Worked example · 2022-09

CryptoFX / Mauricio Chavez fake-asset-manager Ponzi targeting Latino community — Houston, Texas + ten-state US footprint + two foreign countries — 2020-05 onward / SEC emergency action 2022-09

Loss: approximately $300M raised from approximately 40,000 predominantly Latino investors across the U.S. and at least two other countries (per the SEC's March 2024 amended-complaint figure across the broader 17-defendant network); the September 2022 initial SEC emergency action targeted Mauricio Chavez and Giorgio Benvenuto specifically and named approximately $12M raised from 5,000+ investors at the time of the temporary restraining order. The headline $300M / 40,000-investor figure includes the broader CryptoFX network of regional promoters across Texas, California, Louisiana, Illinois, and Florida who acted as downstream MLM-tier recruiters under the Chavez / Benvenuto operator surface.
Recovery: partial via SEC court-appointed receiver — Judge Andrew S. Hanen of the U.S. District Court Southern District of Texas appointed John Lewis, Jr. as Receiver for CryptoFX and relief defendant CBT Group LLC on September 29, 2022 (asset freeze extended); the receivership at v0.1 reporting horizon is collecting and adjudicating victim claims through the cryptofxreceiver.com process. Realised recovery on the order of low-tens-of-millions per public filings; the bulk of the receivables were dissipated to fund Chavez's lifestyle, real-estate purchases, and downstream Ponzi payouts to early investors.
OAK Techniques observed: OAK-T11.005.002 — fake-custodian / fake-asset-manager fraud — the operator presented a paid-classes / "wealth-management" educational MLM structure that solicited deposits from the Latino community on the premise of "AI-powered" crypto-asset and forex trading. No real trading occurred: per the SEC's emergency complaint, more than 90% of investor funds were used to pay fake returns to other investors (classical Ponzi structure), to support Chavez's lifestyle (luxury vehicles, residential real-estate purchases), and to acquire and develop real estate held via CBT Group LLC. The structural class is operator-side fake-platform fraud where the asset-manager / educational platform is the vehicle of the fraud — the Latino-community targeting via Spanish-language paid seminars and trust-built community-pastor / community-leader endorsement is the recruitment surface; the "AI trading bot" narrative is the yield-source fiction; the Postgres-backed balance display is the substrate of fictitious-balance growth. Distinct from T2.x rug-pull tokens (no token contract, no AMM pool); distinct from T5.005 (no DeFi treasury — CryptoFX had no on-chain protocol whatsoever); distinct from T4 phishing (users deposited willingly into operator-controlled wallets after attending Chavez's paid seminars).
Attribution: confirmed — SEC emergency action filed September 19, 2022 in the U.S. District Court Southern District of Texas (Houston Division); amended complaint March 14, 2024 expanded the cohort to 17 defendants across five states (Texas, California, Louisiana, Illinois, Florida). Judge Andrew S. Hanen issued the asset freeze and receiver appointment. Federal-record-civil-judgment entered against Chavez August 2023. Criminal-record attribution is at v0.1 reporting horizon less developed than the SEC civil action; no DOJ criminal indictment of Chavez has been confirmed in publicly-available federal-record sources at v0.1 reporting horizon (the SEC civil action and receivership are the dominant federal-record surface). The confirmed attribution-strength label applies under OAK convention because the SEC civil emergency action and receiver appointment are public federal-court actions naming the operator-defendants by name with specific scheme-of-fraud allegations; this is structurally analogous to the SafeMoon SEC + DOJ pattern (examples/2023-11-safemoon-charges.md).
OAK-Gnn: unattributed — CryptoFX is a U.S.-based MLM-Ponzi cohort targeting the Latino community; does not map to any v0.1 OAK-Gnn cluster (which are predominantly cybercriminal / state-aligned operator clusters).
Key teaching point: CryptoFX is the canonical U.S.-domestic ethnic-community-targeted worked example of the OAK-T11.005.002 fake-custodian / fake-asset-manager fraud sub-class, and the case structurally complements the international-scale cohort cases that dominate the broader T11.005 family. The structural distinction between CryptoFX and the international cases is the trust-acquisition surface: Chavez's primary recruitment vector was the in-person Spanish-language paid-seminar circuit leveraging community-leader / educational-figure persona, distinct from the multi-level-online-marketing surface that dominates OneCoin, PlusToken, and HyperVerse. The defender / framework lesson is that the T11.005.002 family encompasses both international-scale online-MLM cohorts and metropolitan-region / ethnic-community in-person-MLM cohorts, with structurally distinct trust-acquisition surfaces but identical fake-asset-manager / fake-yield-source fictions.

