The complete story of the MCT+ Exit Scam 2

The complete story of the MCT+ Exit Scam

Part 2 of 4

Other parts

Part 1: https://issuu com/mctplus/docs/mct 2b exit scam

Part 2: https://issuu.com/mctplus/docs/mct exit scam 2

Part 3: https://issuu com/mctplus/docs/mct exit scam 3

Part 4: https://issuu com/mctplus/docs/mct exit scam 4

Investigation conducted by tax79

Version: 2021-01-04

Link to the original file: https://drive google com/open?id=106rsZiOJDNpaeHNI C3SjwS3tA1JZQ1gU2dGXRf0SBg

Contact me via Telegram: https://t me/tax79

Join the “MCT+ Exit Scam” channel: https://t me/MCTPlus

Incident on 14 May 2019

On 14 May 2019 users’ balances unexpectedly disappeared on the Platform - all BTC and some other well-traded coins

Let’s find out what happened there

Chain of events

Here is the chain of events happened on that day:

1 At 13:00 (UTC) the Platform MCT wallet started staking and it was going on for about 40 minutes While staking users’ balances on the Platform started randomly changing* - each time when the user's MCT address on the Platform got a stake.

2 At 13:15 (UTC) transactions started from the Platform BTC wallet (four transactions were made within three minutes2 85 BTC in total)

3 At approx 14:30 (UTC) users’ MCT balances disappeared on the Platform

4 At approx 14:45 (UTC) users’ BTC balances disappeared on the Platform

5. At 15:00 (UTC) the Platform was shut down.

6 At 18:24 (UTC) 500k MCT were moved from the Platform addresses to one external address -----

*For example, my balance changed twice - from 20k to 89k, then from 89k to 169k

I as a moderator of the MCT+ Discord chat noticed that something wrong was going on with the Platform and sent Andrew[MCT+] a private message at 13:46 (UTC) He replied only in an hour at 14:54 (UTC)

Here is the convo:

In a few minutes Andrew[MCT+] wrote the following message in the team channel:

Several hours later my convo with Andrew[MCT+]:

In the team channel:

https://i imgur com/PstTd70 png (click to enlarge)

https://i imgur com/S20sv9W png (click to enlarge)

On that day Andrew[MCT+] made the following announcement to the public:

https://i imgur com/Ep6ZrQ4 png (click to enlarge)

On 15 May 2019 Andrew[MCT+] posted the following message:

https://i imgur com/MOgMHRf png (click to enlarge)

On 16 May 2019 the Platform was back online with the following wallets reset to zero: BTC | WOLF | XRD The MCT wallet was disabled completely:

https://i imgur com/7tMoBKh png (click to enlarge)

Note:

All the founders’ announcements about the Incident can be found in the following video: https://www youtube com/watch?v=MqKAmvb6Tcw

What we found out from the above:

Andrew[MCT+] states that his developer laptop was left unlocked in a public place (a coworking office) for several hours thus letting anybody access to the entire Platform infrastructure Someone in the office took advantage of the situation and stole users’ funds from the Platform

Honestly speaking, all this story does not look true Because committing such theft a person had to have a very strong knowledge in cryptocurrencies, skills to operate command line interface wallets, be pretty good at Linux

To find such a person in a small coworking office who besides the mentioned skills can calmly take someone else's laptop and do different manipulations with it without fear of being caught is extremely doubtful

So let’s investigate more

Behind the curtain

1 At 14:18 (UTC) on 14 May 2019 a transaction from Andrew[MCT+]'s private BTC wallet was made

But according to Andrew[MCT+]'s version of the Incident and his further comments he got access to his laptop only at approx 15:20 (UTC) As you remember, the Platform was shut down at 15:00 (UTC) when he was driving home and he had to spend some time coming back to the office Before that, his laptop had been out of his view for four hours by his words

All this says that Andrew[MCT+] had access to his laptop during the Incident and his version of what happened is far from reality

By the way, the last known transaction during the Incident was made at 14:02 (UTC) from the Platform XRD wallet - only 16 minutes before Andrew[MCT+] started manipulating with his private BTC wallet

