Crypto Arbitrage Between Exchanges: Why It’s a Scam

"Guaranteed 15–30% profit in a couple of hours. Legal arbitrage route. Valid only today." This is roughly what the ads that hook beginners look like. In every second "success story" from such posts, funds get stuck at the second or third exchange stage. The promised profit turns into "waiting for AML verification," "we will return it within 30–60 days," and then endless requests for documents begin. The result is always the same: loss of funds, nerves, and time. In this article, we break down how P2P scams via "arbitrage routes" work and why they are scams.

In this article:

1. How P2P arbitrage works and where "arbitrage routes" came from
   1.1 A typical example of a route: a step-by-step breakdown
   1.2 Where exactly money is lost — technically
   1.3 What red flags can be spotted immediately
2. Who lures whom into the route: a fraud role map
   2.1 Common "freezing" scenarios
3. What to do if you have already sent cryptocurrency

How P2P arbitrage works and where "arbitrage routes" came from

In simple terms, P2P arbitrage is an attempt to profit from the price difference between platforms. A user buys cryptocurrency on one platform cheaper and sells it on another slightly higher. For example, buying USDT on Bybit for 90 ₽ and selling it on Huobi at the same moment for 92 ₽. The difference is 2 ₽ profit. In a normal market, this is a real strategy, but it requires speed, volume, and precise calculations.

The problem began when pseudo-arbitrageurs appeared around this idea, promoting ready-made "routes." On Telegram, forums, and even YouTube Shorts, they are presented as legal ways to make money.

"Buy 100 USDT on a legal exchange → swap for 0.5 XMR → sell XMR for 120 USD."

At first glance, everything is logical: well-known platforms, understandable currencies, screenshots with supposedly successful exchanges. This is exactly what makes the scheme plausible.

• The first step is always "white" — the victim actually buys crypto on a legal exchange.
• The second step is the bait. Scammers offer an "exchange at a favorable rate" elsewhere, where you just need to send the coin.
• The third step is the trap. As soon as the coins leave the exchange for their "exchanger," the money gets stuck. The scammers report that the "transaction is suspended due to AML verification" and suggest "waiting 30 days" or "sending documents."

Why does it work this way? Accepting rubles is risky. It is easier to steal cryptocurrency, especially Monero (XMR). This coin has high privacy, and its transactions cannot be tracked.

Such "arbitrage routes" are tempting because they mention real platforms (Bybit, KuCoin, MEXC P2P) and everything starts as an honest deal. But it ends with funds being sent to a wallet from which they will never be returned.

A typical example of a route: a step-by-step breakdown

Imagine an ad like this: "Buy 100 USDT → rotate through XMR → get back 120 USD. Guarantor — major exchange (Bybit). 20% profit in a couple of hours." On paper — +20%. In reality, the theft happens at steps 2–3.

Step 1. Preparation

• The chat/post shows a screenshot with rates and "real" payouts.
• The person is assigned a "curator," given a link to instructions, and a limited window (e.g., the promotion ends tonight).

Step 2. Entry point

• What the user does: transfers rubles to Bybit (or P2P) and buys 100 USDT.
• Result: USDT is credited within a few minutes. Everything looks clean.

Step 3. Transfer to a fake exchanger

• What they usually say: "Send 100 USDT to this exchanger to swap for XMR, it has the best depth."
• What the user does: transfers 100 USDT to the address they sent.
• Why it is dangerous here: this address is controlled by scammers. Up to this step, the money was on the exchange (partially protected by rules and the possibility of a dispute). Once the coins go into someone else's wallet, they cannot be returned.

  Typical phrases used by scammers after sending:

  "Suspicious transaction, AML verification required."

  "Send proof of source of funds."

  "Selfie with passport/video call required."

  "We will return everything within 30 days."

Often, they send promises and a partial minimal refund to build trust, but in fact, they are just stalling for time.

Step 4. Exchange into a privacy coin

What they promise: to exchange USDT for 0.5 XMR (or another privacy coin), then sell XMR for more and return USD.

Why it is convenient for scammers: The privacy of Monero makes it impossible to track the further movement of funds, so there is no possibility of a refund.

For example:

• The person sent 100 USDT.
• They were promised 0.5 XMR → on paper, this is equivalent to 120 USD.
• In reality, the XMR either does not arrive, or it arrives at addresses controlled by scammers and then goes into mixers or cold wallets.

