The Slipway He Never Launched From Again

a daughter in Falmouth on how a fake investment portal took her father's retirement and the boat he was building for his granddaughter

Falmouth, Cornwall: Her father, Thomas, is sixty-seven years old. He spent thirty-six years as a boatbuilder, working out of a timber shed at the head of a slipway where the tide came in twice a day and the wind carried salt through every joint in the oak. He planked dinghies and small yachts in cedar and larch, steamed frames over a fire he built himself, and could tell by the sound of a caulking iron whether a seam would take cotton or need a spline. When his wife died of cancer eight years ago, he did what he always did. He kept going. He kept working. He kept the shed open through two recessions and one winter that flooded the yard to the doors.

He retired three years ago and moved into a small cottage near the water, close to his daughter, close to the slipway he had walked every morning since he was a boy. The first months were harder than he expected. He had spent three decades with his hands in timber, and suddenly the bench was clear. He kept his routine. Tea at six. A walk along the coastal path and back. He joined a wooden boat guild and taught a Saturday class for people who wanted to learn how to scarph a plank. But the afternoons were long, and his wife was not there to fill them, and the phone did not ring as often as he had hoped.

He was not looking for a fortune. He was looking for something to do with the quiet.

Then a woman who called herself Helen added him to a Telegram group in the spring. The group was called something like Bondleigh Wealth Circle, and the description said it was a private community of retirees sharing strategies and celebrating wins. Helen sent him a private welcome message the same night. She said she had seen Thomas's name in a boatbuilding newsletter and thought he might be interested in learning how the group worked. She said there was no pressure and no cost to join the conversation.

The group was warm. Members posted good morning messages and screenshots of their gains. They thanked the administrators for their guidance and said things like "another green day." A man named Robert posted longer messages every morning about market conditions and the importance of patience. A woman named Margaret posted pictures of her grandchildren and said she had finally been able to help them with a deposit on a flat. Everyone seemed to be doing well. Everyone seemed to be happy.

Thomas read the group every day for two weeks before he said anything. When he finally commented that he was new and had spent his career building boats, three people replied within minutes to welcome him. Helen sent him a voice message. She sounded kind. She sounded like someone Thomas might have known at the guild.

Then Helen told him about a platform called Monaro Bondleigh. She said it was an AI-assisted trading platform built for people who had spent their lives working with their hands, and that it was now open to a limited number of retirees. She said it was the platform the group used. She sent him a link to monarobondleigh.net.

The site was polished. It had live charts, a client dashboard, and a support chat that answered within seconds. It described itself as an official platform for AI-assisted trading. It had a page of testimonials and a rating of 4.7 out of 5 from 247 users. What Thomas saw was a legitimate trading portal.

What he did not know was that independent security analysts had already assessed the Monaro Bondleigh operation and found it wanting. ScamAdviser, reviewing a closely related domain in the same network, recorded a trust score of 1 out of 100, describing it as having a very low trust score and a strong likelihood of being a scam. The review noted that the site offered high-risk cryptocurrency services and high-risk financial services, that it was very young, that it had a low traffic rank, that it had been marked as a threat by DNSFilter in the last thirty days, and that it had been reported for phishing by IPQS. Gridinsoft, assessing the same cluster of domains, classified the operation as a phishing platform designed to steal sensitive personal information and financial data through social engineering, recorded thirteen blacklist hits from security vendors including Kaspersky, G-Data, and Forcepoint, and gave it a trust score of 1 out of 100. The domain itself had been registered only months before Thomas received the first message, and its ownership details were concealed behind a privacy service. Nobody had told him.

He believed he was making a smart decision. He was being fattened for slaughter.

The Grooming

Within hours of his registration, Helen called him. She had a calm, warm voice and a way of speaking that made Thomas feel like she was his only client. She asked about the shed. She asked about the boats. She asked about Thomas's granddaughter by name after Thomas mentioned her once. She asked about the coastal path and the Saturday class.