2 At 15:21 (UTC) on 18 May 2019 (four days after the Incident) there was a transaction from the addresses where the stolen BTC were initially moved during the Incident

And three minutes later after that - at 15:24 (UTC) on 18 May 2019 there was a transaction from Andrew[MCT+]'s private BTC wallet

It is hard to believe in such coincidence Therefore, those two wallets (Andrew[MCT+]'s private BTC wallet and the wallet with the stolen coins) were being managed simultaneously by one person

https://i imgur com/UAFMjVH png (click to enlarge)

The Platform BTC addresses mentioned in the table above were announced by the founders on 18 May 2019:

Note:

The addresses provided by the MCT founders are actually part of the MCT Platform wallet How it was established you can read in the following chapter:

Transactions during the Incident on 14 May 2019

3 Several months later after the MCT+ Exit Scam occured, new important details showed up

There was a transaction on 17 August 2019 from one of the addresses where some stolen BTC was moved

The addresses involved in this transaction clearly show that the stolen funds from the Platform were initially moved to Andrew[MCT+]’s private wallet

Before this transaction I was thinking that there were two separate wallets - Andrew[MCT+]’s private wallet with BTC he got from Presale and the wallet with the stolen funds

Now it is clear he moved the stolen BTC from the Platform straight to his private wallet

https://i imgur com/rggfHnB png (click to enlarge)

Note:

The tables with transactions above can be found in the following documents: The Incident at the MCT+ Platform (transactions)

The Incident at the MCT+ Platform (transactions) (update)

Conclusion

Based on the facts and evidence provided above, we can state with 100% accuracy that Andreas Kaltenhuber was the one who stole users’ funds from the Platform during the Incident on 14 May 2019

It was proven by blockchain transactions that he moved the stolen funds from the Platform to his private BTC wallet.

MCT+ Exit Scam

The whole process of the MCT+ Exit Scam can be divided into several stages:

1 Simon[MCT+]’s “leaving” the Project

2 Statement about incorporation and implementation of fiat currencies

3. “An unauthorized access on the Platform”.

4 Announcement about shutting down the Platform

5. Exit scam.

Stage I Simon’s “leaving” the Project

On 13 March 2019 every moderator of the MCT+ Discord chat received the following message from Simon[MCT+]:

Nobody expected such a scenario - there was no apparent reason for this

In the team channel Andrew[MCT+] posted an announcement about this situation:

To the public it was announced the following:

https://i

The situation cleared up a few days later when Simon[MCT+] started dumping his MCT coins on the Platform As it was mentioned earlier, he got 225.000 MCT for free from the premine, then he set up 15 Masternodes and they generated him another 600 000 coins within almost a year So in March 2019 he owned about 800 000 MCT in total I reported about all this to Andrew[MCT+] in early April:

https://i imgur com/7EthvUB png (click to enlarge)

imgur com/JfbASVg png (click to enlarge)

As we see, Andrew[MCT+] did not mind at all that Simon[MCT+] was dumping all his coins, despite the fact that 800 000 MCT was a very significant amount and dumping it within a short period of time at a very low price could cause serious damage to the Project and all investors

Now we understand that it was the first stage of the planned exit scam

Strange proposal

On 29 March 2019 I got the following message from Andrew[MCT+]:

To be honest, I did not expect to hear such statements Because all moderators were doing a great job And, moreover, they were some of the largest long term investors of the MCT+ Project

What he writes next:

So Andrew[MCT+] liked that I was tracking large investors and wanted me to track more

Then he asks about a “fictive” situation when they start a new coin:

https://i imgur com/Na0Wr3K png (click to enlarge)

After that he literally says about abandoning MCT+:

So now we clearly see what “hypothetical” intentions Andrew[MCT+] had about the Project already in March 2019

Stage II. Statement about incorporation and implementation of fiat currencies

The founders were always saying that MCT+ was going to be an official company It clearly followed from the MCT+ Whitepaper

