La Bontà is an Italian-style restaurant, located on the palm-lined boulevard in Lushnja, a meeting point for families who spend Sundays together and for young people who stop by during the week for an espresso.
In addition to pizzas and pasta dishes with tomato sauce, in late August, the restaurant also began advertising cryptocurrency investments, promising “lifetime profits” and “many rewards.” According to the State Police, a typical fraudulent pyramid scheme was hidden behind the ads.
"The more people you bring and the greater the amount invested, the higher the promised income," said the State Police.
"But in reality, these were not real investments, but a well-organized mechanism for embezzling funds through fraud, where only the upper echelons benefited, while the majority, especially the bottom of the pyramid, lost their savings," she added.
This scheme is suspected to have started operating in Albania last fall through Telegram apps and cryptocurrency trading platforms XUEX and Binance. It has become widespread, involving hundreds of citizens, mostly in the Divjaka and Lushnja areas.
According to investigative data, this scheme also involved public servants, who also recruited their family members and friends, luring them to invest with promises of quick and significant profits.
But in recent months the scheme began to malfunction, as investors were not getting their money back as promised, leading to its exposure.
Infiltrated agents
Emanuel Taullau, 21, worked as a waiter at "La Bonta" in Lushnja until September 14, when he was arrested as one of six suspects involved in the cryptocurrency pyramid scheme.
He told investigators that he received a monthly salary of 45 thousand lek and that he had invested 100 thousand lek in June 2025 in the XUEX platform, which he had known from society. He made the investment through his account at Banka Tirana, transferring the money to the cryptocurrency platform Binance and then to XUEX. According to him, he had virtually benefited from 120 thousand lek, which he had not withdrawn, but had kept in crypto.
On August 27, the Fier Police launched an investigation with undercover agents after posters advertising XUEX with slogans such as “One-time investment, lifelong benefits” were found in the window of the restaurant where Taullau worked. The agents introduced themselves as interested and Taullau explained that a deposit of $1,000 was required and that the information was distributed in Telegram groups. He added that the platform’s headquarters was in Divjaka and had many participants.
At a second meeting, Taullau introduced the agents to his colleague, Flavio Mukaj, 23, who was also arrested. The two waiters registered one of the infiltrated agents on the Binance platform and Telegram groups, then Taullau transferred $1,000 to XUEX, using $100 from Mukaj’s account. The agent handed him 100,000 lek in cash, and the entire procedure was documented with audio and video.
When questioned as a person under investigation, Taullau said that it was the undercover agents themselves who asked him for explanations about the advertisement and that he was helped because he was registered on the platform. He insisted that he was not employed by any such company, but only used his technological knowledge to register them. The young man also emphasized that he had not benefited from this service and had not registered other people before. Regarding the amount invested, he stated that he did not know what fate had befallen him.
However, he was arrested red-handed, along with Mukaj and the bar's owner, Arbër Çela. The latter was seized from an Audi Q7 that police suspect was purchased with proceeds from illegal online cryptocurrency activity.
Who is Leo Smith?
Police investigations in Divjaka revealed the involvement of dozens of people in this cryptocurrency pyramid scheme, organized through the Telegram application and the XUEX platform.
One of the suspects as an agent of the scheme is 35-year-old Ereledio Shebeku, who is wanted, who created a group of five people on Telegram, where each invested amounts ranging from 1 thousand to 5 thousand dollars.
Shebeku communicated regularly with a person identified as Leo Smith. In addition to investments, participants were asked to “like” pages sent to Telegram at certain times each day, in exchange for a promise of a 1% return on their investment.
Leo Smith is introduced as a person who communicates with users of the XUEX platform via Telegram, as a “mentor” or a person who provides “trading signals” and investment motivations. He is said to be British, according to statements from people involved in the scheme. Smith uses relatively formal language, often with messages that seem automatic or “robotic.”
Some experts believe it could also be a fictitious identity, or some kind of computer program, operating through automated messages.
Elements of fear and pressure also appear in the collected evidence.
Marius Kodra, 28, from Tirana, said that after recruiting other people, he began to be threatened for the return of their money. In conversations obtained by the police, “Leo Smith” replied without giving any guarantees: “It’s not the money that is lost, it’s just a delay in payment… the only thing we can do is wait.”
According to the police, only in the territory of the Divjaka Municipality, around 580 people have been registered, who have invested considerable amounts, while the promised profits were to be withdrawn every 45 days through bank accounts and the Binance platform.
The investigation shows that Shebeku has also involved his family members, while another suspect, Brunilda Ndini, an employee of the Divjaka Municipality, has included colleagues and residents of the area on the platform.
Even the owner of the "La Bonta" restaurant in Lushnja, Arbër Çela, admitted that he had invested $2,300 in April, withdrawing up to $9,000 in Prizren, Kosovo.
He described himself as deceived and denied having recruited other people.
BIRN spoke to two currency exchange offices in Prizren, Kosovo, which also offer cryptocurrency exchange services.
One of the agents said he was unaware of such cases, while another, on condition of anonymity, claimed that during the months of July and August there was an influx of Albanian citizens who converted their values from the "Binance" platform into euros and withdrew them in cash.
According to him, five to ten people have arrived each week, while the amounts withdrawn have ranged from 3,000 to 5,000 euros each. He added that so far there has been no interest from law enforcement authorities, neither in Kosovo nor in Albania, in these transactions.
Investigators say the scheme operated as a recruitment chain, with individuals who entered first bringing in others, constantly increasing the network and the promised profits. Through this method, according to police, a genuine fraudulent scheme was set up, involving a large number of residents of Divjaka and the surrounding areas. /BIRN/
