← back to the index
VT-002 Crypto exchange · Turkey 2021

Thodex — CEO Fled Turkey with $2 Billion, Sentenced to 11,196 Years

trading-exchangeconvicteddefi-era
Platform
Thodex
Est. Losses
~$2B (est.)
Users Affected
391,000
Status
Convicted

Summary

Thodex, one of Turkey's largest cryptocurrency exchanges, collapsed on April 20, 2021, when founder and CEO Faruk Fatih Özer froze all withdrawals, suspended the platform, and boarded a flight to Albania — leaving approximately 391,000 registered users locked out of accounts holding funds estimated at roughly $2 billion. The exchange had operated since 2017 under the name Koineks before rebranding as Thodex in March 2020. Özer was 27 years old at the time of the exit.

Turkish prosecutors launched an immediate investigation. Özer was arrested in Vlora province, Albania in August 2022 after more than 16 months as a fugitive. He was extradited to Turkey in April 2023. On September 7, 2023, an Istanbul court convicted Özer and several of his siblings of aggravated fraud, money laundering, and criminal organisation charges, and sentenced him to 11,196 years in prison — one of the longest sentences ever imposed in Turkey. On appeal, the Istanbul Regional Court of Justice upheld the fraud and money laundering convictions in early 2025 but dismissed the organised-crime charge and ordered a limited retrial on that element. Özer remained incarcerated pending the retrial. On November 1, 2025, he was found dead in Tekirdağ F-Type High Security Closed Penitentiary. Authorities reported he was discovered hanged in the bathroom; the Istanbul prosecutor's office opened an investigation and the body was transferred to the Institute of Forensic Medicine. The cause of death remained under formal inquiry at the time of this report.

The estimated loss figure of $2 billion, widely cited by Turkish prosecutors and international media, reflects the claimed value of cryptocurrency held in Thodex accounts at the time of the freeze. Because Thodex operated as a closed order-matching system without publishing audited proof-of-reserves, the true value of cryptocurrency under management has never been independently verified from blockchain records. The figure should be treated as the prosecutors' working estimate rather than a fully audited loss amount.

Timeline

2017
Exchange founded
Faruk Fatih Özer, then 23 and a high-school dropout, launches Koineks in Istanbul — Turkey's fourth cryptocurrency exchange. The platform establishes Turkey's first Bitcoin ATMs.
March 2020
Rebrand to Thodex
Koineks relaunches under the Thodex name, marketing itself as a global exchange. User base expands rapidly during the 2020–2021 crypto bull market.
April 20, 2021
Withdrawals frozen
Thodex suspends all trading and withdrawals, announcing a temporary closure of four to five days to facilitate an unspecified "partnership transaction." Özer simultaneously departs Turkey on a flight to Tirana, Albania.
April 22, 2021
Turkish authorities act
The Istanbul prosecutor's office announces a criminal investigation. An international arrest warrant is issued. Turkish police arrest 62 individuals with links to the exchange in raids across the country; Özer's siblings are among those detained.
April 2021
Prosecutor's figures released
Turkish prosecutors allege Özer fled with funds held by 391,000 users, estimating losses at approximately $2 billion. Early official filings cite a lower lira-denominated figure; subsequent proceedings use the $2 billion estimate consistently.
August 2022
Özer arrested in Albania
Albanian police locate Özer in Vlora province, where he had lived under his real name. He is taken into custody and faces extradition proceedings.
April 2023
Extradited to Turkey
Following Albanian court approval, Özer is transferred to Turkish custody and held on remand in Tekirdağ F-Type penitentiary pending trial.
September 7, 2023
Conviction and sentence
An Istanbul court convicts Özer of aggravated fraud, money laundering, and founding a criminal organisation. He is sentenced to 11,196 years in prison and fined 135 million Turkish liras (approximately $5 million). Siblings also receive substantial sentences.
January–February 2025
Partial appeal ruling
The Istanbul Regional Court of Justice upholds fraud and money laundering convictions but dismisses the criminal-organisation charge and orders a retrial on that element. Özer remains in custody.
November 1, 2025
Özer found dead
Prison authorities report Özer was discovered unresponsive in the bathroom of his cell at Tekirdağ penitentiary. Authorities treat the death as an apparent suicide; a formal investigation by the Istanbul prosecutor's office and the Institute of Forensic Medicine is opened. The inquiry is ongoing.

