“They show us the terms of service every single presentation, and I’ve never read the whole thing.”

That admission came during one of seven recorded telephone conversations conducted by our investigator Bobby Lane, operating under the cover name Mike Segers.

The person speaking was Linda Paxton, who told our investigator she had followed the projects leading up to RIFT Protocol for approximately three and a half years. Yet when questioned about MARIDA LTD, the company identified in RIFT’s own legal documents as its owner and operator, she admitted she had never looked into it.

For anyone considering putting money into a cryptocurrency trading opportunity, that should be a serious warning. If people who have spent years following and recommending these projects cannot explain the company behind them, what chance does an ordinary newcomer have of understanding the risks?

Over the past five years, I have investigated cryptocurrency investment schemes, interviewed victims, confronted promoters and watched familiar networks reappear under different names. RIFT Protocol caught my attention because of its publicly identified founder and CEO, Shavez Ahmed Siddiqui, whose involvement with earlier cryptocurrency ventures has already attracted international media attention and regulatory scrutiny.

Danny de Hek Featured in Bloomberg’s Exposé on Dubai’s Billion-Dollar Crypto Underworld

Danny de Hek Featured in Bloomberg’s Exposé on Dubai’s Billion-Dollar Crypto Underworld

This is not a connection we have invented. In Bloomberg’s documentary Dubai’s Billion Dollar Crypto Underworld, journalist Alice Kantor identified Siddiqui as having taken over We Are All Satoshi (WAAS), a venture previously associated with Sam Lee. The California Department of Financial Protection and Innovation subsequently issued a desist and refrain order describing WAAS as a fraudulent pyramid and Ponzi scheme. Those findings concern WAAS, not RIFT, but they make the history of the people involved particularly relevant.

Our investigation also uncovered a recurring problem with the explanations being given about MARIDA LTD. RIFT’s own Privacy Policy and Terms of Service identify the company as incorporated in Hong Kong, yet some people discussing the opportunity described it as being based or registered elsewhere. Others appeared unfamiliar with the company altogether, despite its name appearing throughout the documents customers are expected to accept.

Rather than relying on another polished presentation or carefully rehearsed promotional webinar, we decided to approach individuals associated with RIFT directly. Bobby Lane made the calls, asked questions about the company’s ownership, its trading activities, regulatory history and withdrawal arrangements, and allowed people to explain the opportunity in their own words.

The resulting recordings offer an unusually revealing insight into how RIFT is being presented to prospective participants. Some interviewees were confident about the opportunity but uncertain about its corporate structure. Others described earnings and withdrawals without establishing whether their original capital had been recovered. Several referred our investigator to somebody else when the questions became more technical.

Avengers Anti-Fraud Alliance

Avengers Anti-Fraud Alliance

Alongside those conversations, our Avengers Anti-Fraud Alliance has been examining RIFT’s published documents, historical regulatory warnings and the independent blockchain research produced by CryptoG, including his investigation into RIFT’s trading activity and his separate analysis of the HyperFund and HyperVerse network.

This investigation is not about assuming that every person involved in RIFT knows something is wrong. It is about examining what people are telling others, what they have actually verified, and whether their confidence is supported by evidence.

Because there is an important difference between believing an investment opportunity works and understanding the company responsible for it.

After listening to these conversations, I believe that distinction deserves much closer public scrutiny.

The Investigator Who Started Making Calls

The investigation took a different direction when Bobby Lane, one of the investigators working alongside our Avengers Anti-Fraud Alliance, began contacting people associated with RIFT Protocol. Rather than confronting them as an anti-fraud investigator, Bobby introduced himself as Mike Segers, someone seeking information about the trading opportunity. The objective was straightforward: find out what these individuals actually understood about the company they were discussing, without giving them an opportunity to prepare answers specifically for an investigative journalist.

We had already examined RIFT’s promotional material, its published Terms of Service and the history of Shavez Ahmed Siddiqui. We knew that the platform identified MARIDA LTD as its owner and operator, that its legal documents placed the company in Hong Kong, and that its marketing described a non-custodial trading system connected to Hyperliquid. These were not obscure details buried in corporate filings. They were fundamental facts appearing in the company’s own documentation, which anyone recommending the opportunity should reasonably be expected to understand.

