Cryptex reboots as Bytnex following domain seizure
Following multiple regulatory fraud warnings, Crytpex’s website domain was seized earlier this month.
As tracked by BehindMLM readers, Cryptex’s “cryptex.to” domain was seized on or around Thursday, October 9th.
WHOIS records reveal NameCheap, Cryptex’s domain registrar, changed the domain’s nameservers to abuse placeholders:

This broke DNS and rendered Cryptex’s website inaccessible.
One of the reasons NameCheap cites for domain seizure is participation in fraud and scamming. Unverifiable domain ownership details is another reason.
Upon seizure, Cryptex’s admin would have been immediately notified via email.
Instead of being honest about its website domain being seized, on October 9th Cryptex sent out an email claiming 24-48 hours of “data security enhancement”.

Attention: Data security enhancement
Please be advised that our data center maintenance team will be updating all server databases with new security measures affecting our data center.
The maintenance details are as follows:
Maintenance Date: October 9, 2025
Maintenance Downtime: 24-48 hours
Maintenance Window: 18 hours
On October 10th, Cryptex informed investors “encrypting all data can only be done offline, which is why all servers are offline.”
Various ruses carried through the weekend, wherein Cryptex’s admin(s) no doubt tried to rectify the seizure with NameCheap (this to date hasn’t been disclosed to investors).

On October 12th I predicted that, unless Cryptex was able to fool NameCheap, they’d spin up a new domain this week.
By October 14th it was pretty obvious that Cryptex had failed to fool NameCheap. For whatever reason, NameCheap was not releasing Cryptex’s domain.
On October 15th, Cryptex announced it would be rebooting as Bytnex. To that end the domains “bytnex.io” and “secure-bytnex.io” were registered on October 13th, 2025.
From this date we can assume NameCheap informed Cryptex it would not be releasing the “cryptex.to” domain either on Sunday the 12th or Monday the 13th.
This prompted Cryptex to register the Bytnex domains on Monday. Any updates provided between Monday and Wednesday were a baloney ruse while Cryptex scrambled to transfer rebranded Bytnex hosting over.
Tellingly, Cryptex’s Bytnex domains are not registered through NameCheap. Instead the Ponzi scheme has gone with TLD Registrar Solutions.
Both NameCheap and TLD Registrar Solutions are ICANN accredited. It’s unclear whether this means NameCheap will share why they seized Cryptex’s website domain with TLD Registrar Solutions.
This could lead to TLD Registrar Solutions take action against Cryptex’s new Bytnex domains.
Cryptex and now Bytnex are MLM crypto Ponzis that are believed to have ties to Europe. This is based on Cryptex’s early targeting of Germany and Austria.
- Germany has issued two Cryptex fraud warnings, one in July 2025 and a second in August 2025
- Austria issued a Cryptex fraud warning in April 2025
- Australia issued a Cryptex fraud warning in September 2025
As of September 2025, SimilarWeb was tracking ~330,000 monthly visits to Cryptex’s website.
Top sources of Cryptex website traffic are currently the US (33%), Germany (15%), Canada (8%), Switzerland (8%%) and Hungary (5%).
Several BehindMLM readers are actively tracking Cryptex and Bytnex developments. Stay tuned for updates in the comments below.
Update 17th October 2025 – As at the time of this update Cryptex’s Bytnex domains have been disabled.
“Bytnex.io” was disabled at the DNS level by the registrar Public Domain Registry on October 16th.

It’s unclear whether TLD Registrar Solutions took action prior to the switch to Public Domain Registry.
“Secure-bytnex.io” now redirects to “cryptex.to”, which remains disabled as per the October 9th NameCheap seizure.


I found this current warning on Facebook.
postimg.cc/phYzKKLh
facebook.com/profile.php?id=61582561102869
Who registered the domain bytnex.com on January 8, 2016, and updated it on January 7, 2025?
postimg.cc/8fFHMtjV
postimg.cc/75PNNHCs
bytnex.com
I made an interesting discovery today that got me thinking.
The domain bytnex.io was registered on October 13, 2025, but Bytnex was already mentioned in this video from October 6, 2025, on the YouTube channel BytnexMilli.
postimg.cc/HcrVGDgL
youtube.com/watch?v=P6t8_Ei6HU0
However, this video is an old one that was uploaded on June 14, 2025, to Cornelius Jones’ (Ten Mina Investing) YouTube channel with a different title.
postimg.cc/4nsZDRbj
youtube.com/watch?v=lDkqVWkF2u4
I mentioned this video by Cornelius Jones in this comment:
https://behindmlm.com/mlm-reviews/cryptex-review-daily-roi-smart-contract-ponzi-scheme/#comment-493489
Two more videos were uploaded today to the BitnexMilli YouTube channel, which were originally uploaded to the CryptexMilli YouTube channel.
postimg.cc/34sdjSDV
youtube.com/watch?v=TbraHNmNkME
postimg.cc/dZ8Q0T4B
youtube.com/watch?v=ZorO7Wv9HPs
The YouTube channel BytnexMilli.
postimg.cc/vgybNmQ7
youtube.com/@BytnexSphere
It happens a lot the last hours and just in the moment. The members are not happy about the new Domain/Website/not-payouts. There were (accidentialy?) postet some internas too.
Here some of the postings from telegram:
postimg.cc/sBT17SP3
postimg.cc/t7KJ396T
postimg.cc/gnyz38mb
postimg.cc/NynBQx7y
postimg.cc/7JMFJ17C
postimg.cc/ygf91tp9
postimg.cc/3d0phLXm
Uh, that second screenshot. Lulwut?
edit: after reading all those updates, sounds like an exit-scam is on in full earnest.
Start. The. Clock.
@Melanie
The first video from BytenexMilli from 06.10.2025 you mentioned in #3. I posted there in comments on same day and I am quite sure, the name was crytex.
I have tried signing in to bytnex.io its given me a fatal error.
“Bytnex.io” is hooked up to “secure-bytnex.io” for logging in (databases etc.). The “secure” website is not loading, so functionality on “bytnex.io” will also not work.
@Deborah
try secure-bytnex.io/login.php
worked for me, but it’s slow.
