ToI investigates

Austrian authorities allege ex-IDF intel officer ‘mastermind’ behind €200m scam

No charges, but investigators say Ilan Tzorya and Tradologic provided software to manipulate financial data and help swindlers defraud consumers; Tzorya denies wrongdoing

Illustrative: A broker works in a trading room of a Portuguese bank in Lisbon, Wednesday, July 3, 2013. (AP/Francisco Seco)
Illustrative: A broker works in a trading room of a Portuguese bank in Lisbon, Wednesday, July 3, 2013. (AP/Francisco Seco)

An Israeli man who founded a binary options trading platform has been named by Austrian authorities as one of the masterminds of a massive “pan-European” fraud scheme.

Austria’s Ministry of the Interior, which oversees police and public security, has cited Israeli citizen Ilan Tzorya, founder of the binary options platform Tradologic, as one of the masterminds of a fraud scheme that allegedly netted over 200 million euros.

The January/February 2021 issue of the ministry’s magazine “Öffentliche Sicherheit” (Public Safety), featured an article describing how federal police have, since 2017, investigated an Israeli-run multinational ring of allegedly fraudulent call centers running financial websites. The investigation has thus far led to 11 suspects being taken into custody as well as a conviction of Tzorya’s former business associate Gal Barak.

Tzorya, who also spells his surname Tzroya, denied any wrongdoing, telling The Times of Israel he believes the claim originates with a rival of his who is out to harm him.

According to investigators, the ring duped consumers into investing in binary options and contracts for difference (CFD) — forms of gambling on supposed stock movements — and on cryptocurrencies, but used software that could manipulate the prices to ensure the fraudsters came out on top.

Until recently, media reports on the scheme have revolved around Barak, 33, who reportedly owned call centers in Belgrade, Sofia, Sarajevo, Pristina, Tbilisi and Kyiv. The Times of Israel has previously reported on Barak’s arrest and the allegations against him.

Reports in Bulgarian, German and British media have referred to Barak as the “Wolf of Sofia,” and described him as the ringleader of the massive scam being investigated by Austrian and German police. In September 2020, the Vienna Regional Criminal Court sentenced Barak to four years in prison.

Gal Barak in 2014 (Facebook screenshot)

But the January/February article claimed for the first time that Tzorya, who has hitherto stayed out of the limelight, was also a “mastermind” of the scheme under investigation and that he in fact founded the company, Tradologic, that allegedly made the fraud possible, according to Austrian police.

“The accused Israeli citizen Ilan T. [Tzorya] is considered to be one of the masterminds behind the websites Option888 and OptionStars,” the article said.

“He was confronted by investigators from the Federal Criminal Police Office in Vienna with the allegations,” it added.

Responding to these claims, Tzorya confirmed to The Times of Israel that he was questioned by Austrian police several weeks ago, but said that he flew to Austria and answered questions voluntarily and has not been arrested.

He said that if Austrian police had thought he was a fraud mastermind they could have arrested him on the spot.

“If they had thought so, they could have easily, and should have arrested me a few weeks ago when I was in Austria. It’s obvious I am not the mastermind behind these sites,” he said.

The Austrian Interior Ministry article also highlighted Tzorya’s background as an intelligence officer in the Israel Defense Forces.

‘More than an ordinary internet scam’

According to the article, the plethora of fraudulent online trading websites has become a “pan-European fraud phenomenon,” with just the network of call centers around Barak inflicting about 200 million euros in losses on victims worldwide.

“Skillful acts of deception on the Internet cause devastating financial damage and human suffering,” said  a senior law enforcement official who oversees financial investigations and asset recovery for the Austrian Federal Police.

According to Austrian police, Barak ran websites that included XtraderFX, Option-Stars and Goldenmarkets, all of which lured investors with promises of quick profits as well as claims that German and Austrian celebrities had earned money through online trading. Investors would start out depositing a few hundred euros, but later be cajoled and induced by trained call center employees using fake identities to “invest” more and more of their money.

Ilan Tzorya in May 2018 (Facebook screenshot)

“After the customer has transferred the money, ‘brokers’ simulate
supposed trading in financial instruments,” a press release accompanying the Austrian Interior Ministry article explained.

“While the customers assume that they are now trading in the advertised financial instruments, there is no actual trading on the market. In fact, the [financial] charts presented can be updated using specially developed software that can be manipulated arbitrarily by the perpetrators,” the press release alleged.

Investors never earned money trading on these websites, Austrian police further alleged.

“The money flows into the money laundering network and the victim has no chance of receiving a payout,” said an investigator of ​​white-collar crime for the Lower Austria Criminal Police Office.

The investigator said the investigation began in September 2017 when the Wiener Neudorf police station in Lower Austria received a complaint from a victim who had lost more than 100,000 euros on the Option888 and another website.

As Austrian police began investigating, numerous victims across Austria came forward with similar accounts of alleged online trading fraud.

“I was immediately aware that there was much more to this than an ordinary Internet scam,” he said.

Criminologists and law enforcement officials in Europe and elsewhere say that online consumer fraud has reached epidemic proportions. A recent European Commission survey found that 56 percent of European respondents said they had been exposed to a scam or fraud in the last two years.

Unlike traditional criminals, online fraudsters rely on reputation laundering, hiding in plain sight behind a veneer of legitimacy provided by a soporific press, using their ill-gotten gains to attain public leadership roles and using an opaque network of corporate dealings to obscure their true involvement in criminal activity.

The Austrian police investigator said he noticed that many of the allegedly fraudulent websites used software produced by an Israeli-founded Sofia-based company known as Tradologic.

‘Crime as a service’

In January 2019, the Interior Ministry article said, Austrian police raided Tradologic’s Bulgarian offices in Sofia and seized large amounts of digital material. Using this material, prosecutors were able to prove that victims had been defrauded, prove that the software could manipulate investors’ trades, and were given a window into the scope of the fraud, an Austrian investigator said. He noted that Tradologic had processed a total of more than $710 million of victims’ money, an amount in excess of the 200 million euros of fraud alleged in this particular investigation.

“The [Tradologic] software was programmed in such a way that the fraudsters were always able to manipulate trades. For example, the prices were changed at short notice at a certain point in time in order to exceed a limit value, whereby the trade was automatically closed and the desired result achieved. These possibilities also existed through the assignment of risk levels. The higher the victim’s risk level was set, the higher the probability that the victim’s trades would generate losses through automated manipulation,” the Austrian police investigator said.

The investigator alleged that Tradologic not only provided software, but a full suite of services for would-be scammers who wished to set up a fraudulent website and call center business.

“In addition to the software, Tradologic offered other services, such as shell companies with straw men, bank accounts or payment service providers,” he said.

Under questioning, Austrian police said, recently convicted fraudster Gal Barak had alleged that Tradologic constituted an entire “ecosystem” of fraud whose business model was “crime as a service.”

‘The way the internet is heading’

Tradologic was founded in 2009 by Tzorya, a then-29-year-old career intelligence officer for the Golani Brigades, according to a 2014 affidavit he submitted to an Israeli court. Tzorya’s father also worked in intelligence, for the Mossad, while his sister has worked as a state prosecutor in Jerusalem.

Tzorya said in the affidavit that the IDF had paid for him to take a course as part of his transition into civilian life. He chose to study financial derivatives and capital markets.

“As I was studying, the idea popped into my head to develop an internet platform that allows investors to trade ‘exotic options’” he said in the affidavit. “The idea was pretty new at the time but it was clear to me that this was the way the internet was heading.”

Since its founding, brands running on the Tradologic platform have included Optionbit, CedarFinance, Zoomtrader, OptionStars, Option888, Xmarkets, Blue Bit Banc and Binex.

A list of binary options brands as they appeared on the website in July 2015 (Screenshot)

According to Austrian police, Ilan Tzorya “founded the software company Tradologic in 2009 and developed his own brands and call centers from 2012. He created an extensive digital ecosystem. This system comprised all components, starting with websites and trading software, via call centers, right up to payment service providers and a money laundering network. Since it began marketing, a total of over 240 brands use Tradologic software.”

One of these brands was Blue Bit Banc, whose owner Blake Kantor was in July 2019 sentenced by a US federal court to 86 months in prison for defrauding investors between 2014 and 2017.

A US grand jury alleged in its April 2018 indictment of Kantor that the computer software used by his brand “allowed Blue Bit Banc to [fraudulently] manipulate data associated with the investors’ binary options so that the probability of investors earning a profit would favor Blue Bit Banc.”

Tradologic moved its operations to Bulgaria in 2011. While many of the websites using the software operated from call centers in Sofia, the companies often recruited Israelis to manage them. According to an article in “Finance Magnates,” a trade publication for Israel’s online trading industry, in late 2017 Tzorya purchased the “intellectual property” of Tradologic while selling the “trademark, brand name and rights” to an Israeli named Gal Barak and a German man named Uwe Lenhoff.

In February 2019, Barak and Lenhoff were arrested in Bulgaria and Germany for running at least 11 websites alleged to be scams. At least nine of these websites were powered by Tradologic.

Barak was tried and sentenced in September 2020 but Lenhoff, 55, died suddenly of “drug poisoning” while in custody in May 2020, according to the Balkan Insight news site.

The news site also reported that Alexander Ignjatovic, a 34-year-old Serbian-German call center employee who had blown the whistle on the fraud ring to German police, was found dead in a Sofia hotel room in February. Bulgarian authorities reportedly said he died of heart failure.

Tzorya acknowledged to the Times of Israel by phone that he was indeed “one of the founders” of Tradologic, but insisted that his involvement tapered off long before the time period being investigated by Austrian police.

“Since 2010 I have been a minority shareholder in the company. In 2015, I left all management positions and even left the country where the company operates, while this investigation is focused on the years 2016-2018,” he wrote in an email.

“The companies [Option888, OptionStars and Speartrader] have used a different platform besides Tradologic since 2018 and are still accused of fraud after that time. How do you explain that?!” Tzorya asked.

If I were a rich man

In 2017, Tzorya became a cryptocurrency entrepreneur, founding a venture capital firm with offices in Kyiv and Malta called Krypton Capital that invested in blockchain projects. One of these projects was, a cryptocurrency news website.

He has also invested in philanthropic ventures, including the Chabad refugee village of Anatevka outside of Kyiv, founded by self-described Chabad Rabbi Moshe Azman, where former US president Donald Trump’s lawyer Rudy Giuliani is an honorary mayor and Giuliani’s indicted associate Igor Fruman is a major benefactor. Anatevka’s website was registered in 2017 by Tzorya and Tradologic Hong Kong. A Chabad spokesperson denied any link between the movement and Azman or Anatevka.

In this screenshot from a June 2018 promotional video for Anatevka, indicted Rudi Giuliani associate Igor Fruman can be seen (r) at a wedding in the Ukrainian village of Anatevka. Rabbi Moshe Azman can be seen in the background raising a toast (YouTube screenshot)

Tradologic is not a single company but a spider’s web of entities registered in Israel, Cyprus, Bulgaria, Singapore, Hong Kong and elsewhere. Shares in some of these companies are held in trust. Precisely which companies fall under the umbrella of “Tradologic” has been the subject of several lawsuits in Israel by an individual who alleged that she was a Tradologic shareholder, but had been cut out of her shares in the company. The defendants rejected her characterizations.

Nevertheless, Israeli public records and court filings, as well as sources with knowledge of the company, revealed the names of additional people linked to Tradologic.

One of these is Mati Gross, whom Tzorya said provided marketing and SEO for Tradologic in 2009. Gross also bought a Cypriot company, Pretoniria Consulting Ltd., which eventually became the binary options company OptionBit. During the same period, Gross worked for a man named Ran Sheleg who owned a binary options marketing company known as Sheleg is the brother and business partner of Udi Sheleg, a major donor and now the treasurer of the UK’s governing Conservative Party.

Gross told The Times of Israel that his work for Tradologic and his work for Ran Sheleg had absolutely nothing to do with each other. He also said that he bought Pretoniria Consulting Ltd. as a shelf company — a registered firm with no activity — and passed it on before doing anything with it.

“Pretoniria was a shelf company that I participated in buying (about ten or more years ago) and it was sold AS IS shortly after we bought it and before it became operational. I am saying this from memory, I am not familiar with its activities to the extent that it has any.”

Gross has not been accused of any wrongdoing. Sheleg did not respond to a request for comment.

Another reported investor in Tradologic is Shalom Meckenzie, an Israeli gambling tycoon who is the largest shareholder of DraftKings — one of the biggest sports betting sites in the US, which has partnered with Major League Baseball and the National Hockey League. In 2019, he became a billionaire overnight when the company went public via a reverse merger.

Meckenzie did not respond to The Times of Israel’s request for comment. He has not been accused of any wrongdoing.

E&G Finances in Sofia, Bulgaria was one of several fraudulent call centers run by Israeli Gal Barak (YouTube Screenshot)

Tradologic was one of several platform providers that provided software, CRM systems as well as payment processing and marketing services to Israel’s vast online trading industry, including its binary options component. These platform providers usually took a percentage of each website’s ongoing revenue. Tradologic was not even the largest such platform.

Binary options was likely the largest and most lucrative Internet scam to operate from Israel in recent years. It operated freely in Israel for a decade before it was outlawed via Knesset legislation in October 2017, largely as a result of investigative reporting by The Times of Israel that began with a March 2016 article entitled “The wolves of Tel Aviv.

At the industry’s height, hundreds of companies employed thousands of Israelis and allegedly fleeced victims worldwide out of billions. The firms would dupe victims into believing that they were investing successfully and earning money, and encourage them to deposit more and more into their accounts, until the company caused them to lose trades or cut off contact with the investor and disappeared with all or almost all of their money.

Many of the fraudulent operatives have since moved their operations abroad, or switched to other financial products while continuing to run call centers as well as money laundering schemes from Israel. Israeli prosecutors have not indicted a single binary options operative for binary options fraud to date and seem unlikely to do so barring significant pressure from outside the country.

The real brain?

In 2018, Tzorya told an associate that the person behind Barak’s scam was Gery Shalon, who has been accused of taking part in other large cyber-criminal operations.

“I said that in my opinion, Shalon is the brains behind Gal Barak,” Tzorya told ToI. “Shalon was the brains behind a much bigger scam so it seems logical. Gal always claimed that he was Gery’s partner in the websites.”

He added that that had been his impression at the time, but he doesn’t know for certain if Shalon was in fact the mastermind behind Barak.

Tzorya had made the comment to Werner Boehm, the owner of a news website known as, which Tzorya apparently owned for about a week in July 2018, via a Marshall Islands company called Krypton Publisher that he seems to control.

The site provides extensive and detailed information about the misdeeds of Barak and Lenhoff, and even coined the term “Wolf of Sofia” to describe Barak. But the site has been largely silent about the activities of Tzorya himself.

Boehm told The Times of Israel that Tzorya had briefly sought to invest in Fintelegram but that the deal was reversed when Boehm and his colleagues learned that Tzorya was a suspect in the Austrian police investigation.

“When we learned that Tzorya is a suspect in this Tradologic case, we said we cannot allow Krypton publishing to invest in Fintelegram. So he rescinded the whole contract,” Boehm said.

Boehm said that his site refrained from writing about Tzorya because “we have been asked by the police to be a bit cautious when reporting on an open criminal case. I think that’s understandable, right? So we actually reduced our reporting on the main business and focused on what is already public,” he said.

Despite the canceled deal, Boehm kept in touch with Tzorya and began giving investigators information provided by Tzorya himself, at the behest of Austrian police, Boehm said. Austrian police have neither confirmed nor denied this.

“We met with Tzorya several times, even in Israel, in Tel Aviv,” said Boehm.

“Ilan Tzorya knew I was sharing the information he provided with the police. He agreed to do this because he told me that his former partner Gery Shalon is the criminal, and that he has been arrested in Israel and extradited to the United States,” Boehm said.

Shalon, the Georgian-Israeli son of Georgian politician Shota Shalelashvili, was indicted by a US grand jury in 2015 for what was described at the time as “one of the biggest cybercrimes in history.”

He and his accomplices were alleged to have hacked into banks, including JPMorgan Chase & Co., stolen customer data and used it to promote a pump-and-dump scheme. They also allegedly ran illegal Internet casinos, as well as a payment processing service for criminals and an unlicensed Bitcoin exchange.

Gery Shalon, suspected of being involved in several fraud schemes tied to the NYSE and a massive data breach at JPMorgan Chase & Co., at the Jerusalem Magistrates’ Court, July 22, 2015. (Yonatan Sindel/Flash90)

Two of Shalon’s alleged accomplices, Russian hacker Andrei Tyurin, and Shalon’s accountant Ziv Orenstein have been convicted and sentenced. Shalon himself is reportedly cooperating with US federal authorities, possibly providing insight into “international money laundering,” according to Bloomberg News, while his alleged accomplice Tyurin may have been persuaded to “illuminate the links between Russia’s cyber criminals and its spy agencies.”

The Wall Street Journal has reported that Shalon and some of his alleged accomplices ran a company in Tel Aviv known as Webologic Ltd. Prior to Shalon and Orenstein’s arrests in July 2015, Webologic advertised widely for employees, describing itself as an “online gaming” and “binary options” company. Among its binary options brands was, which launched in 2013 using Tradologic’s platform. The Times of Israel does not know the names of other binary options sites run by Webologic and has no independent information that Shalon was connected to any of Barak’s sites, many of which were run from Bulgaria.

Shalon’s attorney did not respond to an email from the Times of Israel requesting clarification and comment.

The Austrian police declined to comment on who is and isn’t a suspect in the Barak case beyond its press releases and other published material.

Meanwhile, Austrian police have identified 1,330 victims in Austria alone of the “Wolf of Sofia” scam. They have seized 2.5 million euros from Gal Barak, which will be used to compensate victims. Eleven other suspects remain in custody, including several unnamed Israelis.

read more:
Never miss breaking news on Israel
Get notifications to stay updated
You're subscribed