A months-long investigation by Norway’s NRK and BEN TELEVISION has uncovered a sprawling investment scam network targeting victims through fake cryptocurrency websites, with a Nigerian web developer’s hosting infrastructure linked to hundreds of suspected fraudulent platforms.

David Erubure, a 32-year-old web developer and IT expert based in Warri, Delta State, is at the centre of the investigation. While neighbours and social media followers know him as the owner of a web-hosting business, investigators found links between his company, iSkySoftic, and websites allegedly used to defraud investors in Norway and other countries.

The investigation does not establish that Erubure committed fraud, and there is no indication that he has been charged or convicted of any crime. Erubure has denied involvement in fraudulent activities.

How the scam worked

The investigation began in Norway, where scammers used fake TikTok accounts impersonating investment influencers to lure victims into cryptocurrency schemes.

One of the influencers targeted was Mi Le Hagen, whose identity and photographs were copied to create convincing fake profiles. Followers were contacted through direct messages and encouraged to invest through websites such as 247autobot.com.

Victims were shown fake investment returns on the websites but could not withdraw their money. Instead, they were repeatedly asked to pay additional fees or taxes.

One victim told investigators she lost 23,000 Norwegian kroner, equivalent to about $2,100 at the time.

Hundreds of fake investment websites uncovered

Ethical hacker Daniel Christensen began examining one of the suspected scam websites and discovered vulnerabilities that provided access to parts of its backend.

His investigation initially identified about 100 fraudulent investment websites. Further checks by NRK uncovered more than 200 additional websites sharing similar characteristics.

Investigators found common coding features across many of the platforms, while some contained Norwegian telephone numbers and documents allegedly uploaded by users to verify their identities.

The investigation also identified more than 140 cryptocurrency payment addresses associated with the websites.

According to a cryptocurrency analysis conducted by Arild Møller-Holst of KPMG Norway for NRK, funds were transferred through at least 54 crypto addresses linked to cryptocurrency exchanges.

Those addresses had received about 700 million Norwegian kroner, or roughly $74 million, although the investigation could not establish that all of the funds were proceeds from the scam network.

Nigerian connection

Investigators subsequently traced part of the digital infrastructure to Store Vase, an e-commerce platform linked to Erubure’s IT company, iSkySoftic.

A suspected scam investment website, firstapexpips.org, was found to share portions of its code with StoreVase.

The investigation also found that iSkySoftic’s name appeared on the login page of one of the websites under investigation.

Erubure is listed as managing director and technical director of iSkySoftic, a company that provides web-hosting services, templates and software.

Investigators also found historical online activity associated with Erubure, including a 2017 website post titled “How to start your own Ponzi scheme in Nigeria.”

The investigation further linked the username “Eagle worker” to more than 25 suspected fake investment websites.

On one cryptocurrency platform, an account using the Eagle worker name was linked to a telephone number and name associated with Erubure.

Erubure denies involvement

Erubure denied involvement in fraud when contacted by NRK.

He confirmed that the web-hosting infrastructure belongs to his company but said neither he nor iSkySoftic was involved in fraudulent activities.

He also acknowledged that the company previously sold website facades and scripts but said these were not specifically designed for investment fraud.

According to Erubure, customers could use the scripts for legitimate or illegitimate purposes.

He also disputed the suggestion that he operated the Eagleworker account, saying someone who knew him could have created the account.

When asked about victims who lost money through websites hosted on his infrastructure, Erubure expressed sympathy and said the investigation had prompted him to consider carrying out additional checks on websites hosted by his company.

Warri visit

A BEN TELEVISION reporter who visited Erubure’s former residence in the Izomo Idum area of Warri found an unfinished story building containing several flats.

Neighbors and shop owners confirmed that Erubure had lived there before reportedly moving elsewhere after his marriage.

Attempts to obtain further information from people connected to him produced limited responses.

Erubure initially declined several calls from BEN TELEVISION reporters before later communicating with the investigators.

Investigators trace money across borders

The investigation suggests that the suspected fraud network operated across several countries, with scammers using fake social media profiles, cloned identities and fraudulent investment platforms to target victims.

Investigators said the movement of cryptocurrency through multiple addresses and exchanges made it difficult to determine the final beneficiaries of the money.

The analysis by KPMG Norway identified a much larger flow of funds through cryptocurrency addresses connected to exchanges, raising questions about whether the accounts belonged to people involved directly in the scams or professional money launderers.

No charges against Erubure

There is currently no indication that Nigerian law enforcement authorities are investigating or prosecuting Erubure over the allegations detailed in the investigation.

He has not been convicted of fraud.

However, Nigerian law criminalizes various forms of financial and computer-related fraud.

Under the Advance Fee Fraud and Other Fraud Related Offences Act, obtaining property through false pretense with an intention to defraud is a criminal offence. The Cybercrimes Act 2024 also provides for offences involving computer-related fraud.

Lawyer and Senior Advocate of Nigeria, Monday Ubani, told BEN TELEVISION that the specific facts of a case would determine the charges, but computer-related fraud could fall under the Cybercrimes Act.

Calls for international action

Back in Norway, influencer Mi Le Hagen said the investigation showed the need for stronger international cooperation against online fraud.

She said the movement of funds across borders made it possible for scammers to operate from one country while targeting victims in another.

The investigation highlights the increasingly international nature of online investment fraud — with victims recruited through social media in Norway, fraudulent websites hosted through infrastructure linked to Nigeria, and cryptocurrency transactions moving through multiple addresses and exchanges.

For now, however, a key question remains unanswered: who is ultimately behind the network, and where did the stolen money go?