Bobby’s approach was to ask the sort of questions a cautious prospective participant might ask before committing money. Who is behind the company? Where is it registered? What does MARIDA LTD actually do? How does the trading generate returns? What happens when somebody wants to withdraw their original investment? And what connection, if any, does the current operation have with earlier projects involving the same individuals and promotional networks?

The purpose was not to catch somebody making a minor mistake. It was to establish whether the confidence being expressed about RIFT was supported by genuine knowledge.

Across seven recorded conversations, Bobby encountered people with different levels of involvement. Some described themselves as ordinary participants, while others acknowledged presenting the opportunity or occupying leadership positions within the community. That distinction matters. Someone who has invested their own money is not necessarily responsible for the claims made by a company’s promoters. But when an individual actively encourages others to participate, questions about their understanding of the business become considerably more important.

One recurring feature of the conversations was the tendency for difficult questions to be referred elsewhere. When Bobby asked about MARIDA LTD, company registration, legal responsibility or the technical operation of the trading system, some interviewees suggested speaking with another person who supposedly knew more. Others offered explanations that did not match the company’s published documents. In several cases, the conversation moved more easily when discussing potential earnings than when examining the business responsible for generating them.

That contrast became increasingly significant as we reviewed the recordings. A person may be able to demonstrate that money has appeared in their account or that they have received a withdrawal without establishing that the underlying trading operation is profitable, independently audited or capable of returning everyone’s original capital. Those are separate questions, and the distinction is particularly important when financial opportunities rely on personal testimonials to attract new participants.

I have seen this pattern repeatedly during previous investigations. People become convinced by what appears on a dashboard, by payments received into their wallets, or by the enthusiasm of somebody they trust. Over time, those experiences can become more persuasive than the underlying financial evidence. But a successful withdrawal does not, by itself, establish where the money originated or whether the operation is financially sustainable.

As the recordings accumulated, we began comparing the answers against RIFT’s own disclosures, regulatory records and the independent research conducted by CryptoG. We also examined the historical connections that some interviewees appeared unwilling or unable to acknowledge, particularly those involving We Are All Satoshi and Shavez Ahmed Siddiqui.

What emerged was not a collection of identical conversations. Some people were more forthcoming than others, and not every interview provided enough evidence to draw meaningful conclusions about the person involved. Nevertheless, the recordings exposed a recurring gap between the certainty with which RIFT was being discussed and the limited understanding demonstrated when basic questions were asked.

The first particularly revealing example came from Linda Paxton, who acknowledged years of involvement with the surrounding projects but admitted she had never read the complete Terms of Service.

Linda Paxton: Three and a Half Years Following the Projects, but Never Read the Terms

“They show us the terms of service every single presentation, and I’ve never read the whole thing.”

Linda Paxton

Linda Paxton

That statement from Linda Paxton became one of the most revealing admissions in our investigation into RIFT Protocol. During her recorded conversation with Bobby Lane, operating under the name Mike Segers, Linda explained that she had been following the projects associated with this opportunity for approximately three and a half years. Yet when Bobby raised the name MARIDA LTD, the company identified in RIFT’s own legal documents as its owner and operator, her response was remarkably straightforward: “I wouldn’t know. I haven’t looked that up.”

This was not a complicated question about blockchain programming, trading algorithms or the finer details of decentralised finance. It concerned the legal entity responsible for the platform. RIFT’s Privacy Policy expressly identifies MARIDA LTD as a Hong Kong company, while its Terms of Service describe the same entity as the provider of the trading interface. Its legal disclaimer goes further, claiming that MARIDA owns and operates the RIFT ecosystem. These are fundamental details for anyone attempting to assess who stands behind a financial opportunity, particularly one involving cryptocurrency trading and the possibility of losing substantial amounts of money.

What makes Linda’s conversation interesting is the contrast between familiarity and verification. Following a succession of projects for several years may give somebody confidence in the people involved, especially if they have attended presentations, joined community discussions and watched the technology evolve. But familiarity is not the same as independently checking a company’s registration, its legal responsibilities or the accuracy of its promotional claims. Linda’s admission illustrates that distinction. She knew the presentations existed and acknowledged that the Terms were being shown, but she had not read the complete document herself.

