Burp Press Investigates | Part I

Extraordinary wealth usually leaves extraordinary evidence, that became the first inconsistency.

A woman identifying herself as “Aarushi Shetty” claimed to earn ₹3–4 crore every month through cryptocurrency while presenting herself as a Mumbai-based fashion entrepreneur serving wealthy clients across Europe and the Middle East. She described owning a textile manufacturing business, travelling frequently across India and overseas, staying at Delhi’s Shangri-La Hotel during business trips, driving a Mercedes S-Class and quietly building an international luxury brand.

Those claims became the starting point of Burp Press’s investigation.

Over roughly 30 to 40 days, nearly ₹20 lakh moved through more than 20 different bank accounts before becoming trapped inside a platform that never appeared to collect customer money directly into its own accounts. What began as questions about one online identity gradually exposed something much larger, a digital ecosystem built on emotional grooming, borrowed credibility, rotating bank accounts, offshore branding and a payment architecture that appears designed to keep those controlling the money insulated from immediate accountability.

At the centre of the documented case stood one woman. The investigation would eventually expose multiple identities and a network that raises questions extending far beyond a single victim.

First product wasn’t crypto, it was trust

The conversations did not initially revolve around investments or cryptocurrency. Instead, they established familiarity first. Within hours of connecting on Facebook, communication moved to WhatsApp, where daily conversations, personal photographs and carefully maintained routines gradually built an appearance of authenticity before financial discussions entered the picture.

A nickname soon followed, “Bubski.”

The communication itself appeared unusually controlled. Video calls happened only three or four times over the course of the relationship. Voice calls were infrequent, and even voice notes were routinely declined, although a couple were eventually shared after repeated requests. Every personal interaction appeared to require prolonged persuasion and hours of waiting before it was reluctantly granted.

The calls themselves raised further questions. During voice calls, the microphone remained muted for much of the conversation. Whenever it was briefly unmuted, voices and laughter from several people nearby could be heard in the background before the microphone was muted again.

Meeting in person never materialised despite repeated claims of travelling between Mumbai and Delhi.

Looking back through the conversations, a consistent pattern emerges. Access was never completely denied. It appeared to be carefully rationed. Each rare call, brief unmuting or occasional voice note reinforced the impression that trust was being earned while independent verification remained consistently out of reach.

By the time cryptocurrency entered the conversation, the relationship itself had already become the investment.

Building a life too good to question

The biography itself became part of the persuasion.

She described herself as a successful entrepreneur running a vertically integrated textile business, from yarn production to finished luxury garments for wealthy international clients. She spoke about feeding stray dogs, helping poor families and volunteering at old-age homes. She shared photographs that appeared to reinforce that world: luxury cars, restaurant outings, frequent travel and what she described as her own textile factory.

Then the investigation exposed a crucial contradiction.

Evidence gathered during the reporting showed that the woman later identified as Amrita Singh had previously worked with ColorJet Group, a company operating in India’s textile and industrial printing sector. That discovery changed the meaning of earlier conversations.

Factory photographs she had presented as evidence of owning a large manufacturing operation appeared, after comparison with the broader digital trail, to be connected to real textile-industry environments rather than independently proving ownership of the business she claimed to run.

Another anomaly emerged.

Some of the photographs she shared of herself displayed characteristics that appeared consistent with AI-generated or digitally manipulated imagery, adding another layer to a persona that repeatedly blurred the line between authentic material and manufactured perception.

The investigation repeatedly found that genuine elements of her real-world life appeared to be woven into a much larger fictional narrative. A documented internship in the textile industry, genuine travel, authentic photographs and publicly traceable educational records coexisted with contradictory claims about business ownership, luxury wealth and international influence, creating a persona considerably more convincing than a completely fabricated identity.

The persona did not appear to invent everything, it appeared to rearrange reality.

Selling the “Inside Edge”

By the time cryptocurrency entered the conversation, credibility had already been established. The investment itself was presented as privileged access rather than an opportunity available to everyone.

She claimed her international business relied heavily on cryptocurrency because it simplified cross-border transactions while helping avoid unnecessary taxation. She also claimed to earn approximately ₹3–4 crore every month through one trading platform.