Summary

CryptoFX LLC was a Houston, Texas-based fake-asset-manager Ponzi scheme operated by Mauricio Chavez (founder, CEO) and Giorgio Benvenuto (co-principal) that targeted the U.S. Latino community from approximately May 2020 through September 2022. The scheme presented itself as a "crypto education and wealth-management" service for Spanish-speaking communities, with Chavez personally conducting paid in-person seminars across Houston, Dallas, Los Angeles, Chicago, New Orleans, and Miami metropolitan areas. The seminars were structurally MLM-recruitment events: attendees were charged a fee for the seminar, then solicited to deposit BTC / ETH / USDT / fiat with CryptoFX for purported AI-driven crypto-asset and foreign-exchange trading.

Per the SEC's September 2022 complaint, Chavez had no background, education, or training in crypto-asset trading or foreign-exchange trading. The "AI trading bot" narrative was a fiction. CryptoFX did not conduct material crypto-asset or foreign-exchange trading at any point; per the SEC's allegations, more than 90% of investor funds were used to pay fake returns to existing investors (classical Ponzi structure), to support Chavez's lifestyle, and to acquire and develop real estate held via CBT Group LLC (the relief defendant). The MLM-recruitment structure incorporated commissions paid to existing investors who recruited new investors — promised return rates ranged from 15% to 100% of principal, with daily return claims of 0.5%-1%.

The cohort grew to approximately 40,000 investors and approximately $300M in receivables before the SEC's emergency action on September 19, 2022. The SEC's amended complaint of March 14, 2024 expanded the defendant cohort to 17 individuals across Texas, California, Louisiana, Illinois, and Florida — the regional promoter network that acted as downstream MLM-tier recruiters. The amended complaint named the broader regional-promoter network including Ismael Zarco Sanchez, Gabriel Ochoa Sanchez, and others, and brought the public-record cohort attribution to its current 17-defendant scope.

For OAK's purposes, CryptoFX is a canonical U.S.-domestic worked example of the OAK-T11.005.002 fake-custodian / fake-asset-manager fraud sub-class targeting an ethnic-community trust surface. The case is structurally instructive because it demonstrates that the broader T11.005 family operates not only at the international scale (OneCoin 2014-2017; PlusToken 2018-2019; HyperVerse 2020-2022 — all multi-billion-dollar global cohorts) but also at the metropolitan-region / ethnic-community scale (CryptoFX 2020-2022, ~$300M targeting U.S. Latino community; CoinDeal-Chandran 2019-2022, ~$45M targeting U.S. retail investors via "metaverse"-themed marketing). The trust-surface dimension is the key operational feature: Chavez's community-leader / educational-seminar persona was the proximate trust-acquisition vector, distinct from the multi-level-online-marketing surface that dominates the international-scale cohort cases.

Timeline (UTC unless noted)

When	Event	OAK ref
2020-05	Chavez begins running paid Spanish-language seminars in Houston metropolitan area on the premise of "crypto education for the Latino community"	(off-chain entry vector — OAK-T11.005.002)
2020-2022	CryptoFX recruits approximately 40,000 investors across the U.S. (Texas, California, Louisiana, Illinois, Florida) and at least two foreign countries; cumulative receivables ~$300M	(T11.005.002 fake-asset-manager Ponzi growth phase)
2022-09-19	SEC files emergency action in U.S. District Court Southern District of Texas (Houston Division); Judge Andrew S. Hanen issues TRO halting offering, asset freeze	federal-record-civil entry point
2022-09-29	Court grants SEC motion for receiver; appoints John Lewis, Jr. as Receiver for CryptoFX and CBT Group LLC; asset freeze extended	federal-record receiver appointment
2023-08	Federal-record-civil judgment entered against Chavez	federal-record-civil judgment
2024-03-14	SEC files amended complaint expanding to 17 defendants; cohort attribution to broader regional-promoter network	federal-record-civil cohort expansion
2024-onward	Receivership at cryptofxreceiver.com adjudicates victim claims; partial recoveries paid to victims	(federal-record recovery phase)
Continuing	Cohort recovery phase open at v0.1 reporting horizon (May 2026); criminal-record attribution path less developed than SEC civil; receivership-distributions ongoing	(cohort recovery-phase open)

