GoldBS Exit Scam: Two APKs, One Signing Key, $1.5M Traced

Two APKs, One Signing Key: Taking Apart the GoldBS Exit Scam

A debug certificate, a WebView wrapper, and four TRON wallets. The whole operation is visible in static analysis and public ledger data.

GoldBS sold itself as a crypto and commodities exchange. It ran as an Android app distributed by direct APK download, gathered deposits in USDT, and displayed portfolio balances that users could not withdraw. In June 2026, it stopped working, and users were told to migrate to a replacement platform called CHZBIT and fund the new account with 20 per cent of their old balance to unlock it. That balance never arrived.

Both APKs were recovered before the domains died. What follows is what came out of them, and out of the blockchain. None of it requires trusting anyone’s testimony — every hash and every wallet in this article can be verified independently.

The signing key is the whole story

Android packages are signed by their developer. Extract META-INF/CERT.RSA from each APK and compare fingerprints:

Identical across both files, down to the second of key creation. A signing key cannot be forged or coincidentally collided. Only the holder of that private key produced both packages. The GoldBS platform and the CHZBIT platform that was supposed to rescue its users are the same operation, and that is established cryptographically rather than inferred from branding.

The certificate itself is the second finding. CN=Android Debug is the throwaway key Android Studio generates for local testing. Google Play rejects debug-signed uploads at submission. No release keystore was ever created here, which tells you the software was never intended to go near a review process — and explains why distribution was direct APK download from the operators’ own sites.

There is no trading engine. There is no app.

Both packages are Flutter builds wrapping flutter_inappwebview. The main activity in each is com.web.build_web_app.MainActivity — a generic class name from an off-the-shelf site-to-APK template. Each binary contains exactly one hardcoded endpoint:

• goldwkx.apk → https://goldwkx.com/h5/ios
• chzbitga.apk → https://chzbitga.com/h5/ios

No order matching, no price feed, no wallet implementation, no custody logic. Grep the dex and the Flutter blob, and there is nothing there but a browser frame pointed at a remote page. The /h5/ path is a tell in itself: h5 is the standard route naming for HTML5 mobile wrappers in Chinese white-label platform kits.

Every balance, chart, and “Today’s Earnings” figure users saw was rendered server-side. Change one value on the backend and every user’s portfolio changes. Pull the DNS records and every account ceases to exist, which is exactly what happened — both domains now return ERR_NAME_NOT_RESOLVED, meaning the records were removed outright rather than a server going down.

Package names encode the burn schedule

Random six-letter prefix, embedded build timestamp. That is automated generation: every rebuild produces a fresh package ID so the previous one can be abandoned without collateral damage. The naming scheme is the rotation strategy, wired into the release pipeline.

Note the dates. The CHZBIT successor was compiled on 25 May, fifteen days after the GoldBS build and roughly three weeks before the deposits documented below were collected. The replacement existed before the original failed. The migration was not a response to a collapse; it was scheduled.

Diff the two packages

Of roughly 2,000 files per APK, sixteen differ: AndroidManifest.xml, the three META-INF signature files, classes.dex, both libapp.so builds, resources.arsc, kotlin-tooling-metadata, a baseline profile, and five PNGs. Everything else is byte-identical. One product, a substituted URL, a substituted logo.

Permissions are worth a glance too. Both request CAMERA, RECORD_AUDIO, ACCESS_FINE_LOCATION, ACCESS_BACKGROUND_LOCATION and full external storage. For a WebView shell displaying a trading page, none of that is necessary. Background location in an app with no location-dependent feature is hard to explain innocently.

The money: 1.53M USDT, 4,273 addresses, six days

Everything below is on the public TRON ledger and reproducible at tronscan.org. The token is genuine Tether USDT, contract TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t. Users sent real assets and received a number in a web page.

Step 1: The deposit address is single-use

One traced deposit, 159.38 USDT sent from a Binance account to the address the platform issued:

One minute forty-eight seconds, 14 June 2026. Exact amount in, exact amount out, gas paid by a separate wallet that had delegated energy to the address. The address was activated minutes before the deposit landed and has been dormant since. Generated for one user, swept, discarded. The funds were never in custody, so no trade could have been executed even in principle.

