Phoinexes: Fraud Risk Alert. How It Works and What Victims Can Do (2026)

Phoinexes is a USDT investment scheme operated by the same anonymous actors behind Loanledger, a collapsed MLM crypto Ponzi. Victims who deposited funds face serious risk of total loss.

By DefendMe Editorial, Intelligence Team · · Hot News

If you deposited USDT into Phoinexes after seeing promises of daily returns as high as 5 percent, you are not alone, and your suspicion that something is wrong is well founded. DefendMe analysts have identified Phoinexes as a scheme displaying structural indicators of a Ponzi, operated by the same anonymous actors responsible for Loanledger, an MLM crypto scheme that collapsed in May 2026 and left investors with significant losses. The platform offers no verifiable external revenue source, its registered company details are consistent with a shell entity, and its public-facing leader is a fabricated identity played by the same individual who fronted Loanledger under a different name. What you experienced was not a market downturn or a technical glitch. It exhibits every hallmark of a deliberate fraud reboot.

How It Works

Phoinexes presents itself as a technology-driven investment platform combining artificial intelligence, algorithmic capital management, and market analytics. These claims are not supported by any verifiable product, trading record, or external revenue source. DefendMe analysts found that the only documented source of money entering the platform is new investor deposits, paid in the cryptocurrency USDT (Tether). When a platform pays existing investors using funds from new investors rather than from legitimate business activity, that structure is consistent with a Ponzi scheme.

The compensation plan is structured to reward recruitment above all else. Investors choose from six tiers ranging from a minimum of 9 USDT (Nova plan) up to 1,000,000 USDT (Elysium plan), with advertised daily returns of 0.7 percent to 5 percent over periods of 12 to 100 days. Six promoter ranks, from Partner to Diamond, unlock deeper referral commission levels across up to 50 layers of recruited investors. The Diamond rank alone requires 500,000 USDT in personal investment and 500,000,000 USDT in downline volume, a structure that mathematically pressures participants to recruit aggressively rather than generate any external value.

There are no retailable products or services. Promoters can only sell membership in Phoinexes itself. This is a defining structural characteristic of MLM Ponzi schemes: when the only thing being sold to outsiders is participation in the income opportunity, the scheme is entirely dependent on continuous recruitment to sustain payouts. Once recruitment slows, the inflow of new USDT falls below the outflow required to pay advertised returns, and the scheme collapses. This is precisely what happened to Phoinexes' predecessor, Loanledger, in May 2026.

Phoinexes uses language that appears calibrated to appeal to former Loanledger victims. Its website promotes the concept of "investment rebirth" and encourages investors to see their deposits as "a step toward freedom" rather than "numbers on a screen." Open-source analysis of the platform's messaging indicates this framing is designed to reactivate a pool of already-defrauded investors who may be more vulnerable to a second loss.

Red Flags. What Victims Reported

Investigation Findings

DefendMe analysts examined public registration records, domain data, and open-source video evidence to establish the connection between Phoinexes and the collapsed Loanledger operation. The domain phoinexes.com was registered on May 7, 2026, using details that public WHOIS records indicate are fabricated. Despite this, the platform's website asserts it has been in development since 2012, a claim that is directly contradicted by the registration date and consistent with deceptive legitimacy tactics used by recurring fraud operators.

A certificate displayed on the Phoinexes website references Phoinexes Pty Ltd as an Australian registered company. Open-source company registry checks indicate that incorporating a shell entity in Australia requires minimal verification of beneficial ownership details. Our review of this tactic shows it was used identically by Loanledger, which also displayed Australian shell company documentation to create a false appearance of regulatory compliance. The reuse of this specific tactic across both schemes is a structural link between the two operations.

Visual analysis of publicly available marketing videos confirms that the individual presented as Phoinexes leader "David Leshinskiy" in a June 20, 2026 Telegram video is the same person who appeared as "Oliver Tate, Media Relations Officer" in Loanledger promotional content. Clothing items visible in both videos, including a shirt and jacket combination, match across appearances. The June 2026 video was geolocated to the public park behind the Office du Tourisme de Monaco building. Russian regulatory authorities issued a formal pyramid fraud warning against Loanledger in March 2026, approximately two months before Loanledger collapsed and Phoinexes emerged using the same operators and the same structural playbook.

Criminal Context and Enforcement Landscape

Russian authorities issued a formal pyramid fraud warning against Loanledger in March 2026, identifying it as a pyramid scheme. That warning predated Loanledger's collapse by approximately two months. No equivalent official regulatory action against Phoinexes has been identified to date by DefendMe analysts. However, the structural overlap between the two schemes, including identical shell company tactics, the same anonymous operator, and a compensation plan with no external revenue source, means that any enforcement action against Loanledger is directly relevant context for Phoinexes victims.

Recurring MLM crypto Ponzi operations of this type are an active enforcement priority across multiple jurisdictions. Authorities including the U.S. Securities and Exchange Commission, the UK Financial Conduct Authority, and Australian Securities and Investments Commission have each taken action against comparable schemes involving anonymous operators, fabricated executives, and USDT-denominated investment pools. The use of Australian shell companies to simulate regulatory compliance is a pattern regulators in multiple countries have publicly flagged. Victims in any jurisdiction who deposited funds into Phoinexes may have grounds to file complaints with their national financial regulator or law enforcement body.

Scheme operators who reboot a collapsed Ponzi under a new brand while using the same infrastructure and personnel face compounded legal exposure in jurisdictions that treat serial fraud as an aggravating factor. Victims of Loanledger who were subsequently drawn into Phoinexes may be able to document that exposure as part of a broader complaint. Preserving all transaction records, wallet addresses, communication logs, and deposit confirmations now, before the platform restricts access, is the most important step any victim can take.

What Victims Should Do Now

  1. Stop all deposits immediately. Do not invest additional funds to unlock withdrawals or reach a higher tier. This is a common retention tactic used by Ponzi operators.
  2. Preserve all evidence now. Screenshot your account dashboard, transaction history, deposit confirmations, wallet addresses, and all communications with the platform or recruiters. Save copies in multiple locations.
  3. Do not contact Phoinexes about your funds. Alerting the operators may cause them to accelerate fund movement or restrict your account access.
  4. Do not pay any recovery fees. If anyone contacts you offering to recover your Phoinexes losses for an upfront payment, that is a recovery scam. Report it separately.
  5. Record all cryptocurrency transaction details. Note every wallet address you sent USDT to, the transaction hashes, the amounts, and the dates. A blockchain tracing assessment requires this data.
  6. Report to your national financial regulator and, if applicable, law enforcement. In Australia, report to ASIC (asic.gov.au). In the US, report to the SEC (sec.gov/tcr) and FBI IC3 (ic3.gov). In the UK, report to the FCA (fca.org.uk/consumers/report-scam) and Action Fraud.
  7. Submit your case details to DefendMe for a confidential crypto tracing assessment. Early action improves the chances of documenting fund flows before operators consolidate or disperse holdings.

Source: https://behindmlm.com/mlm-reviews/phoinexes-review-loanledger-scammers-try-again/

Were you affected by this scam?