The Exchange That Turkey Built

Faruk Fatih Özer founded Koineks in 2017 during Turkey's first significant wave of retail cryptocurrency adoption. He was 23 years old, had no formal financial background, and had dropped out of secondary school. Despite those credentials, or perhaps because the regulatory baseline for exchanges at the time imposed few barriers, Koineks grew rapidly. It established the country's first Bitcoin ATM network, staked a visible public presence, and rode the 2017 bull market to become one of Turkey's four leading exchanges.

The rebrand to Thodex in March 2020 coincided with another surge in Turkish retail crypto interest, partly driven by persistent lira depreciation. Between 2020 and early 2021, Turkish consumers transferred savings into cryptocurrencies at rates far above the global average, making the country one of the highest per-capita adoption markets globally. Thodex, marketed as a domestic champion and a global exchange simultaneously, benefited from that structural demand. The 391,000 registered users it reported at collapse reflected genuine growth, not an invented number.

By mid-2021, Turkish regulators had moved to restrict crypto payments — prohibiting cryptocurrency from being used to settle goods and services — but the specific oversight framework for centralised exchanges remained underdeveloped. Thodex was not required to publish proof-of-reserves, maintain segregated client accounts, or submit to any form of external audit of the assets it held in custody. Özer operated the exchange's wallet infrastructure without any independent check on whether deposits matched the balances displayed on the platform.

The Exit and the Manhunt

On April 20, 2021, Özer published a message to Thodex users stating the platform was temporarily suspending operations to complete a business partnership transaction. The notice asked users to wait four to five days. Within hours, it became apparent that Özer was no longer in Turkey. He had boarded a flight to Tirana, Albania, carrying documents but no extraditable flag on his passport at the time of departure.

Turkish prosecutors moved quickly. Within 48 hours of the closure announcement, the Istanbul Commercial Crime Bureau had opened an investigation and applied to Interpol for a Red Notice. Simultaneously, Turkish police conducted coordinated raids across Istanbul, Ankara, and other cities, detaining 62 people with documented associations to the exchange — including several of Özer's siblings who held operational roles. The siblings were charged as co-conspirators in what prosecutors alleged was a pre-planned exit scheme.

Özer spent roughly 16 months in Albania before Albanian police arrested him in August 2022 in the coastal city of Vlora. He had lived under his own name, and despite the Red Notice, extraction took more than a year as Albanian courts worked through procedural requirements. He was extradited to Turkey in April 2023 and placed in pre-trial detention at Tekirdağ F-Type penitentiary — a maximum-security facility. The trial concluded in September 2023 with a sentence of 11,196 years: a figure that reflects the Turkish legal system's practice of stacking consecutive sentences for each individual act of fraud against each individual victim, rather than a single aggregated term.

What Victims Lost and What Was Recovered

The 391,000 users who held active balances in Thodex accounts at the time of the freeze came from a broad demographic cross-section of Turkish society. Turkey's persistent inflation and successive lira crises had driven widespread retail adoption of cryptocurrency as a store of value; for many Thodex users, the platform held a meaningful proportion of their liquid savings. Accounts ranged from small retail positions to larger sums held by individuals who had explicitly converted lira savings to cryptocurrency to protect against devaluation.

No significant recovery of user funds has been documented. Turkish prosecutors pursued asset freezes and international cooperation orders, but the mechanics of how Özer managed, transferred, or dissipated the funds remain incompletely documented in the public record. His siblings' prosecutions produced additional defendants but not a traceable recovery of assets at scale. The conviction itself, and the sentences imposed, stand as the legal resolution — not as a mechanism of restitution. As of the time of this report, creditors had received nothing.