This is an example of what the founders were promising back in August 2018:

But in early April 2019 Andrew[MCT+] firmly declared to the public that MCT+ would be incorporated in the nearest future

He also confirmed it in a private convo:

It was also announced that after incorporation there would be a huge step ahead - implementation of PayPal and USD/BTC, EUR/BTC trading pairs on the Platform There was even a vote and the majority voted for all this:

https://i imgur com/MeychqU png (click to enlarge)

On 17 April 2019 in his announcement Andrew[MCT+] persistently urged the public to invest money in MCT+. He insisted that development was in full swing and MCT+ was a long term project:

https://i imgur com/ZMVYqEa png (click to enlarge)

On 01 May 2019 Andrew[MCT+] even started asking the moderators tough questions in the team channel in order to find out their loyalty to the Project. I was asked not to answer:

At present, using knowledge of what really happened to the Project, we understand that all what he was saying above was a lie There were no plans about incorporation and any further development of the Platform

His only goal was to pump the MCT coin on big news about the bright Platform’s future and then let the founders including himself dump their coins at the highest price possible. We can see it from his private messages to me about using the pump & dump scheme on his side

This worked partially - some investors started buying very serious amounts of MCT, but it was not enough to raise the price significantly and let the founders dump all their coins As we know, Simon[MCT+] was able to dump only 300 000 out of 800 000 MCT However, he became the biggest dumper of MCT for its whole history

Stage III. “An unauthorized access on the Platform”

Pre story One

As it was mentioned earlier, Andrew[MCT+] wanted me to track more users of the MCT+ Platform and on 01 April 2019 he provided me a link to the file which contained all MCT addresses belonging to the Platform:

In early May 2019 the file stopped to be updated and on 11 May 2019 I wrote Andrew[MCT+] about it:

And I got no reply

So something had already started on the Platform that I was not supposed to know in Andrew[MCT+]’s opinion.

Pre storyTwo

On 04 May 2019 I managed to find Andrew[MCT+]’s identity for the first time.

For more than a week I was checking and analyzing all information possible about him and his wife Mari[MCT+] And when I was sure for 100% that I found the right person I decided to inform Andrew[MCT+] how easily his identity could be found by anyone Moreover, I considered him a friend

On 13 May 2019 (the day before the Incident) I wrote a message to Andrew[MCT+] where it was said that I found his and his wife's identities and told him how to eliminate the leak:

Note:

The whole conversation can be found in the following video: https://www youtube com/watch?v=OELrnl8AOHo

On the next day, 14 May 2019, as we know “ an unauthorized access on the Platform” by Andrew[MCT+]’s words occurred and users’ funds were stolen

Pre stories conclusion

It is obvious that finding the founders’ identities was a trigger to start their plan of abandoning the Project earlier than they were initially planning. Why so early - most likely, a psychological factor. That’s why their “laptop story” was so poorly written that nobody believed it - it was not ready yet to release

Andrew[MCT+] was saying that he did not worry about his anonymity because his name would be published anyway when MCT+ was incorporated:

According to his hasty action now we see that he did worry about his anonymity And all he was talking about was a lie

Right after the Incident

About the Incident on 14 May 2019 it was already said in detail in the previous chapter Now let’s concentrate on what was going on right after Andrew[MCT+] stole the funds from the Platform Below there are some messages posted in the team channel on those days with some of my comments

On 15 May 2019 Andrew[MCT+] decided to share some details about the consequences of the Incident with the “team” (actually, moderators and large investors in the same time):

I perfectly realised that the Incident was not a coincidence or a bad timing, so you have to understand with what sarcasm the following question was asked:

What he meant by “lost 4 years of my life yesterday” we can only guess

Then I asked about a technical detail of the Incident and he did not answer He just wrote some nonsense that did not regard to the question:

But the answer is simple Apparently, Andrew[MCT+] just copied the “wallet dat” file from the Platform wallet folder to his private wallet folder The “mct conf” file in his private wallet folder already contained the “staking=1” line, so the wallet started staking and distorted all the balances on the Platform connected to the addresses of the wallet