The issue is not that Linda failed to memorise a legal agreement. It is that years of exposure to a financial opportunity had apparently not prompted her to establish who legally operated it.

That matters because RIFT’s Terms contain disclosures that are considerably less reassuring than the confidence often expressed in promotional discussions. The company states that it is not a broker, exchange or investment adviser, disclaims guarantees of profitability, warns that users may lose all their funds and seeks to limit its own liability. The same documents place responsibility for trading decisions, wallet security and risk management on the customer. These provisions do not prove the platform is fraudulent, but they are precisely the sort of information prospective participants should understand before relying on recommendations from people within the community.

Linda’s comments also raise a broader question about how these opportunities are promoted. When presentations repeatedly introduce new features, trading strategies and potential earnings, participants may become accustomed to hearing reassuring explanations without examining the contractual details themselves. The existence of a Terms of Service document can create an impression of legitimacy, but its value depends on what it actually says and whether those recommending the opportunity have taken the time to understand it.

I am not suggesting that Linda’s statements establish she knowingly misled anybody, nor does this recording alone establish the extent of her recruitment activity. What it does establish is that someone who described years of familiarity with the surrounding projects could not answer a basic question about MARIDA LTD and admitted she had not read the full agreement.

For me, that is the significance of this conversation. It shows how confidence in a project can develop through repeated exposure and personal relationships, even when important corporate and contractual questions remain unanswered. And as Bobby continued speaking with other people associated with RIFT, we encountered an even more consequential issue: individuals who were not merely following the opportunity, but acknowledging leadership and presentation roles while defending its history.

Chantal Sturkenboom: A Community Leader Defends RIFT

Chantal Sturkenboom

Of all the conversations recorded by Bobby Lane, the approximately 27-minute exchange with Chantal Sturkenboom was particularly revealing. Unlike some participants who described themselves primarily as investors, Chantal openly acknowledged having a position within the RIFT community. She told Bobby, operating under the name Mike Segers, “I am a trainer in Rift,” and said she was committed to both RIFT and Shavez Ahmed Siddiqui. She was initially suspicious of the caller, requesting verification of his account and referral details before discussing the opportunity. That caution was understandable, but the conversation eventually moved into questions about her previous involvement with related projects, the company behind RIFT and the explanations being offered about its history.

The first significant disagreement concerned We Are All Satoshi (WAAS). When Bobby suggested that WAAS, 3FO and RIFT were connected through the same promotional history, Chantal rejected the suggestion that they were the same entity. She described them as having different infrastructure and insisted that Shavez had not been the owner or CEO of WAAS. According to her explanation, he had operated a development company providing technical support and training, while another party controlled the earlier operation. However, she also acknowledged that she had worked as a trainer during the previous period and described a subsequent restructuring involving Shavez.

This distinction deserves careful examination. Separate companies and different technology can exist within an overlapping promotional network, and involvement as a developer does not automatically establish ownership. Nevertheless, Bloomberg’s documentary Dubai’s Billion Dollar Crypto Underworld provides important historical context that Chantal’s explanation did not address. Journalist Alice Kantor identified Shavez as having taken over We Are All Satoshi following Sam Lee’s involvement. The documentary also featured Shavez responding to questions about the California regulatory allegations concerning WAAS. Those documented appearances make a blanket denial of any association difficult to reconcile with the public record, even though the precise legal and operational responsibilities of each individual require separate evidence.

Bobby also questioned Chantal about MARIDA LTD, the company RIFT identifies in its own Terms of Service as its Hong Kong operator. Chantal correctly directed him towards the platform’s registration information and said she had access to corporate details, including a registration number. However, when he challenged her about contractual dispute arrangements and the practical implications for customers, she acknowledged that she did not know the details. Some of Bobby’s assertions about minimum dispute values and legal jurisdictions were themselves unverified during the call, so they should not be mistaken for findings. What matters is that the conversation exposed a gap between Chantal’s confidence in the company and her ability to explain the contractual protections available to participants.

