On Sunday, September 14, 2025, the State Police announced the arrest of six people and the search for two others, while the exact amount of money that citizens have lost in these schemes is still unknown.
Those arrested were field agents who promoted and recruited citizens to invest, but it is suspected that their real number is much larger.
According to experts, over 20,000 people have invested on these platforms, using cryptocurrencies through Binance or by handing over the money to “agents”.
Evidence obtained by “shteg.org” shows the involvement of these agents who appeared as guarantors for payments and openly advertised the applications, which were freely distributed throughout the country.
Victims’ accounts, as well as expert analysis, reveal that platforms with strange names, Xuex, Txex, and Grokr, quietly spread across social networks, Telegram groups, and suburban cafes, until they turned Albania into a breeding ground for digital fraudsters.
“Online Millionaires”
Hamdiu*, a self-employed tour operator, decided to invest 1,000 euros after seeing people claiming profits and knowing people who guaranteed payments. The agents distributed information and taught “clients” how to become “investors.”
In cities like Lushnje, Divjakë or Lezha, there were even places where profit was “guaranteed” from these online investments.
“I deposited 1 thousand euros at first and had to follow the signals, as they called them. They came twice a day, at 14:20 and 19:20. Online I could see that my money was increasing, but I never managed to withdraw anything,” Hamdiu tells “shteg.org”.
According to data, these platforms began to spread massively in early 2024. The belief that “the business was advertised everywhere” pushed Hamdi to invest his savings, even though what he saw was only an online projection on his phone.
“There were bars that advertised these applications with posters. In Lushnje, a girl took it upon herself to collect the money, while in Divjaka there was a bar where the money was given in person. In other cases, it was transferred through wallets on Binance and then they went and mined the cryptocurrencies in Kosovo, where it is legal,” he adds.
Platforms like Xuex, Txex, and Grokr promised huge profits through investments in dubious networks.
Experts say that the growth figures were completely fictitious and were manually manipulated by certain individuals, making citizens believe that they were actually gaining.
“The first people to invest, about 5% of participants, could receive benefits. But to withdraw the money, you had to bring in other people or pay additional amounts. When the scheme reaches “maturity”, when there are no more new recruitments and there is a lack of liquidity, the site disappears,” explains IT expert Besnik Semanaj.
Another young man, Eklenti* from Tirana, says he managed to earn 4 thousand euros within 45 days on Xuex: “I heard about Xeux through a friend from Divjaka. He sent me the link to the application, I downloaded it and joined. I initially entered with 2 thousand euros and left with 4 thousand euros after 45 days. They made me part of a group on Telegram where they received instructions.”
He claims that he managed to withdraw the money through Binance, but with a 5% commission.
“When I withdrew the money, I transferred it to Binance and other crypto platforms. They didn’t ask me for any additional money, they just kept a 5% commission on the amount I had earned,” he says.
According to experts, this mode of operation posed a double risk, not only the loss of money, but also the risk of personal data theft.
“The way it worked was very simple, there was a website, some of them also worked with applications, but they were not allowed in either the Google Store or the Apple Store, but simply launched a link and then you became part of them, with the risk of receiving data from the phone as viruses,” explains Besmir Semanaj, an IT expert.
Army of agents
At the entrance to the city of Lushnja, on the “Shëtitorja e Palmave” street, your eyes immediately went to a bar-restaurant called “La Bonta”. On the glass of the main door they had two posters that promised a lot. “One-time investment = Lifetime benefits” and “Long-term investment project, teamwork, many rewards”. It was an advertisement for a platform called “Xuex”, which would soon turn out to be a fraudulent pyramid scheme.
On August 27, 2025, undercover agents went to “La Bonta” and asked about the advertisement. It was waiter Emanuel Taullau who, with natural calm, explained to them that to become part of the platform, a minimum of $1,000 was needed.
“The platform also works on Telegram,” he said, giving the agents his personal contact information and also mentioning an enigmatic figure, the owner of the bar, known by the nickname “The Professor.”
The next day, Emanueli introduced the agents to his colleague, Flavio Mukaj. The two helped open accounts on Binance and Telegram groups, and the first payment was made on the spot. The agents handed Emanueli 100,000 lekë, which was converted into $1,000 through his account and transferred to “Xuex.” Every step was secretly recorded by the police.
