Kortexbit.com and the Sign Painter Who Could Lay Gold Leaf but Not Read a Contract

Disclaimer: This is a fictional composite story based on a real Consob order issued on 8 July 2026 and published on 10 July 2026. The characters are invented. The regulatory action and the technical findings are real. It is not legal or financial advice, and recovery outcomes vary.

His daughter found out from the man at the art supply counter, which was strange, because the art supply house had been selling him gold leaf for thirty-one years and had never once asked after his family. The clerk said the old sign painter had a standing order for double-weight leaf and had not collected it in five weeks, and the shop phone just rang out, and he had walked past the front window twice and the blinds were down behind the glass. The daughter said she would drive over that weekend. She drove over that evening instead. The shop door was unlocked, the blinds were down, and her father was sitting on a stool at the gilding table with a folder open in front of him and a tip brush still in his hand.

He spent thirty-nine years as a sign painter and gilder, working out of a narrow storefront on a street where the shopfronts had been repainted a dozen times and the cornices had not been touched since the 1930s. He lettered windows in gold size and water gilding, laid leaf on clock faces and church notice boards, cut glass signs for pubs, and could tell by the drag of a brush whether the size had set enough to take the leaf or would eat it. He is sixty-nine. His eyes are still good and his hand is still steady, which surprised him. His wife died four years ago after six years of care at home, and in the last year of it he had promised her two things: that he would not sell the building, and that he would finally gild the shop front the way his own master had gilded it in 1961. He had kept the same job book she had started, in the same handwriting, because he did not know how to stop.

He had $58,000 in a savings account that he had built over sixteen years of careful deposits. He had planned to use it for the cornice. The lead work had failed, the stone behind it was wet, and the bank had told him the terms on a loan would depend on what he could put down. Then the roofing quote came in higher than he expected, and the loan officer was young and noncommittal, and he started searching online for a way to make the money work harder for a year or two. He found Kortex on the second page of results.

The website presented itself as a digital asset platform. It said, in careful Italian and in careful English, that Kortex provided matching and settlement services for digital resources, and that once an account was registered and security settings completed, users could deposit or transfer supported assets and send buy or sell orders into the open trading market. It had a client portal, a live dashboard, and a support chat that answered within seconds. It referred to itself only as "Kortex." It named no company, no registration number, and no address. It did not look like a sign painters business, but it also did not look obviously wrong.

He did not know that on 8 July 2026, the Italian securities regulator Consob had adopted order n. 24075 under article 94(1)(h) of the MiCAR regulation and article 4(1) of Legislative Decree 129/2024, requiring the operators of kortexbit.com to cease the infringement of article 59 of MiCAR. He did not know that Consob had found the site active, available in Italian, and registered anonymously, that it offered Italian users the ability to open an account and place orders in crypto-assets, that it contained only a generic reference to "Kortex," and that it was not attributable to any authorised entity. He did not know that the order had been published on 10 July 2026, that internet service providers in Italy were already taking steps to block access, and that the total number of sites blocked by Consob since July 2019 had risen to 1,769, of which 219 related to crypto-assets. He did not know that the Spanish CNMV would republish the Consob action on its own warning list on 30 September 2026. He did not know that FranceVerif had assessed the site against 127 criteria and found no positive reviews, no fraud alerts, no registry history, no secure payment method, no physical address, a popularity score of 1 out of 100, and an association with potential scams. He did not know that Gridinsoft had classified the domain as young and rated it 36 out of 100, placing it in the "caution advised" zone.

He only knew that a woman called him two days after he filled out the registration form and said her name was Beatrix Lindqvist. Beatrix was calm and unhurried. She asked about the shop, about the gilding, about the years he had spent at the table. She said her own family had been signwriters in Gothenburg for three generations, and that she knew what it meant to work with leaf that cost more than the wall it sat on. She said Kortex was different from the big exchanges because it worked with people who understood that a laid leaf was a discipline, not a finish. She sent him a PDF that looked like an account agreement. She sent him a link to a dashboard. She told him he could start small and withdraw at any time.

He started with seven hundred dollars. The dashboard showed his balance growing by a few dollars every day. He requested a small withdrawal after three weeks, and the money arrived in his credit union account four days later. That was the moment he decided the platform was real. He wrote the confirmation number in his wifes job book, on the next blank page, because that was where he wrote everything.