The exchange became more revealing when Bobby challenged her description of herself as merely a trainer rather than a promoter. Chantal resisted that characterisation, but eventually stated: “I am presenting, and I am a leader in the community.” She also described herself as the person driving the Financial Freedom team within RIFT. Those admissions establish an active leadership and presentation role, although the recording does not independently establish how many people she personally recruited or what commissions she received.

Another important part of the conversation concerned earlier node purchases and outstanding payments. Bobby raised a claim about having paid $20,000 for nodes and not receiving expected earnings. Chantal responded that the nodes were undergoing maintenance during an organisational restructuring and that announcements would follow. She also claimed that previous node payments had been made retrospectively and expressed confidence that outstanding amounts would be addressed. Bobby’s claimed purchase and payment history were part of his undercover questioning, not verified personal losses, while Chantal’s assurances were not supported during the conversation by transaction records or independent financial statements.

This is precisely where promotional confidence becomes an issue of accountability. A community leader may sincerely believe that a restructuring will succeed or that payments will eventually resume. But assurances about future payments are not evidence that sufficient funds exist to honour them. The distinction is especially important when participants are being encouraged to remain involved with successive products or platforms while unresolved obligations from earlier arrangements continue to be discussed.

As the conversation progressed, Chantal repeatedly emphasised that she was responsible for her current RIFT community rather than everything that had happened before it. That is a position she is entitled to explain. However, her acknowledged training and leadership roles make it reasonable to examine what she knew about the earlier projects, which representations she personally made and whether she corrected information that later proved inaccurate.

The recording does not establish that Chantal knowingly participated in fraud. It does establish that a person presenting RIFT and identifying herself as a community leader defended the separation between RIFT and earlier ventures, acknowledged limited knowledge of certain legal details, and offered reassurances about outstanding node payments without producing independent verification during the call.

For prospective participants, those distinctions matter far more than the confidence with which an opportunity is presented.

The Other RIFT Participants: Conflicting Stories and Missing Answers

As Bobby Lane continued his undercover calls under the name Mike Segers, a broader pattern began to emerge. Not everybody he contacted occupied the same position within RIFT Protocol. Some appeared to be ordinary participants, others were familiar with the promotional network, and several directed him towards people they believed could answer more difficult questions. What interested me was not simply whether someone could explain the technology, but whether they understood the company, the people behind it and the financial risks associated with the opportunity they were discussing.

Rajiv Saraf provided one of the more significant accounts of RIFT’s history. During his conversation with Bobby, Rajiv described We Are All Satoshi as an earlier operation that had closed following Sam Lee’s involvement, with a new company emerging when Shavez Ahmed Siddiqui took over. This was particularly interesting because it differed from the more emphatic separation between the projects presented by Chantal Sturkenboom. Rajiv also described MARIDA LTD as registered in Singapore, whereas RIFT’s published Privacy Policy and Terms of Service explicitly identify MARIDA LTD as a Hong Kong company.

That distinction is not a minor geographical error. The jurisdiction in which a company is incorporated matters when customers need to establish who is legally responsible, what regulatory obligations may apply and where disputes might be pursued. A Hong Kong company could conduct business in Singapore, but that would not make its place of incorporation Singapore. Rajiv’s explanation therefore required clarification, particularly because the company responsible for RIFT is identified in documents available to users before they trade.

Thomas Grant

Thomas Grant

The conversations with Thomas Grant revealed a different problem. When Bobby raised questions about MARIDA LTD and the corporate structure, Thomas could not provide a clear explanation and referred him to others for answers. There is nothing inherently suspicious about admitting that a technical or legal question falls outside someone’s knowledge. In fact, acknowledging uncertainty is preferable to inventing an explanation. However, the exchange demonstrated how easily a prospective participant could be passed between community contacts without receiving an authoritative answer about the company operating the platform.

Angel Rathorb‘s conversation provided an important reminder that investors and promoters should not automatically be treated as interchangeable. Angel described herself as a participant with approximately $1,000 invested, rather than someone administering the operation. She claimed that her money had doubled, but also acknowledged that she had not withdrawn her original investment. That distinction matters. An account displaying twice the initial balance is not equivalent to recovering the original capital and realising a profit. Until funds are withdrawn and the transactions independently verified, the reported increase remains a claim about account performance rather than proof of a completed financial return.

