ARBCORE is not an arbitrage bot.

The x-powered-by: Express header confirms the backend is built on Node.js + Express.js. Institutional fintech platforms hide this header as a matter of information-disclosure hygiene; its presence here is itself an opsec immaturity signal. Access-Control-Allow-Origin: * on a Bearer-authenticated API is a permanent entry on the OWASP top-misconfiguration list. content-security-policy: upgrade-insecure-requests; — a CSP consisting of a single directive is functionally equivalent to no CSP at all; there is no XSS protection at the policy layer.

Three fields in this payload each leave a distinct trace. The tgUserId field carrying a generic email value shows the backend was originally authored for a Telegram Mini-App, with web-signup later grafted onto the same schema. A genuine fintech would design its user-ID shape from scratch. The platform's birthplace is not a professional brokerage — it is a Telegram bot economy.

The isMaster flag is the single most important finding in this report. The role model reduces to a master / non-master binary. Real fintech platforms maintain ten-plus role tiers (trader, compliance, risk, ops, admin, auditor, etc.). A one-bit role partition is the backend's own admission of a two-class user base: regular depositor and platform operator / top-tier promoter. This field is the code-level fingerprint of the private commission agreements examined later in § 06.

is2FAEnabled: false being the default directly contradicts the site's claim of “multi-signature wallets, zkML decentralized verification, institutional-grade security.” 2FA is optional; the multi-factor security claim is marketing.

A single bundled script (index-*.js) and the session-storage key tsr-scroll-restoration-v1_3 confirm the application is built on Vite + React + TanStack Router. Previous independent review (BehindMLM, March 2026) identified the starting template as create-tsrouter-app — an open-source scaffolding project with brand assets layered on top. The hashed CSS filenames in the bundle expose the full user-facing surface:

• AllContractsTable · my-contracts · all-contracts — the word “contract” is UI branding for deposit records.
• ProScreen · ArbBoostScreen · boost · arb-speed — upsell screens pushing users toward Pro / Boost / Speed paid tiers.
• PartnersTable · network-program · partner-program — MLM downline visualizations.
• mok-*.css — “mok” is the Latin transliteration of Cyrillic мок, meaning “mock” (fake-demo) page. A developer left it shipped — a Russian-speaking developer fingerprint.

Real cross-exchange arbitrage spreads change at millisecond resolution. Order-book depth, liquidity, fee tiers and maker/taker ratios all move continuously. Identical values on the same key across separate calls, with four-decimal precision, have a probability indistinguishable from zero. These numbers are being read out of a Postgres table populated by a periodic cron or an admin panel — they are not a live market feed.

Within the same response the backend reports the price of TRX, TON, ADA, DOGE and XLM as "0" — meaning it has no live price feed for them. Yet those same assets are each paired with a “daily 1.4% arbitrage profit” figure. Arbitrage between two exchanges requires at minimum a price at both endpoints; an arbitrage profit figure on an asset whose price is unknown is mathematically impossible. This single response line is definitive proof that the profitability field is fabricated.

Line by line, this is not a brokerage account model. It is a gamified deposit economy:

• promoBalance — referral earnings held back pending additional downline activity. The classic “hold it, grow it, you can withdraw later” trap.
• earn — cumulative Ponzi payout counter. Tracks progress toward the 250% cap.
• isPro · isBoostPro · boostAmount · isSpeed — an upsell ladder. “Multiply your daily yield, accelerate the payout schedule, shorten the contract.” A real arbitrage bot is either connected or not; there is no such thing as a paid speed tier.
• autoPayoutNetwork: TON — all cash flow defaults to the TON blockchain, which integrates natively with the Telegram Mini-App and receives less compliance tracking pressure than TRC20 or ERC20.
• reinvest — a flag that routes users into re-investing rather than withdrawing. The core mechanism extending Ponzi lifespan.

Real cross-exchange arbitrage nets between 5% and 15% annually in stablecoin terms. The structural reasons for that ceiling:

• Every exchange enforces KYC/AML, daily withdrawal limits and API rate limits — capital turnover is physically constrained.
• Maker-taker fees (0.02–0.1%) are paid on both legs; the net spread is typically less than half of gross.
• Capital sitting in hot wallets carries an operational-risk premium that eats margin.
• On Tier-1 venues (Binance, OKX, Bybit, Kraken) price divergences close within seconds; professional market-makers have 10–100× faster infrastructure and close the gap first.

A claimed daily return of 1.2% compounds to (1.012)^365 ≈ 7,850% annualized. No legitimate financial structure in history has sustained such returns — not a hedge fund, not an HFT firm, not a central-bank balance sheet.

The only structure that can advertise such returns is a Ponzi: incoming deposits from new investors become the “payouts” of earlier investors. The moment inflow slows, payouts freeze; the platform pauses under the label of “technical maintenance” or “product migration” and eventually shuts down.

In platforms of this architecture, private side-agreements with large-downline ambassadors follow a recognizable worldwide template. The existence of the isMaster flag, combined with the operational footprint of serial MLM ambassadors documented by BehindMLM (Vladislav Stefanov, Aderly Dupont, Uwe Klemm, Steffen Wolter) and their relationship to the operator group, strongly indicates the presence of the following hidden-agreement components:

The BehindMLM report (March 2026) documents the ambassador network promoting ARBCORE and their track record across prior failed schemes:

• Vladislav Stefanov — Bulgarian national, self-described “Global Ambassador,” operating from Dubai / Thailand. Runs the Unity feeder alongside Aderly Dupont.
• Aderly Dupont — Documented president of Athena Group, a Ponzi scheme collapsed in mid-2025; Athena Group's website is now disabled.
• Uwe Klemm — German national broadcasting from Thailand. Previously promoted ROXXTTER Club, Streakk, BitNest, Orange Cat Energy, each of which collapsed.
• Steffen Wolter — DACH-market focused, promoted multiple failed MLM-crypto schemes.
• Evgeny Levin — named as ARBCORE's “CEO” in certain YouTube promotional videos; no documented corporate or regulatory history under that name.

This cluster is what the industry calls serial launchers: as soon as one scheme collapses, the same playbook is redeployed under a new brand. ARBCORE was not built from scratch — the signals point to it being the next iteration of a recurring template.

Backend stack, payout model, claim framing, domain-aging window, and MLM structure are two versions of the same playbook. When one shuts down, the next launches under a new theme: “neural networks,” “arbitrage,” “AI trading,” “quantum hedging.” The target jurisdictions, brand names and top-level ambassador roster rotate. The underlying economic code does not.

ARBCORE claims regulation under Hong Kong law via “Capital Co. Ltd.” This claim is directly testable against the SFC public register; filing complaints in HK is therefore particularly effective because the platform itself has invited that jurisdiction.

The EU currently operates under the MiCA regulation for crypto-asset service providers. ARBCORE does not appear on any national CASP register. Belgium (30% of traffic) and Germany (19%) are priority reporting jurisdictions; Ukraine (42% of traffic) sits outside the EU but has its own channels.

If you have not yet deposited

• Close the tab. Clear the session. The JWT expires on its own within 24 hours.
• Press the person who sent you the referral link: “What is your rate? Who gets paid first in a loss event?” If the answer is evasive, the answer has already been given.
• Leave the Telegram / WhatsApp group immediately. Those groups exist to apply social pressure.
• Warn your immediate circle. German-language promotional content is especially heavy; check relatives and colleagues in the DACH region.

If you already have a deposit on the platform

• If the platform is still paying, submit a withdrawal today. Pull the principal first.
• If withdrawal is being blocked — requiring “additional KYC,” an “activation deposit,” or endless support-ticket loops — that is the exit-pressure tactic. Do not send more funds.
• Export every piece of evidence you can: deposit TXIDs, email confirmations, Telegram chat screenshots, the referral tree, the URL of every page you touched. Back it up off-device.
• File at least two reports: the regulator in your country of residence, plus the SFC (since the platform claims HK regulation). Cross-jurisdictional filings are the fastest escalation path.
• Consult a lawyer, especially if the deposit originated from a bank transfer in fiat currency. Traceability degrades with each crypto hop.