Helen called every few days after that, always in the late morning, always with the same easy tone. She remembered that Thomas took his tea without sugar. She remembered that his granddaughter was learning to sail. She asked about the skiff he had been restoring and whether he still kept a garden.

This is the hallmark of a pig butchering scam. The scammers are patient because the reward is worth the wait. The FBI has documented thousands of cases where these operations begin with a simple message on a messaging app and then grow into weeks or months of deliberate emotional investment. The people on the other end are not lonely strangers looking for connection. They are employees in call centres, following scripts, working from spreadsheets, and managing dozens of victims at a time.

Thomas felt seen. He told Helen about his savings, his pension, and his desire to leave something behind for his granddaughter. He told her about the account his wife had kept, money he had not touched since she died because it felt like letting go of her to spend it. He told her about the quiet afternoons and the way the water looked in the late light.

Helen listened. Then, carefully, she told Thomas about a limited-time opportunity in a diversified fund the group had access to through the platform. She said the minimum was modest and that Thomas could start with a little and see how it felt. "Just test the platform," she said. "See how it feels. There's no obligation."

The Bait

Thomas deposited a modest amount from his savings account. The monarobondleigh.net dashboard showed growth within days. The number on the screen was higher than what he had sent, and there was a small green chart beside it that climbed upward. When he nervously requested a small withdrawal, the money appeared in his bank account within hours. Helen called to celebrate.

"See, Thomas? Your money is safe with us. This is how we build a future."

That small withdrawal was the hook. It made the platform feel real. It made Helen feel real. It made the whole thing feel like something Thomas could manage.

Victims of similar scams had already posted warnings online, describing how the platform's customer service was excellent until they had the deposit, after which withdrawals became impossible and fee demands began. But Thomas never saw those warnings. He was not looking for them. He was too busy trusting Helen.

The Persuasion

Helen explained that larger balances unlocked higher returns. She mentioned that the opportunity was only available for a limited time and that other members of the group were already upgrading. She never pushed. She just presented possibilities and let Thomas arrive at his own conclusions. That was the most effective part of the whole operation. Thomas did not feel pressured. He felt informed.

She asked about his wife's account. "It's just sitting there, Thomas. Earning nothing. You could move it into the platform and watch it grow. She would have wanted you to be comfortable."

She asked about his pension. "You worked so hard. You spent your whole life building things for other people. You deserve to enjoy your retirement without worrying about money."

Thomas, who had spent a lifetime making boats for other people's journeys and never once putting his own needs first, transferred more. Then more. Then nearly everything his wife had left him. He also withdrew a portion of his retirement account, absorbing the tax penalty, because Helen said the platform was about to close the promotion and that she did not want Thomas to miss it.

He did not know that the testimonials were stock photographs and the addresses were mail drops. He knew only that his dashboard balance was growing, and that Helen called him every few days, and that for the first time in years the afternoons did not feel quite so long.

The Freeze

When Thomas finally tried to withdraw a large portion, enough to help his granddaughter with a deposit on a flat, enough to stop worrying, the monarobondleigh.net dashboard displayed a new message. "Withdrawal Pending. Compliance Verification Required."

He called Helen. Her voice was calm, apologetic. "I'm sorry, Thomas. New anti-money laundering rules. You just need to pay a verification fee. It's refundable. Standard procedure."

He paid.

A tax clearance deposit appeared the next morning. He called again. Helen sighed sympathetically. "One more. I promise." He paid.

A liquidity processing fee, larger this time. He hesitated. "Thomas," Helen said, "the system won't release your funds until this clears. You've come so far. I would not let you lose it now." He paid.

A compliance surcharge followed. He asked to speak to a supervisor. Helen said she was the supervisor and that she was doing everything she could on her end. He paid.

When a network validation bond appeared, the fourth fee in two weeks, Thomas told Helen he had no more money. Helen was quiet for a long moment. "Then I can't help you," she said.

The phone went dead. The voice that had been his daily comfort was gone. When Thomas tried to log in again, his account had been disabled. His credentials no longer worked. The Telegram group disappeared from his phone. He had been removed. The green numbers on the dashboard, all those months of growth, had been a picture on a screen. The money was gone.