Addition to comment #1.
The Hungarian website names and shows four Cryptex scammers.
Mario Emmrich – Erzsébet Sztaneff a.k.a. Lisa – István Szabó and György Szilágyi.
postimg.cc/KRZ1LSJp
The list of sources also includes a link to BehindMLM.
postimg.cc/yk4qxcyS
cryptex.tor.hu/cryptex-english.html
Not sure I understand excatly what’s going on. Bytnex is the new scam ?
Addition to comment #1.
The Hungarian website names and shows four Cryptex scammers.
Mario Emmrich – Erzsébet Sztaneff (a.k.a. Lisa) – István Szabó and György Szilágyi.
postimg.cc/KRZ1LSJp
The list of sources also includes a link to BehindMLM.
postimg.cc/yk4qxcyS
cryptex.tor.hu/cryptex-english.html
@Matthias
The same scam, just with a new name. An example.
The Facebook account Cryptex Defi Staking Hybrid Contract, which has 211 followers, still links to cryptex.to. The operator lists New York as its location, but the phone number is from India.
postimg.cc/2bQDjQSz
facebook.com/profile.php?id=61575580828691
Yesterday he uploaded this screenshot. Partial quote.
postimg.cc/0bm4JYgD
facebook.com/photo?fbid=122159309174852694&set=a.122097563708852694
German serial fraudster Mario Emmrich (aka Super Mario) announces a broadcast on October 19, 2025, on his YouTube channel.
postimg.cc/LnkCNmyp
Which time is correct? 6 a.m. or 11 a.m.?
youtube.com/watch?v=W_2F49rK1Do
Article updated to note Cryptex has disabled its Bytnex domains.
edit: the update appears to be related to “bytnex.io” being suspended by Public Domain Registry.
In the first domain registration of bytnex.io dated October 13, 2025, the United States was listed as the country of registration.
postimg.cc/TLTQz7ZZ
Following the update on October 16, 2025, KY (Cayman Islands) is listed as the registrant country.
postimg.cc/7JYd9xsw
I think that’s related to the private registration (changing from TLD Registrar Solutions to Public Domain Registry).
The current domain suspension is related to suspected false or unverifiable owner details, so whoever is running Cryptex/Bytnex could have also provided a bogus Cayman Islands address.
Yesterday, someone posted their first review of bytnex.io on Trustpilot, calling Mario Emmrich an internet fraudster who lives in Thailand.
postimg.cc/JDgv1z9H
at.trustpilot.com/review/bytnex.io
The same user has already submitted three reviews about cryptex.to and Mario Emmrich in 2024.
at.trustpilot.com/users/65b768a77a195f0012736ce5
189 reviews of cryptex.to with a score of 2.6 (unsatisfactory).
postimg.cc/64x38tZM
at.trustpilot.com/review/cryptex.to
shortly the whois entry is changed from … to … (see img)
postimg.cc/Q9vhdTCb
after a view in my email-client I saw the reason:
postimg.cc/s1cCLq9T
(wrote the email shortly after we found the name for the new domain)
If I had to guess, something has caused ICANN to flag Cryptex and any related entities.
Otherwise it’d be strange for two additional registrars after NameCheap to act so quickly. They’d normally do their own investigation, which I’d expect would take at least a few days.
ICANN flagging Cryptex is likely due to contact from authorities (either criminal or a financial regulator). This is 100% speculation on my part but fits the timeline of events.
It would also explain why whoever is running Cryptex has gone underground. From what I’m gathering we have a “top promoters scrambling to buy time before they pull out the “admins stopped communicating a week ago! I’m a victim just like you!” line” scenario playing out.
Current status:
“secure-bytnex.io” as a root domain is now pointing back to “bytnex.io” (suspended).
“secure-bytnex.io” is registered through TLD Registrar Solutions and is currently set to CloudFlare nameservers.
“secure-bytnex.io/login.php” pulls up Cryptex/Bytnex’s hosting. Hosting appears to be through Shinjiru Technology Sdn Bhd, a Malaysian company that specializes in “absolute privacy”.
From Shinjiru’s website;
Emails to bytnex.io cannot be delivered.
postimg.cc/V05PSmNy
A funny cartoon! 😀
postimg.cc/47LTNLCS
facebook.com/profile.php?id=61582561102869
German serial fraudster Mario Emmrich continues to promote Cryptex on his fraud portal emmrich.consulting.
postimg.cc/XpvkC2M6
@melanie
there are more from t.me/bytnexio
postimg.cc/Lgkfd1gc
postimg.cc/nsQXbD6v
postimg.cc/QHXTZdgt
ok, I tried it also. One lost one.
postimg.cc/YvkNCB53
@Josef Stark
Wonderful! Well done! 😀
Cryptex advertising on flow.page.
postimg.cc/t7zskH0y
flow.page/cryptexenglish
When was Cryptex transparent? Did I miss something?
Links are provided to the following nine English videos in this playlist.
postimg.cc/nChP25V5
youtube.com/watch?v=agrgrFXEC4o&list=PL_TaKfx6J1l_a_X5Bue5UX35avD9RktNv
The Cryptex DeFi Staking German playlist with three videos.
postimg.cc/McL9sKTh
youtube.com/watch?v=avHKoPqtzlI&list=PL_TaKfx6J1l9LcXisow4SyHX78A0TpKve
The YT channel Cryptex DeFi Staking contains 45 videos in eight playlists in multiple languages and has 2,260 subscribers.
postimg.cc/CBBnNwBD
youtube.com/@cryptex.to.defistaking/playlists
The operator of the channel links to istanty.eu/cryptex.defi, but this redirects to the website secure.cryptex.to/MyRegister.php?a=C7401436746, which is no longer accessible.
postimg.cc/hQ4bcfCF
The domain istanty.eu was registered in Italy on March 27, 2023. The registrant is listed as “Digitals Power.” This explains why this channel contains 20 Italian videos.
postimg.cc/YGMyL2Xq
whois.eurid.eu/de/search/?domain=istanty.eu
The operator of the YouTube channel Cryptex DeFi Staking also promotes the Cryptex scam on another YouTube channel, where they link to istanty.eu/cryptex.defi.
postimg.cc/rK79BF27 and postimg.cc/47BkY2PR
youtube.com/@RoyalTeamUniversal
This video from September 5, 2023, in which the unnamed Italian Cryptex scammer and German serial fraudster Mario Emmrich communicate, is really interesting.
postimg.cc/yDCzVRqY
youtube.com/watch?v=Zfzf6bu05DI
Does anyone know the name of this Italian fraudster, or was his name mentioned in the video? I haven’t had time to watch the video yet.