The shorter calls with Clare G Harvey and Carl Miller were less conclusive. Clare’s conversation largely involved directing Bobby towards another community contact, while Carl’s brief exchange did not provide enough substantive information to assess his understanding of RIFT or establish a meaningful promotional role. These recordings remain part of our investigation, but I do not believe it would be fair to turn a short or inconclusive conversation into an accusation of misconduct.

Taken together, the interviews exposed something more revealing than a collection of people getting questions wrong. Different participants were offering different explanations of the same operation, while some relied on personal experience, others deferred to community leaders, and others expressed confidence in returns that had not necessarily been converted into recovered capital.

The important question was becoming increasingly clear: if people involved in discussing or presenting RIFT could not consistently identify its operator, explain its corporate history or distinguish claimed earnings from realised withdrawals, what information were prospective participants relying on when deciding whether to put their money at risk?

Marida LTD: What RIFT’s Own Documents Reveal

After listening to the conflicting explanations given during Bobby Lane’s calls, I returned to the one source that should have settled the question of who operates RIFT Protocol: the company’s own legal documents. The Terms of Service and Privacy Policy, both dated 17 March 2026, identify MARIDA LTD, incorporated in Hong Kong, as the entity behind RIFT. That is a significant detail when people discussing the opportunity cannot consistently identify the company responsible for it.

RIFT describes a platform involving non-custodial wallets and automated trading through Hyperliquid, with trading activity governed by user-defined parameters and authorisation. Its Terms also acknowledge the possibility of financial losses, impose restrictions on liability and provide for arbitration in Hong Kong. The limitation of liability is particularly noteworthy: the agreement seeks to cap liability at the fees paid by the user or US$100, depending on the circumstances. These are contractual provisions that prospective participants should understand before committing money, not details to discover after something goes wrong.

PDFThe regulatory history raises further questions. On 27 September 2023, the California Department of Financial Protection and Innovation (DFPI) issued a Desist and Refrain Order against We Are All Satoshi (WAAS) and Sam Lee, identifying violations of California securities laws. This action concerned WAAS, not RIFT Protocol, but it is relevant because of the documented association between Shavez Ahmed Siddiqui and WAAS and the earlier ventures discussed during Bobby’s interviews.

The New Zealand Financial Markets Authority (FMA) also published warnings concerning We Are All Satoshi and Boomerang Trade on 7 August 2024, advising the public to exercise caution and stating that neither was registered or authorised to provide financial services in New Zealand. These official warnings provide important historical context when examining the people and projects that participants say they have followed.

More directly relevant to the corporate questions surrounding RIFT is an FMA warning first published on 2 May 2025 and updated on 29 January 2026, concerning Lquid Finance, trading as Lquid Pay. The regulator identified misleading representations about regulatory compliance and discussed a related project, Protocol Yield, which had incorrectly claimed that its parent company, Marida Limited, was licensed in Hong Kong. This caught my attention because RIFT’s own legal documents identify MARIDA LTD as its Hong Kong operator. The matching name warrants investigation, although it does not, by itself, establish that both references identify the same registered legal entity.

There are also important questions about what RIFT’s contractual disclosures actually establish. Describing a system as automated, referring to Hyperliquid or stating that wallets are non-custodial does not independently demonstrate that advertised trading results have been achieved. Nor does publishing legal documents establish that the company has the regulatory permissions, financial resources or operational safeguards that prospective participants might assume it possesses. The distinction between what a platform claims, what its contracts disclose and what can independently be verified is central to this investigation.

For me, the most revealing aspect is how much of this information was already available in writing while people discussing RIFT struggled to explain it. MARIDA LTD is not a minor detail buried in an unrelated document. It is the company RIFT identifies as its operator. Anyone presenting the opportunity to others should know that, understand the contractual risks and be prepared to explain the relevant regulatory history rather than relying on confidence in the people promoting the project.

