Glossary / Privacy & security
Exit scam
- Definition
- An exit scam is a platform that operates normally, builds up customer deposits, and then vanishes with them, usually behind a wall of withdrawal delays and technical excuses.
Theft is the business model here, not the aftermath of a mistake. Ontario's securities regulator reviewed the collapse of QuadrigaCX and found that 76,000 clients were owed about 169 million Canadian dollars, roughly 115 million of which the founder had already lost trading client money on his own account. Withdrawal friction is the earliest warning anybody outside the company ever gets.
How it works
An exit scam follows an arc, and the profitable part of the arc looks exactly like a functioning business.
Stage one is credibility. Deposits clear, trades execute, withdrawals settle in minutes. Reviews accumulate, an affiliate programme pays out, a sponsorship appears on a football shirt. Nothing at this stage is fake, because a platform that cannot demonstrate a working withdrawal cannot attract the balances worth stealing.
Stage two is accumulation. Promotions push balances higher: bonus interest for locked deposits, fee rebates for keeping funds on the venue, a referral bounty paid in platform credit rather than cash. Every one of these mechanisms increases the pool and reduces the number of coins that ever leave.
Stage three is the exit. It rarely begins with silence. Withdrawals slow first and acquire explanations: network congestion, an unscheduled wallet migration, a compliance review, a banking partner change. Support replies become templated, then late, then absent. Some operators stage a hack to explain the gap, since a theft narrative attracts sympathy where an admission does not.
BitConnect shows the pattern at scale. It raised money from retail investors worldwide on the promise of a proprietary trading bot, abruptly closed its lending platform in January 2018, and the token collapsed within hours. A federal indictment unsealed in February 2022 charged its founder over a scheme that took roughly 2.4 billion dollars from investors, and he had left the United States.
Distinguish a collapse from an exit. Mt. Gox lost coins over years through theft and mismanagement and its chief executive stayed to face a Japanese court. That is a failure, not an exit scam, and the two need different words because they need different warning signs.
Where you see it
Exit scams cluster where oversight is thin and the deposit is easy to make.
Small exchanges in jurisdictions with no licensing regime are the classic venue, which is why the country guides on this site note whether a local regulator registers virtual asset providers at all. Yield platforms and cloud mining contracts are the next tier, because both give the operator a reason to ask you to leave funds in place. Peer-to-peer brokers who suggest settling outside the platform's escrow are running the same play at individual scale.
Three habits remove most of the exposure:
- Test the exit early. Withdraw a small amount within the first week of using any platform, before there is a balance worth losing. A venue that makes this awkward has told you something.
- Hold nothing you are not actively trading. An exit scam can only take what sits on the platform when the door closes. Coins in a wallet you control are outside the blast radius entirely.
- Treat withdrawal delay as the alarm. Not the second delay, the first. The window between "processing takes longer than usual" and total silence has historically been days, not months.
Exit scam vs rug pull
An exit scam takes custody of your money first; a rug pull never holds it at all. The scammed exchange has your coins in its wallets and disappears with them, which makes the loss a straightforward theft of a specific balance you can name. A rug pull leaves you holding a token that is still in your own wallet and technically still yours, and destroys its market instead. The evidence trails differ too: an exit scam leaves customer records, bank rails, and a company registration, while a rug pull leaves a smart contract and an anonymous deployer address.