Mario Emmrich in the same video.
postimg.cc/rdpZcyw3
youtube.com/watch?v=Zfzf6bu05DI
@Melanie
This appears to be the native South Tyrolean Martin Obrist. facebook.com/profile.php?id=100007009995615
postimg.cc/4KX2nmb8
facebook.com/MBCryptoTarget
telemetr.io/en/channels/1209151204-thecryptotarget/posts
facebook.com/MBCryptoTarget/posts/1207078260528354 (look at affiliat nr)
The video is actually quite interesting, though I only skimmed through it. I’ve seen so many of these, and at some point, the dumb catchphrases and lies just become unbearable.
Emmrich is once again telling the fairy tale of how and when he got involved with Cryptex. But we know that as early as January 2022, he had already placed the Cryptex logo on his personal website, emmrich.me.
He also talks about the revenue he supposedly generated after 15 months with Cryptex.
The bytnex.io website is unavailable, but I can find Bytnex accounts on Instagram.
postimg.cc/n92bNFM4
instagram.com/bytnex_/
postimg.cc/zyChH4bZ
instagram.com/bytnex_india/
postimg.cc/cKJQqXCN
instagram.com/bytnexmillionaires/
The operator of this account links to buildyourwealthfast.com, which redirects to crazycashformula.systeme.io/3c20b96a.
This page still advertises Cryptex, not Bytnex.
postimg.cc/TKwRzYBR
This website contains several videos that are not linked to YouTube. A guy who only calls himself David is visible.
postimg.cc/NKw6DSn9
In a video, this fraudster shows the first Cryptex fraud warning from Germany on BehindMLM, which did not concern cryptex.to, but cryptex-vip.com. Partial quote.
postimg.cc/47TRxJ2d
Wow! Oz and the CIA? That’s an explosive development that we should watch carefully. 🙂
Who is the operator of this website? Shane Farnsworth?
His photo.
postimg.cc/NyVCsYDP
His contact details.
postimg.cc/WFw9MrTk
His copyright notice.
postimg.cc/phr9ZMt5
@Josef Stark
Thank you for finding him so quickly. In March 2018, Martin Obrist only uploaded his photo without any text on Instagram, but he has 104 followers. How is that possible? Did he delete posts?
postimg.cc/dLmjXZ0x
instagram.com/obristmartin/
@Melanie
your welcome.
This guy with with name ‘David’:
his name is David Anthony.
I researched him some weeks ago. But it’s hard to search s.o. with such name. I forgot his name now, but I took a look to sourcecode of crazycashformula.systeme.io/3c20b96a. And there I searched for word ‘author’. Then I remembering that I already found his name some weeks before.
facebook.com/DavidAnthonysPalace
@Josef Stark
His face looked familiar to me, and now I know why. I already mentioned and showed David Anthony in this comment.
https://behindmlm.com/mlm-reviews/cryptex-review-daily-roi-smart-contract-ponzi-scheme/#comment-493467
His photo on Facebook and on crazycashformula.systeme.io/4ec0e14e is 100% identical.
postimg.cc/m1bppv9h and postimg.cc/dhChvPTd
The development of Cryptex and Bytnex is becoming increasingly confusing.
We know that the domain bytnex.io was registered on October 13, 2025. But this video with a registration link to secure-bytnex.io/MyRegister.php?a=C8014408603 was uploaded to YouTube on August 28, 2025. The link works.
postimg.cc/XpzHYbnF
youtube.com/watch?v=aYC0po9FKR8
How did the operator of this channel know back in August 2025 that Cryptex would be renamed Bytnex?
There is a link to wealthdoorway.com below the video. The domain was privately registered on June 23, 2025, and updated on July 4, 2025.
postimg.cc/n9ZLbBQ0
On this website, we also find Hungarian expressions and an email address.
postimg.cc/9RJCwSkh
The YouTube channel Crypto Magician Millions, with 69 videos and 86 subscribers, has been around since November 2023. The first Cryptex video was uploaded on November 29, 2023. It is noticeable that the channel also contains Hungarian videos and that questions are sometimes answered in Hungarian.
postimg.cc/hQjZy3P3
youtube.com/@CryptoMagicianMillions
The last video was uploaded on October 17, 2025.
postimg.cc/5Hkm95Bs
youtube.com/watch?v=C4d-k4DGexc
Cryptex Hungary. another YouTube channel, has also been in existence since June 2023, with 256 videos and 2,480 subscribers. Bytnex has not yet been mentioned on this channel.
postimg.cc/5QNXGTGp
youtube.com/@CryptexHungary/
The domain registration for bytnex.io was updated on October 18, 2025.
postimg.cc/yk040YnG
@Melanie compared the whois entry with #19
only the addPeriod-Entry is removed at October 18.
are you recognized #19? because you mentioned it also in #22.
This DNS is banned, it’s unusable for them. Banned because of froud. Yet they only have secure-bytnex(.)io left.
At cryptex they had the domain cryptex.to and used the subdomain secure.cryptex.to for backend/dashboard.
At bytnex they have to url. One for main page (bytnex.io – already dead) and one for backend (secure-bytnex.io).
they used two different registrator for this two domains.
Addition to comment #14.
The video announced for October 19, 2025, featuring Mario Emmrich (left) and two other fraudsters, is 38 minutes long. What fairy tales did the three of them tell? I haven’t had time to watch the video yet.
postimg.cc/XZXnn7YQ
youtube.com/watch?v=W_2F49rK1Do
The entire video is a complete disappointment—utterly meaningless and devoid of substance. Nothing new, just mindless rambling.
Here the points.
* Payouts are supposedly working again
* The blame lies with liars, incompetent failures, and agitators (unclear whether he means us or the members)
* Claims about Lies about Superleaders and Leaders
* Cryptex leadership figures are just regular users—everyone’s in the same boat
* Communication with Cryptex support has improved
* DeFi84 contracts are being shut down, but the old ones will continue
* DeFi36 contracts are to be moved to offshore accounts—whatever that’s supposed to mean
* Users are to blame for trying to collateralize their funds with shady providers before contract expiry (a ridiculous argument)
But this was in the video the main reason for the problems with DNS. Totall stupedity
* 13 staking pools blah blah blah
* No more Zoom calls in the future, only YouTube—so members won’t see other angry members in the video
* A new “hub” is supposed to launch midweek, where servers will converge (don’t ask me what that’s supposed to mean or accomplish—it seems designed to confuse users)
* All payments and misbookings have been corrected
* Next meeting is in exactly one week, same time
The man on the left is Mario Emmrich.
The man in the middle is Rico Rosin.
Does anybody knows the full name of Ronald on the right side of the video?
@Josef Stark
Just a quick addition. Ronald (right) ends the video with the words:
Now we know where these three fraudsters are hiding. It has been repeatedly pointed out on the internet that Mario Emmrich is not in Dubai, but in Thailand.
postimg.cc/9RG7KWRq
youtu.be/W_2F49rK1Do?t=2265
I have a lot in Cryptex.
Please keep me updated.
Thank You
Jerry Sorrell
@Melanie
yes, it’s in Mario’s pool villa house. In his office in Thailand/Phattaya/Jomtien.
postimg.cc/yg6pbLn1
you can found the video in telegram.
there is another video in his office:
youtube.com/watch?v=0JumdM-4yrQ&t=1585s
This three guys also made a video toghether in his villa. but I did not find it. maybe deleted.
Numerous scammers are re-uploading old Cryptex videos to YouTube with new Bytnex titles. Here’s an example from yesterday.
postimg.cc/8FrWcsWW
youtube.com/watch?v=E8oHS3MIs3Y
Since June 4, 2025, 39 videos for the Cryptex/Bytnex scam have been uploaded to this YouTube channel, Bitcoin Wizard Wealth. The titles of the last 12 videos contain the new name Bytnex.
postimg.cc/PNP34qd2
youtube.com/@BitcoinWizardWealth
In the channel information, this primitive scammer still links to cryptex.to.
postimg.cc/7GZN6qHk
The only remaining domain, secure-bytnex(.)io, has reportedly been unreachable for several hours today due to “maintenance.” At this point, even a ping no longer works.
It’s starting to look like a sustained DDoS attack is being carried out against the server.
From a Telegram channel:
postimg.cc/z3hsNLB9
they showed us a payout proof
postimg.cc/wtBSh70q
after we laughed about the mistake, they corrected it. but still….
postimg.cc/5jqWWdHm
Who can see it?
Mario announced today a update on the server.
postimg.cc/yJ9rhccP
Didn’t he recognize that the server is already down since yesterday?
Didn’t he recognize that bytnex(.)io is blocked because of fraud?
It’s becoming a complete joke.
@Josef Stark
secure-bytnex.io is currently accessible again. Screenshot from two different accounts.
postimg.cc/mzS1481F and postimg.cc/JyVsB9bp
Yesterday, the following message appeared here:
That ended an hour ago.
@Josef Stark
I have marked your second screenshot in the relevant places. 😀
postimg.cc/jCK1tXFz
Who is Damian Guevara?
Since January 2024, German citizen Bernd Althof has been promoting the Cryptex/Bytnex scam on Instagram. He currently goes by the name Bernd Bytnex, but has already changed his username four times.
postimg.cc/JyzrznLp
instagram.com/bernd_bytnex/
Just a video from March 25, 2025, by Bernd Althof on YouTube.
postimg.cc/wyYJ7Zqd
youtube.com/watch?v=h3oe4M7VcUs / youtube.com/@BerndAlthof
Bernd Althof describes himself on Facebook as a digital creator, has 69 followers, and also promotes Zinzino products.
postimg.cc/jCTbxcrZ
facebook.com/bernd.althof.50/
Bernd Althof is also the administrator of the German Facebook group Bytnex Visionaries – Pioneers of the New Financial System with 226 members. Previously, the name of this group was “Cryptex & Defi Your Journey Begins Here.”
postimg.cc/gXpMDVXv
facebook.com/groups/1137328954591344/
Bernd Althof has been an administrator on Facebook since January 27, 2025. He is clearly visible in this photo. 😀
postimg.cc/CRyxm5Nv
facebook.com/photo/?fbid=1348276253756199&set=a.100307008553136
The Biggest THANK YOU SO MUCH to Melanie and Josef Stark for their tireless Efforts and Work about Crypt… ääähhh outch… BYTNEX.com!
This Forum so far seems to be the only one where you can follow the Drama and get fresh News about it! Thanks so much!
Hi Torsten, I have been observing the MLM scene for more than 20 years, and at 76 years of age, I have plenty of time for research. I don’t know how much longer I will be able to write, as my health is deteriorating.
Rifet “Rifko” Nuhanovic from Recklinghausen, Germany, has uploaded another short video today.
postimg.cc/Bj5pHyZS
youtube.com/watch?v=QdW6B5CB22E
I have already mentioned this fraudster in detail in this comment.
https://behindmlm.com/mlm-reviews/cryptex-review-daily-roi-smart-contract-ponzi-scheme/#comment-491172
Rifet “Rifko” Nuhanovic has renamed his former YouTube channel “Cryptex Online Infokanal” to BYTNEX / Cryptex Online Infokanal. This channel now contains 103 videos since May 25, 2024, and the last three videos feature the new name Bytnex.
postimg.cc/fJR5m5tc
youtube.com/@CryptexOnlineInfokanal/videos
@Torsten
Thank you for your words. This is realy motivation for me.
@Melanie
Let me take a moment in this comment to share a few personal words. Your work here is incredibly valuable—truly beyond words. I had already been reading your posts before I became active myself, and I’ve always admired your dedication and efforts.
I’m almost entirely focused on researching this project, which keeps me more than busy, and I have to be careful not to lose track of things. You are a true role model.