Marida LTD: What RIFT’s Own Documents Reveal

After listening to the conflicting explanations given during Bobby Lane’s calls, I returned to the one source that should have settled the question of who operates RIFT Protocol: the company’s own legal documents. The Privacy Policy, Terms of Service and Legal Disclaimer all identify MARIDA LTD as a company incorporated in Hong Kong. The Legal Disclaimer describes MARIDA as the owner, developer, operator and rights holder of the entire RIFT ecosystem. Yet our investigator encountered people who believed the company was registered in Singapore, others who could not explain what MARIDA actually did, and participants who appeared more familiar with the trading presentations than the legal entity behind them.

This becomes particularly significant when we examine the history of the name Marida Limited. On 2 May 2025, the New Zealand Financial Markets Authority (FMA) published a warning concerning Lquid Finance, trading as Lquid Pay. The regulator subsequently updated that warning on 29 January 2026. The FMA identified problems involving representations about regulatory compliance and also discussed Protocol Yield, another project associated with Marida Limited. According to the regulator, Protocol Yield had incorrectly claimed that Marida was licensed in Hong Kong. The FMA warned that misrepresentations of regulatory status are commonly associated with scam operations.

That is an important piece of regulatory history. It does not mean the FMA has issued the same finding against RIFT Protocol, and it does not establish that every venture associated with Marida is fraudulent. However, it means the corporate name appearing throughout RIFT’s legal documents already has a documented history of regulatory concern. This is information that anyone presenting the opportunity as trustworthy should be prepared to address, rather than simply relying on the latest promotional material.

The documents also reveal how RIFT describes its relationship with customers. MARIDA states that RIFT is not a broker, exchange, custodian or investment adviser. It presents the platform as a non-custodial interface facilitating transactions through third-party infrastructure, including Hyperliquid. Customers are told that they retain control of their wallets and private keys, while accepting responsibility for trading decisions, position sizing and risk management. The Terms expressly warn that automated systems may behave unexpectedly, leveraged positions can be liquidated and users may lose all their funds.

What interested me was the contrast between the sophistication of the product being advertised and the limitations MARIDA places on its own responsibilities. RIFT promotes automated trading infrastructure and execution technology, yet its Terms state that all execution requires explicit user action. Its definition of the Automated Trading Engine refers to system-driven execution based on user-approved parameters. Those descriptions may be technically compatible, but they leave an important question: what trading authority does the customer grant, and how much control does the automated system exercise after that authorisation? That cannot be answered simply by repeating that the platform is non-custodial.

There are also contractual provisions that prospective customers should understand. The version supplied to our investigation states that disputes are governed by Hong Kong law and resolved through arbitration in Hong Kong. It also attempts to limit MARIDA’s total liability to fees paid or the equivalent of US$100, subject to applicable law. Whether those limitations would be enforceable in a particular dispute is a separate legal question, but their inclusion demonstrates why reading the Terms matters. A customer who believes they are dealing with a Singapore company, or who assumes that RIFT guarantees the safety of their investment, may have misunderstood fundamental aspects of the arrangement.

Another unusual feature of the documents is the extensive attention given to intellectual property enforcement. RIFT’s Legal Disclaimer and DMCA Copyright Policy repeatedly assert restrictions on reproducing its website, screenshots, logos, presentations and promotional materials. They expressly address media outlets, publishers and social media users, while warning of copyright complaints, search-engine removals and legal proceedings. These declarations do not override statutory protections for legitimate reporting, criticism or other lawful uses. Nevertheless, their prominence is notable in the legal documentation of a platform seeking public participation in financial trading.

For our investigation, the significance of MARIDA LTD goes beyond whether a promoter remembers the correct country of incorporation. MARIDA is the entity RIFT itself identifies as legally responsible for operating the platform, and its name connects the current opportunity to earlier regulatory concerns that deserve examination. Its documents explain what the company claims to provide, the risks customers accept and the protections MARIDA seeks for itself.

The promoters’ explanations should be measured against those documents, not the other way around. And once we established what MARIDA was claiming on paper, the next question was whether RIFT’s advertised trading activity and reported earnings could withstand independent examination.

Following the Money: Trading Profits, Withdrawals and CryptoG’s Findings

CrYptO GOne of the most important lessons I have learned from investigating cryptocurrency investment schemes is that money appearing on a dashboard is not necessarily money an investor has earned. The same applies to withdrawal testimonials. A participant might receive regular payments and genuinely believe the system is working, but those payments alone do not establish where the money originated, whether the underlying trading is profitable or whether everyone could recover their original capital. This distinction became increasingly important as Bobby Lane questioned people associated with RIFT Protocol about their experiences.

