Impersonating the Mt.Gox Rehabilitation Trustee "Accelerated Payout"—A Prepaid Scam Charging Deposits and Fees Under the Guise of Priority Settlement

Who Gets Targeted

Victims are predominantly Chinese and foreign creditors who deposited Bitcoin at Mt.Gox prior to 2014 and have spent over a decade waiting for compensation. Many are older, have not operated their accounts in years, and face barriers in reading official notices in Japanese or English. Their psychological vulnerabilities are typical: after more than ten years of waiting, book values have skyrocketed while payouts have been repeatedly delayed, leaving them trapped between anxiety and the sunk-cost fallacy of "fearing to miss the final deadline"; when presented with "official notices" featuring trustee names, court case numbers, and precise payout dates, their willingness to verify drops significantly. In particular, when fraudsters claim that "paying a small deposit or tax fee can unlock a large payout early," their aversion to loss is precisely exploited. Fraudsters also purchase or scrape creditor lists and claim information from creditor forums and Telegram groups, allowing their script to cite specific personal details of victims as if they were acquaintances.

骗局怎么运作

• Step 1: Obtain lists and build precise profiles. Fraudsters filter targets from creditor forums, public claim filings, and leaked data, mastering their claimed currencies, amounts, registered email addresses, and approximate payout tiers. This lays the groundwork for sounding fluent when impersonating officials, leading victims to mistakenly believe "the other party genuinely holds my creditor file."
• Step 2: Issue notices impersonating the trustee or appointed law firms. They forge emails and websites with domains closely resembling official ones, claiming "your settlement has been included in the early repayment list" and "final confirmation must be completed before the October 31, 2026 deadline," attaching forged Tokyo District Court civil rehabilitation documentation screenshots to lower victims' guard through the authority of judicial documents.
• Step 3: Throw out the "accelerated payout" bait. They inform victims that normal procedures would take months more, but via the "priority settlement channel" or "early unlock procedure," Bitcoin payouts can be received within days. The script emphasizes limited quotas and expiration upon overdue, pressuring victims to make decisions on the spot.
• Step 4: Request prepayment and critical credentials. Under the guise of "blockchain unfreezing fees," "cross-border tax withholding," "Japanese notarization and translation fees," or "refundable deposits," they collect cryptocurrency or wire transfers equivalent to thousands or tens of thousands of dollars, while simultaneously demanding claim system account credentials, passwords, or even wallet address signatures.
• Step 5: Disappear or secondary harvesting. After receiving funds, websites go dark and emails go unanswered; fraudsters who have already acquired account credentials may directly modify the victims' registered receiving addresses or resell victim data to other scam syndicates for secondary phishing, creating a continuous harvesting cycle.

红旗信号（看到这些快跑）

• 🚩 Any emails or direct messages claiming "accelerated payout," "priority settlement," or "paid early unblocking"—genuine civil rehabilitation procedures are executed uniformly according to court-approved plans, with no paid queue-jumping channels.
• 🚩 Demands to pay taxes, deposits, or fees upfront before receiving payouts—the Tokyo trustee's distributions are deducted directly from trust assets and never require creditors to pay in advance.
• 🚩 Claim links using domains other than the official domain (mtgox.com), or using similarly spelled domains or free email providers to impersonate the trustee's office.
• 🚩 Countdown phrasing in emails such as "deadline" or "failure to act will forfeit your claim," deliberately weaponizing the real context of payout delays to manufacture panic.
• 🚩 Requests for login credentials, wallet private keys, seed phrases, or demands to sign any on-chain transactions—official trust procedures require none of these.
• 🚩 Contact information existing exclusively in Telegram groups, direct messages, or unfamiliar phone calls, with no corresponding information found in official announcements.

真实案例

• The U.S. Department of Justice publicly indicted two Russian nationals in 2023, charging them with conspiring to commit Mt.Gox theft and laundering over 640,000 Bitcoin through the BTC-e exchange. The indictment corroborates the long-standing illegal transfer of exchange assets and demonstrates that the gray industry surrounding this massive asset remains active.
• The Tokyo District Court in Japan handed down a guilty verdict against former Mt.Gox management in March 2019 (two and a half years imprisonment with a four-year suspended sentence, as disclosed in reporting details by Sina Finance in 2019). During the trial, bad actors exploited hot topics such as "latest court rulings" and "management confessions that will release frozen assets" to send fake claim notices to creditors.
• Between 2024 and 2026, the trustee repeatedly issued warnings on the official website confirming the appearance of phishing websites and forged payout emails impersonating the trustee, instructing creditors to operate solely through the official repayment system; media outlets like Gate and PANews also reported cases where creditors received fake "payout confirmation" emails.
• In January 2025, the Tencent Game Security Team assisted Shandong Jining Qufu police in dismantling a criminal chain that used Trojan programs to steal game accounts and virtual equipment, involving a total amount exceeding 30 million yuan. The criminals employed a novel account-stealing method utilizing stolen "login state" data, showcasing a case combating digital asset theft chains. (Source: [https://www.ithome.com/0/824/077.htm](https://www.ithome.com/0/824/077.htm))
• In July 2024, Maanshan police cracked a major cross-border telecommunications network scam case, arresting 48 syndicate members, involving 15 fraudulent apps and a total amount of over 40 million yuan. Victims were lured into "Enterprise WeChat groups" to perform task-based shopping scams, losing 880,000 yuan, with the syndicate entrenched overseas to conduct fraud. (Source: [https://ah.ifeng.com/c/8b4WGXDuUFF](https://ah.ifeng.com/c/8b4WGXDuUFF))

Official Stance

• The Mt.Gox civil rehabilitation trustee has repeatedly published announcements on the official domain clarifying that all payout notifications are issued exclusively through official channels, warning creditors to be vigilant against phishing websites and scam emails impersonating the trustee, and strictly avoiding the leakage of passwords and private keys (continuously updated since 2024, with the payout deadline extended to October 31, 2026).
• The U.S. Department of Justice published an indictment in June 2023 charging two Russian nationals involved in the Mt.Gox theft case and warning the public against scams leveraging the case's payout process.
• China's Central Television and national cyberspace administration authorities have long used the Mt.Gox incident as a typical case study for investor education on preventing virtual currency trading risks and scams, warning of exchange custody risks and "proxy payout" scams.
• In security reviews of the Mt.Gox incident published by security vendors such as Ledger, "refund impersonation" is listed and warned against as a classic social engineering scam in the crypto industry.

How to Protect Yourself

• ✅ Recognize only the official domain mtgox.com and announcements published on the official website of the Japanese trustee's office; all payout information is subject to the official website. Do not click any claim links in emails; manually enter the URL when access is needed.
• ✅ Never provide claim system login credentials, wallet private keys, seed phrases, or sign any on-chain transfers to anyone; official trust distributions do not require these.
• ✅ When receiving notifications regarding "payout credited," "fee required to unlock," or "accelerated channels," first verify the sender's domain spelling, then cross-check the content item by item against the official announcement page. Discard immediately if in doubt, and do not reply or transfer funds.
• ✅ Remain anonymous in creditor communities outside official channels, and do not publicize your claimed amounts or identity information to prevent precise targeting by fraudsters.
• ✅ If funds have been transferred or credentials leaked, report it immediately to local police and report account anomalies or freeze registered receiving methods through the trustee's official channels.
• ✅ Understand the process and timeline of genuine civil rehabilitation procedures in advance (such as the deadline extension to October 31, 2026), using public information to vet any so-called "inside information."