For what reason he did so - it has no answer, maybe by mistake

Now Andrew[MCT+] is talking about how many coins were stolen:

As we see he is talking about 2.5 BTC. So he could not even count how much exactly BTC he really stole. Later when the Platform BTC addresses involved in the Incident were announced in the team channel, I discovered four more addresses connected to the stolen funds And the whole amount was 2 85 BTC Then this figure was announced to the public:

https://i imgur com/1IIth43 png (click to enlarge)

On 17 May 2019 Andrew[MCT+] started talking about “trust” in the team:

https://i imgur com/eZmsIpQ png (click to enlarge)

But as you remember less than two months before he wrote that he trusted nobody in the team channel:

Then Simon[MCT+] unexpectedly showed up in the team channel on that day:

https://i imgur com/fP4fWZS png (click to enlarge)

And he writes it after he already dumped 300 000 MCT and was going to dump all the rest

Now he is talking about some “potential action” against them, even a lawsuit:

https://i imgur com/XdL6XJM png (click to enlarge)

What is all this supposed to mean? That somebody from another project (XRD or WOLF) knows who he is in real life?

In late May 2019 Andrew[MCT+] disappeared from the chat and this is the first mention about some “health issues” with his family:

https://i imgur com/cjVTeRp png (click to enlarge)

And this is Andrew[MCT+]’s first appearance after several days of keeping silence:

https://i imgur com/9ysavQa png (click to enlarge)

He is even trying to play on emotions to arouse sympathy for himself

After that, I understood that “ game is over” and an exit scam was going to happen in its classic way So I started my own investigation about what really happened during the Incident on 14 May 2019 Of course, I knew that Andrew[MCT+] committed the theft but I needed to get real evidence - not only my thoughts.

And now I was clearly aware that Simon[MCT+] came back only with one purpose - to legitimately pull Andrew[MCT+] out of the Project so it did not look like an exit scam They could not just shut everything down because they knew that I knew their identities And if they had done that immediately they would have been accused of an exit scam with all negative consequences for them So they chose slow tactics

Now their official version announced in the team channel and to the public was that Andrew[MCT+] was spending all his time with his father and it would last indefinitely Therefore, there was a lack of dev resources on the Platform and nobody could do anything about that.

Meanwhile, during the whole June 2019 Andrew[MCT+] showed up only a couple of times posting short insignificant messages. That was what he posted to the public:

And this is how Simon[MCT+] was doing his job in the team channel:

As you might notice, one of the posts above dated by 14 June 2019

Exactly on that day Andrew[MCT+] was having fun and playing golf with his friends:

https://issuu com/magazinring/docs/1907 t magazin gesamt issuu (TIROLERIN, July 2019, pages 134-135) (photo taken on 14 06 2019)

Now it must be absolutely clear what the story about the sick father is worth

And one more detail - my last communication with Andrew[MCT+] was on 22 May 2019. Then total silence from his side.

And we forgot about Mari[MCT+] This is her last message posted on 06 May 2019:

Then nobody heard anything from her

On 29 June 2019 Mari[MCT+] left the MCT+ Discord chat. These were my messages to another moderator on that day:

And the answer to my question was not long in coming

Stage IV Announcement about shutting down the Platform

On 30 June 2019

Simon[MCT+] posted the following announcement to the public:

From tons of nothing meaning words in the announcement above we can understand the following:

1. Andrew[MCT+] is out of the Project.

2 The Platform is shutting down in two weeks

3 The further fate of the Project is uncertain

1 See you later in a year Have a nice day Goodbye

https://i imgur com/sM4ehiw png (click to enlarge)

https://i imgur com/XSK4tcB png (click to enlarge)

https://i imgur com/orPap3a png (click to enlarge)

Nothing

more needs to be proven that this is the announcement of an exit scam

So abandoning the Project that Andrew[MCT+] was talking about in March 2019 was completed

Stage V Exit scam

On 01 July 2019 I published the first part of my investigation about the Incident on 14 May 2019 There was only a text describing the situation in general without any technical details The founders accused me of misrepresentation and extortion