During our recorded conversations, participants described positive account performance and expressed confidence in the opportunity. Angel Rathorb, for example, told Bobby that she had invested approximately $1,000 and claimed her money had doubled. However, she had not withdrawn her original investment. That does not mean her account balance was fictitious, nor does it establish that RIFT was unable to pay her. It means the conversation provided evidence of a claimed increase in account value, rather than independently verified investment profits. For someone deciding whether to invest, that is an important difference.

Our wider investigation also received accounts of substantial daily withdrawals and much larger sums committed to the opportunity. One particularly concerning account involved a woman reportedly withdrawing more than $400 per day, while her husband had invested approximately $40,000. These figures require further verification against the relevant recording and transaction history before they can be treated as established findings. Even if the withdrawals are confirmed, the central question remains whether the couple recovered their original capital or were receiving payments while a much larger amount remained exposed.

This is where the independent work of CryptoG, a blockchain investigator collaborating with our Avengers Anti-Fraud Alliance, becomes particularly valuable. In his report, RIFT Protocol: The Engine That Lost Money on the Day It Paid Out, CryptoG examined trading and transaction records associated with the platform. His analysis described a 24-hour period in which a participant was credited $1.67, despite the associated trading account recording a $14.26 realised trading loss. During the same period, he identified approximately $131,419 in deposits arriving at the account under examination.

Those figures deserve attention because they raise a question that promotional testimonials cannot answer: how was a positive participant payment calculated during a period when the associated trading activity reportedly produced a loss? There may be explanations involving different accounting periods, balances, strategies or payment sources, but those explanations need to be supported by verifiable records. A credit displayed to a participant does not, by itself, demonstrate that the money came from profitable trading.

CryptoG’s findings are an independent analysis, not a regulatory determination or a complete audit of RIFT’s finances. The deposits he identified cannot automatically be treated as funds used to finance payouts, and one losing trading period does not establish that an entire platform is unprofitable. Nevertheless, the discrepancy provides a concrete basis for questioning how RIFT calculates earnings, reconciles trading results and reports performance to customers. These are precisely the details that should be available if the company wants people to trust its automated trading technology.

RIFT’s own published explanations add another dimension. The platform says customers retain their assets in non-custodial wallets and that trades execute through Hyperliquid, with RIFT earning fees associated with trading activity. Its referral system also offers participants a share of trading fees generated by people they introduce. This is not inherently evidence of fraud; legitimate trading platforms also operate referral programmes. But it means recruitment, trading volume and transaction fees can all generate financial incentives, regardless of whether an individual trader ultimately makes a profit.

The broader question is whether RIFT’s advertised trading performance can be independently reconciled with actual transactions, fee distributions and withdrawals. We need to know whether reported returns represent realised trading gains, changes in account valuation, promotional credits or some combination of these. We also need to distinguish between funds remaining under a customer’s control and funds committed to trading strategies, contracts or other arrangements that may expose them to losses.

For me, the most revealing aspect of Bobby’s conversations was how readily some participants discussed positive experiences without being able to explain the underlying financial mechanics. Their confidence may have been sincere, but personal confidence is not a substitute for an independently verifiable trading record.

That is why our investigation does not end when somebody produces a screenshot showing a profit or confirms that a withdrawal was processed. The more important questions concern the source of those payments, the amount of capital still at risk and whether the platform’s financial claims remain consistent when examined against blockchain evidence.

Until those questions are answered, claims about successful trading should be treated as claims requiring verification, not proof that RIFT Protocol is generating the returns its participants believe they are receiving.

The Responsibility of RIFT Promoters: Who Did Their Homework?

RIFT Protocol — Nobody Read the Fine Print

RIFT Protocol — Nobody Read the Fine Print

After reviewing approximately 69 minutes of recorded telephone conversations, one thing became increasingly clear to me: confidence in RIFT Protocol was not always accompanied by an understanding of the company behind it. Our investigator, Bobby Lane, wasn’t asking people to explain complicated blockchain algorithms or produce confidential financial records. He was asking straightforward questions about who operated the platform, its history and how participants could verify the claims being made. The answers varied considerably, and that is what makes these recordings important.