Investigations revealed that at the center of the scheme was Ereledio Shebekut, 35. He managed groups on Telegram, where investors poured in amounts ranging from $1,000 to $5,000. For each investment, participants were promised a 1% profit per day, which could be withdrawn every 45 days, through transfers from Binance to Albanian banks.
In constant communication with a person identified as “Leo Smith,” a British suspect, Shebeku led the daily rituals of the scheme.
At 2:20 PM and 7:20 PM, participants had to “like” the pages he sent, simulating online activity to justify “winnings.”
According to the investigative file, around 580 people were recruited in Divjaka, including employees of institutions and residents of the rural area. Some of them, such as Brunilda Ndini, Medi Kajo, Fadil Balliu, Sokrat and Anila Lapi, Farie Maci, Evgjeni Kokoneshi, Brunilda Todi and Alban Noreci, not only invested themselves, but also brought in their families. They are considered the “managers” of the network, who ensured the chain of recruitment and kept the pyramid scheme alive.
They are accused of deceiving citizens by promising them quick profits, but the detainees denied the charges, claiming that they were only users of the platform and that their activity was an “online job.”
“We met online and continued working. We didn’t scam anyone. To enter the scheme, a minimum investment of $1,000 was required. We invested funds in cryptocurrencies which we then converted to Kosovo,” they said, claiming that they were only users of this platform.
Investigations revealed that the scheme operated as a chain recruitment: each agent had to bring in at least five new people, who then brought in others, expanding the scheme endlessly. Instructions were given in closed Telegram groups by a person identified as “Leo Smith.”
In the documents, Xuex appears as a product of EG Investment Group, founded by “Anthony Leo Smith” in 2018, a completely false identity.
EG Investment Group claims to be a company that deals with investment funds, while advertising that it has a 99.6% accuracy in capital growth and was first introduced to the market in 2022 as an innovation founded by Nnty Jay, a software engineer who worked for Uber.
The two people claimed as founders do not exist, but are fake profiles to reach as many people as possible.
Xuex cannot be downloaded from the Google Store or Apple Store, but only through the links provided by field agents from these companies.
Such groups had millions of followers, while the Cyber and Economic Crime Directorate of the State Police officially announced the launch of investigations into this fraudulent scheme on August 28, 2025.
The Financial Supervisory Authority and the National Cybersecurity Authority said in official statements that they have warned citizens about the risk and that they have blocked these platforms.
The authorities do not respond to questions raised by “shteg.org” about the number of victims involved in these schemes as loggers, the agents who advertised these schemes, or the amount of money that Albanians have lost on these platforms.
MP Erion Braçe stated that there were around 400 active agents in Divjaka alone, while the Police stated that during the several-month investigation codenamed “Xuex”, 83 searches of people and homes were carried out in the cities of Fier, Tirana, Dibër, Berat and Gramsh.
“There are over 400 field agents in that group! I’m not talking about someone who entered there with their family; but those who maintained groups with 50,100 members and who everyone in Divjaka knows,” the MP wrote on his social network, inviting citizens to report all cases of the spread of these fraudulent schemes to the police.
Police seized 50 cell phones, 11 computers, hard drives, DVRs, a car and significant amounts of cash. As part of the investigation, Albanian authorities blocked 6 cryptocurrency accounts.
According to experts, cryptocurrencies were simply the instrument used by these applications to carry out the fraud scheme.
“I have been on the ground myself in Lushnja, in Divjaka and I have seen that most of these applications have people on the ground who deal directly with such work. So, it is the agents who guide people to register and become part of these schemes,” says Denisa Kele, investor and trainer for cryptocurrencies.
Meanwhile, the police say they are continuing their investigations to find the organizers of this criminal activity, but according to experts, identifying the people who organized the scheme is very difficult.
“There is a problem in finding them, because we don’t know who created it, where it was hosted, where the money goes, because they used cryptocurrencies. So citizens have bought cryptocurrencies on regular sites and transferred them to the accounts of the people in question,” explains Semenaj.
Gazetar dhe bashkëpunëtor në “Rrjetin e Raportimit të Krimit të Organizuar dhe Korrupsionit në Shqipëri” - RRKOKSH.
Ka mbaruar studimet në fakultetin e historisë dhe filologjisë, Universiteti i Tiranës.