What defenders observed

Ethnic-community-targeted MLM-Ponzi schemes operate at the metropolitan-region scale and exhibit a distinct trust-acquisition surface. Chavez's primary trust-acquisition vector was the in-person Spanish-language paid-seminar circuit, leveraging community-leader / educational-figure persona rather than the multi-level-online-marketing surface that dominates international-scale cohort cases. The defender / framework lesson is that T11.005.002 detection signals must include off-chain in-person community-event monitoring for ethnic-community-targeted variants — regulator-side ethnic-language consumer-protection outreach (the SEC's Office of the Investor Advocate Spanish-language materials post-CryptoFX; the FTC's parallel multi-language consumer education) is a load-bearing mitigation surface that on-chain-only telemetry cannot surface.
The "no verifiable trading background" disqualifying signal was discoverable but not verified at scale by the cohort. Chavez's pre-CryptoFX professional history was publicly available via standard background-check / LinkedIn surface; the absence of any verifiable crypto-asset / foreign-exchange-trading professional background was a definitively disqualifying signal for the "AI-powered trading" narrative he was selling. The defender / user-side lesson is that basic operator-background verification is the most actionable user-side T11.005.002 mitigation — and the gap between the technically-trivial verification primitive and the cohort-scale uptake of the scheme demonstrates the structural feature of the T11.005 family: the gating constraint is user-layer enforcement, not the availability of verification primitives.
The SEC's emergency-action surface produced rapid asset-freeze and receiver-appointment within days of the regulator-action threshold. The September 19, 2022 SEC emergency-action filing was followed by the September 29, 2022 receiver appointment — a 10-day window from emergency-action to receivership establishment. The defender / framework lesson is that the SEC's emergency-action surface is one of the cleanest and fastest federal-record-civil intervention primitives for the T11.005.002 class, and contributors writing future T11.005.002 worked examples should preserve the SEC-emergency-action-to-receivership timeline as a first-class observable.
The amended-complaint cohort-expansion pattern (September 2022 → March 2024, 2 → 17 defendants) is a recurring T11.005.002 feature. The initial SEC action named the principal operators (Chavez and Benvenuto); the subsequent amended complaint expanded the defendant cohort to the broader regional-promoter network (17 defendants across five states). The defender / framework lesson is that federal-record cohort attribution for T11.005.002 cases unfolds in stages — the principal operators are typically named in the initial action; the regional-promoter / MLM-tier-recruiter cohort is named in subsequent amended-complaint cycles. Contributors writing future T11.005.002 worked examples should preserve the initial-action-versus-amended-complaint-cohort-expansion timeline dimension explicitly.
The realised-recovery-versus-aggregate-loss gap is structurally informative. CryptoFX's headline figure is ~$300M raised; the receivership is collecting and adjudicating claims with realised distributions on the order of low-tens-of-millions at v0.1 reporting horizon. The bulk of the receivables were dissipated to fund Chavez's lifestyle, downstream Ponzi payouts to early investors, and real-estate acquisitions via CBT Group LLC. The defender / cohort-recovery lesson is that T11.005.002 cases exhibit realised-recovery-to-loss ratios in the 5-15% band when the recovery surface is SEC-receivership-only; cases where DOJ civil forfeiture is the dominant recovery surface (Chen Zhi / Prince Group October 2025) exhibit substantially higher realised-recovery ratios.

What this example tells contributors writing future Technique pages

CryptoFX is the canonical U.S.-domestic ethnic-community-targeted T11.005.002 worked example. Contributors writing future T11.005.002 worked examples in the ethnic-community-targeted variant should preserve the (a) in-person community-seminar trust-acquisition surface, (b) ethnic-language MLM-recruitment structure, (c) operator-trading-background disqualifying signal, (d) SEC-emergency-action-to-receivership recovery timeline, and (e) amended-complaint cohort-expansion pattern dimensions explicitly. The case structurally complements the international-scale cohort cases (OneCoin, PlusToken, HyperVerse) by demonstrating the metropolitan-region / ethnic-community scale variant.
Receivership-versus-DOJ-civil-forfeiture is a first-class recovery-surface observable for the T11.005 class. CryptoFX's receivership-only recovery surface (no DOJ civil forfeiture) places it in the 5-15% realised-recovery-to-loss band at v0.1 reporting horizon; Prince Group / Chen Zhi (examples/2025-10-prince-group-chen-zhi-15b-seizure.md) demonstrates that DOJ civil-forfeiture seizure is a structurally distinct recovery surface that produces substantially higher realised-recovery ratios. Contributors writing future T11.005 worked examples should report the recovery-surface dimension explicitly.
The SEC civil-action surface is a confirmed attribution-strength threshold under OAK convention. Contributors should preserve the SEC-civil-versus-DOJ-criminal distinction explicitly: the CryptoFX confirmed attribution at v0.1 reporting horizon rests on the SEC civil action and receivership, not on a DOJ criminal indictment. This is structurally consistent with the OAK convention and demonstrates that confirmed does not require DOJ criminal action specifically — SEC / regulator civil action with named-defendant scheme-of-fraud allegations is sufficient.

Public references

[secsep2022cryptofx] — SEC press release / emergency action announcement, September 19, 2022; primary federal-record-civil entry-point source.
[seclr25547cryptofx] — SEC Litigation Release LR-25547 (October 3, 2022); covers the TRO and asset freeze.
[secmar2024cryptofxamended] — SEC press release 2024-35 (March 14, 2024); primary source for the amended complaint expanding the cohort to 17 defendants.
[seclr25949zarcosanchez] — SEC Litigation Release LR-25949; covers the regional-promoter cohort defendants (Ismael Zarco Sanchez et al.).
[cryptofxreceivership] — cryptofxreceiver.com — primary receivership-process source for victim-claim adjudication.
[abc132023cryptofx] — ABC13 Houston coverage of Latino-community impact and victim advocacy.
[texaslawbook2022cryptofx] — Texas Lawbook coverage of the SEC's Fort Worth Regional Office action.

Citations

Existing citation keys reused: none directly — this is the first OAK example anchoring the T11.005.002 fake-custodian / fake-asset-manager fraud class for the ethnic-community-targeted U.S.-domestic variant.

Proposed new BibTeX entries (added to citations.bib as part of this batch):

[secsep2022cryptofx] — SEC September 2022 emergency-action press release.
[seclr25547cryptofx] — SEC Litigation Release LR-25547 (October 2022).
[secmar2024cryptofxamended] — SEC press release 2024-35 (March 2024) amended complaint.
[seclr25949zarcosanchez] — SEC Litigation Release LR-25949 (regional-promoter cohort).
[cryptofxreceivership] — cryptofxreceiver.com receivership-process source.
[abc132023cryptofx] — ABC13 Houston coverage.
[texaslawbook2022cryptofx] — Texas Lawbook coverage.

Discussion

CryptoFX is the canonical U.S.-domestic ethnic-community-targeted worked example of the OAK-T11.005.002 fake-custodian / fake-asset-manager fraud sub-class, and the case structurally complements the international-scale cohort cases that dominate the broader T11.005 family. The structural distinction between CryptoFX and the international cases is the trust-acquisition surface: Chavez's primary recruitment vector was the in-person Spanish-language paid-seminar circuit leveraging community-leader / educational-figure persona, distinct from the multi-level-online-marketing surface that dominates OneCoin, PlusToken, and HyperVerse. The defender / framework lesson is that the T11.005.002 family encompasses both international-scale online-MLM cohorts and metropolitan-region / ethnic-community in-person-MLM cohorts, with structurally distinct trust-acquisition surfaces but identical fake-asset-manager / fake-yield-source fictions.

The case is also structurally important for the SEC-civil-action recovery-surface analysis. The September 19, 2022 SEC emergency-action filing produced a TRO and asset freeze within days; the September 29, 2022 receiver appointment established the recovery substrate within a 10-day window. The receivership at v0.1 reporting horizon is collecting and adjudicating victim claims with realised distributions on the order of low-tens-of-millions — placing the CryptoFX realised-recovery-to-aggregate-loss ratio in the 5-15% band that is characteristic of T11.005.002 cases where the recovery surface is SEC-receivership-only. Contributors writing future T11.005 worked examples should preserve the recovery-surface dimension as a first-class observable and should not under-weight cases where DOJ civil-forfeiture seizure is not part of the recovery surface.

The amended-complaint cohort-expansion pattern (September 2022 → March 2024, 2 → 17 defendants across five states) is a recurring T11.005.002 feature that contributors should preserve explicitly. The initial SEC action named the principal operators (Chavez and Benvenuto); the subsequent amended complaint expanded the defendant cohort to the broader regional-promoter / MLM-tier-recruiter network. The structural feature is that federal-record cohort attribution for T11.005.002 cases unfolds in stages, and contributors writing future T11.005.002 worked examples should report the initial-action-versus-amended-complaint-cohort-expansion timeline dimension explicitly. The CryptoFX timeline (initial action 2022-09; amended complaint 2024-03 — ~18-month lag) is broadly consistent with the federal-record-attestation lag observable across the T11.005 family.

Techniques demonstrated (1)

OAK-T11.005.002 Fake-Custodian / Fake-Asset-Manager Fraud