QAnon Crypto Trading Scheme Lost Investors Millions

Investigation by Ernie Piper, Nick Backovic, and Tori Marland

A Logically investigation can reveal that, for the past year, two QAnon-affiliated influencers have been persuading their thousands of followers to invest in a portfolio of cryptocurrency tokens marked as fraudulent by the Stellar network — a major blockchain, alongside the better known Bitcoin and Ethereum — causing their followers to collectively lose millions of dollars, one of whom died by suicide after losing more than $100,000.

“I am without doubt that WhipLash347, Emily, and QSI are scam artists,” Rocky Morningside, a former admin of the QSI chats, told Logically. “[They] were promoting pump and dumps, and this appeared to be a very large and well organized Ponzi Scheme.”

WhipLash347 and the Quantum Stellar Initiative

There are two main Telegram hub channels that coordinate to share the fraudulent tokens – Quantum Stellar Initiative (QSI) and WhipLash347. The WhipLash347 channel has 277,000 subscribers and the QSI channel has 30,000.

There is also a large central chat for QSI with 10,000 subscribers, and multiple regional satellite QSI chats where locals can organize their own investment groups based on the influencers’ advice and opinions. These are labeled according to places (such as QSI Queensland). 

The primary service of the chats is to provide a curated list of domains and tokens on the Stellar network, and to share information about the supposed banks, fintech companies, or metals-backed commodity ventures that are creating the tokens. This information contains a mix of conspiracy promoting content (such as links from Disclose.tv), genuine news articles, and official pages or statements from banks presented in misleading ways. 

“Whiplash targets patriot-types, Q followers, financial Replacement Value enthusiasts, and the like,” a former admin for an WhipLash347/QSI-affiliated investment chat told Logically. “He uses current events, Q posts, cryptic crap, and news to duct tape it all to the QSI shitcoins.”

This extends to speculation about UFOs and the “white hats,” or secret military intelligence operatives. Morningside told us that Tang has said that aliens want us to trade cryptocurrency “as an on-ramp to familiarize ourselves with the quantum financial system until we can evolve into 5D and trade assets with our consciousness. How crazy is that?”

The QAnon community has several narratives that align with the crypto community’s ethos, beyond the general distrust of government, banks, and media. The WhipLash347/QSI channels often draw on NESARA/GESARA, a long-running pyramid scheme that asks adherents to send more money and wait for a financial redistribution that never comes. The WhipLash347/QSI channels also favorably reference the Iraqi Dinar scam of the 2000s, in which people were encouraged to buy large amounts of valueless foreign currency with the promise its value would soon skyrocket. 

WhipLash347 is an anonymous personality in the QAnon community who has claimed close personal connections with Elon Musk, former President Donald Trump, and John F. Kennedy Jr, who is dead. Although at one point there was a WhipLash347 QAnon influencer account on Twitter and Facebook, the social media behavior of the WhipLash347 Telegram account makes it likely that the account has changed hands within the past year. Currently, the group mostly contains forwarded messages from other crypto investing groups, and contains far fewer Q-related posts than it did at the account’s inception. 

Emily Tang, the person behind PatriotQakes, openly runs the QSI channel. She frequently hosts YouTube talks and livestreams, socializes with other QAnon followers, and occasionally attends cryptocurrency events. Conversations with former members of QSI confirmed that Tang was also an admin in the WhipLash347 group. Tang did not respond to our request for comment. 

Tang has been caught out several times by other companies for promoting tokens that appear to be attached to those businesses but are actually not. The cryptocurrency company Pendulum had to issue a statement on their official Telegram channel in response to Tang, saying that it did not issue coins. Fintech company Novatti registered its concern that Tang had not checked with Novatti to check the veracity of the coin, had not taken action to correct the post when she was informed, and had blocked the Novatti executive from the QSI chat when they attempted to correct the record.

Several current admins of the WhipLash347 chat were identified but most did not reply to requests for comment. @Whiplash34SeVeN, named as an admin of the channel by QSI, did respond to request for comment, but refused to confirm or deny whether they were an admin, despite having knowledge of the chat’s operations. Whiplash34SeVeN claimed they were under a “military NDA” and could not reveal anything, and that the real WhipLash347 was in Iraq and that all the admins were in other parts of Asia. They also said that WhipLash347’s posts do not amount to financial advice, and that users are at fault if they lose money. 

The case of Indus.gold

Stellar is a major blockchain that aims to facilitate the exchange of digital assets for other digital assets or for fiat money. Users buy into the network by purchasing Stellar Lumens (XLM), currently worth about $0.10, which they can then exchange for any other cryptocurrency, including entirely new ones. Stellar enables the creation of tokens with very little technical know-how.

The indus.gold URL and domain were created on February 16, 2022 and first appeared on the WhipLash347/QSI channels on February 20. Indus.gold shares an IP address with another apparently unrelated crypto domain, “quantum-system.finance,” which was shared on WhipLash347 throughout February. 

WhipLash347 and QSI made a number of posts talking about the legitimacy of Indus.gold, claiming that a New York banking company was investing in gold around the world. Although there is an IndusInd Bank that has a product called Indus Gold, it has no relationship with the products promoted by Whiplash347 and QSI. Indus.gold minted dozens of assets, 15 of which were traded at scale. Each token that Indus.gold minted was supposedly backed by a different project — one called “Sungold” was supposedly backed by a Kazakh gold mine, and purportedly linked to the real Russian company Sungold.

Nowhere on Sungold’s webpage are any cryptocurrency assets listed, nor does it indicate it partners with cryptocurrency companies at all. Logically asked Sungold to confirm whether or not it backed any crypto assets, but it did not reply. The most recent updates displayed on the Sungold website are from 2020.