As for myself, I won’t be able to keep doing what I’m doing here for much longer. Yes, parts of it have been enjoyable, but overall it’s just too exhausting and frustrating.
It’s shocking to see the scale and indifference with which these criminal actors—and I explicitly don’t mean just those at the top of the pyramid—deceive and rob unsuspecting, less-educated people with their lies and manipulation. And most of the time, they hide behind the excuse that they themselves believe in the project. That disgusts me to no end.
It’s deeply frustrating to watch these people face no consequences and simply move on to the next scam after the collapse.
The mere fact that we have to hide behind anonymity while these criminals can openly show their faces in videos speaks volumes—it’s a glaring sign that something here is fundamentally wrong.
I honestly don’t think I could do this for 20 years like you have.
Maybe the past few weeks were just too intense. I’m going to need a break.
@Melanie (according #44)
I don’t know, the guy with this email. never heard of him.
I think it’s one of the guy who should deliver a fake payout, mentioned in a leak (I do not find it now, but delivered a screenshot here in any comment).
There is another stupid payout ‘proof’:
postimg.cc/XZKQwvWx
So far, I’ve seen two payout proof screenshots—and both are ridiculously easy to identify as fakes.
Addition to comment #47.
Rifet “Rifko” Nuhanovic also has a Facebook group with 52 members: BYTNEX Online. He is the administrator.
postimg.cc/ThX6J9st
facebook.com/groups/1115138712929990
His own Facebook account is Rifko Nuh.
postimg.cc/kBqnFm4s
facebook.com/groups/1115138712929990/user/1309756478/
@Josef
I understand your frustration. My neighbor “invested” in Cryptex. First time he told me about it, I will only need 2 sentences to know this is complete bullshit.
One day I will help him with the computer and see the name of the scam. I started to research on it and since then I follow Mario’s newest scam.
He’s very clever to say that he is just a user like all others and in the end he will just switch of the funny Cryptex/Bytnex dashboard. That’s it … money is gone and what is even more worse: All the dreams of a rich life are gone.
Just short time after the website was gone, I will talk to my neighbor and tell him to stop investing in that bullshit. But he will say: Now, he wants to invest more.
That made me think, if you, Melanie, Oz and the Ponzi Avanger do try to protect the wrong ones. Because those people are literally asking to be fooled. Those people want to get rich and don’t want to share their success with other (paying taxes).
They life in a dreamworld (like in the love scam), where Mario whispers them beautiful stories of how they later invest their crypto millions.
I never found a evidence that a Ponzi/pyramid system really made the users rich. It is all fake and scam. It is there since people invest money.
Still it can be useful to give the scammers names and faces. I love Danny’s stories where he uncovers those scammer and show their real names. That’s real life entertainment at its best!
You can’t protect those people from the scam. They want to believe in that. It’s nearly something religious. In the end the scammers rob the money from the people who think they should not pay taxes.
The next “Thank you so much” goes out to Claus S !
Every single Word you wrote gets 10 Points out of 10! The so called “Victims” in Reality are kind of Perpetrators of themselves!
Beside greedy Tax dodging it seems to be a pervert Game to be the Victim in the End to be in a Position to complain endlessly and possibly to find a Group to share their Plight and Grieve……….. and those Subjects produce innocent Children and vote……. ???………..
TIL I’m a CIA operative:
youtube.com/watch?v=LR8yiOqTPZI
Anything to avoid admitting Cryptex/Bytnex is a collapsed Ponzi scheme.
Best part of the vid is [1:51], where the butthurt boomer with a North American accent literally spells out the Howey Test.
Ayo does the CIA go on strike if the US govt has shut down? I’m not sure I’m even supposed to be working…
@Oz lol, it’s always funny to see what kind of stories scammers come up with.
I got another fake payout proof:
postimg.cc/bs25dZPV
The Bytnex Wallet Number leads me to this YT-channel
youtube.com/@mlmmarket2024
(254 videos / 8450 abo / start 23.07.2021 / India)
The creator starts promoting cryptex about two months ago.
The creator of this channel does everything to hide his identity. But I found there another affiliate number from another scam. And this number leads me to an older YT-channel:
youtube.com/@mobiteqpayallinone/
(97 videos / 904 abo / start 16.08.2012 / India)
And there I found his email address and his name.
So, I am now able to prowdly present the happy new fake half millionair Meena Hanuman from India:
youtube.com/watch?v=SL4gA5e0GHs&list=PL57_wmQ_grRh7wvkoz5d5QyWR6tRo4sWE&index=2
On the other cryptex article I posted a screenshot from a early cryptex zoom meeting with Vincenzo Carpanzano on post #110.
https://behindmlm.com/mlm-reviews/cryptex-review-daily-roi-smart-contract-ponzi-scheme/#comment-487146
On this screenshot is another famous person, Michael Baur, well known from the scam Skainet
postimg.cc/MvV910JR
Ups. Where are all his valueable projects?
emmrich.me/
Just a visitcard. Crytex Advertising. I expect more creativity from Mario.
I like that one: emmrich.me/index1.html
Mario, really? Are you serious?
@Claus S
Mario Emmrich’s current fraud portal is emmrich.consulting.
postimg.cc/T5V25nZT
@Oz, I already mentioned that in comment #28. 😀
Who uploaded this excellent video? A group of private investigators or the FBI?
postimg.cc/YvBhdCpp
youtube.com/watch?v=LR8yiOqTPZI
The uploader links to cryptex.automatedcryptoprofits.com that redirects to crazycashformula.systeme.io. And who do we see on this website? The well-known Cryptex/Bytnex scammer David Anthony.
postimg.cc/8s1vZhvJ
I have already mentioned David Anthony in these comments:
https://behindmlm.com/mlm-reviews/cryptex-review-daily-roi-smart-contract-ponzi-scheme/#comment-493467
and
https://behindmlm.com/companies/cryptex-reboots-as-bytnex-following-domain-seizure/#comment-494794
David Anthony links to his YouTube channel CRYPTO PROFITS on this website, where the BehindMLM video can be viewed.
postimg.cc/VJSHZJTL
youtube.com/@totalincomesolutions/videos
David Anthony obviously no longer believes in success with Cryptex/Bytnex, because he is now also promoting Zionix (zionixglobal.net).
postimg.cc/mtVy3Tg8
He links to his website ultimatemoneyleveragingprogram.com on YouTube, which redirects to crazycashformula.systeme.io/zionixglobal with this photo, which we already know. 😀
postimg.cc/PNFTcwJw
Oh I missed that! Just popped up on my news feed this morning. Been a busy week :(.
