A Nigerian web developer, David Erubure, has been identified as a key figure in a sophisticated international cryptocurrency fraud network that has deceived victims worldwide, according to a joint investigation by the Norwegian Broadcasting Corporation (NRK) and PREMIUM TIMES. The investigation traced the scam network's operations from Norway to Nigeria, linking Mr Erubure's web hosting company, iSkySoftic LTD, to over 300 fraudulent investment websites that collectively received millions of dollars from unsuspecting victims.
The Scam Network's Global Reach
The investigation began in Norway, where investment advice and money-making schemes are prevalent on TikTok. Influencer Mi Le Hagen, who regularly shares stock market tips with her followers, discovered that scammers had created fake profiles mimicking her account to defraud her followers. Between September and November last year, these fake profiles sent direct messages to her followers, recommending a fake investment website called 247autobot.com.
"Right now I'm investing in Bitcoin and making good money from it. I can actually give you a good insight into how you can make money through Bitcoin," the fake profile said, according to the investigation. Victims who invested money on the website watched their supposed returns grow on screen, but the money was never actually invested. The scammers simply stole it.
"Oh my God. I was scammed out of 23,000 NOK (approx. $2,100)," said a victim who did not want to disclose their real name. That amount is approximately N3.3 million using the current exchange rate of N1,344.45 per US dollar.
Unmasking the Scammers
NRK enlisted the help of Daniel Christensen, an ethical hacker who hunts cybercriminals, to unmask the identity of the scammers. Mr Christensen discovered that the scammers had a coding flaw in their websites that allowed him to access their back-end systems. He found lists of unwitting investors and identified one name that caught his attention: "Eagleworker," who had investor profiles on many of the fraudulent websites.
Mr Christensen shared his findings with NRK, which included 100 fraudulent investment websites. NRK subsequently found over 200 more, bringing the total to over 300. The websites shared several features, including a security flaw that made it easy to access their back-end systems and a Norwegian phone number on 55 of them.
One victim, a nurse from the United States, was about to deposit more money into a scam website when Mr Christensen intervened. "She was about to deposit more, so I called her," he recalled. He stopped her from transferring another 3,200 NOK (about $320), but she had already lost about 20,000 NOK (about $2,000).
Millions Lost to Fraud
NRK identified over 140 payment addresses on the scam websites. Together, these addresses had received more than 12 million NOK (about $1.2 million at the time), which is approximately N1.6 billion using the current exchange rate. The payment addresses are changed regularly, and the scammers send the money onward as soon as it is received, making it difficult to trace.
Crypto analyst Arild Møller-Holst from KPMG Norway followed the money trail for NRK. He found that the money was sent to at least 54 different crypto addresses linked to cryptocurrency exchanges. These accounts had received around 700 million NOK (about $74 million), approximately N100 billion using the current exchange rate. Mr Møller-Holst told NRK that either the people behind these accounts are directly involved in the scam, or they are professional money launderers who help criminals move and hide stolen money.
Connecting the Network to Erubure
Mr Christensen discovered that a scam investment website, firstapexpips.org, shared parts of its code with storevase.com, an e-commerce platform that was eventually linked to iSkySoftic, Mr Erubure's company. The iSkySoftic name appeared on the login page of the scam website.
Mr Erubure is listed as the managing director and technical director of iSkySoftic LTD, a company that claims to offer website templates and web hosting. On his personal Facebook profile in 2020, he shared two posts showing that iSkySoftic was offering templates for investment websites. The company also appears to have been successful, with Mr Erubure enticing job seekers with promises of a mouth-watering salary.
However, the hosting provider was also full of fraudulent websites. In 2017, a website registered in his name published a blog post titled "How to start your own Ponzi scheme in Nigeria." Mr Erubure has created many accounts online and used many nicknames, with variations of "eagle" being a recurring one. On his web host, "Eagleworker" was the name that most often appeared on the websites as an investor, with user accounts on more than 25 fake investment websites, apparently used to test that they were functioning as intended.
Investigation Findings and Erubure's Response
The investigation suggests that Mr Erubure is behind the Eagleworker identity. NRK found two instances where these identities appear together. On a crypto platform, there was an account with the username "eagleworker" linked to Mr Erubure's phone number and name.
When contacted for comment, Mr Erubure initially rejected calls from a PREMIUM TIMES reporter. After NRK sent him a 1,100-word email with allegations and questions, he replied after 37 minutes, saying, "Hello, I'm glad to hear from you and I believe there may be errors in your investigations." The 32-year-old confirmed that the web host belongs to his company but denied any involvement in fraud. When asked about the Eagleworker account, he said, "It must have been someone who knows me who set up an account in hopes of recruiting me."
On selling website templates for investment websites, Mr Erubure admitted that his company previously sold website facades, but not full websites, and that this was discontinued a few years ago. He argued that the templates can be used for good or harmful purposes, saying, "Knife used for cooking can create joy, but it can also be used for wrong purposes."
When asked what he would say to those who have lost their money to websites hosted by him, Mr Erubure said, "I am deeply sorry and understand what it means for someone to lose money as I have been a victim too. I learnt something from our conversations this past week. What I am sure to do from hence forth is to do a follow up check on websites hosted on our infrastructure."
Legal Implications and Calls for Action
The investigation found no indication that Nigerian agencies are currently investigating Mr Erubure, nor has he been found guilty of any crime. However, fraud of any kind is illegal in Nigeria. The Advance Fee Fraud and Other Fraud Related Offences Act 2006 prescribes imprisonment for up to 20 years for offenders. The Cybercrimes Act, originally enacted in 2015 and amended in 2024, also makes computer-related fraud a crime, with offenders facing at least five years' imprisonment and a fine of at least N10 million.
Monday Ubani, a Senior Advocate of Nigeria, told PREMIUM TIMES that any computer-related fraud, such as fraud committed through scam investment websites, falls under the Cybercrimes Act 2024. "The facts of the case will determine the charges to be filed against an offender, but it will generally come under the Cybercrimes Act (2024)," he said.
Back in Norway, influencer Mi Le Hagen was presented with the findings of the investigation. "It is possible to follow the money to Nigeria," she said, calling for international cooperation to stop the scammers more quickly. "I wish that at a higher political level, there would be international cooperation to stop the scammers more quickly," she added. The investigation's findings highlight the global nature of cyber fraud and the need for cross-border collaboration to combat it.