The explanation became even more persuasive through another claim. An uncle living in the United States, who had previously worked at JPMorgan, she said, possessed insider knowledge of exactly when markets would move.

The trading instructions reflected that certainty: buy now, wait, sell immediately. The messages consistently arrived second by second.

One documented trade reportedly showed nearly 20 percent profit in roughly 60 seconds. The implication was clear. This was being presented not as speculation, but as precision.

The financial escalation followed a consistent progression. ₹50,000 became ₹1 lakh. ₹1 lakh became ₹10 lakh. Eventually came advice that crossed into life-altering territory, sell your properties, invest everything, withdraw profits within a few months and buy everything back later.

Throughout that escalation, the reassurance remained unchanged, “I’ve got your back.”

Borrowing Wall Street’s credibility

The platform itself did not present itself as an obscure cryptocurrency website, it borrowed familiarity.

Its name, NASDAQ.US, closely resembled the branding of the globally recognised NASDAQ exchange while presenting itself as a separate cryptocurrency investment platform.

The deeper Burp Press examined the operation, the more contradictory its infrastructure appeared.

The platform identified itself as being linked to the Cayman Islands, operated almost entirely through WhatsApp and repeatedly shifted to different web addresses over time. Those changing domains became one of several operational patterns documented during the investigation, alongside rotating payment accounts, manual balance updates and the complete absence of formal transaction receipts.

Customer support revealed another anomaly.

Conversations initially appeared to be handled by someone communicating like an ordinary Indian representative. However, technical indicators documented during those exchanges increasingly pointed toward China-based handling of parts of the platform’s communication infrastructure.

The combination created an unusually fragmented operational picture: a platform carrying Wall Street-inspired branding, an offshore corporate claim, an India-wide payment collection system and communication channels that appeared to extend beyond India’s borders.

The significance of that architecture becomes clearer when viewed alongside recent Indian investigations. Earlier this year, the Gujarat Cyber Cell dismantled an international cryptocurrency network allegedly involving around ₹226 crore, with investigators tracing financial pathways that allegedly connected parts of the operation to Hamas and Houthi, linked funding channels alongside other organised criminal activities.

Viewed together, those elements transformed what initially appeared to be a cryptocurrency website into a far more complex digital operation.

Company that never collected its own money

Legitimate investment firms generally collect customer deposits into company-controlled accounts. This platform didn’t.

According to banking records examined during the investigation, deposits were routed into more than twenty different bank accounts across India. Some belonged to private individuals. Others belonged to organisations.

One documented payment instruction pointed to an account associated with Disha Manav Kalyan Avam Utthan Samiti, a registered Lucknow-based NGO that later became the subject of a separate cyber-fraud investigation involving funds allegedly passing through its bank account.

The payment process followed the same script every time. Money was transferred into a bank account. A payment screenshot was shared over WhatsApp. The platform replied that the payment had been verified. Customers were then instructed to refresh their online balance.

Unlike regulated financial institutions, the platform never issued a deposit receipt, transaction acknowledgement or formal confirmation after receiving customer funds. Instead, the balance simply appeared inside the trading account through what support described as backend verification.

The separation between the banking transaction and the digital trading balance became one of the investigation’s most significant findings. Platform claimed it had 20,000 payment partners across India, allowing deposits to continue without relying on a single banking trail.

The investigation documented another recurring pattern.

When one recipient account allegedly stopped working because it had been blocked or became unavailable, another account immediately replaced it.

Then another.

Then another.

The payment network never appeared to stand still.

That distributed banking architecture mirrors patterns that investigators have been documenting elsewhere. Gujarat Police’s Operation Mule Hunt exposed thousands of mule bank accounts allegedly used to fragment cybercrime proceeds across India, demonstrating how unrelated account holders can become part of a much larger laundering chain that makes tracing money significantly more difficult.

Withdrawal that became another trap

The illusion held until the money tried leaving. First withdrawal request triggered a demand for US tax.

The payment was made. Withdrawal never arrived. Instead came another demand.

A “Risk Payment Fee.”

No receipt for the earlier tax payment was ever issued. No official documentation accompanied the new demand either.

Then came the deadline. Pay within seven days, or lose 3 percent of the account balance every day as damages.

Throughout the process, the woman who had introduced the platform continued reinforcing the same message, “Either deposit it or forget about the money.”

When asked to contribute herself, despite earlier claims of earning crores every month, she suddenly claimed she had no money available.

Soon afterward, the replies slowed, profile changed, then disappeared.

One woman became many

The deeper Burp Press looked, the less this resembled one persuasive individual.

The pattern kept repeating.

Multiple female personas emerged across different cities, Mumbai, Hyderabad, Delhi, Bengaluru, Kolkata and overseas. The names changed. The biographies changed. The script barely did.

Luxury lifestyles, international businesses, extraordinary crypto earnings and absolute confidence.

The investigation also documented evidence suggesting that the woman at the centre of the case was actively encouraging people within her own social circle, including friends facing financial hardship, to become part of the same ecosystem.

Another name surfaced, “Aditya.”

According to evidence reviewed during the investigation, members of her immediate family appeared to be aware of at least some of the multiple identities she used online. The investigation also examines whether Aditya’s role extended beyond awareness into support for aspects of the wider ecosystem surrounding the operation.

Another individual identified during the investigation, “Mohammed”, also emerged as a figure connected to the operational structure surrounding her activities, raising further questions about whether the operation extended beyond a single online persona.

By this stage, the operation increasingly resembled something repeatable.

Not one scam, a recruitment model.

Why this investigation doesn’t end with one woman

The operation documented in this investigation displayed an unusual combination of characteristics. A platform carrying Wall Street-inspired branding could not be meaningfully traced through ordinary public searches. It repeatedly changed its web addresses, operated almost exclusively through WhatsApp, routed deposits through dozens of unrelated bank accounts, relied on manual backend balance updates instead of standard financial settlement systems, issued no deposit receipts, refused tax documentation and presented an operational trail stretching across India, the Cayman Islands and apparent China-linked communication infrastructure.

Taken individually, each irregularity raises questions. Taken together, they reveal a business model that bears little resemblance to how regulated financial institutions ordinarily operate.

The broader context makes those questions harder to ignore. In another major investigation, India’s Financial Intelligence Unit (FIU-IND) traced a sophisticated cyber-fraud money-laundering network involving around ₹868 crore, more than 5,000 mule bank accounts and complex cryptocurrency transactions spanning multiple jurisdictions. The financial intelligence generated during that probe ultimately led to enforcement action by the Enforcement Directorate, highlighting how modern cyber fraud increasingly operates across multiple countries rather than within a single jurisdiction.

More recently, Delhi Police dismantled interstate cyber-fraud syndicates that investigators said relied on fake investment platforms, shell companies, mule bank accounts and cryptocurrency transactions to defraud victims across multiple states, reinforcing that these financial structures are becoming a recurring feature of organised cybercrime rather than isolated incidents.

The cumulative pattern documented by Burp Press points towards a deliberately opaque financial ecosystem whose structure appears designed to minimise transparency, fragment accountability and complicate efforts to trace where money ultimately travels after leaving a victim’s bank account.

Whether that machinery exists solely to facilitate large-scale fraud or serves wider illicit financial networks remains a question for investigators.

The fact that those questions became significant enough for the Enforcement Directorate, which is currently examining the matter, to decline comment citing “national security”, only deepens the significance of this investigation.

By then, the story had become larger than one woman using multiple identities.

It had become an examination of a shadow financial ecosystem where identities shifted, websites migrated, payment trails fragmented across dozens of accounts and accountability appeared to dissolve at every stage of the transaction.

The biggest question is no longer where the money went, but, who designed a system that made it so difficult to follow.

Coming Next

Part II: Who Is Amrita Singh?

The woman who introduced herself as Aarushi Shetty. The real identity Burp Press traced through public records and digital evidence. Recycled photographs, multiple aliases and the digital trail that may reveal how one convincing persona became the face of a much larger operation.