Was expecting more grey hair but otherwise, David Anthony looks like I expected.
According to my post #55:
I am probably wrong with the statement there. Got wrong information!
Sorry for that.
Mario Emmrich‘s new statements in a video from today.
postimg.cc/4mK7xXkP
youtube.com/watch?v=bCqmWgmQVOw
Cryptex/Bytnex scammer Mario Emmrich mentions Maik Spyrou in his video today, who has been critical of him and Bytnex on Facebook.
Maik Spyrou has been a member of the BYTNEX DEFIE STAKING group, which has a total of 599 members, since October 18, 2025, and complains that his 16 contracts that matured in October 2025 have not been paid out.
postimg.cc/Cz7NWWfB
facebook.com/groups/585403110685800/user/100036792174020/
This is a new comment from Maik on his Facebook page. He apparently signed 16 contracts even though he knew!!! what was going to happen!!! Could it be any easier for Graf von Einem “Super” Mario? I’m speechless!
Addition to comment #40.
Four new Bytnex/Cryptex videos were uploaded yesterday on the Bitcoin Wizard Wealth YouTube channel.
postimg.cc/tZsKF0vq
youtube.com/@BitcoinWizardWealth
A video showed yet another very primitive fake of an alleged payout of $15,764,770.84 USD.
postimg.cc/94vg9D6H
At one point in this video, I read blockchair.com and blockchair, not blockchain. 😀 In addition, the QR code was made unreadable.
postimg.cc/Zvr6QRs9
youtube.com/watch?v=pBMdlqpPKNI
again, in a russish telegram channel a payout proof is postet:
postimg.cc/wyBv4tNv
The transaction you can find here
blockchain.com/explorer/transactions/btc/31a68d1b5660340c490384fb2ee7897f69b2e2a1b5ee0e7f3f9398a0aa358bc5
The sender address does not belong to cryptex, it belongs to Binance!!!
postimg.cc/yDNbds0M
This was the 4th trial!
Since April 2025, Jigyanshu Sonkar from India has been promoting the Cryptex/Bytnex scam on YouTube with 10 videos.
postimg.cc/Bjq34jZf
youtube.com/@jigyanshusonkar0777/videos
This Indian scammer uploaded the last video on October 16, 2025. The screenshot contains his email address.
postimg.cc/njc5PWxZ
youtube.com/watch?v=w6bhm2sVd1Q
A BehindMLM reader commented:
Jigyanshu Sonkar simply replied:
postimg.cc/G9WpZWMM
Since May 2025, Jigyanshu Sonkar has also been promoting the Cryptex/Bytnex scam on Instagram with nine posts. Here, he still links to cryptex.to.
postimg.cc/5XBd6GSB
instagram.com/jigyanshusonkar
Screenshot of an alleged Cryptex payout dated October 6, 2024, for $2,842,640.20 on his Instagram account.
postimg.cc/bZdXRTbQ
instagram.com/p/DJvzQ3fugVv/
Jigyanshu Sonkar (left) on Instagram on June 12, 2025.
postimg.cc/B8RPwgRg
instagram.com/p/DKzDxIyTwJF/
Addition to comment #65.
New comments under the video from October 26, 2025. Partial quote.
“David”, as the speaker in this video calls himself, responds with another lie.
postimg.cc/FYnK1y52
youtube.com/watch?v=pBMdlqpPKNI
according to the last sentence in #36
I found this
facebook.com/mariohoffie/posts/1392146189583388
So Ronald’s full name should be Ronald Bransche
Rico Rosin and Ronald Bransche where together also involved in the bcconnect scam. More information you can find in
facebook.com/mariohoffie
Especially here you see fotos of the involved persons.
facebook.com/mariohoffie/posts/1399021312229209
Can you see any other that are involved in Cryptex?
Today, I wanted to buy a Bytnex/Cryptex contract on Mario Emmrich’s website emmrich.consulting, but unfortunately, that wasn’t possible. 🙁 Now I’m very sad. 🙁 🙁 Who can comfort me?
On emmrich.consulting/#CRYPTEX, I clicked on the “BUY CONTRACT” button.
postimg.cc/vx9CMtQr
After that, secure.cryptex.to/MyRegister.php?a=C4652611755 appeared on my monitor with the message:
postimg.cc/K4q5vMKb
How can this be explained? The answer is simple.
German serial fraudster Mario Emmrich knows that a new registration link to Bytnex (secure-bytnex.io) is required in order to continue this scam. He obviously no longer expects to be able to lure new victims into the Bytnex scam on his website.
With an average of only 150 visitors per month to emmrich.consulting, his website was no longer successful either.
postimg.cc/CzhZQhw5
@Josef Stark
Excellent! Ronald Bransche on Facebook.
postimg.cc/JH0b8WSb
facebook.com/profile.php?id=100075059087636
The list of his 508 friends is no longer visible.
facebook.com/profile.php?id=100075059087636&sk=friends
In addition, this fraudster deleted numerous posts and comments from his account and did not answer questions about Cryptex. Here is an example.
postimg.cc/Yh93KTFR
Günter J. Holzer from Ulm (Germany) promotes the Bytnex/Cryptex scam on LinkedIn and XING. He still links to secure.cryptex.to and not to secure-bytnex.io.
Steven Wagner, who is mentioned and shown in Günter J. Holzer’s LinkedIn profile, is also known as a serial fraudster (OneCoin, EXW, etc.).
postimg.cc/0MX2t1V1
linkedin.com/in/g%C3%BCnter-j-holzer-01505a158/?originalSubdomain=de
postimg.cc/B8WFgHXx
xing.com/profile/GuenterJ_Holzer/web_profiles
By now, all three-year contracts due through January 2026 are reportedly being converted into new two-year agreements. As a result, all due contracts continue to go unpaid. Anything else would have been surprising.
