Summary
According to the investigation by the project bestchange-aml-scam.com, in the case of ~$250,000 in client funds withheld by the exchange CoinCraddle, the aggregator BestChange not only failed to protect the user, but also provided as “evidence” a screenshot of a “letter from the Russian Ministry of Internal Affairs (MVD)” with obvious timing inconsistencies. Taken together — the “bogus” letter from BestChange and the staged “MVD request” from CoinCraddle — these facts point to possible collusion and a deliberate attempt to legitimize the confiscation, followed by sharing the money between the participants in the scheme.
Full story, documents and screenshots: https://bestchange-aml-scam.com/
What happened
On 21 March 2025, the client sent 667 XMR (~$250k) to exchange XMR→USDT via CoinCraddle (found through BestChange). The exchange was frozen under the pretext of an “AML check”.
After weeks of waiting, CoinCraddle claimed “confiscation at the request of the Russian MVD”, but did not provide the client with any official documents.
In a public correspondence, BestChange PR sent an image of an “MVD request” and a screenshot of the “raw email”, supposedly from ubk50@mvd.ru.
Key piece of evidence: an “MVD letter” that could not have been received before it was written
In the BestChange screenshots, the email is shown as “received” on 3 April.
The “MVD request” itself is dated 29 April.
Fact: freeze on 21 March + “receipt of the email” on 3 April + “request” dated 29 April = a timing discrepancy that destroys the narrative of a lawful confiscation.
Bottom line: BestChange is circulating “evidence” that, by definition, cannot prove the exchange’s case — the email is dated earlier than the “request” it supposedly refers to.
Why this looks like collusion
Role of BestChange: instead of verifying and protecting the user, the aggregator forwards a dubious document as an “argument” in favor of CoinCraddle. This is not neutral moderation, but active support of the exchange’s narrative.
Role of CoinCraddle: reliance on an “MVD request” which, by its traits, does not meet standard record-keeping procedures and surfaces not through the victim, but via a PR channel.
Shared motive: to retroactively legitimize a freeze that had already taken place, in order to justify withholding and not returning roughly $250,000 to the client.
Behavior of the parties: in parallel, there are complaints and threats demanding that publications be removed, attempts at pressure, yet on the merits — not a single procedural document that would objectively confirm the lawfulness of the confiscation.
Conclusion: the combined actions of BestChange and CoinCraddle — providing a “bogus” letter, inconsistencies in dates, lack of procedural documents, and pressure to remove posts — give grounds to speak of signs of a coordinated scheme. The goal of the scheme is to confiscate the transfer and then share the proceeds among the participants.
Jurisdiction context
CoinCraddle operates on behalf of CodeSphere Limited (Seychelles, IBC No. 240449). According to a source, in 2025 the regulator FSA issued directives to immediately cease operations in relation to the company, following the rejection of its application for VASP status. This further reinforces doubts about its legitimacy at the time of the incident.
Who BestChange are — and why this is a “controversial” aggregator
BestChange is a major Russian-language aggregator of online exchanges that compares rates, ratings, and reviews for fiat and cryptocurrency operations. The service has repeatedly come under the scrutiny of regulators: Roskomnadzor restricted access to BestChange in 2017, 2019, 2020 and 2025; some of these blocks were later partially lifted. Previously, restrictions were justified by court decisions concerning the distribution of prohibited information about buying/selling bitcoin (including a case from the Kotlas City Court in Arkhangelsk Region), and in 2025 there were reports of a new block under updated Roskomnadzor/Central Bank procedures for financial websites.