Step 5. "Delay" and constant demands

Standard delay scheme:

• 1–3 days: "AML verification, we will return it soon"
• 7–14 days: "Additional documents needed" (passport, proof of income, statements)
• 30+ days: "Data under review"

Where exactly money is lost — technically

Funds are sent to an address that is under the control of scammers, and such transactions on the blockchain cannot be canceled. After receipt, the cryptocurrency is usually quickly distributed across multiple addresses and passed through services that make tracking difficult to hide further movement.

What red flags can be spotted immediately

• Promise of 10-30% profit in a few hours.
• Direction to an exchanger without a reputation: new domain, few reviews, weak history.
• Requirement to transfer the entire amount at once under the pretext of a limited "window."

Who lures whom into the route: a fraud role map

The scammers' task is to create the appearance of a legal deal, take the money, and cover their tracks. Let's break down each role, what it does, and how to distinguish it from an honest participant.

1) Initiator / advertiser. This is a Telegram account/channel/financial blogger/chat that distributes an ad about guaranteed profit on a route. They publish an attractive ad with a screenshot of "real" profit, provide a link to instructions, and a curator's contact. They often add reviews and fake success stories.

Under no circumstances should you click on links from suspicious posts or message them first!

2) Curator / personal manager. This is a contact in the chat who guides you from step to step. They may give instructions and control the timing. They administer the deal, provide exchanger addresses, ask to urgently transfer the entire amount, and manipulate you.

Their task is to speed up the transfer. They always pressure you with urgency. They ask to transfer the entire amount at once and do not offer a test transfer.

3) Entry point (legal exchange / P2P). A familiar and reliable platform where you make the first transaction (e.g., Bybit, P2P section of major exchanges). But in fact, it only gives you a starting balance. This part of the operation often goes without problems.

4) Fake exchanger (the main danger). The site to which you transfer crypto for further rotation. This is where the theft most often occurs.

What is important to pay attention to:

1. Domain: WHOIS (registration date), owner, country. New domains are always a risk.
2. Whether the exchanger is on reputable monitoring sites (e.g., Antiswap).
3. Transaction history of the address: if funds quickly leak into mixers/new addresses, this is a red flag.
4. Before exchanging, it is always worth doing a test transfer so as not to lose all funds at once.

5) Guarantor / intermediary (often fictitious). A person or service promising to act as a guarantor (escrow) so that both parties are calm. Most often, this is a plant. Their goal is to create a sense of security and lull your vigilance, after which you transfer a large amount.

It is important to consider that a real escrow is not a "person from a chat," but a public platform with clear rules, history, and reputation. A safe option is considered to be conducting a deal only through official escrow services.

Common "freezing" scenarios

What to do if you have already sent cryptocurrency

The chance of a refund is usually zero, however, timely documentation of evidence helps to save important data, reduce additional risks, and in some cases contributes to the subsequent blocking of fraudulent addresses.

Below is a step-by-step plan of what a user needs to do after falling for this scam scheme:

➜ Document all information while the trail is still fresh

• Screenshots of all correspondence (Telegram, WhatsApp, email).
• Addresses of the scammers' wallets.
• TXID (transaction identifier) — it can be found in the wallet history or a blockchain explorer.
• Links to the exchanger site and all payment details (cards, crypto addresses, accounts).
• Curator's contacts and the time they were online.

➜ Check the movement of funds through a blockchain explorer

• date and time of the transfer;
• final address;
• chain of transactions (where the coins went next).

➜ Write to the support of the legal platform where you received the cryptocurrency and ask to mark the address as suspicious

Some exchanges do mark such wallets as "Risky" and block them during repeat operations. This will not return the money, but it may save others.

➜ Under no circumstances pay for a refund

After the first scam, "helpers" often appear:

• "We can unblock your USDT for a 5% fee"
• "We work with the Bybit department, we will return it in 3 days"

In 99% of cases, this is a second wave of scammers. No one can unfreeze funds without control over the address to which they went.

➜ Draw conclusions and set up security

Getting money back after a loss is almost impossible, but you can stop scammers for others and prevent such a situation for yourself in the future. You can publish the information and warn the community. Each documented story is another chance that their wallets will end up in a risk database.