I talked about Martin Bat on the former Cryptex Thread (#206 ans #247). He made a FB page about the scam.
facebook.com/profile.php?id=61582561102869
He also opened a hungarian chat group on telegram
t.me/cryptex_aldozatok
and an international chat group
t.me/bytnexio
The Scam Army Group made a german group
t.me/Cryptex_Hilfe
And there is an cryptex archive channel, also created from Martin Bat
t.me/cryptex_investigation
On the last entry on this archive there is a important comment:
postimg.cc/dLjB6zrw
This means we have additional information that we cannot disclose publicly, as sharing it would violate the protection of personal data. However, if someone requires this information for a criminal complaint, we can forward it to law enforcement authorities.
@Josef Stark
German serial fraudster Mario Emmrich also rents out apartments in Pattaya (Thailand). In three unlisted videos on his YouTube channel, he describes the apartments and mentions two different WhatsApp numbers.
postimg.cc/DWzPvTB7 (with WhatsApp from Thailand)
youtube.com/watch?v=K1hMiljaVpM&list=PLdQAKrIaCnthQlDxdqD_3Fpux-E393n00
google.com/maps/place/La+Royale+Beach+Condominium/@12.8590915,100.8982376,17z/data=!3m1!4b1!4m6!3m5!1s0x310295b5e5519d2b:0xad51452e2b56f20e!8m2!3d12.8590915!4d100.8982376!16s%2Fg%2F11h3bf4jc_?entry=ttu&g_ep=EgoyMDI1MTAyOS4yIKXMDSoASAFQAw%3D%3D
postimg.cc/jWjGJCRP (with WhatsApp from Thailand)
youtube.com/watch?v=xrs_rrja63I&list=PLdQAKrIaCnthQlDxdqD_3Fpux-E393n00&index=2
google.com/maps/place/344%2F74+Jomtien+Soi+9,+Muang+Pattaya,+Amphoe+Bang+Lamung,+Chang+Wat+Chon+Buri+20150,+Thailand/@12.8910791,100.8754056,17z/data=!3m1!4b1!4m6!3m5!1s0x3102968e5a67d93d:0xeb9c3133c54aedfa!8m2!3d12.8910791!4d100.8754056!16s%2Fg%2F11tk7882nq?entry=ttu&g_ep=EgoyMDI1MTAyOS4yIKXMDSoASAFQAw%3D%3D
postimg.cc/GT2p9bHL (with WhatsApp from Germany)
youtube.com/watch?v=gYdhnktGYNo&list=PLdQAKrIaCnthQlDxdqD_3Fpux-E393n00&index=3
google.com/maps/place/Cosy+Beach+View/@12.9192884,100.8607273,17z/data=!3m1!4b1!4m6!3m5!1s0x31029646e62e0d59:0x1a048f208462f6db!8m2!3d12.9192884!4d100.8607273!16s%2Fg%2F1tp0b3nk?entry=ttu&g_ep=EgoyMDI1MTAyOS4yIKXMDSoASAFQAw%3D%3D
If Mario Emmrich is the owner of these apartments, he should be easy to find. German target investigators have already located and arrested MLM fraudsters in Thailand on several occasions.
Mario Emmrich‘s daughter Nadine Struck is now reportedly also involved in real estate. On the new website familie-struck-immobilien.de, she appears with her husband Normen Struck.
postimg.cc/YLF9ZpGX
The imprint lists Dieburg, Germany, as her place of residence.
postimg.cc/kDwqMR9F
familie-struck-immobilien.de/impressum/
Post from September 3, 2025, with Nadine and Normen Struck on Facebook, keyword “Immostrucktion.”
postimg.cc/8JmfwR3X
facebook.com/profile.php?id=61573742477503
How many properties has Mario Emmrich purchased with the embezzled funds over the years?
The Sunday livestream was cancelled today. According to his own statements, Mario is in the hospital. However, he was spotted in a video posted by his daughter:
postimg.cc/fJZMj4jt
It looks like he’s hiding out in a house currently occupied by his daughter.
@Melanie
Excellent. The apartments you posted are close to Mario’s main residence. As the crow flies, it’s probably less than 10 kilometers each.
24-minute video from today. Mario Emmrich in the hospital.
postimg.cc/kVLK4NR3
youtube.com/watch?v=rdO50x4UIvo
Hi! I have sacrificed my self and watched this ugly video with that ugly walrus hanging in the bed and interestingly that ugly walrus mentioned that due to insurence problems he has to go Spain!!!
for operations! Spain is in the EU right? Lets roll lets get him !!!
>But with our Politicians and their Parties it all looks rather hopeless………. I am dead shure in the USA he would quickly end up in Sing Sing or in that Florida Everglades “Hotel”! The USA are so much better in punishing Subjects like that…..
Former OneCoin scammer and active Voidara scammer Hansjörg Oberrauch from Zurich (Switzerland) also links to cryptex.to on Facebook.
postimg.cc/DSh3fMrZ
facebook.com/hansjoerg.oberrauch
On November 6, 2025, a German lawyer warned against bytnex.io and other fraudulent systems.
postimg.cc/YGd8nMXn
anwalt.de/rechtstipps/broker-warnliste-november-2025-achtung-vor-betruegerischen-online-brokern-257233.html
Addition to comment #74.