Accounts on the Stellar blockchain, also called wallets, can only be created by other wallets. They are identified with a 56 character alphanumeric code, and are commonly referred to by the last four characters of that code.

The indus.gold wallet, ending in ABDC (supposedly standing for “asset-backed digital currency), minted 900 billion Sungold tokens on March 1. Wallet ABDC sent the entire 900 billion stock of tokens to account PQOQ, which then sent the entire stock on to account 2SIA, which was created only two days before. PQOQ and ABDC were both created by the same account on February 19, wallet QUJH. 

The Sungold token was first advertised on WhipLash347 and QSI on March 5. WhipLash347 posted about the Sungold token 64 times between March 30 and April 5, many of these posts were the same copy-pasted post about the supposed legitimacy of the enterprise. WhipLash347 and QSI encouraged their followers to hold onto the tokens, saying it would make the price skyrocket.

From March 30 to April 1, account 2SIA gradually increased the price of Sungold token. The 2SIA account was selling 18 different indus tokens at the time, all promoted on WhipLash347/QSI. 

On April 1, account 2SIA sent all its remaining Sungold to the newly-created account TJZP, which traded for 1.3 million XLM, or $210,000, within three hours. That XLM was sent the same day in batches of 100,000 to a currency exchange via another account where it could be traded for Bitcoin, Ethereum, or fiat. 

Account 2SIA continued selling the other indus.gold tokens through April 4. When the combined profits of all the indus.gold tokens reached a high of 10 million XLM, worth approximately $1.8 million at the time, 2SIA then split the profits into two new accounts created on April 4, where it was then sent off to a currency exchange in batches of 400,000 XLM, or approximately $80,000 at the time.

The indus.gold domain and its Sungold token was merely one of dozens in a long curated list, posted weekly to the WhipLash347/QSI channels. Central Bank Digital Currency, or cdbc tokens, have a direct relationship to the same wallets that controlled indus.gold. A supposed Swiss bank called Swiss Custody shares a relationship with the wallets that pushed indus and another domain called Stellar Commodities. Stellarmart.org (not to be confused with the actual StellarMart.com), DogeToken, Turkish-Gems, and many more. 

In each case that Logically examined, the wallets that created the tokens were directly tied to the wallets earning an enormous profit. In most cases, the assets themselves, though apparently different, were linked on the blockchain ledger or through IP addresses of the domains hosting the websites that were supposedly promoting the assets. 

Swiss Custody, which is still promoted on the channel, was first promoted back in October 2021. WhipLash347 had linked to the supposed bank’s unverified Twitter page, which has a link to a broken Wix website. The domain and URL have since been changed, but the asset is still promoted. Who.is information about the domain (shared on WhipLash347 and QSI) reveals a misspelling of the French word “banque,” which they have written as “bankque.” Swiss Custody is listed as a scam on Stellar Explorer. 

This has been a common problem. “On Stellar Expert, the domains took me to a Wix website. Emily claimed the white hats were upgrading the site,” said ALWarrior, a former WhipLash347 investor, to Logically. “This happened for every Indus and Swiss Custody token.”

Some of the domains that WhipLash347 shared, although they appear to be unrelated, show similarities in registration and hosting details. These domains in many cases are created only a few days before they first appear on the WhipLash347/QSI channels. Many of the domains and assets pushed by WhipLash347 have since been delisted by the wallet app Lobstr or the Stellar network, or marked as scams by Stellar.

One of the domains pushed regularly by both WhipLash347 and QSI, anclap.io, appeared to be a clone of a different crypto asset company’s website – anclaps.home – and was linked by IP address to a domain with “Whiplash347” in the URL. Archived versions of the website show it redirecting to the cloned version of the anclaps.home page. 

The scale of loss

Many of the WhipLash347/QSI investors got into crypto trading as a way of earning money over the pandemic, as they were unable to work due to lockdowns, closures, or illness. While a tiny minority reported breaking even, or even netting a small profit, the vast majority lost anywhere between several hundred and tens of thousands of dollars. 

People shared their stories in a Telegram chat group dedicated to warning people about WhipLash347 and QSI. They cataloged their losses – while some lost hundreds of dollars, some lost thousands, or even tens of thousands. An informal survey of one chat group of former WhipLash347/QSI investors, based on self-reported responses from 52 people, found that the estimated losses were a collected $223,494. 

One man in Washington state (who we are not naming, at the request of his family) lost his life after suffering a huge financial loss. The man’s brother told Logically that they ran a WhipLash347/QSI regional chat investment group. The man had invested over $100,000 of his own money, spread across 30 cryptocurrency wallets, into tokens that WhipLash347 had promoted. Screenshots of these 30 wallets seen by Logically with about 500 XLM, or about $70 USD each, were all that remained — a total of $2,100 out of over $100,000 originally invested. The man died by suicide after losing his house and construction business due to unpaid debts.

Buyer beware

“The ‘shitcoin’ sector has its own weird morality when it comes to scams,” said Alex Hern, U.K. Technology Editor for The Guardian. “The underlying ethos is ‘DYOR’ – do your own research – and there’s a feeling amongst many of the investor/gamblers that losing your money to a scam is almost the victim’s fault.”

“Obfuscating the initial sales, though, is wrong in both conventional morality and the weird world of shitcoins.”

“The pattern you’ve uncovered suggests the developer is pumping a coin they hold – and so simply encouraging people to pay them money – but hiding that fact, to help maintain the fiction that they’re providing some sort of neutral advice.”

While the true number of people who lost money might not be known, estimates based on “trustlines” indicate it could be in the tens of thousands.

Introducing LI: Crypto, powered by Logically Intelligence

Get ahead of nefarious actors across social media with quick and granular insights to more accurately assess disinformation, platform manipulation, and online discourse about cryptocurrencies at scale.

Learn more about LI: Crypto.