The Five Factors

01
Regulatory vacuum at the moment of peak adoption
Thodex collapsed during the most active period of retail cryptocurrency adoption in Turkish history, and it did so precisely because Turkish law had not yet established mandatory custody, audit, or reserve-verification standards for exchanges. The absence of licensing requirements meant that an operator could accumulate hundreds of thousands of custody relationships with no external check whatsoever. When adoption outpaces regulation, the gap creates a structural opening for exactly this kind of exit.
02
Single-operator custody with no independent verification
Özer controlled the platform's wallet infrastructure personally. There was no co-signing requirement, no independent custodian, and no published proof-of-reserves for users to check. The entire custody relationship between 391,000 users and their funds rested on the continued goodwill and continued presence of one person. This is not a security architecture; it is an unmitigated single point of failure.
03
Social proof and nationalist branding as trust proxies
Thodex positioned itself as a domestic Turkish champion building global infrastructure. Özer cultivated a visible public persona as a young entrepreneur and national success story. These signals — coverage, endorsements, visible ATM infrastructure, a rebrand to a global-sounding name — functioned as substitutes for the institutional credibility that regulated custodians demonstrate through audits and capital requirements. Retail users had rational reasons to trust a platform their peers used; they had no mechanism to assess what actually secured their funds.
04
Jurisdictional arbitrage during flight
Özer's escape route exploited a gap in Turkey–Albania extradition procedures. The 16 months he remained free in Albania while holding whatever assets he had removed from the exchange is a recoverable interval only because Albanian courts ultimately cooperated. In many cases, the combination of no-extradition jurisdiction and layered crypto transfers would permanently frustrate recovery. The length of the manhunt illustrates how easily a single fugitive can exploit inter-state legal timelines.
05
Pre-exit information manipulation
The "partnership transaction" notice posted as Özer departed was a deliberate misdirection designed to suppress user alarm for long enough to complete the exit without an immediate rush of withdrawal requests triggering platform warnings. Framing an exit as a temporary technical pause is a documented pattern across exchange frauds. Any unscheduled suspension of withdrawals, regardless of stated reason, should be treated as a material custodial risk event requiring immediate independent verification.

Aftermath

Faruk Fatih Özer was convicted in September 2023 and sentenced to 11,196 years in prison — a sentence that, while nominally staggering, meant effective life imprisonment under Turkish law's maximum-service provisions. His fraud and money laundering convictions were upheld on appeal in early 2025, though the organised-crime component was remanded. He died in Tekirdağ F-Type penitentiary on November 1, 2025, in circumstances authorities classified as apparent suicide. The investigation by the Istanbul prosecutor's office and Institute of Forensic Medicine was open at the time of this writing.

Several of Özer's siblings, who held positions within Thodex's operations, were also convicted and sentenced. The exact sentencing breakdown across co-defendants was not fully reported in English-language sources at the time of research.

No material recovery of user funds has been documented. Turkish regulators subsequently moved to close the licensing gap that allowed Thodex to operate: the country's Capital Markets Board (CMB/SPK) introduced a cryptocurrency licensing framework requiring exchanges to register, maintain segregated client assets, and meet minimum capital thresholds. The Thodex case was the primary catalyst for that regulatory overhaul.

Lessons

  1. Any centralised exchange that cannot produce independently audited proof-of-reserves — matching on-chain wallet balances to customer liabilities — is asking users to extend unconditional trust to one operator's honesty. That trust is not a security architecture.
  2. An unscheduled, unexplained suspension of withdrawals should be treated as a custodial emergency regardless of the stated reason. Any operator who cannot immediately produce verifiable evidence of fund holdings after a suspension announcement has forfeited the right to the benefit of the doubt.
  3. Retail cryptocurrency adoption that exceeds the pace of regulatory framework development creates a structural window for large-scale exit fraud. Regulators in emerging markets should prioritise custody and audit standards at the onset of adoption growth, not after the first major collapse.
  4. An exchange's domestic reputation, public profile, and length of operation are not substitutes for regulatory oversight. Thodex operated for four years, built visible infrastructure, and rebranded — none of which had any bearing on the safety of deposited funds.
  5. Extradition timelines, even in cooperative jurisdictions, can extend to 16 months or more. Users whose funds are locked in a collapsed exchange should not expect rapid legal resolution, and should assume that assets removed from custody are effectively irrecoverable absent a highly coordinated international response.

References