Ewds66.it: The Lithuanian Server That Stole a Kentucky Foreman’s Retirement

--

*A 28-year factory veteran in Kentucky had carefully saved for his grandchildren’s college funds. A platform that looked like a legitimate European crypto exchange turned that future into a frozen screen and an error message.*

LOUISVILLE, KENTUCKY

Editor’s Note: *This account is based on an official order published on May 4, 2026, by Italy’s Companies and Exchange Commission (CONSOB), which ordered the blocking of EwdS66 (https://ewds66.it) for illegally providing crypto-asset services, bringing the total number of sites blocked by Consob since July 2019 to 1,681. Independent cybersecurity investigators later confirmed the website was shut down for phishing, with investigators tracing its origination to Lithuania. The victim’s identity has been fully reshaped and protected.*

The Man Who Ran the Line for Three Decades

For Eugene “Gene” O’Leary, 55, the factory floor had been the steady rhythm of his existence. For twenty-eight years, he had clocked in at the same Louisville automotive plant, rising through the ranks from assembly line worker to shift foreman, responsible for sixty workers and millions of dollars in production. He knew every machine by its sound, every employee by their first name. When the alarm bells rang across the floor, he was the one who silenced them.

His wife had passed away six years earlier. His two sons were grown, both living in Nashville, both struggling to buy their first homes. Gene’s dream was modest: keep the house, help with the grandkids, retire at sixty-two without asking anyone for a handout.

In the spring of 2026, a younger worker on his shift — a kid who spent every break scrolling through his phone — showed him a website. “Look at this, Gene,” the kid said, tilting the screen toward him. “Ewds66.it. It’s like a European investment thing. Some guys are making real money on it.”

Gene squinted at the screen. The .it domain looked official. Italian, he thought. Europeans are serious about their money.

That night, alone in his kitchen, Gene typed ewds66.it into his laptop.

The Website That Wore a Nice Suit

The website that loaded was clean, corporate, and utterly unremarkable — which, to a man who had spent his career avoiding anything flashy, was a mark of trust. The interface was split between English and Italian, with charts that looked like the ones he had seen on CNBC during lunch breaks. The color scheme was navy blue and silver. It looked like a bank. It smelled like a bank. It was not a bank.

He filled out the registration form. A name, an email, a phone number. The usual. He did not read the fine print. He was a factory foreman, not a lawyer.

Within an hour, his phone buzzed with a call from an Italian number. A man with a calm, deliberate voice introduced himself as “Matteo Bellini.” He said he was a senior account manager. He asked about Gene’s work, about his years on the line, about what he wanted for his grandchildren. He said he had grown up in Turin, in a family of factory workers. That single lie — a manufactured origin story designed to mirror Gene’s own — lowered the foreman’s guard more than any prospectus ever could.

“Matteo spoke to me like a man, not a mark,” Gene later told an FBI victim specialist. “He asked about my wife. He said he understood loss. I hadn’t talked about her in years. He made me feel seen.”

The Dashboard and the One That Got Away

Matteo walked Gene through setting up an account. The ewds66.it dashboard was sleek — live charts, a portfolio tracker, and a chat window where Matteo promised to be available “anytime.” Gene deposited a modest amount from his credit union, money he had set aside for a new roof.

Within days, his balance showed a small gain. Matteo called to congratulate him. Then came the test: Gene requested a small withdrawal, just enough to prove the machine worked. The money landed in his bank account within forty-eight hours. That single successful transaction — a sliver of what he would later lose — convinced him that Ewds66.it was the real thing.

“I told my son, ‘I think I finally found something that works,’” Gene said.

Over the following weeks, he transferred more. He moved his emergency fund. He liquidated a small annuity his wife had left him. He even borrowed against the equity in his home, telling himself the returns would cover the interest. The Ewds66.it dashboard climbed — not like a rocket, but like a well-maintained conveyor belt, steady and believable.

Enough to help both sons with down payments. Enough to keep the house. Enough, finally, to stop worrying about the factory closing.

The Freeze: The Server Behind the Curtain

Three months into his “investment journey,” Gene needed to withdraw a substantial portion to help his youngest son cover a down payment. He logged into the platform and initiated the request.

The delay began. The request sat in “Processing” for four days. He called Matteo. No answer. He emailed support. No reply.

The fee arrived. A message from “Compliance Department” landed in his inbox. It informed him that, due to “new international anti-money laundering protocols,” Ewds66.it was required to collect a “verification fee” before any large withdrawal could be released. The fee was calculated as a percentage of his total displayed balance.

The excuses multiplied. A second email demanded a “tax clearance fee.” A third demanded a “system restoration deposit.” Each email had a different wallet address, a different deadline, and a different tone of urgency. Each was a fresh lie designed to extract more from a man who had already given everything.

The silence became total. Gene called the Italian number. It rang once and then clicked to a generic voicemail that did not accept messages. He emailed [email protected]. The message bounced. He searched for “Matteo Bellini” online. The man had never existed.

Gene had lost the bulk of his savings and was now in debt.

The Warnings That Had Been Broadcast Before He Ever Logged On

Gene’s younger son, a data analyst in Nashville, sat down at his computer and did not move for five hours.

The CONSOB warning. He found a public alert dated May 4, 2026 — barely a month after his father’s first deposit. Italy’s Commissione Nazionale per le Società e la Borsa (CONSOB) had ordered the blocking of EwdS66 (https://ewds66.it) for illegally providing crypto-asset services. The regulator’s statement was explicit: the site was offering financial services without authorization, targeting Italian savers — and, by extension, anyone who found it online — with deceptive practices.

CONSOB noted that the use of “cloned” emails and websites, counterfeit profiles, and AI-generated content had increased, all designed to induce savers to make harmful investment decisions. The total number of sites blocked by Consob since July 2019 had risen to 1,681, of which 178 concerned crypto-related issues. The authority had exercised powers granted by the “Growth Decree” and MiCAR (EU Regulation and Legislative Decree №129/2024), ordering internet connectivity providers operating in Italy to block the websites.

The independent investigation. A cybersecurity researcher who analyzed the platform reported that the website had been shut down for phishing. A deeper investigation revealed that the operational origin of the platform was Lithuania. The friendly Italian phone number, the .it domain, the sophisticated European branding — all of it was a stage set in Eastern Europe.

The registration theft. The registration number displayed on the Ewds66.it website belonged to an entirely different financial institution. A simple cross-check with a public registry would have exposed the fraud in a matter of seconds. But Gene, who had spent years trusting the manuals and the machinery, had never thought to look.

The Aftermath: An Unexpected Ally

Gene’s son filed a report with the FBI’s IC3, the Kentucky Department of Financial Institutions, and the Italian CONSOB directly. A victim support coordinator connected them with AYRLP, a firm specializing in blockchain forensics and cross-border asset recovery.

The AYRLP team worked with a precision that Gene, a man who had diagnosed machine failures by sound alone, immediately recognized as world-class.

Evidence collection. They gathered Gene’s bank statements, his home equity loan documents, screenshots of his Ewds66.it dashboard, and every email from “Matteo Bellini.”

Blockchain forensics. The funds Gene had sent had been converted to cryptocurrency almost immediately. Using proprietary tracing software, AYRLP followed the money through a peel chain — an automated sequence that split his deposits into dozens of tiny fragments and routed them through a shifting array of intermediary wallets, a maze designed specifically to break any audit trail.

Exchange convergence. Despite the complexity, AYRLP’s software identified that the fragments ultimately funneled into a cluster of wallet addresses at a regulated cryptocurrency exchange in Eastern Europe — the same jurisdiction where the website’s servers had been tracked.

Legal freeze. AYRLP prepared a sworn forensic affidavit with time-stamped transaction hashes and submitted a legal preservation request to the exchange’s compliance department. Under anti-money laundering regulations, the exchange froze the flagged accounts.

The return. After several months of legal coordination, AYRLP recovered a substantial portion of Gene’s original losses. The funds that had already passed through “privacy wallets” — crypto laundromats that cannot be traced — were lost forever. But the remainder was enough to keep his home, to help one of his sons with his down payment, and to begin the slow work of rebuilding.

“When my AYRLP case manager called, I was sitting in my truck outside the factory,” Gene said. “I had already written myself off. They didn’t get it all back, but they got enough. Enough to keep me standing.”

The Red Flags That Should Have Flashed

Gene now speaks at union retirement seminars, not about pension plans, but about digital traps.

• The Regulatory Warning Existed. CONSOB’s blocking order was published before he ever made a deposit. A simple search — “Ewds66.it CONSOB” — would have saved him everything.
• The Unsolicited Call. A “senior account manager” who calls you within hours of clicking a link is not a financial professional. He is a fisherman, and you are the catch.
• The Single Small Withdrawal. One successful test payment is not proof of legitimacy. It is bait. The scammer always pays a little to take a lot.
• The Escalating Fee Ladder. A verification fee, then a tax fee, then a restoration fee. Each new fee was a fresh lie designed to extract more from a desperate victim.
• The Eastern European Server. A company that claims to be an Italian financial institution but routes its traffic through Lithuania is not a broker. It is a bunker.
• The Stolen Registration Number. The registration number on the website belonged to a different institution entirely. A simple cross-check would have exposed the fraud in seconds.

Why AYRLP Made the Difference

For an individual investor, tracing a cryptocurrency peel chain across multiple blockchains to a foreign exchange is effectively impossible. AYRLP’s existing intelligence on scam-associated wallet clusters and their legal relationships with compliance departments at international exchanges turned a catastrophic loss into a partial recovery.

Conclusion: The Foreman Who Learned to Read the Machine

Gene O’Leary did not get everything back. But the funds that AYRLP recovered allowed him to keep his home, to walk his sons through their first home purchases, and to face his retirement with a measure of hope rather than despair.

“I spent twenty-eight years teaching men and women how to build cars,” Gene said. “I told them to trust the process — but to check the bolts. The people behind Ewds66.it didn’t need a factory. They just needed me to be tired and hopeful.”

*If you or someone you love has been targeted by Ewds66.it or any similar platform, report it immediately to the FBI’s IC3, your state securities regulator, and a verified asset-recovery service. CONSOB warned about this platform. Do not let the next warning go unread.*

* — This case study draws on CONSOB’s May 4, 2026 blocking order, independent cybersecurity investigations tracing the fraud to Lithuania, and on-chain forensic analysis of scam-associated wallet clusters.*