On 02 July 2019 I published the second part of my investigation with all technical details including blockchain transactions

Within three hours after that the Platform was shut down, the website and the project’s social accounts were deleted The exit scam was completed

All users’ funds that were on the Platform disappeared with the founders This is how Andreas Kaltenhuber committed the second theft of users’ funds

As a result, more than six thousand people lost their funds All investors lost their investments in the Project Some of them lost very serious sums The total damage caused to users and investors taking the current BTC price can be estimated up to 3-5 million USD

All the moderators of the MCT+ Discord chat lost 1-3 BTC each. I personally lost about 2 BTC from buying and mining the coin (holding 300 000 MCT - 2% of the total supply)

The largest known investor under the nickname “gominer” had about 1 600 000 MCT How much he lost we can only guess Probably, up to 10 BTC

Andreas Kaltenhuber and Carina Fontan got themselves more than 20 BTC from the Project in total (coin presale, collected fees, stolen funds)

Simon Hibbert, by rough estimate, got 1-2 BTC* from dumping his coins and who knows how much BTC Andreas Kaltenhuber shared with him

*Regarding Simon Hibbert all figures are very approximate

After committing the exit scam Andreas Kaltenhuber created a new Discord chat and invited all ex-moderators of MCT+, except me, of course This is his first and only message he posted there:

Yes, Andreas, the scammers must be revealed. Think, you have still been “working” on your “repay” plan.

After the MCT+ Exit Scam

Dolce Vita

Just a few days after the MCT+ Exit Scam Andreas Kaltenhuber and Carina Fontan went to Malta on vacation. The “repay” plan in action as we can see:

07-08 July 2019, Malta https://www instagram com/andreaskibk/ https://www instagram com/p/Bzm6hJ3lew1/

This is how he was probably spending time with his sick father. In a month he posted a photo about him “enjoying life”:

07 August 2019

https://www instagram com/andreaskibk/

But what about Andreas’ father? As we remember his health issues allegedly were the cause why Andreas Kaltenhuber had to stop developing MCT+ Here he is:

As we can see, he is definitely in hospital taking medical procedures

So as Simon Hibbert said in his announcement, we “wish Andrew’s father a speedy recovery”

Here we see how Andreas Kaltenhuber as a member of the SSCSC club is giving a check on 7007 EUR to some charity organisation:

https://www facebook com/SSCSC/ (screenshot taken in November 2019)

No need to mention that Facebook determined that the SSCSC page has connection with the MCT+ page because they have the same administrator The main thing here is what Andreas Kaltenhuber really thinks about charity:

It is understandable due to the fact that his father, Heinrich Kaltenhuber, used to be the head of the Austrian branch of the international charity organization "Lions"

The photo with the check is the last that was heard from Andreas Kaltenhuber in his or administrated by him social accounts

Back to reality

On 11 August 2019 Andreas Kaltenhuber’s and Carina Fontan’s identities were revealed to the public After that a new period of their life began - keeping a low profile

Now their Instagram accounts are private:

https://i imgur com/ztFcmuPpng (click to enlarge)

https://www instagram com/andreaskibk/

Moreover, look at how Carina Fontan significantly cleaned her Instagram:

https://www instagram com/fontanella007/

Before announcing the results of investigation she had 709 followers and 371 posts. After - only 199 followers and 253 posts

Same happened with her daughters’ accounts:

https://i imgur com/rFAf7Y5 png (click to enlarge)

https://www instagram com/juls gran/

https://www instagram com/mt gran/

For young ladies it is very difficult to keep their life private, so they invented super tactics - they open their accounts when they post a new photo and then make them private again after a couple of days Stupid, of course, but for them it seems ok

Also all this affected Andreas Kaltenhuber’s closest friends.

So Emanuel Jahn, director at Autohaus Dosenberger, and Michael Perlornigg, director and co-owner of insurance company Steinmayr & Co, decided not to be open to the world anymore:

https://i imgur com/TZ1gUF5 png (click to enlarge)

https://www instagram com/emanueljahn81/

https://www instagram com/instamipe/

Even Andreas Kaltenhuber’s mother, Waltraud Kaltenhuber, a local politician, closed the list of her friends on Facebook:

https://i imgur com/a8bW3St png (click to enlarge)

https://www facebook com/people/Waltraud-Kaltenhuber/100008353030305

Interesting, how Andreas Kaltenhuber was explaining to them what was going on - probably it had to be machinations of evil competitors of his tiny business PushPanda

I hope the current investigation will explain everything to them

Note:

Some social accounts mentioned above were changed or deleted

Here are some “backup” copies:

Andreas Kaltenhuber's Instagram: https://www youtube com/watch?v=FPwr7bLCuy4

Vacation in Malta (July 2019): https://www youtube com/watch?v=NaE0US nc0Q

Andreas Kaltenhuber's and Carina Fontan's Facebook: https://www youtube com/watch?v=vtU4yzfPsB0

Andreas Kaltenhuber's and Carina Fontan's Facebook (featured photos): https://www.youtube.com/watch?v=zkDZNPtSV3g

Marie-Therese Granbichler's Instagram: https://www youtube com/watch?v=u5rWH64tssU

Julia Granbichler's Instagram: https://www youtube com/watch?v=FXs0JdVRz6M

Worldwide fame

The adventures of the MCT+ founders could not be ignored by the press And a very good article about them was published on the most famous Russian cryptocurrency site:

https://forklog com/golf-kluby-i-otdyh-na-malte-kak-semejnaya-para-iz-avstrii-sovershila-ekzit-skam-platformy-my-crypto-trade/

Note:

The English translation of the article can be found at the link below: https://telegra.ph/The-MCT-Platform-exit-scam-from-an-Austrian-couple-09-25

PushPanda

At the present time, Andreas Kaltenhuber and Carina Fontan are running a software company PushPanda which has been developing a browser push notification service.

Links:

https://www.pushpanda.io

https://www facebook com/pushpanda io/ https://www.instagram.com/pushpanda.io/ https://twitter com/pushpanda io https://www linkedin com/company/pushpanda

https://medium.com/pushpanda

https://github com/pushpanda

https://github com/PushPandaHQ

They even registered a trademark:

https://tmdb eu/trademark/EU-018008733-pushpanda html

The trademark application was filed in January 2019

So it is not difficult to guess on what funds it was probably done

As we look at the “How the raised funds were spent” chapter of the current investigation, we will see that 1 4 BTC was moved from their BTC wallet in that month. On what? The server costs were much less.

In September 2018 PushPanda posted a view from the office they apparently rented in the center of Innsbruck (Salurner Str. 15, 6020 Innsbruck):

https://www instagram com/pushpanda io/

In September 2018 the MCT+ founders moved 1 4 BTC from their BTC wallet

In November 2018 they even rented a charter to Warsaw, Poland:

As we can see they were just burning money they got for free. This is the only explanation to all this.

The following photo where Carina Fontan shows off her jewelry was deleted soon after their disclosure:

https://www instagram com/pushpanda io/

https://www instagram com/pushpanda io/

In the photo we can see:

The bracelet as a nail - "Cartier juste un clou" - about 12 000 USD

The watch - "IWC Pilot's Spitfire Mark XV" - about 5 000 USD

The second bracelet is unidentified but must be expensive too

So not their "real world company" sponsored MCT+ as they were stating, but MCT+ sponsored their "real world company”

An interesting detail - apparently the name “Andreas Kaltenhuber” became so toxic, so they began to get rid of any mention of it on their site, even on the page with legal information:

https://www pushpanda io/en/info/imprint-legal/

So a huge progress they both, Andreas Kaltenhuber and Carina Fontan, made for the last years - from meetings with the Governor and publishing their photos in the local press to criminal activities and hiding their identities on the Internet. What to expect next?

Other parts

Part 1: https://issuu com/mctplus/docs/mct 2b exit scam