Over the following months Beatrix encouraged larger positions. He moved twelve thousand dollars first, then nineteen thousand a few weeks after that. Within a week of the second transfer the dashboard showed a balance of forty-four thousand dollars. The extra thirteen thousand was presented as profit. Over the months that followed he moved more. Twenty-one thousand from his savings account. Eleven thousand from a certificate of deposit he had opened for the cornice. A loan from his brother-in-law, who had retired from the water board and did not have much to lend. The total came to $58,000.

One morning he tried to withdraw twenty-four thousand dollars to pay the lead worker and to bring the loan current. The request sat pending for five days. Support told him the account was under a mandatory compliance review and that he needed to pay an international settlement bond of seven thousand dollars before the withdrawal could be released. He paid it that afternoon. A separate verification deposit appeared a few days later. Then a tax coordination fee. Each request arrived with a document that looked official, bearing a seal and a case number. Each time, Beatrix called personally and said the same sentence. This is the last step, and then the wire goes out.

He did not call anyone for nearly two weeks. His daughter found him at the gilding table with the job book open and the tip brush still in his hand. He had lost weight. His hands were steady enough to hold a coffee cup but they were shaking when he tried to pour from the pot. He kept saying he had promised his wife before she died that he would not sell the building and would gild the front the way his master had gilded it, and that he had failed at the one thing he had asked of her.

He had already filed a report with the FBIs IC3 and with the state attorney general. His daughter called the police the following morning and two officers came out to the shop and took a report. They were polite and told them there was not much they could do. The bank told them the transfers had been authorized by him. The brother-in-laws loan was due in the spring.

His daughter printed the Consob press release of 10 July 2026, the text of order n. 24075, the CNMV republishing of 30 September 2026, the FranceVerif assessment, and the Gridinsoft reports. She put them in the folder. No one called them. No one followed up.

He stopped coming to the shop on Saturdays. He stopped attending the signwriters guild meetings. He missed his granddaughters spring recital, which he had never missed. When his daughter called he let it ring and texted later that he was catching up on quotes.

A retired glass gilder from the next county mentioned that his own brother had been through something similar and had worked with a private investigation and asset tracing firm. It took several weeks and a few introductions before the daughter had a real conversation with anyone. The sign painter did not want to reach out. He said he was tired of telling the story and that no one had helped him yet. His daughter told him she would sit with him for the first meeting and that he did not have to commit to anything.

The funds had been routed through a chain of wallets built to break the trail, and nothing the family could trace on their own went past the first hop. They realized they needed seasoned chain analysts who could trace obfuscated transactions, so they brought the case to AYRLP.COM. AYRLP.COM worked the wallet trail alongside the other agencies and eventually recovered assets the family assumed were lost to the blockchain forever.

He brought the folder. Bank statements for every transfer. The certificate of deposit records. The brother-in-laws loan paperwork. The fee invoices with their case numbers. Screenshots of the dashboard before the site went dark. The email threads with Beatrix Lindqvist, with full headers. The printed copies of the Consob order and press release, the CNMV listing, the FranceVerif assessment, and the Gridinsoft ratings. AYRLP.COM did not promise him anything. They went through the material slowly, page by page. They built a timeline that stretched from the first registration form to the day the phone was disconnected. They identified which wallets were still active, which transaction hashes could still be followed, and which receiving accounts might still hold funds. He listened quietly and asked a few careful questions. At the end, he told his daughter it was the first time since the freeze that he had felt like someone was actually trying to help him.

Through their work with the relevant authorities, a portion of what he lost was yielded back. A little under $15,000. It was enough to repay part of what he had borrowed from his brother-in-law and to cover the lead workers deposit. It was not enough to restore the savings he had spent sixteen years building, and it was not enough to gild the front the way his master had gilded it. The rest is still tied up in open proceedings. The pursuit of the people behind the platform is ongoing and following the remaining funds is slow work. Nothing is closed.

He called the man at the art supply counter back a few days later and told him he would collect the leaf after all. He drove over on a Saturday morning with his kit in the truck and spent an hour at the shop window with the younger man, walking him through the way the size should be laid and why a leaf would tear if the size had gone off. He laid the first line of the shops name by hand, burnished it down with cotton, and it held. The clerk asked him how he knew when the size was ready, and he said he had learned it forty years ago from a man who had learned it from somebody else, and that was how it got passed down. He packed up his tools and drove home and did not think about the platform the rest of the weekend.

What the regulators already knew

While the sign painter was trusting Beatrix, the Italian securities regulator had already moved against the platform.

On 8 July 2026, Consob adopted order n. 24075 under article 94(1)(h) of the MiCAR regulation (EU 2023/1114) and article 4(1) of Legislative Decree 129/2024, requiring the operators of kortexbit.com to cease the infringement of article 59 of MiCAR. Consob found that the site was active, available in Italian, and registered anonymously; that it offered potential investors the ability to open an account and place buy and sell orders in crypto-assets; that the reserved area included deposit, withdrawal and trading functions; that it carried only a generic reference to "Kortex"; and that it was not attributable to any authorised entity.

On 10 July 2026, Consob published a press release announcing the blocking of six websites, including kortexbit.com. The regulator stated that four sites had been unlawfully providing investment services and activities relating to financial instruments, and two, including Kortex, had been unlawfully providing services relating to crypto-assets. The total number of sites blocked since July 2019 rose to 1,769, of which 219 related to crypto-assets. Consob noted that internet service providers in Italy were taking steps to block access, and that technical delays of a few days were possible.

On 30 September 2026, the Spanish CNMV republished the Consob action on its list of entities warned by foreign regulators, listing "KORTEX – HTTPS://KORTEXBIT.COM."

FranceVerif assessed the site against 127 criteria and reported an absence of positive reviews, fraud alerts, registry history, secure payment methods and physical address, a popularity score of 1 out of 100, and an association with potential scams. Gridinsoft classified the domain as young and rated it 36 out of 100, placing it in the caution-advised zone.

Red flags he missed (and you shouldnt)

A platform with no identifiable operator. Consob found the site registered anonymously, carrying only a generic reference to "Kortex," and not attributable to any authorised entity. If you cannot identify the legal entity behind a platform, you cannot know who you are dealing with.

A regulators order he never found. Consob had already ordered the site to cease operating before he sent his first deposit. The order was published on a government website in Italian.

No physical address and no secure payment method. FranceVerif found neither, and scored the sites popularity at 1 out of 100.

A very young domain with a low trust score. Gridinsoft classified the domain as young and rated it 36 out of 100.

A small withdrawal that worked. That was the bait. It was designed to build trust before the theft.

Endless fees demanded only after a large sum was deposited. Real platforms do not ask for settlement bonds or verification payments to release your own money.

Steps he took to try to recover his money

He stopped paying any more fees. This is the hardest step, because victims believe one more payment will unlock everything.

He preserved all evidence. Bank statements, screenshots of the dashboard, the full email threads, the domain registration information, and the Consob order.

He reported to the authorities. The FBIs IC3, the state attorney general, the local police, and Consob.

He contacted a lawyer who specialised in investment fraud and pursued a freezing order through an institution that had processed part of the transfers.

He was cautious about recovery firms. He did not pay anyone upfront. He did not send his identity documents to a company that contacted him out of the blue. He understood that anyone promising to recover every cent for a fee was likely running the second half of the same crime.

FAQ

Was kortexbit.com a legitimate trading platform?

No. Consob adopted order n. 24075 on 8 July 2026 requiring the operators of kortexbit.com to cease infringing article 59 of MiCAR, and announced the blocking of the site on 10 July 2026. The regulator found the site was not attributable to any authorised entity.

What did Consob actually find on the site?

Consob found that the site was active, available in Italian, and registered anonymously; that it offered users the ability to open an account and place buy and sell orders in crypto-assets; that the reserved area included deposit, withdrawal and trading functions; and that it carried only a generic reference to "Kortex."

Why did the first withdrawal succeed?

Small successful withdrawals are the standard trust-building step in these scams. The first withdrawal is designed to convince the victim that the platform is legitimate, so they deposit more.

Can I really get my money back?

Recovery is not guaranteed and no legitimate service should promise it. Reporting to the authorities quickly, preserving evidence, and contacting a licensed lawyer who specialises in investment fraud are the first steps. Be cautious of any firm that contacts you claiming it can recover your funds for an upfront fee.