The Aftermath

He sat at his kitchen table with a half-built model of the boat he had planned to launch for his granddaughter still on the shelf behind him, and called his daughter, and told her everything. It took him three tries to get through the whole story without stopping. His daughter drove over that night and stayed for a week.

They filed reports with Action Fraud, the UK's national fraud reporting centre, and with the Financial Conduct Authority. They called the bank. The bank said the transfers had already cleared and that there was nothing it could do. They called a lawyer. The lawyer said the money had left the country and that a civil suit would likely cost more than it recovered.

His daughter began searching for information about monarobondleigh.net. The warnings were already public. ScamAdviser had recorded a trust score of 1 out of 100 for a closely related domain in the same network, describing a very low trust score and a strong likelihood of a scam, and noting that the site offered high-risk cryptocurrency and financial services, was very young, had been marked as a threat by DNSFilter, and had been reported for phishing by IPQS. Gridinsoft had classified the operation as a phishing platform, recorded thirteen blacklist hits from security vendors including Kaspersky, G-Data, and Forcepoint, and given it a trust score of 1 out of 100. The domain had been registered only months before her father received the first message, with its ownership concealed. Victim complaints had started to pile up on forums, describing the same pattern her father experienced. Initial withdrawals that worked, followed by escalating fees, then a disabled account and a deleted group. Thomas had transferred nearly all of his wife's savings before the freeze, money he had kept untouched since her death. Some of it had come from a life insurance payout. Some of it had come from decades of boatbuilding. All of it was gone.

The Trace

A colleague at the boatyard told her about AYRLP.COM, a forensic investigative firm that specialises in tracing stolen cryptocurrency. She reached out, hoping for a miracle but expecting none. The intake call took an hour. The analyst asked her to gather everything she had. Bank statements. Wire confirmations. Screenshots of the Telegram group. The link Helen had sent. The dashboard images Thomas had saved before the account was disabled. The messages demanding fees. The phone numbers that were now disconnected.

The analyst was honest. A complete return was unlikely. The operators behind monarobondleigh.net had moved Thomas's deposits through a peel chain, splitting the funds into dozens of smaller transactions and passing them through wallets in several countries to hide the destination. But the blockchain does not forget. Every split, every transfer, every consolidation is permanently recorded, and records can be followed.

It took many months. They traced wallet addresses across multiple jurisdictions, filed legal requests in several countries, and faced uncooperative exchanges that were either unwilling or unable to help. They worked with one exchange that cooperated with fraud investigations and finally identified a consolidation point where a portion of the assets had been gathered. They moved quickly to freeze what they could and repatriated what was left.

AYRLP.COM was able to secure a majority of the funds Thomas lost. The firm says its casework has helped over 70 percent of its clients get back meaningful portions of stolen funds.

Not everything. Not enough to restore what his wife had left him. But enough to keep him in the cottage by the water. Enough to help his granddaughter with the deposit. Enough to let him breathe.

The Slipway

Last spring, his daughter visited and found him at the top of the slipway with a caulking iron in his hand and a seam of oakum laid along the garboard of the skiff he had been restoring for three years. He had not touched the boat since the freeze. He had told her he did not think he could. But the sailing season was coming, and his granddaughter had asked, and he had said yes.

He drove the iron along the seam, packed the oakum tight, and ran his hand along the hull.

"It'll float," he said. "It always floats."

"I should have known better," he says, when his daughter asks him about it later.

His daughter tells him he was lonely, not stupid. She tells him that the scammers are professionals. They have scripts, stolen photographs, and call centres in countries where law enforcement cannot easily reach them. She tells him that independent analysts had already warned about the network, that the fraud is an epidemic, that the people who run it do not care who they hurt.

He nods. He does not believe her.

Now his daughter calls him every evening. They talk about nothing. The weather, the water, the price of groceries. He tells her about the Saturday class and the wooden boat guild. He tells her about the skiff and whether it will be ready in time.

