Between February 25 and March 6, 2026, a case of selective scamming was recorded on the BitcoinTalk platform during cryptocurrency exchange via the Jud-EX.com service. A user with the nickname QI2FY, after successfully completing several previous exchanges, initiated a transaction to convert 1.00662 BTC to XMR. Initially, the system confirmed the receipt of the deposit, but after refreshing the page, the order status changed to "Order not found". Despite repeated appeals to support, the user received neither the XMR equivalent nor a refund in BTC. Blockchain analysis confirmed that the sent BTC were redirected with a 99.8% fee, indicating clear fraud.

An investigation conducted by user albon revealed a UI Overlay Scam mechanism. The analysis showed:

• The main transaction page displayed an amount of 1.006 BTC (~$69,000 at the time)
• In the internal system ("Swap Steps"), processed through the 'solver-priv-liq.near' wallet, only 0.002 BTC (~$138) was actually moved
• The remaining funds (~1.0046 BTC) were redirected by the scammers

albon provided a video recording that documented the connection between the Jud-EX interface and the fraudulent addresses, as well as the fact that the service continued to use the same 'solver-priv-liq.near' wallet at the time of the investigation.

An investigation conducted by users Trêvoid and JeromeTash revealed:

• The domain jud-ex.com was registered just 2 weeks before the incident (around mid-February 2026)
• The service was actively promoted on several cryptocurrency forums, but had no significant reputation or operational history
• Connections were found with other suspicious platforms, such as darkmap and byware, which used the same Near-Intents wallet

Further OSINT investigation conducted after the incident was published showed that Jud-EX is part of a wider network of fraudulent cryptocurrency exchange services, which includes:

• darkmap.com
• byware.net
• nokyc-noaml.com

All these platforms use the same Near-Intents wallet (solver-priv-liq.near). They practice selective scamming (servicing small transactions to create the illusion of functionality, while appropriating large amounts). They quickly change domains after being exposed, launching new platforms under different names.

This case highlights the importance of thoroughly vetting any cryptocurrency services, especially new ones, and the need to conduct one's own due diligence before entrusting them with funds. The community is encouraged to actively share information about such incidents to protect other users.