Step 2: the collection wallet

TQgMdDtSqsVF8aewPG5MgYBGmdKVB8vDt2

Step 3: aggregation, and the Ponzi engine in plain sight

TAHAhrTeUG6tjkWatAkgNR6zQ9YpmAgS7u

Two inbound counterparties, 4,194 outbound. The outflow splits cleanly: 696,141 USDT back out to 4,192 wallets at a median of 104 USDT each, and 830,000 onward to extraction. That payout branch is the Ponzi mechanism rendered as ledger data — roughly 46 per cent of deposits recycled as the “withdrawals” and “earnings” that sustained belief and drove recruitment, funded entirely from new deposits. There is no trading revenue anywhere in this dataset because there was no trading.

Step 4: converting out of a freezable asset

TDVLm9ivCsX6Br4iL84rU9Ekn4RDSZstoq

841,292 USDT and 550,000 USDD in, all of it out. The notable function here is USDT converted to USDD. Tether can freeze balances on law-enforcement request and routinely does. USDD is decentralised with no freeze function. Moving victim funds out of USDT before extraction removes the only technical route to recovery. That is not incidental routing; it reflects specific knowledge of which assets are seizable.

Beyond this hop the funds enter wallets carrying hundreds of millions across thousands of counterparties — exchange hot wallets, payment processors, and in one case the USDD issuer contract performing redemption. Those are shared infrastructure serving large numbers of unrelated legitimate users and are not implicated in the fraud. They are noted as trace endpoints because the services running them hold KYC on the accounts that moved these funds, and that material is obtainable on legal process.

The corporate veneer

Two UK companies were registered on consecutive days in October 2024, matching the names of the two apps: GOLDBS LIMITED (16011121) and THOMAS GROUP SERVICE LIMITED (16007931). Both used SIC 82990, a catch-all with no connection to financial services. Neither ever filed accounts or a confirmation statement. Both had their registered office forcibly replaced with the Companies House default address in June 2025, and both were dissolved by compulsory strike-off on 28 October 2025.

This means the entities were legally dead roughly eight months before the deposits above were collected. The registrations were never operating vehicles. They were a Companies House URL to show anyone who asked whether the platform was real.

The register lists one director for both: Mark Brown, American, born January 1985, correspondence address 2081 Lincoln St, Denver, 80202. Read that for exactly what it is. Companies House performs no identity verification on filings — mandatory checks under ECCTA 2023 only commenced on 18 November 2025, three weeks after both companies were dissolved, and neither ever filed a confirmation statement that would have triggered verification. No passport or biometric check was ever performed. The register establishes that a name was submitted. It does not establish that a verified person of that name exists or operated these apps.

What to check in any app before you fund it

• Distributed as a direct APK download rather than through an app store — there is a reason it cannot be listed.
• Domain changes every few weeks. Regulator warnings name domains; rotation makes them unfindable.
• Pull the signing certificate. CN=Android Debug on a financial app means no release keystore exists.
• Decompile and look for a trading engine. If it is a WebView shell with one hardcoded URL, the balance is a rendered string.
• Displayed balance that will not withdraw, followed by a fee, tax or percentage top-up demand to release it.
• A company registration used as a credential. Check whether it is active, whether it has ever filed accounts, and whether the SIC code matches the business.

Sources and artefacts

The British Columbia Securities Commission added GoldBS Group Limited to its Investment Caution List on 24 March 2026 as an unregistered entity offering financial products; IOSCO republished it on 1 April 2026. TOLOnews reported in June 2026 that thousands of Afghan investors had lost access to funds, and Da Afghanistan Bank confirmed that online forex trading is illegal there and that no licence has been issued to anyone for it.

The figures above cover one collection wallet over six days. They are a floor, not a total. Earlier and later domains, the companion app and parallel wallets are outside this dataset.

About this report

Compiled by an affected user. A 12-page evidence report with the full wallet trace, complete APK analysis, all transaction hashes and the underlying CSV exports is available on request to journalists, researchers and investigators. If you lost funds to GoldBS, CHZBIT or a related domain, get in touch — a coordinated filing carries far more weight with investigators than isolated reports.

Name: Jahanzaib WhatsApp: +92 304 8086046

GoldBS Investigation Report

No fee is charged, and no recovery service is offered or endorsed. Anyone who contacts you asking for payment to recover your money should be treated as a further attempt at fraud.