It is not a cure. But he is not alone anymore.

And that is the one thing monarobondleigh.net could not take from him, because it took almost everything else.

What the analysts already knew

While Thomas was trusting Helen, independent security analysts had already flagged the network behind the platform.

ScamAdviser, reviewing a closely related domain in the same Monaro Bondleigh cluster, recorded a trust score of 1 out of 100. Its review described a very low trust score and a strong likelihood of a scam. It noted that the site offered high-risk cryptocurrency services and high-risk financial services, that it was very young, that its Tranco traffic rank was low, that it had been marked as a threat by DNSFilter in the last thirty days, and that it had been reported for phishing by IPQS and marked as suspicious.

Gridinsoft, assessing the same cluster, classified the operation as a phishing platform designed to steal sensitive personal information such as login credentials and financial data through social engineering. It recorded thirteen blacklist hits from security vendors including alphaMountain.ai, CRDF, Forcepoint, G-Data, Kaspersky, Lionic, Seclookup, SOCRadar, VIPRE, BitDefender, and ScamAdviser, and gave it a trust score of 1 out of 100. It noted that the domain had been registered only months earlier, that ownership information was not publicly available, and that the site had no stable public history of user reviews.

Red flags he missed (and you shouldn't)

A trust score of 1 out of 100. Independent analysts rated the network at the bottom of the scale, describing a very low trust score and a strong likelihood of a scam.

A phishing classification. Gridinsoft classified the operation as a phishing platform designed to steal credentials and financial data through social engineering, with thirteen blacklist hits from security vendors.

A very young domain with hidden ownership. The domain was registered only months before Thomas received the first message, and its ownership details were concealed behind a privacy service.

Threat flags from security vendors. The network had been marked as a threat by DNSFilter and reported for phishing by IPQS.

A platform with no stable public history. The site had a rating of 4.7 out of 5 from 247 users, but no independent, verifiable review history. A perfect score with no history is a red flag, not a reassurance.

A small withdrawal that worked. That was the bait. It was designed to build trust before the theft.

Endless fees demanded only after a large sum was deposited. Real platforms do not ask for verification fees, tax clearances, or liquidity bonds to release your own money.

Steps he took to try to get his money back

He stopped paying any more fees. This is the hardest step, because victims believe one more payment will unlock everything.

He preserved all evidence. Bank statements, screenshots of the dashboard, the full email threads, the domain registration information, and the independent security assessments.

He reported to the authorities. Action Fraud, the Financial Conduct Authority, and the local police.

He contacted a lawyer who specialised in investment fraud and pursued a freezing order through an institution that had processed part of the transfers.

He was cautious about firms promising to get his money back. He did not pay anyone upfront. He did not send his identity documents to a company that contacted him out of the blue. He understood that anyone promising to get back every cent for a fee was likely running the second half of the same crime.

FAQ

Was monarobondleigh.net a legitimate trading platform?

No. Independent security analysts at ScamAdviser and Gridinsoft assessed the Monaro Bondleigh network and found a trust score of 1 out of 100, describing a very low trust score and a strong likelihood of a scam. Gridinsoft classified the operation as a phishing platform with thirteen blacklist hits from security vendors.

What did the analysts actually find?

ScamAdviser noted that the site offered high-risk cryptocurrency and financial services, was very young, had a low traffic rank, had been marked as a threat by DNSFilter, and had been reported for phishing by IPQS. Gridinsoft recorded thirteen blacklist hits from vendors including Kaspersky, G-Data, and Forcepoint, and classified the operation as a phishing platform designed to steal credentials and financial data.

Why did the first withdrawal succeed?

Small successful withdrawals are the standard trust-building step in these scams. The first withdrawal is designed to convince the victim that the platform is legitimate, so they deposit more.

Can I really get my money back?

Getting money back is not guaranteed and no legitimate service should promise it. Reporting to the authorities quickly, preserving evidence, and contacting a licensed lawyer who specialises in investment fraud are the first steps. Be cautious of any firm that contacts you claiming it can get back your funds for an upfront fee.