TRON.

USDT on Ethereum.

Bitcoin.

Ethereum.

Their US$500 payment was made using USDT over the TRON blockchain, and the subsequent movement of that money is precisely what allowed CrYptO G to conduct this investigation.

There may be a distinction NexusX wishes to make between trading cryptocurrency and accepting investor deposits through cryptocurrency infrastructure.

If so, it should explain that distinction clearly.

Because an investor reading “Zero Crypto. Ever.” could reasonably form a very different impression from somebody being instructed to transfer USDT to a blockchain address.

What This Report Does — And Does Not — Prove

One of the reasons I consider CrYptO G‘s report useful is that it clearly identifies the limitations of blockchain analysis rather than pretending the blockchain can answer questions it cannot.

The connection between the original deposit address and NexusX/Northcrest relies upon the investor’s contemporaneous account and the deposit information supplied to the investigation. The blockchain itself cannot display the name “Northcrest Capital” above an address and establish ownership.

The report therefore does not claim that every wallet identified is owned by Northcrest Capital, NexusX or any particular individual.

It does not claim that everyone receiving money knew anything was wrong.

It does not claim that sending funds to an exchange identifies the ultimate beneficiary.

And importantly, the approximately US$1.46 million traced through the central distribution wallet should not be interpreted as the total size of the operation.

The collection infrastructure appears to pre-date the central distribution wallet, and the report identifies additional financial pathways that remain unresolved.

What the blockchain can establish is considerably simpler:

money moved.

It moved at specific times, through specific addresses, in specific amounts.

Those transactions exist independently of the marketing presentation, the trading dashboard and anything a promoter tells a prospective investor.

And that is precisely why this evidence matters.

PDFDownload The Full On-Chain Forensic Report

I have only highlighted the findings I consider most relevant to this investigation.

CrYptO G‘s complete 24-page NexusX & Northcrest Capital On-chain Forensic Report, published 16 August 2026, contains the wallet addresses, transaction hashes, methodology, network analysis, payment patterns and limitations behind these findings.

I am making the complete report available so investors, researchers, journalists, regulators and anyone being approached about NexusX or Northcrest Capital can examine the evidence themselves.

If somebody has sent you this investigation because you are considering depositing money into NexusX or Northcrest Capital, I strongly recommend reading the forensic report before making that decision.

And if somebody you know believes this opportunity is legitimate, send them the report.

Don’t ask them to take my word for it.

Give them the wallet addresses. Give them the transaction hashes. Give them the methodology.

Let them look at the blockchain themselves.

The question I now want Northcrest Capital and NexusX to answer is straightforward:

If investor funds are genuinely held in personal accounts — “not pooled, not shared” — and professionally managed to generate trading returns, how do they explain the on-chain movement of the US$500 deposit and the wider financial network documented in this report?

What Northcrest Still Needs To Explain

At this stage, the evidence does not allow me to say who ultimately controls the cryptocurrency addresses, whether genuine securities trades are occurring behind the Northcrest and NexusX dashboards, or whether the recruitment terms described by my source apply to every participant.

What I can document is the gap between Northcrest Capital’s public image and the experience described to me by an investor.

Northcrest presents itself as a sophisticated international financial organisation using AI, quantitative strategies and institutional investment systems, while claiming more than 500,000 active clients worldwide. Yet its publicly visible digital history appears surprisingly recent, its corporate leadership is difficult to independently establish, and the SEC Form D I located concerns a proposed equity offering that does not obviously match the cryptocurrency-funded trading opportunity described by my source.

Then there are the questions raised by the investor’s experience: the alleged recruitment requirements, the connection with NexusX, the apparent US$5 trading profit, the BonChat requirement, the sudden account closure and the four cryptocurrency addresses supplied for deposits.

None of those questions requires speculation. Northcrest Capital should be able to answer them with evidence.

I want Northcrest and NexusX to identify the legal entity operating the investment platform, the people controlling it, the regulated broker executing the claimed securities trades and the custodian holding client assets. I want to know how cryptocurrency deposits reach the markets supposedly generating the returns, and whether those transactions can be independently reconciled against brokerage records.

I also want an explanation of the recruitment structure described by my source and why Northcrest was allegedly presented to someone who had already lost money through BG Wealth Sharing/DSJ  Exchange as a way of recovering those losses.

Finally, Northcrest needs to explain its history. How does a company claiming more than half a million active clients reconcile that scale with the relatively recent digital footprint I found? Why does its YouTube channel date to 2019 when the oldest publicly visible Northcrest content I could locate was only around eight months old? And what is the relationship between the different domains that have appeared around the operation?

There may be legitimate answers.

I intend to give Northcrest Capital and NexusX the opportunity to provide them.

Right Of Reply

Before publication, I contacted Northcrest Capital at contact@northcrestglobal.com and provided the company with a detailed right of reply covering the findings raised throughout this investigation.

I asked Northcrest to address its ownership and management, regulatory position, SEC Form D, relationship with NexusX, claimed trading activity, cryptocurrency deposits, recruitment structure, use of BonChat, account closures, claimed 500,000+ active clients, online history and any relationship with former BG Wealth Sharing/DSJ  Exchange participants.

I also supplied the four cryptocurrency addresses provided to me by my source and asked Northcrest to confirm whether any are currently or were previously controlled by Northcrest Capital, NexusX, their payment processors, agents or associated entities.

At the time of publication, I have not received a response.

Northcrest Capital, NexusX or any named representative remains welcome to provide documentary evidence, correct any factual inaccuracies or answer the questions raised in this investigation. Any substantive response will be reviewed objectively and, where appropriate, this article will be updated.

The right of reply remains open.

Disclaimer: How This Investigation Was Conducted

This investigation relies entirely on OSINT — Open Source Intelligence — meaning every claim made here is based on publicly available records, archived web pages, corporate filings, domain data, social media activity, and open blockchain transactions. No private data, hacking, or unlawful access methods were used. OSINT is a powerful and ethical tool for exposing scams without violating privacy laws or overstepping legal boundaries.

About the Author

I’m DANNY DE HEK, a New Zealand–based YouTuber, investigative journalist, and OSINT researcher. I name and shame individuals promoting or marketing fraudulent schemes through my YOUTUBE CHANNEL. Every video I produce exposes the people behind scams, Ponzi schemes, and MLM frauds — holding them accountable in public.

My PODCAST is an extension of that work. It’s distributed across 18 major platforms — including Apple Podcasts, Spotify, Amazon Music, YouTube, and iHeartRadio — so when scammers try to hide, my content follows them everywhere. If you prefer listening to my investigations instead of watching, you’ll find them on every major podcast service.

You can WORK WITH ME for dedicated access to my time and investigative services — including private consultations, scam-risk reviews, sponsored investigations, support sessions, livestream scam breakdowns, and interviews. I’m also available for SPEAKING ENGAGEMENTS, where I share first-hand experience from years of exposing large-scale fraud, investigating scams, and supporting victims.

“Stop losing your future to financial parasites. Subscribe. Expose. Protect.”

My work exposing crypto fraud has been featured in: