The fraud did not begin with a trading desk. It began, according to prosecutors, with a familiar modern shortcut: the belief that crypto could be wrapped in the language of inevitability and sold across borders faster than regulators could understand it. IcomTech emerged in 2018 inside a Latin American ecosystem already primed for this pitch — remittance corridors, unstable local currencies, and a diaspora community that knew how quickly money could move through family networks, WhatsApp groups, church circles, and neighborhood referrals.
That timing mattered. In 2018, “crypto” had become more than a technology term; it had become a sales category. For many people in Latin America, digital assets carried the promise of insulation from inflation, capital controls, and bank distrust. For promoters, that fear and hope could be packaged together. IcomTech entered the scene not as a transparent exchange with a clear balance sheet, but as a polished recruitment machine, built to convert financial anxiety into deposits. The public record shows a business that appeared to offer access to a new economy while actually relying on the oldest mechanism in fraud: paying existing participants enough to keep the next wave coming in.
The central figure associated with the enterprise was Marco Ruiz Ochoa, identified in U.S. filings and later reporting as one of the people directing the operation. He came from the world of self-help recruitment and aggressive multilevel marketing, where the product often matters less than the story around it. That background mattered. A pyramid scheme does not need technical sophistication at the start; it needs fluency in aspiration, and Ruiz Ochoa’s milieu offered exactly that: glossy presentations, rented ballroom stages, promises of passive income, and the social proof of smiling recruits who seemed to be getting paid.
The structural conditions were unusually favorable. In parts of Latin America, digital assets had acquired the aura of escape from inflation and bank distrust. In the United States, enforcement against crypto-themed MLMs was still lagging behind the industry’s growth. The SEC and state regulators had begun warning that “crypto” could be used as a marketing costume, but the public record shows how often those warnings arrived after the first wave of money had already moved. That gap was the space IcomTech occupied. It was wide enough to allow promoters to recruit in one jurisdiction, collect funds in another, and present the whole thing as a legitimate financial product moving through a borderless digital economy.
A concrete scene helps fix the scale. In one of the early promotional gatherings described in court and investigative reporting, the company presented a polished platform, a compensation plan, and the idea that participants would purchase “packages” that supposedly generated daily returns. The setting was not a hedge fund office or a data center. It was a sales environment: bright lighting, a microphone, banners, and a crowd trained to applaud the next success story. The sensory detail matters because the scheme depended on theater before it ever depended on code. The performance was the product. If people believed they had entered an organized, growing enterprise, the underlying mechanism could remain hidden long enough to bring in more money.
Another scene unfolded not in a ballroom but online. Recruits were being funneled through social media, messaging apps, and local organizers who treated the platform like a franchise. The public record shows that IcomTech’s materials used the vocabulary of innovation while concealing the basic economics. Investors were told they were buying access to crypto mining, trading, or a proprietary ecosystem. Yet the architecture was built around memberships and recruitment, a structure far closer to a classic pyramid than to an exchange. What appeared to be a technological venture functioned, in practice, as a referral ladder.
The first crossing of the line was not a dramatic theft from a vault. It was the decision to pay early participants in ways that made the operation appear real. Once a new recruit saw a dashboard, a withdrawal, or a commission, skepticism softened. The psychology was brutally efficient: if somebody else had been paid, then the machine must be legitimate. That was the founding lie — not that crypto would rise, but that IcomTech’s income came from crypto activity at all. Every early payout bought time. Every visible “success” reduced the chance that a participant would ask a basic question: where was the money actually coming from?
There was also an important feature of the geography. The scheme was not confined to one city or one language. It moved through Spanish-speaking communities in the United States and abroad, using diaspora trust as a multiplier. A cousin in Florida could recruit a cousin in Colombia; a promoter in Texas could host a meeting for relatives from Venezuela or Peru. The distance between jurisdictions made the sales pitch harder to police and easier to deny. Each organizer could point to the next layer and say the operation was bigger than their own role. That fragmentation was not incidental. It was a defense mechanism, one that blurred responsibility and made the enterprise harder to map before it had already spread.
The initial capital likely came from the same place all these schemes begin: membership fees, package purchases, and the belief that enough of the public would keep treating deposits as investments. The exact earliest flows are not fully visible in public filings, and that absence is itself telling. Fraud cases often become legible only after the first banked dollars have already been spent, passed along, or withdrawn under another name. By then the machine has already taught its participants the most dangerous lesson of all: that the line between profit and deception can be crossed without a siren.
That is why the early months of a fraud matter so much. The danger is not simply that the scheme exists. It is that, in the beginning, it can resemble ordinary commerce from a distance: a platform, a compensation plan, a growing network, a stream of small successes. To someone inside the operation, each signal seems to confirm the last one. To someone outside it, the red flags are often diffuse — a focus on recruitment, promises of passive returns, language about exclusive opportunity, a dependence on enthusiasm rather than audited results. But in 2018, before the unraveling became public, those warnings were still submerged beneath the spectacle.
There is a particular tension in that period. The scheme was vulnerable precisely because it was still young. The first versions of the pitch had not yet been fully hardened by repetition, and the records that later prosecutors would use to reconstruct the operation were still being created in real time: presentations, payment trails, membership structures, and promotional materials that helped define what IcomTech claimed to be. Yet the same youthfulness also made it more dangerous. Every day the enterprise continued, it gathered the appearance of legitimacy from the very people it was preparing to disappoint.
What mattered in 2018 was not whether the platform could actually generate the returns it advertised. What mattered was that it had become operational in the only way that counts for a pyramid: recruitment was paying, and the first money was flowing in. By the time those early payouts reached the hands of believers, the company had something more valuable than technology. It had momentum, and momentum was about to become its main product.