German serial fraudster Mario Emmrich confirms in an email that the apartment in Jomtien is available to rent and that he is the landlord.
postimg.cc/Y4JhMXpS
He provides a link to this video from September 29, 2024.
postimg.cc/758ZbKdb
youtu.be/xrs_rrja63I?si=nrDgxBMhgCm9xVS8
Thomas Urbatzka from Dormagen (Germany) has been promoting the Bytnex/Cryptex scam on YouTube with four videos since July 2025.
postimg.cc/ygCHMHvK
youtube.com/@ThomasUrbatzka
Thomas Urbatzka‘s Facebook account with 70 followers is unavailable.
postimg.cc/qNzcYtbT
facebook.com/urbatzkathomas/?locale=zh_CN
ATTENTION! Fantastic news from Facebook. 😀
German serial fraudster “Bert Schmits” (real name Herbert Schmitz) has deleted his Facebook account.
facebook.com/people/Bert-Schmits/
Because “Bert Schmits” is the administrator of at least eight fraudulent Facebook accounts, these are no longer accessible. Here are three examples.
facebook.com/groups/cryptoinvestmentteam/
facebook.com/groups/cryptexteam/
facebook.com/groups/1079426665413044/
Now this evil fraudster is trying to find new victims on LinkedIn. He is hosting a Zoom online event on November 18, 2025, with this invitation.
postimg.cc/bZtfMTWp
linkedin.com/events/verm-genauskryptosicher-einfach7392434873820516352/
German serial fraudster Mario Emmrich informs his team members by email about developments at Bytnex.
postimg.cc/Hjv2Bpkr
The message from Bytnex in the following screenshot.
postimg.cc/RNQ0v0J9
postimg.cc/PPt4M2Zp
The message from Bytnex in the following screenshot.
postimg.cc/RN9PDvkY
Addition to comment #70.
Nothing has changed! German serial fraudster Mario Emmrich still links to secure.cryptex.to/MyRegister.php?a=C4652611755 on his emmrich.consulting website.
A “super leader” like Mario Emmrich should know that purchases are no longer possible on cryptex.to. He has known for four weeks that Cryptex has been renamed Bytnex.
If he does not link to secure-bytnex.io now, he indirectly confirms that he has been promoting a scam for years.
Is Bytnex/Cryptex finally dead? Crypto Fox wrote on Facebook yesterday:
postimg.cc/8sm19Fzt
facebook.com/groups/585403110685800
I checked this and it’s true. It is not possible to log in to secure-bytnex.io/login.php.
In comment #32 I mentioned this link:
The result is identical.
postimg.cc/MXsqYCGP
Hi @Melanie
Supermario posted this at November, 15th
postimg.cc/nXZx6D0R
Since there, the login.php file was removed/renamed on the server. So nobody can login there and sell further contracts since Nov.,15th.
The DNS entry is still there.
Also the ping works. The ping wasn’t 100% stable. There were occasional timeouts, but the pings that went through were fast.
Since yesterday, ping no longer works at all, and access to the site has stopped. Previously, whenever I tried to access login.php, the message “file not found” always appeared. I don’t know what to make of this.
@Josef Stark
Yes, unfortunately you’re right. Bytnex/Cryptex scammer Rifet “Rifko” Nuhanovic from Recklinghausen (Germany) also announced this on his website cryptex-online.de.
postimg.cc/VJ8vCwd7
cryptex-online.de/startseite
Don’t think Bytnex was going anywhere so this is probably the end.
@Oz
unfortunately not. Now they have a new IP 179.43.156.130.
They are obviously moving the server to a server in Panama. They made public, that tomorrow all should work.
My guess is that the old hosting provider kicked them out.
Could be. Still a death spiral though. Anyone with money left in will have been trying to withdraw since Cryptex collapsed.
And nobody is depositing new money into this mess, so tick tock.
@Josef Stark
You’ve made me curious! 🙂
postimg.cc/1fMBmyzY
The screenshot shows only the top part of a long list.
Who is the operator of privatealps.net, based in Zurich, Switzerland? Of course, the website does not contain any legal notice or other contact details, only a contact form.
The domain privatealps.net was registered on May 27, 2019, and updated on May 11, 2023.
postimg.cc/cgbpvfTc
Quotes from the website.
This statement is also interesting.
postimg.cc/DmhY7vhY
privatealps.net/en/faq
@Melanie
PrivateAlps claimed in a chat with us that the IP does not belong to their network. On the other hand, we received an email from them which only generally stated that they cannot take any action unless the Swiss authorities intervene.
There are several possible reasons why the rDNS returns the host name “hostedby.privatealps.net”:
Either this was incorrectly set by Private Layer,
Or PrivateAlps provided us with false information.
Thus, the Cryptex operators either rented a server directly from Private Layer for hosting, or this was done through PrivateAlps, acting as an “intermediary host.” What seems certain is that the server itself is located in Panama, and that it is hosted either by the Swiss company PrivateAlps or by the Swiss company/branch Private Layer.
We are divided on which variant is the most likely. But ultimately, it does not matter. To enforce a shutdown, the Swiss authorities would have to take action in any case. Only then would the hosting providers be obliged to deactivate the server. For this, a formal complaint to the Swiss police would be required.
My assumption is as follows: PrivateAlps offers VPS hosted on servers provided by Private Layer and resells them. In order to prevent customers from checking which and how many virtual servers are running on a given machine, they set the rDNS simply to “hostedby.privateAlps.net” or leave it that way. From my perspective, this would also explain the rather poor and inconsistent performance.
ipinfo.io/ips/179.43.156.0/24
@Josef Stark
I only mentioned what was displayed on this website.
whois.domaintools.com/179.43.156.130
Are false details being disseminated there?
@Melanie
no it’s ok. But PrivateAlp claimed (in chat with us) that they do not hv this ip. So, maybe this entry is false. Maybe Private Layer set this wrong. – Or the information PrivateAlp gave us is wrong.
viewdns.info/reversedns/?ip=179.43.156.130
@Josef Stark
In my opinion, PrivateAlps is not a reputable provider. I have already mentioned the lack of an imprint. In addition, there are striking differences in the network policies depending on whether you access the English or German version. Here is just one example.
postimg.cc/zLQ7rBvc
privatealps.net/en/network-policies
postimg.cc/mh5Xsmcp
privatealps.net/de/network-policies
I found a recommended article on an Austrian website. Partial quote.
The article names the following fraudsters.
postimg.cc/VSQPS5rx
recode.at/wenn-defi-traume-zu-alptraumen-werden/
PS: I mentioned Michael Thomas Gordon, mentioned above, once in this comment in June 2023:
https://behindmlm.com/mlm-reviews/cryptex-review-daily-roi-smart-contract-ponzi-scheme/#comment-467647
In the United Kingdom, a total of 24 companies were registered that included the term “Cryptex” in their company name. Most of these companies have since been dissolved.
find-and-update.company-information.service.gov.uk/search?q=cryptex