Linda Paxton admitted that she had followed the surrounding projects for approximately three and a half years without reading the complete Terms of Service. Chantal Sturkenboom acknowledged that she was presenting RIFT and held a leadership position within its community, yet could not explain certain aspects of its legal arrangements. Rajiv Saraf described MARIDA LTD as a Singapore company, despite RIFT’s published documents identifying its incorporation in Hong Kong. Thomas Grant referred Bobby elsewhere for answers, while Angel Rathorb described an investment that had apparently doubled without having withdrawn her original capital. The shorter conversations with Clare G Harvey and Carl Miller provided less information, and I don’t believe it would be fair to draw conclusions about their involvement from those recordings alone.

There is an important distinction between somebody investing their own money and somebody actively encouraging others to participate. People are entitled to make financial decisions based on their own judgment, even when those decisions carry substantial risks. But when an individual begins presenting an opportunity, organising meetings or encouraging others to invest, their responsibilities change. A promotional presentation should never become a substitute for independent verification. Someone recommending a financial opportunity ought to understand who operates it, what the legal documents disclose, whether its trading results can be verified and what happens if participants cannot recover their funds.

The historical connections also deserve attention. Our blockchain investigator, CryptoG, documented the movement of MOF tokens associated with the earlier HyperFund and HyperVerse operation in his investigation, The Tell: How MOF Gave HyperVerse Away. His findings demonstrate how blockchain records can expose financial activity that promotional presentations leave unexplained. While that report does not establish a direct financial connection to RIFT Protocol, it provides important context for understanding why I insist on independent evidence whenever familiar people and promotional networks emerge around another cryptocurrency opportunity.

I’ve spent years interviewing victims of cryptocurrency investment schemes who trusted friends, relatives and community leaders because those people appeared knowledgeable and confident. Many promoters may genuinely believe what they are saying, particularly when they have received payments themselves. But receiving money does not establish that an operation is financially sustainable, and repeating claims without checking them can expose other people to risks they do not fully understand. Our recordings do not establish that any particular interviewee knowingly deceived investors, nor do they demonstrate that every person Bobby contacted was actively recruiting. What they reveal is a troubling gap between some participants’ confidence and their ability to substantiate important claims.

For me, that is where this investigation leaves the most important question. We have examined RIFT’s corporate disclosures, the government warnings surrounding earlier ventures, CryptoG’s blockchain findings and the explanations given during Bobby’s calls. Readers can examine that evidence and reach their own conclusions. But anyone actively presenting RIFT Protocol to others should ask themselves something before making another recommendation: If you cannot explain who is operating the platform, how the trading profits are generated or what its legal agreements actually say, why should somebody else risk their savings based on your confidence?

Disclaimer: How This Investigation Was Conducted

This investigation relies entirely on OSINT — Open Source Intelligence — meaning every claim made here is based on publicly available records, archived web pages, corporate filings, domain data, social media activity, and open blockchain transactions. No private data, hacking, or unlawful access methods were used. OSINT is a powerful and ethical tool for exposing scams without violating privacy laws or overstepping legal boundaries.

About the Author

I’m DANNY DE HEK, a New Zealand–based YouTuber, investigative journalist, and OSINT researcher. I name and shame individuals promoting or marketing fraudulent schemes through my YOUTUBE CHANNEL. Every video I produce exposes the people behind scams, Ponzi schemes, and MLM frauds — holding them accountable in public.

My PODCAST is an extension of that work. It’s distributed across 18 major platforms — including Apple Podcasts, Spotify, Amazon Music, YouTube, and iHeartRadio — so when scammers try to hide, my content follows them everywhere. If you prefer listening to my investigations instead of watching, you’ll find them on every major podcast service.

You can BOOK ME for private consultations or SPEAKING ENGAGEMENTS, where I share first-hand experience from years of exposing large-scale fraud and helping victims recover.

“Stop losing your future to financial parasites. Subscribe. Expose. Protect.”

My work exposing crypto fraud has been featured in: