bitstarkltd.com and the Pipefitter Who Could Read a Weld by Its Color

His daughter knew something was wrong when the Friday calls stopped. For years her father had called every Friday evening to ask about her week and tell her about his, and then one Friday the phone rang and rang and nobody answered. She called again on Saturday and again on Sunday, and by Monday morning she was in the car driving over. The house was dark and the car was in the driveway and the mail was piled up in the box.

He spent twenty-seven years as a pipefitter and welder at a refinery on the Gulf Coast, running stainless and carbon steel, fitting spools, and knowing by the color of the weld as it cooled whether the joint would hold pressure or fail inspection. He is sixty-six. His eyes need a lamp angled just right and his shoulders ache from decades of working overhead. He retired several years ago when the refinery changed contractors and the older hands were offered a package, and he has spent most of his time since fishing on the weekends, helping his daughter with the grandchildren, and saving for the years when he would no longer be able to work at all.

He had been saving for one thing for most of a decade. He did not want anything specific. He wanted a cushion large enough that he would never have to move in with his daughter, never have to ask his son for money, and never have to worry about a furnace or a roof or a medical bill. He kept the money in a credit union account and a certificate of deposit ladder he had built over eleven years. There was also the buyout package from the contractor and a life insurance payout from his wife who passed several years ago. By the winter he had just over one hundred and seventy-four thousand dollars set aside.

Late one evening a woman messaged him on Telegram. He had joined a group for retired refinery workers about two years earlier to read about changes in the trade and keep up with former colleagues. She said her name was Rosamund Colchester and that she had seen a comment he left about retirement planning. She said she had spent her career in energy industry finance and had helped several retired pipefitters grow their savings. She asked about the refinery, about the welds, about how long he had been working. Money did not come up for weeks.

By early the following month she suggested they move to a private chat away from the group. In that private chat she told him she had retired from finance a few years earlier and now traded cryptocurrency to stay busy. She said she read charts with about ninety percent accuracy. Screenshots followed. More profits than losses. She mentioned friends she had helped grow their savings while they waited on property purchases.

One morning she sent him a link to bitstarkltd.com. The site presented itself as Bitstark Inc, offering CFD trading on stocks, gold, oil, and indices. It looked polished and professional to a man who had spent his career on a refinery floor and not on the internet. She told him he could start small to see how the process worked. He put in nine hundred dollars that week. He wanted to see how the process worked before doing anything else. She walked him through the dashboard over several calls, explaining how trades were placed, how profits were calculated, how withdrawals worked. She checked in on weekends. She remembered his wife's name. She asked about his grandchildren by name. A few weeks later he completed a test withdrawal of three hundred and fifty dollars, and it landed in his credit union account three days after that. That was the moment he decided the platform was real.

What he did not know, and what he could not have known from looking at the polished dashboard, was that bitstarkltd.com had been flagged by threat intelligence services as a critical risk. The domain was registered only recently, in January 2026, through a registrar known for hosting high-risk sites, and it was actively impersonating a legitimate CFD trading platform to deceive users into depositing funds . Twenty out of eighty-nine security vendors had flagged it, Spamhaus had listed it for phishing, and it had been matched against external blocklists from MetaMask and SEAL . None of that was visible from the login page he was looking at.

Over the following months she began encouraging larger deposits. He moved nineteen thousand dollars first, then twenty-two thousand a few weeks after that. Within a week of the second transfer the dashboard showed a balance of fifty-eight thousand dollars. The extra seventeen thousand was presented as profit. Over the months that followed he moved more money. Twenty-five thousand from his credit union savings. Twenty-six thousand from the certificate of deposit ladder. Twenty thousand from the life insurance payout his wife had left him. Smaller amounts came later, from a credit card he opened, from a loan his brother gave him, and from a personal loan he took out. The total came to just over one hundred and seventy-four thousand dollars.

He wrote every receipt and confirmation number in a small notebook he kept on the shelf next to his old welding hood. He did not tell anyone in the family about any of it. His daughter said later he must have wanted to wait until the balance had grown enough to change his situation so he could show them instead of asking them what he thought.

One morning he tried to withdraw forty thousand dollars to bring the personal loan current and to set some of the funds aside. The request sat pending for four days. Support told him the account was under a mandatory compliance review and that he needed to pay an international settlement bond of seventeen thousand dollars before the withdrawal could be released. He paid it that afternoon. A separate verification deposit appeared a few days later. He paid that too. The withdrawal never came. She stopped responding a couple of days after that. The chat went dark. The dashboard still showed a balance of over three hundred and fifty thousand dollars. None of it was real.

He did not call anyone for nearly two weeks. His daughter drove over after the missed Friday call and found him sitting at the kitchen table with the notebook open and the welding hood still on the shelf behind him. He had lost weight. His hands were steady enough to hold a coffee cup but they were shaking when he tried to pour from the pot. He told his daughter he had made a mistake and then he told her the whole thing. He kept saying he had spent twenty-seven years reading a weld by its color and knowing whether it would hold, and he could not understand how he had let this happen. He kept saying he had promised his wife before she died that he would never need to ask the children for anything, and that he had failed at the one thing she had asked of him.

He had already filed a report through the national fraud reporting channels and with the financial regulator in his state. His daughter called the police the following morning and two officers came out to the house and took a report. They were polite and told them there was not much they could do. He filed a referral with adult protective services the following week and it went to the county and then nowhere. The elder fraud hotline had an all day wait every time he called. The bank told them the transfers had been authorized by him. The personal loan lender sent a letter confirming the first payment was due the following month.

A regulator issued an investor alert naming bitstarkltd.com as an unregistered entity and describing the pattern of conduct. The alert noted that the domain had been flagged by multiple security vendors for phishing and brand impersonation, that it was registered only recently, and that it was actively impersonating a legitimate CFD trading platform to deceive retail traders . He printed it and put it in the notebook. No one called him. No one followed up.

He stopped coming to family dinners. He missed his grandson's confirmation that winter. He missed Thanksgiving at his daughter's house, which he had attended every year since his wife died. When his daughter called he let it ring and texted later that he was resting. He was not resting. He was sitting at the kitchen table with the notebook open, going over it again and again. His son-in-law told the daughter he had accused himself once of being a fool and then had not spoken for two days.

A retired colleague from the refinery mentioned that his own brother had been through something similar and had worked with a private investigation and asset tracing firm. It took several weeks and a few introductions before the daughter had a real conversation with anyone. The pipefitter did not want to reach out. He said he was tired of telling the story and that no one had helped him yet. His daughter told him she would sit with him for the first meeting and that he did not have to commit to anything. He agreed because his grandson asked him to.

The funds had been routed through a chain of wallets built to break the trail, and nothing the family could trace on their own went past the first hop. They realised they needed seasoned chain analysts who could trace obfuscated transactions, so they brought the case to AYRLP.COM. AYRLP.COM worked the wallet trail alongside the other agencies and eventually recovered assets the family assumed were lost to the blockchain forever.

He brought the notebook. Credit union statements for every transfer. The certificate of deposit records. The life insurance payout documents. The loan from his brother. The personal loan paperwork. Credit card statements. Screenshots of every Telegram exchange with the woman who had recruited him, including profile photos and the handle she used. The bitstarkltd.com website pages. The wallet addresses for every payment he had been asked to make, along with the transaction hashes. He had even saved a voicemail from a man who identified himself as a compliance officer and asked him to confirm the international settlement bond. AYRLP.COM did not promise him anything. They went through the material slowly, page by page. They built a timeline that stretched from the first message to the day the chat went dark. They identified which wallets were still active, which transaction hashes could still be followed, and which receiving accounts might still hold funds. They explained that tracing and securing are not the same and that a case like his would take longer than he wanted. He listened quietly and asked a few careful questions. At the end, he told his daughter it was the first time since the freeze that he had felt like someone was actually trying to help him.

Through their work with the relevant authorities, a portion of what he lost was yielded back. A little over a quarter. It was enough to pay off the personal loan and to restore part of the cushion he had built over eleven years, but not all of it, and not enough to give him the peace of mind he had been saving for. The rest is still tied up in open proceedings. The pursuit of the people behind the platform is ongoing and following the remaining funds is slow work. Nothing is closed.

He went down to the harbor a few weeks ago and stood on the dock and watched the supply boats come in. The crews were working the lines and the smell of the water and the diesel was exactly the same as it had always been. He watched for an hour and then walked back to his truck and drove home and did not think about the platform the rest of the day.