Publication date: November 12, 2026
A blockchain is a public ledger, yet the proceeds of crypto fraud still disappear every day. Using the AdBlast pyramid scheme, which according to press reports harmed up to 90,000 people and caused losses of around USD 32 million, we trace how investor money is moved from a “private wallet” to cash withdrawn at an ATM. We then look at the criminal, fiscal and regulatory tools available in Poland as of November 2026, a moment when MiCA’s transitional period has expired but Poland still has no national crypto-asset supervisor, and at what this means for victims seeking to recover their funds.
AdBlast presented itself as an innovative social and advertising portal based on a “revenue-share” model. In reality it was a pyramid scheme built on the Ponzi principle. The Polish competition and consumer protection authority (UOKiK) found as early as 2020 that it was a pyramid, banned the operator, Nevada-registered Alternet LLC, from continuing the practice and ordered refunds to customers (TVN24).
Users had to buy advertising packages, typically worth USD 10 to 50, and watch a set number of ads each day to earn a promised return of up to 120%. The money paid out did not come from advertisers but from new participants recruited through a highly organised multi-level marketing structure. The ads themselves were of poor quality and mostly promoted related projects or the platform’s own ecosystem, such as the Alterdice crypto exchange.
According to press reports from August 2026, up to 90,000 people may have been affected and losses reach around USD 32 million. The investigation, first conducted in Wrocław, was taken over by the National Prosecutor’s Office, which in April 2026 disclosed how the proceeds were moved: converted into crypto-assets, cashed out and withdrawn at ATMs or via BLIK. That route is the subject of the next sections.
Schemes of this kind follow the classic three-stage laundering model, adapted to blockchain technology:
The deposit is the only moment at which the investor’s verified identity, for example from buying crypto through a bank account, touches the criminal infrastructure. It is rather like showing ID at a casino cash desk before buying the first chips. When the user requests a deposit, the platform generates a unique public address for that single operation and presents it as the user’s “private wallet”. In fact it is a technical drop box whose private keys are held by the organisers, who can move the funds at any time without the supposed owner’s knowledge.
The concealment strategy rests on hierarchical deterministic wallets (standards such as BIP32 and BIP44), which generate a virtually unlimited number of linked addresses from a single master key. Once an address has received funds, it is abandoned, like a disposable cup. The aim is to avoid concentrating capital in one account that exchange monitoring systems would easily flag. Thousands of small deposits look statistically insignificant and clutter transaction graphs, making it hard to show that seemingly unrelated wallets belong to one organised structure.
As soon as a one-time address is funded, the system moves the money on to reduce the risk of a freeze. In a peel chain, part of the balance is sent to the next intermediary wallet and the “change” goes to a newly generated address, much like receiving change from a banknote, except that every piece of change lands in a fresh, unused box. Random time delays and varying transaction fees break behavioural patterns, forcing investigators to test a large number of dead-end paths.
Mixing services pool criminal funds with other users’ assets in a shared liquidity pool, then pay out different units. Tracing a specific coin becomes like trying to retrieve a glass of water poured into a full swimming pool. CoinJoin achieves a similar effect: many users sign one combined transaction, so an outside observer sees hundreds of inputs and outputs but cannot link a sender to a recipient. Swapping assets between blockchains adds a further layer, the digital equivalent of changing cars during a getaway.
These techniques remain difficult to unpick, but they are no longer a safe harbour. Mixer operators and developers have faced criminal prosecution in several jurisdictions, and from 10 July 2027 the EU Anti-Money Laundering Regulation (AMLR) will prohibit crypto-asset service providers from maintaining anonymous accounts or accounts that allow transactions to be anonymised, including through privacy coins.
Laundered assets must eventually return to platforms connected to the banking system, so they are moved to wallets on centralised exchanges. To get past know-your-customer (KYC) checks, organisers use money mules (in Polish slang, słupy), often recruited from socially excluded groups. They also use synthetic profiles built from stolen data and, increasingly, deepfake-based manipulation of biometric checks. To avoid losing everything to a single exchange’s freeze, deposits are spread across many smaller accounts, preferably in jurisdictions with lighter supervision.
The assets are then sold for fiat currency. Smaller amounts go through ordinary spot markets, where the sales blend in with normal investor activity. Large volumes are handled over the counter (OTC) by private brokers or in peer-to-peer (P2P) trades settled directly between two parties outside the public order book, which avoids moving the price and bypasses intermediaries’ internal limits. The key legal objective at this stage is documentation: when a bank or tax authority asks about the source of wealth, the organisers produce exchange statements presenting the money as legitimate profit from years of trading.
Once in fiat, the funds enter the banking system. The main technique for avoiding financial intelligence scrutiny is smurfing: splitting large transfers into dozens of smaller ones below reporting thresholds. The pieces are sent to a network of accounts held by shell companies or front persons, often abroad, which slows international investigations. Transfer titles are varied to mimic everyday commercial and private payments.
The cycle ends when the money is materialised and the digital trail is cut. Couriers withdraw cash with linked payment cards at ATMs across the country or, in jurisdictions with looser rules, at bank counters. In the AdBlast case, prosecutors also point to withdrawals via BLIK. The cash is then integrated into the legitimate economy through real estate and luxury vehicles. At that point, linking it to the original one-time wallets becomes very difficult, and so does confiscation for the benefit of victims.
Under Polish law, running a platform such as AdBlast exposes its creators to several overlapping offences:
| Provision | Offence | Who it typically targets |
| Art. 286 § 1 Criminal Code | Fraud: causing another person to dispose of property unfavourably by misleading them | Organisers of the scheme |
| Art. 299 Criminal Code | Money laundering, including concealing the criminal origin of assets through mixers and one-time wallets | Organisers and anyone who knowingly moves the proceeds |
| Art. 258 § 1 Criminal Code | Participation in an organised criminal group | Members with defined roles in the structure |
| Art. 18 § 3 Criminal Code | Aiding and abetting | Money mules and other intermediaries who facilitate transfers |
Money mules should not assume they are mere bystanders. Depending on what they knew, they may be charged as accessories or as direct perpetrators of money laundering.
Crypto fraudsters rarely meet their tax obligations, which opens the door to charges under the Fiscal Penal Code. Art. 54 § 1 penalises a taxpayer who evades taxation by failing to disclose the subject or basis of taxation. Art. 55 § 1 targets those who conceal the scale of their business by acting under a false name or using another person’s data, which is exactly how mule networks operate. In parallel, tax authorities may assess income from undisclosed sources, which can reach assets the criminal case has not yet secured.
Centralised exchanges and other virtual asset service providers are obligated institutions under the Polish Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing (the AML Act). Under Art. 34 they must apply customer due diligence, including identifying the customer (KYC) and verifying identity against reliable documents. Failure to do so exposes them to administrative sanctions under Arts. 147 and 150, which can reach millions of euros and, in serious cases, removal from the register or withdrawal of authorisation. Directive (EU) 2018/1673 on combating money laundering by criminal law (often called AMLD6) harmonises the definition of laundering offences across the EU, making it easier to prosecute cases spanning several Member States.
At EU level, two regulations are designed to close the gaps exploited by fraudsters:
The AMLR (Regulation (EU) 2024/1624), applying from 10 July 2027, and the new EU Anti-Money Laundering Authority (AMLA) will tighten the regime further, including the ban on anonymous crypto accounts mentioned above.
Poland is a notable exception in implementation. The Sejm has passed the Crypto-Asset Market Act three times, and the President has vetoed it three times, most recently on 11 June 2026; the attempt to override that veto failed on 4 September 2026 (Prawo.pl). As a result, Poland has still not designated a competent authority under MiCA. The KNF cannot grant CASP licences, and no domestic MiCA sanctions regime exists (PAP). Providers serving Polish customers must rely on licences issued in other Member States. In September 2026 the President filed his own draft in the Sejm, based on the vetoed text, and the government announced a fourth, stricter version of its bill; at the time of writing, neither has been enacted (Interia).
For victims this matters in practice. MiCA itself applies directly, but without a national supervisor there is no Polish authority to which a complaint about a CASP can be addressed and no domestic enforcement of MiCA’s conduct rules. The AML Act, criminal law and cross-border cooperation therefore remain the main levers.
Despite its apparent anonymity, a blockchain is a public and immutable record, and that works in investigators’ favour. Blockchain analytics software such as Chainalysis clusters addresses, follows peel chains and identifies the points at which funds are split for smurfing or reach a regulated exchange. Investigators also reverse-engineer the fraudulent platforms themselves, analysing website source code to uncover links to servers and databases. Because these schemes operate globally, cooperation through Europol, Interpol and the network of financial intelligence units is essential. The Polish FIU (GIIF) can exchange information with foreign counterparts and, under the AML Act, can request a block on an account or the suspension of a transaction for up to 96 hours, which the prosecutor can then extend by securing the assets in criminal proceedings.
Successful cases rest on a combination of digital evidence:
Speed is decisive, because each hour gives the organisers time to move funds further along the chain. Victims and their advisers should:
The AdBlast case shows that crypto laundering is sophisticated but not untraceable. Every stage, from the fake “private wallet” to the ATM withdrawal, leaves data somewhere: on-chain, in exchange KYC files, in server logs or in bank records. The EU has built a dense framework of MiCA, the TFR and, from 2027, the AMLR. Poland’s failure to designate a MiCA supervisor leaves a gap, so for now victims must rely on criminal law, the AML Act and fast, coordinated cross-border action. In crypto fraud, the chances of recovery fall with every day of delay.
TVN24: Piramida finansowa AdBlast? Poszkodowanych mogło być nawet 90 tys. osób (24 August 2026)
Prawo.pl: Ustawa o rynku krypto. Sejm zdecydował ws. prezydenckiego weta (4 September 2026)
Prawo.pl: Prezydent wnosi nowy projekt o kryptoaktywach (8 September 2026)
PAP: Świat od lat reguluje rynek krypto. Polska nadal bez ustawy (15 May 2026)
Interia: Rząd się nie poddaje. Będzie czwarta wersja projektu ustawy o kryptoaktywach
Cointelegraph: EU to ban anonymous crypto accounts and privacy tokens by 2027